diff --git a/accessible/generic/HyperTextAccessible.cpp b/accessible/generic/HyperTextAccessible.cpp
index 2fcce652ce21..76b8fe49caa9 100644
--- a/accessible/generic/HyperTextAccessible.cpp
+++ b/accessible/generic/HyperTextAccessible.cpp
@@ -1494,34 +1494,34 @@ HyperTextAccessible::CaretLineNumber()
   return lineNumber;
 }
 
-nsIntRect
+LayoutDeviceIntRect
 HyperTextAccessible::GetCaretRect(nsIWidget** aWidget)
 {
   *aWidget = nullptr;
 
   RefPtr<nsCaret> caret = mDoc->PresShell()->GetCaret();
-  NS_ENSURE_TRUE(caret, nsIntRect());
+  NS_ENSURE_TRUE(caret, LayoutDeviceIntRect());
 
   bool isVisible = caret->IsVisible();
   if (!isVisible)
-    return nsIntRect();
+    return LayoutDeviceIntRect();
 
   nsRect rect;
   nsIFrame* frame = caret->GetGeometry(&rect);
   if (!frame || rect.IsEmpty())
-    return nsIntRect();
+    return LayoutDeviceIntRect();
 
   nsPoint offset;
   // Offset from widget origin to the frame origin, which includes chrome
   // on the widget.
   *aWidget = frame->GetNearestWidget(offset);
-  NS_ENSURE_TRUE(*aWidget, nsIntRect());
+  NS_ENSURE_TRUE(*aWidget, LayoutDeviceIntRect());
   rect.MoveBy(offset);
 
-  nsIntRect caretRect;
-  caretRect = rect.ToOutsidePixels(frame->PresContext()->AppUnitsPerDevPixel());
+  LayoutDeviceIntRect caretRect = LayoutDeviceIntRect::FromUnknownRect(
+    rect.ToOutsidePixels(frame->PresContext()->AppUnitsPerDevPixel()));
   // ((content screen origin) - (content offset in the widget)) = widget origin on the screen
-  caretRect.MoveBy((*aWidget)->WidgetToScreenOffsetUntyped() - (*aWidget)->GetClientOffset());
+  caretRect.MoveBy((*aWidget)->WidgetToScreenOffset() - (*aWidget)->GetClientOffset());
 
   // Correct for character size, so that caret always matches the size of
   // the character. This is important for font size transitions, and is
diff --git a/accessible/generic/HyperTextAccessible.h b/accessible/generic/HyperTextAccessible.h
index 524276caf7f3..b6ba2ee5d2d8 100644
--- a/accessible/generic/HyperTextAccessible.h
+++ b/accessible/generic/HyperTextAccessible.h
@@ -335,7 +335,7 @@ public:
    * @param [out] the widget containing the caret
    * @return      the caret rect
    */
-  nsIntRect GetCaretRect(nsIWidget** aWidget);
+  mozilla::LayoutDeviceIntRect GetCaretRect(nsIWidget** aWidget);
 
   /**
    * Return selected regions count within the accessible.
diff --git a/accessible/windows/msaa/AccessibleWrap.cpp b/accessible/windows/msaa/AccessibleWrap.cpp
index fd3c07161226..6ac115167b0d 100644
--- a/accessible/windows/msaa/AccessibleWrap.cpp
+++ b/accessible/windows/msaa/AccessibleWrap.cpp
@@ -1633,7 +1633,7 @@ AccessibleWrap::UpdateSystemCaretFor(Accessible* aAccessible)
     return;
 
   nsIWidget* widget = nullptr;
-  nsIntRect caretRect = text->GetCaretRect(&widget);
+  LayoutDeviceIntRect caretRect = text->GetCaretRect(&widget);
   HWND caretWnd;
   if (caretRect.IsEmpty() || !(caretWnd = (HWND)widget->GetNativeData(NS_NATIVE_WINDOW))) {
     return;
diff --git a/browser/components/newtab/NewTabPrefsProvider.jsm b/browser/components/newtab/NewTabPrefsProvider.jsm
new file mode 100644
index 000000000000..86ce80033a6d
--- /dev/null
+++ b/browser/components/newtab/NewTabPrefsProvider.jsm
@@ -0,0 +1,84 @@
+/* global Services, Preferences, EventEmitter, XPCOMUtils */
+/* exported NewTabPrefsProvider */
+
+"use strict";
+
+this.EXPORTED_SYMBOLS = ["NewTabPrefsProvider"];
+
+const {interfaces: Ci, utils: Cu} = Components;
+Cu.import("resource://gre/modules/Services.jsm");
+Cu.import("resource://gre/modules/Preferences.jsm");
+Cu.import("resource://gre/modules/XPCOMUtils.jsm");
+
+XPCOMUtils.defineLazyGetter(this, "EventEmitter", function() {
+  const {EventEmitter} = Cu.import("resource://gre/modules/devtools/event-emitter.js", {});
+  return EventEmitter;
+});
+
+// Supported prefs and data type
+const gPrefsMap = new Map([
+  ["browser.newtabpage.enabled", "bool"],
+  ["browser.newtabpage.enhanced", "bool"],
+  ["browser.newtabpage.pinned", "str"],
+  ["intl.locale.matchOS", "bool"],
+  ["general.useragent.locale", "localized"],
+]);
+
+let PrefsProvider = function PrefsProvider() {
+  EventEmitter.decorate(this);
+};
+
+PrefsProvider.prototype = {
+
+  observe(subject, topic, data) { // jshint ignore:line
+    if (topic === "nsPref:changed") {
+      if (gPrefsMap.has(data)) {
+        switch (gPrefsMap.get(data)) {
+          case "bool":
+            this.emit(data, Preferences.get(data, false));
+            break;
+          case "str":
+            this.emit(data, Preferences.get(data, ""));
+            break;
+          case "localized":
+            try {
+              this.emit(data, Preferences.get(data, "", Ci.nsIPrefLocalizedString));
+            } catch (e) {
+              this.emit(data, Preferences.get(data, ""));
+            }
+            break;
+          default:
+            this.emit(data);
+            break;
+        }
+      }
+    } else {
+      Cu.reportError(new Error("NewTabPrefsProvider observing unknown topic"));
+    }
+  },
+
+  get prefsMap() {
+    return gPrefsMap;
+  },
+
+  init() {
+    for (let pref of gPrefsMap.keys()) {
+      Services.prefs.addObserver(pref, this, false);
+    }
+  },
+
+  uninit() {
+    for (let pref of gPrefsMap.keys()) {
+      Services.prefs.removeObserver(pref, this, false);
+    }
+  }
+};
+
+/**
+ * Singleton that serves as the default new tab pref provider for the grid.
+ */
+const gPrefs = new PrefsProvider();
+
+let NewTabPrefsProvider = {
+  prefs: gPrefs,
+};
diff --git a/browser/components/newtab/RemoteAboutNewTab.jsm b/browser/components/newtab/RemoteAboutNewTab.jsm
index 722e0bae85d1..1f335511d2ad 100644
--- a/browser/components/newtab/RemoteAboutNewTab.jsm
+++ b/browser/components/newtab/RemoteAboutNewTab.jsm
@@ -1,9 +1,8 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
 /* globals Services, XPCOMUtils, RemotePages, RemoteNewTabLocation, RemoteNewTabUtils, Task  */
-/* globals BackgroundPageThumbs, PageThumbs, DirectoryLinksProvider */
+/* globals BackgroundPageThumbs, PageThumbs, DirectoryLinksProvider, PlacesProvider, NewTabPrefsProvider */
 /* exported RemoteAboutNewTab */
 
 "use strict";
@@ -31,6 +30,10 @@ XPCOMUtils.defineLazyModuleGetter(this, "DirectoryLinksProvider",
   "resource:///modules/DirectoryLinksProvider.jsm");
 XPCOMUtils.defineLazyModuleGetter(this, "RemoteNewTabLocation",
   "resource:///modules/RemoteNewTabLocation.jsm");
+XPCOMUtils.defineLazyModuleGetter(this, "PlacesProvider",
+  "resource:///modules/PlacesProvider.jsm");
+XPCOMUtils.defineLazyModuleGetter(this, "NewTabPrefsProvider",
+  "resource:///modules/NewTabPrefsProvider.jsm");
 
 let RemoteAboutNewTab = {
 
@@ -43,6 +46,7 @@ let RemoteAboutNewTab = {
     this.pageListener = new RemotePages("about:remote-newtab");
     this.pageListener.addMessageListener("NewTab:InitializeGrid", this.initializeGrid.bind(this));
     this.pageListener.addMessageListener("NewTab:UpdateGrid", this.updateGrid.bind(this));
+    this.pageListener.addMessageListener("NewTab:Customize", this.customize.bind(this));
     this.pageListener.addMessageListener("NewTab:CaptureBackgroundPageThumbs",
         this.captureBackgroundPageThumb.bind(this));
     this.pageListener.addMessageListener("NewTab:PageThumbs", this.createPageThumb.bind(this));
@@ -51,6 +55,43 @@ let RemoteAboutNewTab = {
     this._addObservers();
   },
 
+  customize: function(message) {
+    if (message.data.enabled !== undefined) {
+      Services.prefs.setBoolPref("browser.newtabpage.enabled", message.data.enabled);
+    }
+    if (message.data.enhanced !== undefined) {
+      Services.prefs.setBoolPref("browser.newtabpage.enhanced", message.data.enhanced);
+    }
+  },
+
+  /**
+   * Notifies when history is cleared
+   */
+  placesClearHistory: function() {
+    this.pageListener.sendAsyncMessage("NewTab:PlacesClearHistory");
+  },
+
+  /**
+   * Notifies when a link has changed
+   */
+  placesLinkChanged: function(name, data) { // jshint ignore:line
+    this.pageListener.sendAsyncMessage("NewTab:PlacesLinkChanged", data);
+  },
+
+  /**
+   * Notifies when many links have changed
+   */
+  placesManyLinksChanged: function() {
+    this.pageListener.sendAsyncMessage("NewTab:PlacesManyLinksChanged");
+  },
+
+  /**
+   * Notifies when one URL has been deleted
+   */
+  placesDeleteURI: function(name, data) { // jshint ignore:line
+    this.pageListener.sendAsyncMessage("NewTab:PlacesDeleteURI", data.url);
+  },
+
   /**
    * Initializes the grid for the first time when the page loads.
    * Fetch all the links and send them down to the child to populate
@@ -186,7 +227,6 @@ let RemoteAboutNewTab = {
    */
   observe: function(aSubject, aTopic, aData) { // jshint ignore:line
     let extraData;
-    let refreshPage = false;
     if (aTopic === "browser:purge-session-history") {
       RemoteNewTabUtils.links.resetCache();
       RemoteNewTabUtils.links.populateCache(() => {
@@ -206,12 +246,31 @@ let RemoteAboutNewTab = {
     }
   },
 
+  setEnabled: function(name, data) { // jshint ignore:line
+    this.pageListener.sendAsyncMessage("NewTab:setEnabled", data);
+  },
+
+  setEnhanced: function(name, data) { // jshint ignore:line
+    this.pageListener.sendAsyncMessage("NewTab:setEnhanced", data);
+  },
+
+  setPinned: function(name, data) { // jshint ignore:line
+    this.pageListener.sendAsyncMessage("NewTab:setPinnedLinks", data);
+  },
+
   /**
    * Add all observers that about:newtab page must listen for.
    */
   _addObservers: function() {
     Services.obs.addObserver(this, "page-thumbnail:create", true);
     Services.obs.addObserver(this, "browser:purge-session-history", true);
+    PlacesProvider.links.on("deleteURI", this.placesDeleteURI.bind(this));
+    PlacesProvider.links.on("clearHistory", this.placesClearHistory.bind(this));
+    PlacesProvider.links.on("linkChanged", this.placesLinkChanged.bind(this));
+    PlacesProvider.links.on("manyLinksChanged", this.placesManyLinksChanged.bind(this));
+    NewTabPrefsProvider.prefs.on("browser.newtabpage.enabled", this.setEnabled.bind(this));
+    NewTabPrefsProvider.prefs.on("browser.newtabpage.enhanced", this.setEnhanced.bind(this));
+    NewTabPrefsProvider.prefs.on("browser.newtabpage.pinned", this.setPinned.bind(this));
   },
 
   /**
@@ -220,6 +279,13 @@ let RemoteAboutNewTab = {
   _removeObservers: function() {
     Services.obs.removeObserver(this, "page-thumbnail:create");
     Services.obs.removeObserver(this, "browser:purge-session-history");
+    PlacesProvider.links.off("deleteURI", this.placesDeleteURI);
+    PlacesProvider.links.off("clearHistory", this.placesClearHistory);
+    PlacesProvider.links.off("linkChanged", this.placesLinkChanged);
+    PlacesProvider.links.off("manyLinksChanged", this.placesManyLinksChanged);
+    NewTabPrefsProvider.prefs.off("browser.newtabpage.enabled", this.setEnabled.bind(this));
+    NewTabPrefsProvider.prefs.off("browser.newtabpage.enhanced", this.setEnhanced.bind(this));
+    NewTabPrefsProvider.prefs.off("browser.newtabpage.pinned", this.setPinned.bind(this));
   },
 
   QueryInterface: XPCOMUtils.generateQI([Ci.nsIObserver,
diff --git a/browser/components/newtab/moz.build b/browser/components/newtab/moz.build
index a2660375a21b..16f657e86f33 100644
--- a/browser/components/newtab/moz.build
+++ b/browser/components/newtab/moz.build
@@ -11,6 +11,7 @@ XPCSHELL_TESTS_MANIFESTS += [
 ]
 
 EXTRA_JS_MODULES += [
+    'NewTabPrefsProvider.jsm',
     'NewTabURL.jsm',
     'PlacesProvider.jsm',
     'RemoteAboutNewTab.jsm',
diff --git a/browser/components/newtab/tests/xpcshell/test_NewTabPrefsProvider.js b/browser/components/newtab/tests/xpcshell/test_NewTabPrefsProvider.js
new file mode 100644
index 000000000000..2d50499051d4
--- /dev/null
+++ b/browser/components/newtab/tests/xpcshell/test_NewTabPrefsProvider.js
@@ -0,0 +1,51 @@
+"use strict";
+
+/* global XPCOMUtils, equal, Preferences, NewTabPrefsProvider, run_next_test */
+/* exported run_test */
+/* jscs:disable requireCamelCaseOrUpperCaseIdentifiers */
+
+const Cu = Components.utils;
+Cu.import("resource://gre/modules/XPCOMUtils.jsm");
+Cu.import("resource://gre/modules/Preferences.jsm");
+
+XPCOMUtils.defineLazyModuleGetter(this, "NewTabPrefsProvider",
+    "resource:///modules/NewTabPrefsProvider.jsm");
+
+function run_test() {
+  run_next_test();
+}
+
+add_task(function* test_observe() {
+  let prefsMap = NewTabPrefsProvider.prefs.prefsMap;
+  for (let prefName of prefsMap.keys()) {
+    let prefValueType = prefsMap.get(prefName);
+
+    let beforeVal;
+    let afterVal;
+
+    switch (prefValueType) {
+      case "bool":
+        beforeVal = false;
+        afterVal = true;
+        Preferences.set(prefName, beforeVal);
+        break;
+      case "localized":
+      case "str":
+        beforeVal = "";
+        afterVal = "someStr";
+        Preferences.set(prefName, beforeVal);
+        break;
+    }
+    NewTabPrefsProvider.prefs.init();
+    let promise = new Promise(resolve => {
+      NewTabPrefsProvider.prefs.once(prefName, (name, data) => { // jshint ignore:line
+        resolve([name, data]);
+      });
+    });
+    Preferences.set(prefName, afterVal);
+    let [actualName, actualData] = yield promise;
+    equal(prefName, actualName, `emitter sent the correct pref: ${prefName}`);
+    equal(afterVal, actualData, `emitter collected correct pref data for ${prefName}`);
+    NewTabPrefsProvider.prefs.uninit();
+  }
+});
diff --git a/browser/components/newtab/tests/xpcshell/xpcshell.ini b/browser/components/newtab/tests/xpcshell/xpcshell.ini
index 6eb525646088..a9903bba5564 100644
--- a/browser/components/newtab/tests/xpcshell/xpcshell.ini
+++ b/browser/components/newtab/tests/xpcshell/xpcshell.ini
@@ -5,6 +5,7 @@ firefox-appdir = browser
 skip-if = toolkit == 'android' || toolkit == 'gonk'
 
 [test_AboutNewTabService.js]
+[test_NewTabPrefsProvider.js]
 [test_NewTabURL.js]
 [test_PlacesProvider.js]
 [test_RemoteNewTabLocation.js]
diff --git a/browser/components/nsBrowserGlue.js b/browser/components/nsBrowserGlue.js
index e803c3cc5d86..8d07060244cb 100644
--- a/browser/components/nsBrowserGlue.js
+++ b/browser/components/nsBrowserGlue.js
@@ -32,6 +32,9 @@ XPCOMUtils.defineLazyModuleGetter(this, "RemoteAboutNewTab",
 XPCOMUtils.defineLazyModuleGetter(this, "RemoteNewTabUtils",
                                   "resource:///modules/RemoteNewTabUtils.jsm");
 
+XPCOMUtils.defineLazyModuleGetter(this, "NewTabPrefsProvider",
+                                  "resource:///modules/NewTabPrefsProvider.jsm");
+
 XPCOMUtils.defineLazyModuleGetter(this, "UITour",
                                   "resource:///modules/UITour.jsm");
 
@@ -849,6 +852,7 @@ BrowserGlue.prototype = {
     RemoteNewTabUtils.init();
     RemoteNewTabUtils.links.addProvider(DirectoryLinksProvider);
     RemoteAboutNewTab.init();
+    NewTabPrefsProvider.prefs.init();
 
     SessionStore.init();
     BrowserUITelemetry.init();
@@ -1170,6 +1174,7 @@ BrowserGlue.prototype = {
     WebappManager.uninit();
 
     RemoteAboutNewTab.uninit();
+    NewTabPrefsProvider.prefs.uninit();
     AboutNewTab.uninit();
 #ifdef NIGHTLY_BUILD
     if (Services.prefs.getBoolPref("dom.identity.enabled")) {
diff --git a/browser/extensions/pdfjs/test/browser.ini b/browser/extensions/pdfjs/test/browser.ini
index 1856a0472a75..fb4aa9afc2a5 100644
--- a/browser/extensions/pdfjs/test/browser.ini
+++ b/browser/extensions/pdfjs/test/browser.ini
@@ -1,12 +1,10 @@
 [DEFAULT]
-support-files = file_pdfjs_test.pdf
+support-files =
+  file_pdfjs_test.pdf
+  head.js
 
 [browser_pdfjs_main.js]
-skip-if = e10s # Bug 1159385
 [browser_pdfjs_navigation.js]
-skip-if = e10s # Bug 1159385
 [browser_pdfjs_savedialog.js]
 [browser_pdfjs_views.js]
-skip-if = e10s # Bug 1159385
 [browser_pdfjs_zoom.js]
-skip-if = e10s # Bug 1159385
diff --git a/browser/extensions/pdfjs/test/browser_pdfjs_main.js b/browser/extensions/pdfjs/test/browser_pdfjs_main.js
index 0abfad679c10..56d03667eeb7 100644
--- a/browser/extensions/pdfjs/test/browser_pdfjs_main.js
+++ b/browser/extensions/pdfjs/test/browser_pdfjs_main.js
@@ -4,9 +4,7 @@
 const RELATIVE_DIR = "browser/extensions/pdfjs/test/";
 const TESTROOT = "http://example.com/browser/" + RELATIVE_DIR;
 
-function test() {
-  var tab;
-
+add_task(function* test() {
   let handlerService = Cc["@mozilla.org/uriloader/handler-service;1"].getService(Ci.nsIHandlerService);
   let mimeService = Cc["@mozilla.org/mime;1"].getService(Ci.nsIMIMEService);
   let handlerInfo = mimeService.getFromTypeAndExtension('application/pdf', 'pdf');
@@ -17,82 +15,53 @@ function test() {
 
   info('Pref action: ' + handlerInfo.preferredAction);
 
-  waitForExplicitFinish();
-  registerCleanupFunction(function() {
-    gBrowser.removeTab(tab);
-  });
+  yield BrowserTestUtils.withNewTab({ gBrowser: gBrowser, url: TESTROOT + "file_pdfjs_test.pdf" },
+    function* (newTabBrowser) {
+      ok(gBrowser.isFindBarInitialized(), "Browser FindBar initialized!");
 
-  tab = gBrowser.addTab(TESTROOT + "file_pdfjs_test.pdf");
-  var newTabBrowser = gBrowser.getBrowserForTab(tab);
-  newTabBrowser.addEventListener("load", function eventHandler() {
-    newTabBrowser.removeEventListener("load", eventHandler, true);
+      yield waitForPdfJS(newTabBrowser);
 
-    var document = newTabBrowser.contentDocument,
-        window = newTabBrowser.contentWindow;
+      yield ContentTask.spawn(newTabBrowser, null, function* () {
+        //
+        // Overall sanity tests
+        //
+        ok(content.document.querySelector('div#viewer'), "document content has viewer UI");
+        ok('PDFJS' in content.wrappedJSObject, "window content has PDFJS object");
 
-    // Runs tests after all 'load' event handlers have fired off
-    window.addEventListener("documentload", function() {
-      runTests(document, window, tab, function () {
-        closePDFViewer(window, finish);
+        //
+        // Sidebar: open
+        //
+        var sidebar = content.document.querySelector('button#sidebarToggle'),
+            outerContainer = content.document.querySelector('div#outerContainer');
+
+        sidebar.click();
+        ok(outerContainer.classList.contains('sidebarOpen'), "sidebar opens on click");
+
+        //
+        // Sidebar: close
+        //
+        sidebar.click();
+        ok(!outerContainer.classList.contains('sidebarOpen'), "sidebar closes on click");
+
+        //
+        // Page change from prev/next buttons
+        //
+        var prevPage = content.document.querySelector('button#previous'),
+            nextPage = content.document.querySelector('button#next');
+
+        var pgNumber = content.document.querySelector('input#pageNumber').value;
+        is(parseInt(pgNumber, 10), 1, 'initial page is 1');
+
+        //
+        // Bookmark button
+        //
+        var viewBookmark = content.document.querySelector('a#viewBookmark');
+        viewBookmark.click();
+
+        ok(viewBookmark.href.length > 0, "viewBookmark button has href");
+
+        var viewer = content.wrappedJSObject.PDFViewerApplication;
+        yield viewer.close();
       });
-    }, false, true);
-  }, true);
-}
-
-
-function runTests(document, window, tab, callback) {
-
-  //
-  // Overall sanity tests
-  //
-  ok(document.querySelector('div#viewer'), "document content has viewer UI");
-  ok('PDFJS' in window.wrappedJSObject, "window content has PDFJS object");
-  ok('PDFViewerApplication' in window.wrappedJSObject,
-     "window content has viewer object");
-
-  //
-  // Browser Find
-  //
-  ok(gBrowser.isFindBarInitialized(tab), "Browser FindBar initialized!");
-
-  //
-  // Sidebar: open
-  //
-  var sidebar = document.querySelector('button#sidebarToggle'),
-      outerContainer = document.querySelector('div#outerContainer');
-
-  sidebar.click();
-  ok(outerContainer.classList.contains('sidebarOpen'), 'sidebar opens on click');
-
-  //
-  // Sidebar: close
-  //
-  sidebar.click();
-  ok(!outerContainer.classList.contains('sidebarOpen'), 'sidebar closes on click');
-
-  //
-  // Page change from prev/next buttons
-  //
-  var prevPage = document.querySelector('button#previous'),
-      nextPage = document.querySelector('button#next');
-
-  var pageNumber = document.querySelector('input#pageNumber');
-  is(parseInt(pageNumber.value), 1, 'initial page is 1');
-
-  //
-  // Bookmark button
-  //
-  var viewBookmark = document.querySelector('a#viewBookmark');
-  viewBookmark.click();
-  ok(viewBookmark.href.length > 0, 'viewBookmark button has href');
-
-  callback();
-}
-
-/**
- * Destroys PDF.js viewer opened document.
- */
-function closePDFViewer(window, callback) {
-  var viewer = window.wrappedJSObject.PDFViewerApplication;
-  viewer.close().then(callback);
-}
+    });
+});
diff --git a/browser/extensions/pdfjs/test/browser_pdfjs_navigation.js b/browser/extensions/pdfjs/test/browser_pdfjs_navigation.js
index a1a501a023f2..c5f2b5279e25 100644
--- a/browser/extensions/pdfjs/test/browser_pdfjs_navigation.js
+++ b/browser/extensions/pdfjs/test/browser_pdfjs_navigation.js
@@ -139,9 +139,7 @@ const TESTS = [
   }
 ];
 
-function test() {
-  var tab;
-
+add_task(function* test() {
   let mimeService = Cc["@mozilla.org/mime;1"].getService(Ci.nsIMIMEService);
   let handlerInfo = mimeService.getFromTypeAndExtension('application/pdf', 'pdf');
 
@@ -151,51 +149,73 @@ function test() {
 
   info('Pref action: ' + handlerInfo.preferredAction);
 
-  waitForExplicitFinish();
-  registerCleanupFunction(function() {
-    gBrowser.removeTab(tab);
-  });
+  yield BrowserTestUtils.withNewTab({ gBrowser, url: TESTROOT + "file_pdfjs_test.pdf" },
+    function* (newTabBrowser) {
+      yield waitForPdfJS(newTabBrowser);
 
-  tab = gBrowser.addTab(TESTROOT + "file_pdfjs_test.pdf");
-  gBrowser.selectedTab = tab;
-
-  var newTabBrowser = gBrowser.getBrowserForTab(tab);
-  newTabBrowser.addEventListener("load", function eventHandler() {
-    newTabBrowser.removeEventListener("load", eventHandler, true);
-
-    var document = newTabBrowser.contentDocument,
-        window = newTabBrowser.contentWindow;
-
-    // Runs tests after all 'load' event handlers have fired off
-    window.addEventListener("documentload", function() {
-      runTests(document, window, function () {
-        var pageNumber = document.querySelector('input#pageNumber');
-        is(pageNumber.value, pageNumber.max, "Document is left on the last page");
-        finish();
+      yield ContentTask.spawn(newTabBrowser, null, function* () {
+        // Check if PDF is opened with internal viewer
+        ok(content.document.querySelector('div#viewer'), "document content has viewer UI");
+        ok('PDFJS' in content.wrappedJSObject, "window content has PDFJS object");
       });
-    }, false, true);
-  }, true);
-}
 
-function runTests(document, window, finish) {
-  // Check if PDF is opened with internal viewer
-  ok(document.querySelector('div#viewer'), "document content has viewer UI");
-  ok('PDFJS' in window.wrappedJSObject, "window content has PDFJS object");
+      yield ContentTask.spawn(newTabBrowser, null, contentSetUp);
 
-  // Wait for outline items, the start the navigation actions
-  waitForOutlineItems(document).then(function () {
-    // The key navigation has to happen in page-fit, otherwise it won't scroll
-    // trough a complete page
-    setZoomToPageFit(document).then(function () {
-      runNextTest(document, window, finish);
-    }, function () {
-      ok(false, "Current scale has been set to 'page-fit'");
-      finish();
+      yield Task.spawn(runTests(newTabBrowser));
+
+      yield ContentTask.spawn(newTabBrowser, null, function*() {
+        let pageNumber = content.document.querySelector('input#pageNumber');
+        is(pageNumber.value, pageNumber.max, "Document is left on the last page");
+      });
     });
-  }, function () {
-    ok(false, "Outline items have been found");
-    finish();
-  });
+});
+
+function* contentSetUp() {
+  /**
+   * Outline Items gets appended to the document later on we have to
+   * wait for them before we start to navigate though document
+   *
+   * @param document
+   * @returns {deferred.promise|*}
+   */
+  function waitForOutlineItems(document) {
+    return new Promise((resolve, reject) => {
+      document.addEventListener("outlineloaded", function outlineLoaded(evt) {
+        document.removeEventListener("outlineloaded", outlineLoaded);
+        var outlineCount = evt.detail.outlineCount;
+
+        if (document.querySelectorAll(".outlineItem").length === outlineCount) {
+          resolve();
+        } else {
+          reject();
+        }
+      });
+    });
+  }
+
+  /**
+   * The key navigation has to happen in page-fit, otherwise it won't scroll
+   * through a complete page
+   *
+   * @param document
+   * @returns {deferred.promise|*}
+   */
+  function setZoomToPageFit(document) {
+    return new Promise((resolve) => {
+      document.addEventListener("pagerendered", function onZoom(e) {
+        document.removeEventListener("pagerendered", onZoom);
+        document.querySelector("#viewer").click();
+        resolve();
+      });
+
+      var select = document.querySelector("select#scaleSelect");
+      select.selectedIndex = 2;
+      select.dispatchEvent(new Event("change"));
+    });
+  }
+
+  yield waitForOutlineItems(content.document);
+  yield setZoomToPageFit(content.document);
 }
 
 /**
@@ -207,99 +227,55 @@ function runTests(document, window, finish) {
  * @param test
  * @param callback
  */
-function runNextTest(document, window, endCallback) {
-  var test = TESTS.shift(),
-      deferred = Promise.defer(),
-      pageNumber = document.querySelector('input#pageNumber');
+function* runTests(browser) {
+  yield ContentTask.spawn(browser, TESTS, function* (TESTS) {
+    let window = content;
+    let document = window.document;
 
-  // Add an event-listener to wait for page to change, afterwards resolve the promise
-  var timeout = window.setTimeout(() => deferred.reject(), 5000);
-  window.addEventListener('pagechange', function pageChange() {
-    if (pageNumber.value == test.expectedPage) {
-      window.removeEventListener('pagechange', pageChange);
-      window.clearTimeout(timeout);
-      deferred.resolve(pageNumber.value);
+    for (let test of TESTS) {
+      let deferred = {};
+      deferred.promise = new Promise((resolve, reject) => {
+        deferred.resolve = resolve;
+        deferred.reject = reject;
+      });
+
+      let pageNumber = document.querySelector('input#pageNumber');
+
+      // Add an event-listener to wait for page to change, afterwards resolve the promise
+      let timeout = window.setTimeout(() => deferred.reject(), 5000);
+      window.addEventListener('pagechange', function pageChange() {
+        if (pageNumber.value == test.expectedPage) {
+          window.removeEventListener('pagechange', pageChange);
+          window.clearTimeout(timeout);
+          deferred.resolve(+pageNumber.value);
+        }
+      });
+
+      // Get the element and trigger the action for changing the page
+      var el = document.querySelector(test.action.selector);
+      ok(el, "Element '" + test.action.selector + "' has been found");
+
+      // The value option is for input case
+      if (test.action.value)
+        el.value = test.action.value;
+
+      // Dispatch the event for changing the page
+      if (test.action.event == "keydown") {
+        var ev = document.createEvent("KeyboardEvent");
+            ev.initKeyEvent("keydown", true, true, null, false, false, false, false,
+                            test.action.keyCode, 0);
+        el.dispatchEvent(ev);
+      }
+      else {
+        var ev = new Event(test.action.event);
+      }
+      el.dispatchEvent(ev);
+
+      let pgNumber = yield deferred.promise;
+      is(pgNumber, test.expectedPage, test.message);
     }
-  });
 
-  // Get the element and trigger the action for changing the page
-  var el = document.querySelector(test.action.selector);
-  ok(el, "Element '" + test.action.selector + "' has been found");
-
-  // The value option is for input case
-  if (test.action.value)
-    el.value = test.action.value;
-
-  // Dispatch the event for changing the page
-  if (test.action.event == "keydown") {
-    var ev = document.createEvent("KeyboardEvent");
-        ev.initKeyEvent("keydown", true, true, null, false, false, false, false,
-                        test.action.keyCode, 0);
-    el.dispatchEvent(ev);
-  }
-  else {
-    var ev = new Event(test.action.event);
-  }
-  el.dispatchEvent(ev);
-
-
-  // When the promise gets resolved we call the next test if there are any left
-  // or else we call the final callback which will end the test
-  deferred.promise.then(function (pgNumber) {
-    is(pgNumber, test.expectedPage, test.message);
-
-    if (TESTS.length)
-      runNextTest(document, window, endCallback);
-    else
-      endCallback();
-  }, function () {
-    ok(false, "Test '" + test.message + "' failed with timeout.");
-    endCallback();
+    var viewer = content.wrappedJSObject.PDFViewerApplication;
+    yield viewer.close();
   });
 }
-
-/**
- * Outline Items gets appended to the document latter on we have to
- * wait for them before we start to navigate though document
- *
- * @param document
- * @returns {deferred.promise|*}
- */
-function waitForOutlineItems(document) {
-  var deferred = Promise.defer();
-  document.addEventListener("outlineloaded", function outlineLoaded(evt) {
-    document.removeEventListener("outlineloaded", outlineLoaded);
-    var outlineCount = evt.detail.outlineCount;
-
-    if (document.querySelectorAll(".outlineItem").length === outlineCount) {
-      deferred.resolve();
-    } else {
-      deferred.reject();
-    }
-  });
-
-  return deferred.promise;
-}
-
-/**
- * The key navigation has to happen in page-fit, otherwise it won't scroll
- * trough a complete page
- *
- * @param document
- * @returns {deferred.promise|*}
- */
-function setZoomToPageFit(document) {
-  var deferred = Promise.defer();
-  document.addEventListener("pagerendered", function onZoom(e) {
-    document.removeEventListener("pagerendered", onZoom);
-    document.querySelector("#viewer").click();
-    deferred.resolve();
-  });
-
-  var select = document.querySelector("select#scaleSelect");
-  select.selectedIndex = 2;
-  select.dispatchEvent(new Event("change"));
-
-  return deferred.promise;
-}
-
diff --git a/browser/extensions/pdfjs/test/browser_pdfjs_views.js b/browser/extensions/pdfjs/test/browser_pdfjs_views.js
index 77e1f737f7f1..ed05ab817030 100644
--- a/browser/extensions/pdfjs/test/browser_pdfjs_views.js
+++ b/browser/extensions/pdfjs/test/browser_pdfjs_views.js
@@ -4,9 +4,7 @@
 const RELATIVE_DIR = "browser/extensions/pdfjs/test/";
 const TESTROOT = "http://example.com/browser/" + RELATIVE_DIR;
 
-function test() {
-  var tab;
-
+add_task(function* test() {
   let handlerService = Cc["@mozilla.org/uriloader/handler-service;1"].getService(Ci.nsIHandlerService);
   let mimeService = Cc["@mozilla.org/mime;1"].getService(Ci.nsIMIMEService);
   let handlerInfo = mimeService.getFromTypeAndExtension('application/pdf', 'pdf');
@@ -17,70 +15,47 @@ function test() {
 
   info('Pref action: ' + handlerInfo.preferredAction);
 
-  waitForExplicitFinish();
-  registerCleanupFunction(function() {
-    gBrowser.removeTab(tab);
-  });
+  yield BrowserTestUtils.withNewTab({ gBrowser, url: TESTROOT + "file_pdfjs_test.pdf" },
+    function* (browser) {
+      // check that PDF is opened with internal viewer
+      yield waitForPdfJS(browser);
 
-  tab = gBrowser.addTab(TESTROOT + "file_pdfjs_test.pdf");
-  var newTabBrowser = gBrowser.getBrowserForTab(tab);
-  newTabBrowser.addEventListener("load", function eventHandler() {
-    newTabBrowser.removeEventListener("load", eventHandler, true);
+      yield ContentTask.spawn(browser, null, function* () {
+        ok(content.document.querySelector('div#viewer'), "document content has viewer UI");
+        ok('PDFJS' in content.wrappedJSObject, "window content has PDFJS object");
 
-    var document = newTabBrowser.contentDocument,
-        window = newTabBrowser.contentWindow;
+        //open sidebar
+        var sidebar = content.document.querySelector('button#sidebarToggle');
+        var outerContainer = content.document.querySelector('div#outerContainer');
 
-    // Runs tests after all 'load' event handlers have fired off
-    window.addEventListener("documentload", function() {
-      runTests(document, window, function () {
-        closePDFViewer(window, finish);
+        sidebar.click();
+        ok(outerContainer.classList.contains('sidebarOpen'), 'sidebar opens on click');
+
+        // check that thumbnail view is open
+        var thumbnailView = content.document.querySelector('div#thumbnailView');
+        var outlineView = content.document.querySelector('div#outlineView');
+
+        is(thumbnailView.getAttribute('class'), null, 'Initial view is thumbnail view');
+        is(outlineView.getAttribute('class'), 'hidden', 'Outline view is hidden initially');
+
+        //switch to outline view
+        var viewOutlineButton = content.document.querySelector('button#viewOutline');
+        viewOutlineButton.click();
+
+        is(thumbnailView.getAttribute('class'), 'hidden', 'Thumbnail view is hidden when outline is selected');
+        is(outlineView.getAttribute('class'), '', 'Outline view is visible when selected');
+
+        //switch back to thumbnail view
+        var viewThumbnailButton = content.document.querySelector('button#viewThumbnail');
+        viewThumbnailButton.click();
+
+        is(thumbnailView.getAttribute('class'), '', 'Thumbnail view is visible when selected');
+        is(outlineView.getAttribute('class'), 'hidden', 'Outline view is hidden when thumbnail is selected');
+
+        sidebar.click();
+
+        var viewer = content.wrappedJSObject.PDFViewerApplication;
+        yield viewer.close();
       });
-    }, false, true);
-  }, true);
-}
-
-function runTests(document, window, callback) {
-  // check that PDF is opened with internal viewer
-  ok(document.querySelector('div#viewer'), "document content has viewer UI");
-  ok('PDFJS' in window.wrappedJSObject, "window content has PDFJS object");
-
-  //open sidebar
-  var sidebar = document.querySelector('button#sidebarToggle');
-  var outerContainer = document.querySelector('div#outerContainer');
-
-  sidebar.click();
-  ok(outerContainer.classList.contains('sidebarOpen'), 'sidebar opens on click');
-
-  // check that thumbnail view is open
-  var thumbnailView = document.querySelector('div#thumbnailView');
-  var outlineView = document.querySelector('div#outlineView');
-
-  is(thumbnailView.getAttribute('class'), null, 'Initial view is thumbnail view');
-  is(outlineView.getAttribute('class'), 'hidden', 'Outline view is hidden initially');
-
-  //switch to outline view
-  var viewOutlineButton = document.querySelector('button#viewOutline');
-  viewOutlineButton.click();
-
-  is(outlineView.getAttribute('class'), '', 'Outline view is visible when selected');
-  is(thumbnailView.getAttribute('class'), 'hidden', 'Thumbnail view is hidden when outline is selected');
-
-  //switch back to thumbnail view
-  var viewThumbnailButton = document.querySelector('button#viewThumbnail');
-  viewThumbnailButton.click();
-
-  is(thumbnailView.getAttribute('class'), '', 'Thumbnail view is visible when selected');
-  is(outlineView.getAttribute('class'), 'hidden', 'Outline view is hidden when thumbnail is selected');
-
-  sidebar.click();
-
-  callback();
-}
-
-/**
- * Destroys PDF.js viewer opened document.
- */
-function closePDFViewer(window, callback) {
-  var viewer = window.wrappedJSObject.PDFViewerApplication;
-  viewer.close().then(callback);
-}
+    });
+});
diff --git a/browser/extensions/pdfjs/test/browser_pdfjs_zoom.js b/browser/extensions/pdfjs/test/browser_pdfjs_zoom.js
index 05efa9dfe4ce..11d026f3df08 100644
--- a/browser/extensions/pdfjs/test/browser_pdfjs_zoom.js
+++ b/browser/extensions/pdfjs/test/browser_pdfjs_zoom.js
@@ -28,6 +28,7 @@ const TESTS = [
   {
     action: {
       keyboard: true,
+      keyCode: 61,
       event: "+"
     },
     expectedZoom: 1, // 1 - zoom in
@@ -37,6 +38,7 @@ const TESTS = [
   {
     action: {
       keyboard: true,
+      keyCode: 109,
       event: "-"
     },
     expectedZoom: -1, // -1 - zoom out
@@ -54,11 +56,7 @@ const TESTS = [
   }
 ];
 
-var initialWidth; // the initial width of the PDF document
-var previousWidth; // the width of the PDF document at previous step/test
-
-function test() {
-  var tab;
+add_task(function* test() {
   let handlerService = Cc["@mozilla.org/uriloader/handler-service;1"]
                        .getService(Ci.nsIHandlerService);
   let mimeService = Cc["@mozilla.org/mime;1"].getService(Ci.nsIMIMEService);
@@ -72,114 +70,83 @@ function test() {
 
   info('Pref action: ' + handlerInfo.preferredAction);
 
-  waitForExplicitFinish();
-  registerCleanupFunction(function() {
-    gBrowser.removeTab(tab);
-  });
+  yield BrowserTestUtils.withNewTab({ gBrowser, url: TESTROOT + "file_pdfjs_test.pdf" + "#zoom=100" },
+    function* (newTabBrowser) {
+      yield waitForPdfJS(newTabBrowser);
 
-  tab = gBrowser.selectedTab = gBrowser.addTab(TESTROOT + "file_pdfjs_test.pdf");
-  var newTabBrowser = gBrowser.getBrowserForTab(tab);
+      yield ContentTask.spawn(newTabBrowser, TESTS, function* (TESTS) {
+        let document = content.document;
 
-  newTabBrowser.addEventListener("load", function eventHandler() {
-    newTabBrowser.removeEventListener("load", eventHandler, true);
+        function waitForRender() {
+          return new Promise((resolve) => {
+            document.addEventListener("pagerendered", function onPageRendered(e) {
+              if(e.detail.pageNumber !== 1) {
+                return;
+              }
 
-    var document = newTabBrowser.contentDocument,
-        window = newTabBrowser.contentWindow;
+              document.removeEventListener("pagerendered", onPageRendered, true);
+              resolve();
+            }, true);
+          });
+        }
 
-    // Runs tests after all 'load' event handlers have fired off
-    window.addEventListener("documentload", function() {
-      initialWidth = parseInt(document.querySelector("div#pageContainer1").style.width);
-      previousWidth = initialWidth;
-      runTests(document, window, function () {
-        closePDFViewer(window, finish);
+        // check that PDF is opened with internal viewer
+        ok(content.document.querySelector('div#viewer'), "document content has viewer UI");
+        ok('PDFJS' in content.wrappedJSObject, "window content has PDFJS object");
+
+        let initialWidth, previousWidth;
+        initialWidth = previousWidth =
+          parseInt(content.document.querySelector("div#pageContainer1").style.width);
+
+        for (let test of TESTS) {
+          // We zoom using an UI element
+          var ev;
+          if (test.action.selector) {
+            // Get the element and trigger the action for changing the zoom
+            var el = document.querySelector(test.action.selector);
+            ok(el, "Element '" + test.action.selector + "' has been found");
+
+            if (test.action.index){
+              el.selectedIndex = test.action.index;
+            }
+
+            // Dispatch the event for changing the zoom
+            ev = new Event(test.action.event);
+          }
+          // We zoom using keyboard
+          else {
+            // Simulate key press
+            ev = new content.KeyboardEvent("keydown",
+                                           { key: test.action.event,
+                                             keyCode: test.action.keyCode,
+                                             ctrlKey: true });
+            el = content;
+          }
+
+          el.dispatchEvent(ev);
+          yield waitForRender();
+
+          var pageZoomScale = content.document.querySelector('select#scaleSelect');
+
+          // The zoom value displayed in the zoom select
+          var zoomValue = pageZoomScale.options[pageZoomScale.selectedIndex].innerHTML;
+
+          let pageContainer = content.document.querySelector('div#pageContainer1');
+          let actualWidth = parseInt(pageContainer.style.width);
+
+          // the actual zoom of the PDF document
+          let computedZoomValue = parseInt(((actualWidth/initialWidth).toFixed(2))*100) + "%";
+          is(computedZoomValue, zoomValue, "Content has correct zoom");
+
+          // Check that document zooms in the expected way (in/out)
+          let zoom = (actualWidth - previousWidth) * test.expectedZoom;
+          ok(zoom > 0, test.message);
+
+          previousWidth = actualWidth;
+        }
+
+        var viewer = content.wrappedJSObject.PDFViewerApplication;
+        yield viewer.close();
       });
-    }, false, true);
-  }, true);
-}
-
-function runTests(document, window, callback) {
-  // check that PDF is opened with internal viewer
-  ok(document.querySelector('div#viewer'), "document content has viewer UI");
-  ok('PDFJS' in window.wrappedJSObject, "window content has PDFJS object");
-
-  // Start the zooming tests after the document is loaded
-  waitForDocumentLoad(document).then(function () {
-    zoomPDF(document, window, TESTS.shift(), callback);
-  });
-}
-
-function waitForDocumentLoad(document) {
-  var deferred = Promise.defer();
-  var interval = setInterval(function () {
-    if (document.querySelector("div#pageContainer1") != null){
-      clearInterval(interval);
-      deferred.resolve();
-    }
-  }, 500);
-
-  return deferred.promise;
-}
-
-function zoomPDF(document, window, test, endCallback) {
-  var renderedPage;
-
-  document.addEventListener("pagerendered", function onPageRendered(e) {
-    if(e.detail.pageNumber !== 1) {
-      return;
-    }
-
-    document.removeEventListener("pagerendered", onPageRendered, true);
-
-    var pageZoomScale = document.querySelector('select#scaleSelect');
-
-    // The zoom value displayed in the zoom select
-    var zoomValue = pageZoomScale.options[pageZoomScale.selectedIndex].innerHTML;
-
-    let pageContainer = document.querySelector('div#pageContainer1');
-    let actualWidth  = parseInt(pageContainer.style.width);
-
-    // the actual zoom of the PDF document
-    let computedZoomValue = parseInt(((actualWidth/initialWidth).toFixed(2))*100) + "%";
-    is(computedZoomValue, zoomValue, "Content has correct zoom");
-
-    // Check that document zooms in the expected way (in/out)
-    let zoom = (actualWidth - previousWidth) * test.expectedZoom;
-    ok(zoom > 0, test.message);
-
-    // Go to next test (if there is any) or finish
-    var nextTest = TESTS.shift();
-    if (nextTest) {
-      previousWidth = actualWidth;
-      zoomPDF(document, window, nextTest, endCallback);
-    }
-    else
-      endCallback();
-  }, true);
-
-  // We zoom using an UI element
-  if (test.action.selector) {
-    // Get the element and trigger the action for changing the zoom
-    var el = document.querySelector(test.action.selector);
-    ok(el, "Element '" + test.action.selector + "' has been found");
-
-    if (test.action.index){
-      el.selectedIndex = test.action.index;
-    }
-
-    // Dispatch the event for changing the zoom
-    el.dispatchEvent(new Event(test.action.event));
-  }
-  // We zoom using keyboard
-  else {
-    // Simulate key press
-    EventUtils.synthesizeKey(test.action.event, { ctrlKey: true });
-  }
-}
-
-/**
- * Destroys PDF.js viewer opened document.
- */
-function closePDFViewer(window, callback) {
-  var viewer = window.wrappedJSObject.PDFViewerApplication;
-  viewer.close().then(callback);
-}
+    });
+});
diff --git a/browser/extensions/pdfjs/test/head.js b/browser/extensions/pdfjs/test/head.js
new file mode 100644
index 000000000000..1997b4612b38
--- /dev/null
+++ b/browser/extensions/pdfjs/test/head.js
@@ -0,0 +1,11 @@
+function waitForPdfJS(browser) {
+  // Runs tests after all 'load' event handlers have fired off
+  return ContentTask.spawn(browser, null, function* () {
+    yield new Promise((resolve) => {
+      content.addEventListener("documentload", function listener() {
+        content.removeEventListener("documentload", listener, false);
+        resolve();
+      }, false, true);
+    });
+  });
+}
diff --git a/browser/extensions/shumway/chrome/ShumwayCom.jsm b/browser/extensions/shumway/chrome/ShumwayCom.jsm
index b5641d2b6b77..c08ef8fb5106 100644
--- a/browser/extensions/shumway/chrome/ShumwayCom.jsm
+++ b/browser/extensions/shumway/chrome/ShumwayCom.jsm
@@ -349,7 +349,7 @@ var ShumwayCom = {
       },
 
       getWeakMapKeys: function (weakMap) {
-        var keys = Components.utils.nondeterministicGetWeakMapKeys(weakMap);
+        var keys = ThreadSafeChromeUtils.nondeterministicGetWeakMapKeys(weakMap);
         var result = new content.Array();
         keys.forEach(function (key) {
           result.push(key);
diff --git a/config/config.mk b/config/config.mk
index 02b75137bb08..df52066e58b2 100644
--- a/config/config.mk
+++ b/config/config.mk
@@ -101,7 +101,7 @@ FINAL_TARGET ?= $(if $(XPI_NAME),$(DIST)/xpi-stage/$(XPI_NAME),$(DIST)/bin)$(DIS
 FINAL_TARGET_FROZEN := '$(FINAL_TARGET)'
 
 ifdef XPI_NAME
-DEFINES += -DXPI_NAME=$(XPI_NAME)
+ACDEFINES += -DXPI_NAME=$(XPI_NAME)
 endif
 
 # The VERSION_NUMBER is suffixed onto the end of the DLLs we ship.
@@ -533,7 +533,7 @@ sysinstall_cmd = install_cmd
 # overridden by the command line. (Besides, AB_CD is prettier).
 AB_CD = $(MOZ_UI_LOCALE)
 # Many locales directories want this definition.
-DEFINES += -DAB_CD=$(AB_CD)
+ACDEFINES += -DAB_CD=$(AB_CD)
 
 ifndef L10NBASEDIR
   L10NBASEDIR = $(error L10NBASEDIR not defined by configure)
@@ -689,5 +689,3 @@ export CL_INCLUDES_PREFIX
 # in environment variables to prevent it from breking silently on
 # non-English systems.
 export NONASCII
-
-DEFINES += -DNO_NSPR_10_SUPPORT
diff --git a/config/external/nss/Makefile.in b/config/external/nss/Makefile.in
index d888143d310d..713c66a3384c 100644
--- a/config/external/nss/Makefile.in
+++ b/config/external/nss/Makefile.in
@@ -213,7 +213,7 @@ DEFAULT_GMAKE_FLAGS += \
 	OS_PTHREAD= \
 	$(NULL)
 
-DEFAULT_GMAKE_FLAGS += ARCHFLAG='$(CFLAGS) -DCHECK_FORK_GETPID $(addprefix -DANDROID_VERSION=,$(ANDROID_VERSION)) -include $(topsrcdir)/security/manager/android_stub.h'
+DEFAULT_GMAKE_FLAGS += ARCHFLAG='$(filter-out -W%,$(CFLAGS)) -DCHECK_FORK_GETPID $(addprefix -DANDROID_VERSION=,$(ANDROID_VERSION)) -include $(topsrcdir)/security/manager/android_stub.h'
 endif
 endif
 
@@ -241,7 +241,7 @@ ifdef MOZ_NO_WLZDEFS
 DEFAULT_GMAKE_FLAGS += ZDEFS_FLAG=
 endif
 ifdef MOZ_CFLAGS_NSS
-DEFAULT_GMAKE_FLAGS += XCFLAGS='$(CFLAGS)'
+DEFAULT_GMAKE_FLAGS += XCFLAGS='$(filter-out -W%,$(CFLAGS))'
 DEFAULT_GMAKE_FLAGS += DARWIN_DYLIB_VERSIONS='-compatibility_version 1 -current_version 1 $(LDFLAGS)'
 endif
 ifeq (1_1,$(CLANG_CL)_$(MOZ_ASAN))
@@ -267,7 +267,10 @@ ifdef MOZ_FOLD_LIBS_FLAGS
 DEFAULT_GMAKE_FLAGS += XCFLAGS='$(MOZ_FOLD_LIBS_FLAGS)'
 endif
 
-ifeq (1,$(ALLOW_COMPILER_WARNINGS))
+ifndef WARNINGS_AS_ERRORS
+DEFAULT_GMAKE_FLAGS += NSS_ENABLE_WERROR=0
+endif
+ifeq ($(OS_TARGET),Android)
 DEFAULT_GMAKE_FLAGS += NSS_ENABLE_WERROR=0
 endif
 
diff --git a/config/makefiles/xpidl/Makefile.in b/config/makefiles/xpidl/Makefile.in
index 1375e0bd5f76..931807e30501 100644
--- a/config/makefiles/xpidl/Makefile.in
+++ b/config/makefiles/xpidl/Makefile.in
@@ -35,8 +35,8 @@ process_py := $(topsrcdir)/python/mozbuild/mozbuild/action/xpidl-process.py
 %.xpt:
 	@echo "$(@F)"
 	$(PYTHON_PATH) $(PLY_INCLUDE) -I$(IDL_PARSER_DIR) -I$(IDL_PARSER_CACHE_DIR) \
-		$(process_py) --cache-dir $(IDL_PARSER_CACHE_DIR) $(dist_idl_dir) \
-		$(dist_include_dir) $(@D) $(idl_deps_dir) $(libxul_sdk_includes) \
+		$(process_py) --cache-dir $(IDL_PARSER_CACHE_DIR) --depsdir $(idl_deps_dir) \
+		$(dist_idl_dir) $(dist_include_dir) $(@D) $(libxul_sdk_includes) \
 		$(basename $(notdir $@)) $($(basename $(notdir $@))_deps)
 # When some IDL is added or removed, if the actual IDL file was already, or
 # still is, in the tree, simple dependencies can't detect that the XPT needs
diff --git a/config/tests/src-simple/Makefile.in b/config/tests/src-simple/Makefile.in
index aa5de0b0e115..96f9a415408e 100644
--- a/config/tests/src-simple/Makefile.in
+++ b/config/tests/src-simple/Makefile.in
@@ -13,7 +13,7 @@ include $(topsrcdir)/config/config.mk
 
 XPI_NAME = test_jar_mn
 
-DEFINES += \
+ACDEFINES += \
 	-DAB_CD=ab-X-stuff \
 	$(NULL)
 
diff --git a/configure.in b/configure.in
index 512dffd99205..990f8c80a48e 100644
--- a/configure.in
+++ b/configure.in
@@ -9172,6 +9172,9 @@ if test -z "$JS_SHARED_LIBRARY"; then
 fi
 AC_SUBST(JS_SHARED_LIBRARY)
 
+# Avoid using obsolete NSPR features
+AC_DEFINE(NO_NSPR_10_SUPPORT)
+
 MOZ_CREATE_CONFIG_STATUS()
 
 if test "$COMPILE_ENVIRONMENT"; then
diff --git a/devtools/client/debugger/test/mochitest/browser_dbg_variables-view-04.js b/devtools/client/debugger/test/mochitest/browser_dbg_variables-view-04.js
index 1ad4ff10f1e1..7f2ff4b85904 100644
--- a/devtools/client/debugger/test/mochitest/browser_dbg_variables-view-04.js
+++ b/devtools/client/debugger/test/mochitest/browser_dbg_variables-view-04.js
@@ -138,8 +138,8 @@ function test() {
 
     is([...variables].length, 0,
        "VariablesView should have been emptied.");
-    is(Cu.nondeterministicGetWeakMapKeys(variables._itemsByElement).length, 0,
-       "VariablesView _itemsByElement map has been emptied.");
+    is(ThreadSafeChromeUtils.nondeterministicGetWeakMapKeys(variables._itemsByElement).length,
+       0, "VariablesView _itemsByElement map has been emptied.");
     is(variables._currHierarchy.size, 0,
        "VariablesView _currHierarchy map has been emptied.");
     is(variables._list.children.length, 0,
diff --git a/devtools/shared/heapsnapshot/HeapSnapshot.cpp b/devtools/shared/heapsnapshot/HeapSnapshot.cpp
index cbc56c25b0be..e7f0ad304b02 100644
--- a/devtools/shared/heapsnapshot/HeapSnapshot.cpp
+++ b/devtools/shared/heapsnapshot/HeapSnapshot.cpp
@@ -91,7 +91,7 @@ HeapSnapshot::Create(JSContext* cx,
                      ErrorResult& rv)
 {
   RefPtr<HeapSnapshot> snapshot = new HeapSnapshot(cx, global.GetAsSupports());
-  if (!snapshot->init(buffer, size)) {
+  if (!snapshot->init(cx, buffer, size)) {
     rv.Throw(NS_ERROR_UNEXPECTED);
     return nullptr;
   }
@@ -203,7 +203,7 @@ HeapSnapshot::getOrInternString(InternedStringSet& internedStrings,
        : Nothing())
 
 bool
-HeapSnapshot::saveNode(const protobuf::Node& node)
+HeapSnapshot::saveNode(const protobuf::Node& node, NodeIdSet& edgeReferents)
 {
   // NB: de-duplicated string properties must be read back and interned in the
   // same order here as they are written and serialized in
@@ -248,6 +248,9 @@ HeapSnapshot::saveNode(const protobuf::Node& node)
       return false;
     NodeId referent = protoEdge.referent();
 
+    if (NS_WARN_IF(!edgeReferents.put(referent)))
+      return false;
+
     const char16_t* edgeName = nullptr;
     if (protoEdge.EdgeNameOrRef_case() != protobuf::Edge::EDGENAMEORREF_NOT_SET) {
       Maybe<StringOrRef> edgeNameOrRef = GET_STRING_OR_REF(protoEdge, name);
@@ -402,7 +405,7 @@ StreamHasData(GzipInputStream& stream)
 }
 
 bool
-HeapSnapshot::init(const uint8_t* buffer, uint32_t size)
+HeapSnapshot::init(JSContext* cx, const uint8_t* buffer, uint32_t size)
 {
   if (!nodes.init() || !frames.init())
     return false;
@@ -430,7 +433,12 @@ HeapSnapshot::init(const uint8_t* buffer, uint32_t size)
     return false;
   rootId = root.id();
 
-  if (NS_WARN_IF(!saveNode(root)))
+  // The set of all node ids we've found edges pointing to.
+  NodeIdSet edgeReferents(cx);
+  if (NS_WARN_IF(!edgeReferents.init()))
+    return false;
+
+  if (NS_WARN_IF(!saveNode(root, edgeReferents)))
     return false;
 
   // Finally, the rest of the nodes in the core dump.
@@ -439,7 +447,15 @@ HeapSnapshot::init(const uint8_t* buffer, uint32_t size)
     protobuf::Node node;
     if (!parseMessage(gzipStream, node))
       return false;
-    if (NS_WARN_IF(!saveNode(node)))
+    if (NS_WARN_IF(!saveNode(node, edgeReferents)))
+      return false;
+  }
+
+  // Check the set of node ids referred to by edges we found and ensure that we
+  // have the node corresponding to each id. If we don't have all of them, it is
+  // unsafe to perform analyses of this heap snapshot.
+  for (auto range = edgeReferents.all(); !range.empty(); range.popFront()) {
+    if (NS_WARN_IF(!nodes.has(range.front())))
       return false;
   }
 
diff --git a/devtools/shared/heapsnapshot/HeapSnapshot.h b/devtools/shared/heapsnapshot/HeapSnapshot.h
index 7a18a3244a60..ec5f6299ac2d 100644
--- a/devtools/shared/heapsnapshot/HeapSnapshot.h
+++ b/devtools/shared/heapsnapshot/HeapSnapshot.h
@@ -59,11 +59,13 @@ class HeapSnapshot final : public nsISupports
   // Initialize this HeapSnapshot from the given buffer that contains a
   // serialized core dump. Do NOT take ownership of the buffer, only borrow it
   // for the duration of the call. Return false on failure.
-  bool init(const uint8_t* buffer, uint32_t size);
+  bool init(JSContext* cx, const uint8_t* buffer, uint32_t size);
+
+  using NodeIdSet = js::HashSet<NodeId>;
 
   // Save the given `protobuf::Node` message in this `HeapSnapshot` as a
   // `DeserializedNode`.
-  bool saveNode(const protobuf::Node& node);
+  bool saveNode(const protobuf::Node& node, NodeIdSet& edgeReferents);
 
   // Save the given `protobuf::StackFrame` message in this `HeapSnapshot` as a
   // `DeserializedStackFrame`. The saved stack frame's id is returned via the
diff --git a/docshell/resources/content/netError.xhtml b/docshell/resources/content/netError.xhtml
index 9b9fe7a631eb..64496bd08bff 100644
--- a/docshell/resources/content/netError.xhtml
+++ b/docshell/resources/content/netError.xhtml
@@ -5,6 +5,9 @@
     PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
     "DTD/xhtml1-strict.dtd">
   %htmlDTD;
+  <!ENTITY % netErrorAppDTD
+    SYSTEM "chrome://global/locale/netErrorApp.dtd">
+  %netErrorAppDTD;
   <!ENTITY % netErrorDTD
     SYSTEM "chrome://global/locale/netError.dtd">
   %netErrorDTD;
diff --git a/dom/base/ChromeUtils.cpp b/dom/base/ChromeUtils.cpp
index 7333264fafa9..d4342fc8c696 100644
--- a/dom/base/ChromeUtils.cpp
+++ b/dom/base/ChromeUtils.cpp
@@ -11,6 +11,26 @@ namespace mozilla {
 namespace dom {
 
 /* static */ void
+ThreadSafeChromeUtils::NondeterministicGetWeakMapKeys(GlobalObject& aGlobal,
+                                                      JS::Handle<JS::Value> aMap,
+                                                      JS::MutableHandle<JS::Value> aRetval,
+                                                      ErrorResult& aRv)
+{
+  if (!aMap.isObject()) {
+    aRetval.setUndefined();
+  } else {
+    JSContext* cx = aGlobal.Context();
+    JS::Rooted<JSObject*> objRet(cx);
+    JS::Rooted<JSObject*> mapObj(cx, &aMap.toObject());
+    if (!JS_NondeterministicGetWeakMapKeys(cx, mapObj, &objRet)) {
+      aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
+    } else {
+      aRetval.set(objRet ? JS::ObjectValue(*objRet) : JS::UndefinedValue());
+    }
+  }
+}
+
+  /* static */ void
 ChromeUtils::OriginAttributesToSuffix(dom::GlobalObject& aGlobal,
                                       const dom::OriginAttributesDictionary& aAttrs,
                                       nsCString& aSuffix)
diff --git a/dom/base/ChromeUtils.h b/dom/base/ChromeUtils.h
index 915ee030fdd4..1102f16ae83a 100644
--- a/dom/base/ChromeUtils.h
+++ b/dom/base/ChromeUtils.h
@@ -35,6 +35,11 @@ public:
                                                                    JSContext* cx,
                                                                    const nsAString& filePath,
                                                                    ErrorResult& rv);
+
+  static void NondeterministicGetWeakMapKeys(GlobalObject& aGlobal,
+                                             JS::Handle<JS::Value> aMap,
+                                             JS::MutableHandle<JS::Value> aRetval,
+                                             ErrorResult& aRv);
 };
 
 class ChromeUtils : public ThreadSafeChromeUtils
diff --git a/dom/base/nsContentList.cpp b/dom/base/nsContentList.cpp
index 734c5b0a3e82..b328f5f071e2 100644
--- a/dom/base/nsContentList.cpp
+++ b/dom/base/nsContentList.cpp
@@ -527,8 +527,9 @@ nsContentList::NamedItem(const nsAString& aName, bool aDoFlush)
     nsIContent *content = mElements[i];
     // XXX Should this pass eIgnoreCase?
     if (content &&
-        (content->AttrValueIs(kNameSpaceID_None, nsGkAtoms::name,
-                              name, eCaseMatters) ||
+        ((content->IsHTMLElement() &&
+          content->AttrValueIs(kNameSpaceID_None, nsGkAtoms::name,
+                               name, eCaseMatters)) ||
          content->AttrValueIs(kNameSpaceID_None, nsGkAtoms::id,
                               name, eCaseMatters))) {
       return content->AsElement();
diff --git a/dom/base/nsDOMWindowUtils.cpp b/dom/base/nsDOMWindowUtils.cpp
index 4414b71cc8a5..0b6e90934e6d 100644
--- a/dom/base/nsDOMWindowUtils.cpp
+++ b/dom/base/nsDOMWindowUtils.cpp
@@ -3641,7 +3641,7 @@ nsDOMWindowUtils::SetChromeMargin(int32_t aTop,
       nsCOMPtr<nsIWidget> widget;
       baseWindow->GetMainWidget(getter_AddRefs(widget));
       if (widget) {
-        nsIntMargin margins(aTop, aRight, aBottom, aLeft);
+        LayoutDeviceIntMargin margins(aTop, aRight, aBottom, aLeft);
         return widget->SetNonClientMargins(margins);
       }
     }
diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
index 992b9fb62474..15379bb34c1e 100644
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -13325,7 +13325,8 @@ nsGlobalWindow::NotifyDefaultButtonLoaded(Element& aDefaultButton,
     aError.Throw(NS_ERROR_FAILURE);
     return;
   }
-  nsIntRect buttonRect = frame->GetScreenRect();
+  LayoutDeviceIntRect buttonRect =
+    LayoutDeviceIntRect::FromUnknownRect(frame->GetScreenRect());
 
   // Get the widget rect in screen coordinates.
   nsIWidget *widget = GetNearestWidget();
@@ -13333,8 +13334,8 @@ nsGlobalWindow::NotifyDefaultButtonLoaded(Element& aDefaultButton,
     aError.Throw(NS_ERROR_FAILURE);
     return;
   }
-  nsIntRect widgetRect;
-  aError = widget->GetScreenBoundsUntyped(widgetRect);
+  LayoutDeviceIntRect widgetRect;
+  aError = widget->GetScreenBounds(widgetRect);
   if (aError.Failed()) {
     return;
   }
diff --git a/dom/browser-element/BrowserElementParent.js b/dom/browser-element/BrowserElementParent.js
index a42c75c0fa8b..b8dc9cb08b1f 100644
--- a/dom/browser-element/BrowserElementParent.js
+++ b/dom/browser-element/BrowserElementParent.js
@@ -42,7 +42,7 @@ function getIntPref(prefName, def) {
 
 function handleWindowEvent(e) {
   if (this._browserElementParents) {
-    let beps = Cu.nondeterministicGetWeakMapKeys(this._browserElementParents);
+    let beps = ThreadSafeChromeUtils.nondeterministicGetWeakMapKeys(this._browserElementParents);
     beps.forEach(bep => bep._handleOwnerEvent(e));
   }
 }
diff --git a/dom/canvas/ImageBitmap.cpp b/dom/canvas/ImageBitmap.cpp
index ec4b84890c5f..5517bec192e6 100644
--- a/dom/canvas/ImageBitmap.cpp
+++ b/dom/canvas/ImageBitmap.cpp
@@ -933,34 +933,37 @@ protected:
   {
   }
 
-  void DoCreateImageBitmapFromBlob(ErrorResult& aRv)
+  // Returns true on success, false on failure.
+  bool DoCreateImageBitmapFromBlob()
   {
-    RefPtr<ImageBitmap> imageBitmap = CreateImageBitmap(aRv);
+    RefPtr<ImageBitmap> imageBitmap = CreateImageBitmap();
 
     // handle errors while creating ImageBitmap
     // (1) error occurs during reading of the object
     // (2) the image data is not in a supported file format
     // (3) the image data is corrupted
     // All these three cases should reject promise with null value
-    if (aRv.Failed()) {
-      mPromise->MaybeReject(aRv);
-      return;
+    if (!imageBitmap) {
+      return false;
     }
 
     if (imageBitmap && mCropRect.isSome()) {
-      imageBitmap->SetPictureRect(mCropRect.ref(), aRv);
+      ErrorResult rv;
+      imageBitmap->SetPictureRect(mCropRect.ref(), rv);
 
-      if (aRv.Failed()) {
-        mPromise->MaybeReject(aRv);
-        return;
+      if (rv.Failed()) {
+        mPromise->MaybeReject(rv);
+        return false;
       }
     }
 
     mPromise->MaybeResolve(imageBitmap);
-    return;
+    return true;
   }
 
-  virtual already_AddRefed<ImageBitmap> CreateImageBitmap(ErrorResult& aRv) = 0;
+  // Will return null on failure.  In that case, mPromise will already
+  // be rejected with the right thing.
+  virtual already_AddRefed<ImageBitmap> CreateImageBitmap() = 0;
 
   RefPtr<Promise> mPromise;
   nsCOMPtr<nsIGlobalObject> mGlobalObject;
@@ -982,17 +985,18 @@ public:
 
   NS_IMETHOD Run() override
   {
-    ErrorResult error;
-    DoCreateImageBitmapFromBlob(error);
+    DoCreateImageBitmapFromBlob();
     return NS_OK;
   }
 
 private:
-  already_AddRefed<ImageBitmap> CreateImageBitmap(ErrorResult& aRv) override
+  already_AddRefed<ImageBitmap> CreateImageBitmap() override
   {
-    RefPtr<layers::Image> data = DecodeAndCropBlob(*mBlob, mCropRect, aRv);
+    ErrorResult rv;
+    RefPtr<layers::Image> data = DecodeAndCropBlob(*mBlob, mCropRect, rv);
 
-    if (NS_WARN_IF(aRv.Failed())) {
+    if (NS_WARN_IF(rv.Failed())) {
+      mPromise->MaybeReject(rv);
       return nullptr;
     }
 
@@ -1054,23 +1058,22 @@ public:
 
   bool WorkerRun(JSContext* aCx, WorkerPrivate* aWorkerPrivate) override
   {
-    ErrorResult error;
-    DoCreateImageBitmapFromBlob(error);
-    return !(error.Failed());
+    return DoCreateImageBitmapFromBlob();
   }
 
 private:
-  already_AddRefed<ImageBitmap> CreateImageBitmap(ErrorResult& aRv) override
+  already_AddRefed<ImageBitmap> CreateImageBitmap() override
   {
     RefPtr<layers::Image> data;
 
+    ErrorResult rv;
     RefPtr<DecodeBlobInMainThreadSyncTask> task =
       new DecodeBlobInMainThreadSyncTask(mWorkerPrivate, *mBlob, mCropRect,
-                                         aRv, getter_AddRefs(data));
+                                         rv, getter_AddRefs(data));
     task->Dispatch(mWorkerPrivate->GetJSContext()); // This is a synchronous call.
 
-    if (NS_WARN_IF(aRv.Failed())) {
-      mPromise->MaybeReject(aRv);
+    if (NS_WARN_IF(rv.Failed())) {
+      mPromise->MaybeReject(rv);
       return nullptr;
     }
 
diff --git a/dom/geolocation/nsGeolocationSettings.cpp b/dom/geolocation/nsGeolocationSettings.cpp
index 2270cadb2572..2f1554cc224e 100644
--- a/dom/geolocation/nsGeolocationSettings.cpp
+++ b/dom/geolocation/nsGeolocationSettings.cpp
@@ -260,6 +260,7 @@ nsGeolocationSettings::HandleGeolocationPerOriginSettingsChange(const JS::Value&
     // if it is an app that is always precise, skip it
     nsAutoJSString origin;
     if (!origin.init(cx, id)) {
+      JS_ClearPendingException(cx); // catch and ignore any exceptions
       continue;
     }
     if (mAlwaysPreciseApps.Contains(origin)) {
@@ -268,7 +269,8 @@ nsGeolocationSettings::HandleGeolocationPerOriginSettingsChange(const JS::Value&
 
     // get the app setting object
     JS::RootedValue propertyValue(cx);
-    if (!JS_GetPropertyById(cx, obj, id, &propertyValue) || !propertyValue.isObject()) {
+    if (!JS_GetPropertyById(cx, obj, id, &propertyValue)) {
+      JS_ClearPendingException(cx); // catch and ignore any exceptions
       continue;
     }
     JS::RootedObject settingObj(cx, &propertyValue.toObject());
@@ -280,6 +282,8 @@ nsGeolocationSettings::HandleGeolocationPerOriginSettingsChange(const JS::Value&
     JS::RootedValue fm(cx);
     if (JS_GetProperty(cx, settingObj, "type", &fm)) {
       settings->HandleTypeChange(fm);
+    } else {
+      JS_ClearPendingException(cx); // catch and ignore any exceptions
     }
 
 #ifdef MOZ_APPROX_LOCATION
@@ -287,6 +291,8 @@ nsGeolocationSettings::HandleGeolocationPerOriginSettingsChange(const JS::Value&
     JS::RootedValue distance(cx);
     if (JS_GetProperty(cx, settingObj, "distance", &distance)) {
       settings->HandleApproxDistanceChange(distance);
+    } else {
+      JS_ClearPendingException(cx); // catch and ignore any exceptions
     }
 #endif
 
@@ -294,6 +300,8 @@ nsGeolocationSettings::HandleGeolocationPerOriginSettingsChange(const JS::Value&
     JS::RootedValue coords(cx);
     if (JS_GetProperty(cx, settingObj, "coords", &coords)) {
       settings->HandleFixedCoordsChange(coords);
+    } else {
+      JS_ClearPendingException(cx); // catch and ignore any exceptions
     }
 
     // add the per-app setting object to the hashtable
@@ -337,11 +345,13 @@ nsGeolocationSettings::HandleGeolocationAlwaysPreciseChange(const JS::Value& aVa
     JS::RootedValue value(cx);
 
     if (!JS_GetElement(cx, obj, i, &value) || !value.isString()) {
+      JS_ClearPendingException(cx); // catch and ignore any exceptions
       continue;
     }
 
     nsAutoJSString origin;
     if (!origin.init(cx, value)) {
+      JS_ClearPendingException(cx); // catch and ignore any exceptions
       continue;
     }
 
diff --git a/dom/html/HTMLMediaElement.cpp b/dom/html/HTMLMediaElement.cpp
index 6031d0f534c7..efcb3f1c5671 100644
--- a/dom/html/HTMLMediaElement.cpp
+++ b/dom/html/HTMLMediaElement.cpp
@@ -1235,7 +1235,7 @@ nsresult HTMLMediaElement::LoadResource()
 
 #ifdef MOZ_EME
   if (mMediaKeys &&
-      !IsMediaStreamURI(mLoadingSrc) &&
+      !IsMediaSourceURI(mLoadingSrc) &&
       Preferences::GetBool("media.eme.mse-only", true)) {
     return NS_ERROR_DOM_NOT_SUPPORTED_ERR;
   }
diff --git a/dom/interfaces/base/nsIServiceWorkerManager.idl b/dom/interfaces/base/nsIServiceWorkerManager.idl
index 60af28f094f3..33f5e6637d3c 100644
--- a/dom/interfaces/base/nsIServiceWorkerManager.idl
+++ b/dom/interfaces/base/nsIServiceWorkerManager.idl
@@ -28,7 +28,13 @@ interface nsIServiceWorkerInfo : nsISupports
   readonly attribute DOMString cacheName;
 };
 
-[scriptable, builtinclass, uuid(e908bc07-0a4c-443f-a546-2109bf1f4A01)]
+[scriptable, uuid(87e63548-d440-4b8a-b158-65ad1de0211E)]
+interface nsIServiceWorkerRegistrationInfoListener : nsISupports
+{
+  void onChange();
+};
+
+[scriptable, builtinclass, uuid(72faba24-0a1b-4284-bad3-d44c044d6d95)]
 interface nsIServiceWorkerRegistrationInfo : nsISupports
 {
   readonly attribute nsIPrincipal principal;
@@ -39,6 +45,10 @@ interface nsIServiceWorkerRegistrationInfo : nsISupports
   readonly attribute nsIServiceWorkerInfo installingWorker;
   readonly attribute nsIServiceWorkerInfo waitingWorker;
   readonly attribute nsIServiceWorkerInfo activeWorker;
+
+  void addListener(in nsIServiceWorkerRegistrationInfoListener listener);
+
+  void removeListener(in nsIServiceWorkerRegistrationInfoListener listener);
 };
 
 [scriptable, uuid(9e523e7c-ad6f-4df0-8077-c74aebbc679d)]
diff --git a/dom/locales/en-US/chrome/netError.dtd b/dom/locales/en-US/chrome/netError.dtd
index b53350579022..8adc21f27028 100644
--- a/dom/locales/en-US/chrome/netError.dtd
+++ b/dom/locales/en-US/chrome/netError.dtd
@@ -92,6 +92,12 @@
 <p>These types of web forgeries are used in scams known as phishing attacks, in which fraudulent web pages and emails are used to imitate sources you may trust.</p>
 ">
 
+<!ENTITY securityOverride.linkText "Or you can add an exception…">
+<!ENTITY securityOverride.warningContent "
+<p>You should not add an exception if you are using an internet connection that you do not trust completely or if you are not used to seeing a warning for this server.</p>
+<p>If you still wish to add an exception for this site, you can do so in your advanced encryption settings.</p>
+">
+
 <!ENTITY cspBlocked.title "Blocked by Content Security Policy">
 <!ENTITY cspBlocked.longDesc "<p>The browser prevented this page from loading in this way because the page has a content security policy that disallows it.</p>">
 
@@ -100,10 +106,3 @@
 
 <!ENTITY remoteXUL.title "Remote XUL">
 <!ENTITY remoteXUL.longDesc "<p><ul><li>Please contact the website owners to inform them of this problem.</li></ul></p>">
-
-<!-- Include app-specific error messages - do not change this in localization!
-     Some applications might override netErrorApp.dtd with their specific version,
-     this inclusion needs to be intact for that approach to work correctly.
-     Please, try to keep this at the end of the file. -->
-<!ENTITY % netErrorAppDTD SYSTEM "chrome://global/locale/netErrorApp.dtd">
-%netErrorAppDTD;
diff --git a/dom/locales/en-US/chrome/netErrorApp.dtd b/dom/locales/en-US/chrome/netErrorApp.dtd
index 54e8da32b6d9..d245555380ca 100644
--- a/dom/locales/en-US/chrome/netErrorApp.dtd
+++ b/dom/locales/en-US/chrome/netErrorApp.dtd
@@ -2,12 +2,22 @@
    - License, v. 2.0. If a copy of the MPL was not distributed with this
    - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
 
-<!-- Error messages that are likely to be overridden by applications go in this
-     file, all messages that likely don't need to tie into app-specific UI
-     should go into netError.dtd -->
+<!-- This file exists to allow applications to override one or more messages
+     from netError.dtd; Applications which want to do this should override
+     this file with their own version of netErrorApp.dtd -->
+
+<!-- An example (from Firefox):
 
 <!ENTITY securityOverride.linkText "Or you can add an exception…">
+<!ENTITY securityOverride.getMeOutOfHereButton "Get me out of here!">
+<!ENTITY securityOverride.exceptionButtonLabel "Add Exception…">
+
 <!ENTITY securityOverride.warningContent "
 <p>You should not add an exception if you are using an internet connection that you do not trust completely or if you are not used to seeing a warning for this server.</p>
 <p>If you still wish to add an exception for this site, you can do so in your advanced encryption settings.</p>
+
+<button id='getMeOutOfHereButton'>&securityOverride.getMeOutOfHereButton;</button>
+<button id='exceptionDialogButton'>&securityOverride.exceptionButtonLabel;</button>
 ">
+
+-->
diff --git a/dom/media/test/mochitest.ini b/dom/media/test/mochitest.ini
index b72caa903a64..2eda57c85064 100644
--- a/dom/media/test/mochitest.ini
+++ b/dom/media/test/mochitest.ini
@@ -629,6 +629,8 @@ skip-if = toolkit == 'android' # bug 1149374
 skip-if = toolkit == 'android' || toolkit == 'gonk' # android: bug 1149374; gonk: bug 1193351
 [test_eme_requestKeySystemAccess.html]
 skip-if = toolkit == 'android' # bug 1149374
+[test_eme_setMediaKeys_before_attach_MediaSource.html]
+skip-if = toolkit == 'android' # bug 1149374
 [test_eme_stream_capture_blocked_case1.html]
 tags=msg capturestream
 skip-if = toolkit == 'android' || toolkit == 'gonk' # android: bug 1149374; gonk: bug 1193351
diff --git a/dom/media/test/test_eme_setMediaKeys_before_attach_MediaSource.html b/dom/media/test/test_eme_setMediaKeys_before_attach_MediaSource.html
new file mode 100644
index 000000000000..95ebb55d468d
--- /dev/null
+++ b/dom/media/test/test_eme_setMediaKeys_before_attach_MediaSource.html
@@ -0,0 +1,41 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>Test Encrypted Media Extensions</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+  <script type="text/javascript" src="manifest.js"></script>
+  <script type="text/javascript" src="eme.js"></script>
+</head>
+<body>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+
+function beginTest() {
+  var video = document.createElement("video");
+
+  navigator.requestMediaKeySystemAccess("org.w3.clearkey", [{initDataTypes: ["cenc"]}])
+    .then(function(keySystemAccess) {
+      return keySystemAccess.createMediaKeys();
+    })
+    .then(mediaKeys => {
+      return video.setMediaKeys(mediaKeys);
+    })
+    .then(() => {
+      var ms = new MediaSource();
+      ms.addEventListener("sourceopen", ()=>{ok(true, "MediaSource should open"); SimpleTest.finish();});
+      video.addEventListener("error", ()=>{ok(false, "Shouldn't error."); SimpleTest.finish();});
+      video.src = URL.createObjectURL(ms);
+    });
+}
+
+if (!IsMacOSSnowLeopardOrEarlier()) {
+  SimpleTest.waitForExplicitFinish();
+  SetupEMEPref(beginTest);
+} else {
+  todo(false, "Test disabled on this platform.");
+}
+</script>
+</pre>
+</body>
+</html>
diff --git a/dom/quota/QuotaManager.cpp b/dom/quota/QuotaManager.cpp
index 9bbc94fbcce4..4b7379c6bcd3 100644
--- a/dom/quota/QuotaManager.cpp
+++ b/dom/quota/QuotaManager.cpp
@@ -2526,35 +2526,30 @@ QuotaManager::UpdateOriginAccessTime(PersistenceType aPersistenceType,
   }
 }
 
-// static
-PLDHashOperator
-QuotaManager::RemoveQuotaCallback(const nsACString& aKey,
-                                  nsAutoPtr<GroupInfoPair>& aValue,
-                                  void* aUserArg)
-{
-  NS_ASSERTION(!aKey.IsEmpty(), "Empty key!");
-  NS_ASSERTION(aValue, "Null pointer!");
-
-  RefPtr<GroupInfo> groupInfo =
-    aValue->LockedGetGroupInfo(PERSISTENCE_TYPE_TEMPORARY);
-  if (groupInfo) {
-    groupInfo->LockedRemoveOriginInfos();
-  }
-
-  groupInfo = aValue->LockedGetGroupInfo(PERSISTENCE_TYPE_DEFAULT);
-  if (groupInfo) {
-    groupInfo->LockedRemoveOriginInfos();
-  }
-
-  return PL_DHASH_REMOVE;
-}
-
 void
 QuotaManager::RemoveQuota()
 {
   MutexAutoLock lock(mQuotaMutex);
 
-  mGroupInfoPairs.Enumerate(RemoveQuotaCallback, nullptr);
+  for (auto iter = mGroupInfoPairs.Iter(); !iter.Done(); iter.Next()) {
+    nsAutoPtr<GroupInfoPair>& pair = iter.Data();
+
+    MOZ_ASSERT(!iter.Key().IsEmpty(), "Empty key!");
+    MOZ_ASSERT(pair, "Null pointer!");
+
+    RefPtr<GroupInfo> groupInfo =
+      pair->LockedGetGroupInfo(PERSISTENCE_TYPE_TEMPORARY);
+    if (groupInfo) {
+      groupInfo->LockedRemoveOriginInfos();
+    }
+
+    groupInfo = pair->LockedGetGroupInfo(PERSISTENCE_TYPE_DEFAULT);
+    if (groupInfo) {
+      groupInfo->LockedRemoveOriginInfos();
+    }
+
+    iter.Remove();
+  }
 
   NS_ASSERTION(mTemporaryStorageUsage == 0, "Should be zero!");
 }
diff --git a/dom/quota/QuotaManager.h b/dom/quota/QuotaManager.h
index c68eb76e2ec4..094315019c80 100644
--- a/dom/quota/QuotaManager.h
+++ b/dom/quota/QuotaManager.h
@@ -461,11 +461,6 @@ private:
                          const nsACString& aOrigin,
                          nsAutoCString& _retval);
 
-  static PLDHashOperator
-  RemoveQuotaCallback(const nsACString& aKey,
-                      nsAutoPtr<GroupInfoPair>& aValue,
-                      void* aUserArg);
-
   mozilla::Mutex mQuotaMutex;
 
   nsClassHashtable<nsCStringHashKey, GroupInfoPair> mGroupInfoPairs;
diff --git a/dom/webidl/ThreadSafeChromeUtils.webidl b/dom/webidl/ThreadSafeChromeUtils.webidl
index de1ae2661765..7a4a71d8ad56 100644
--- a/dom/webidl/ThreadSafeChromeUtils.webidl
+++ b/dom/webidl/ThreadSafeChromeUtils.webidl
@@ -31,6 +31,18 @@ interface ThreadSafeChromeUtils {
    */
   [Throws, NewObject]
   static HeapSnapshot readHeapSnapshot(DOMString filePath);
+
+  /**
+   * Return the keys in a weak map.  This operation is
+   * non-deterministic because it is affected by the scheduling of the
+   * garbage collector and the cycle collector.
+   *
+   * @param aMap weak map or other JavaScript value
+   * @returns If aMap is a weak map object, return the keys of the weak
+   *          map as an array.  Otherwise, return undefined.
+   */
+  [Throws, NewObject]
+  static any nondeterministicGetWeakMapKeys(any map);
 };
 
 /**
diff --git a/dom/workers/ServiceWorkerContainer.cpp b/dom/workers/ServiceWorkerContainer.cpp
index cb66f24b8dbe..63cdc35edeec 100644
--- a/dom/workers/ServiceWorkerContainer.cpp
+++ b/dom/workers/ServiceWorkerContainer.cpp
@@ -158,12 +158,6 @@ ServiceWorkerContainer::Register(const nsAString& aScriptURL,
     }
   }
 
-
-  if (!baseURI) {
-    aRv.Throw(NS_ERROR_DOM_INVALID_STATE_ERR);
-    return nullptr;
-  }
-
   nsresult rv;
   nsCOMPtr<nsIURI> scriptURI;
   rv = NS_NewURI(getter_AddRefs(scriptURI), aScriptURL, nullptr, baseURI);
diff --git a/dom/workers/ServiceWorkerManager.cpp b/dom/workers/ServiceWorkerManager.cpp
index 799a2a098a29..e9816149a1b3 100644
--- a/dom/workers/ServiceWorkerManager.cpp
+++ b/dom/workers/ServiceWorkerManager.cpp
@@ -436,6 +436,36 @@ ServiceWorkerRegistrationInfo::GetActiveWorker(nsIServiceWorkerInfo **aResult)
   return NS_OK;
 }
 
+NS_IMETHODIMP
+ServiceWorkerRegistrationInfo::AddListener(
+                            nsIServiceWorkerRegistrationInfoListener *aListener)
+{
+  AssertIsOnMainThread();
+
+  if (!aListener || mListeners.Contains(aListener)) {
+    return NS_ERROR_INVALID_ARG;
+  }
+
+  mListeners.AppendElement(aListener);
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+ServiceWorkerRegistrationInfo::RemoveListener(
+                            nsIServiceWorkerRegistrationInfoListener *aListener)
+{
+  AssertIsOnMainThread();
+
+  if (!aListener || !mListeners.Contains(aListener)) {
+    return NS_ERROR_INVALID_ARG;
+  }
+
+  mListeners.RemoveElement(aListener);
+
+  return NS_OK;
+}
+
 already_AddRefed<ServiceWorkerInfo>
 ServiceWorkerRegistrationInfo::GetServiceWorkerInfoById(uint64_t aId)
 {
@@ -970,6 +1000,7 @@ public:
       }
 
       mRegistration->mScriptSpec = mScriptSpec;
+      mRegistration->NotifyListenersOnChange();
       swm->StoreRegistration(mPrincipal, mRegistration);
     } else {
       MOZ_ASSERT(mJobType == UPDATE_JOB);
@@ -1162,6 +1193,7 @@ public:
 
     mRegistration->mInstallingWorker = mUpdateAndInstallInfo.forget();
     mRegistration->mInstallingWorker->UpdateState(ServiceWorkerState::Installing);
+    mRegistration->NotifyListenersOnChange();
 
     Succeed();
     // The job should NOT call fail from this point on.
@@ -1329,6 +1361,7 @@ private:
 
     mRegistration->mWaitingWorker = mRegistration->mInstallingWorker.forget();
     mRegistration->mWaitingWorker->UpdateState(ServiceWorkerState::Installed);
+    mRegistration->NotifyListenersOnChange();
     swm->InvalidateServiceWorkerRegistrationWorker(mRegistration,
                                                    WhichServiceWorker::INSTALLING_WORKER | WhichServiceWorker::WAITING_WORKER);
 
@@ -1648,6 +1681,7 @@ ServiceWorkerRegistrationInfo::Activate()
   mActiveWorker = activatingWorker.forget();
   mWaitingWorker = nullptr;
   mActiveWorker->UpdateState(ServiceWorkerState::Activating);
+  NotifyListenersOnChange();
 
   // FIXME(nsm): Unlink appcache if there is one.
 
@@ -2462,6 +2496,15 @@ ServiceWorkerRegistrationInfo::IsLastUpdateCheckTimeOverOneDay() const
   return false;
 }
 
+void
+ServiceWorkerRegistrationInfo::NotifyListenersOnChange()
+{
+  nsTArray<nsCOMPtr<nsIServiceWorkerRegistrationInfoListener>> listeners(mListeners);
+  for (size_t index = 0; index < listeners.Length(); ++index) {
+    listeners[index]->OnChange();
+  }
+}
+
 void
 ServiceWorkerManager::LoadRegistration(
                              const ServiceWorkerRegistrationData& aRegistration)
@@ -3883,7 +3926,7 @@ ServiceWorkerManager::AddListener(nsIServiceWorkerManagerListener* aListener)
 {
   AssertIsOnMainThread();
 
-  if (mListeners.Contains(aListener)) {
+  if (!aListener || mListeners.Contains(aListener)) {
     return NS_ERROR_INVALID_ARG;
   }
 
@@ -3897,7 +3940,7 @@ ServiceWorkerManager::RemoveListener(nsIServiceWorkerManagerListener* aListener)
 {
   AssertIsOnMainThread();
 
-  if (!mListeners.Contains(aListener)) {
+  if (!aListener || !mListeners.Contains(aListener)) {
     return NS_ERROR_INVALID_ARG;
   }
 
diff --git a/dom/workers/ServiceWorkerManager.h b/dom/workers/ServiceWorkerManager.h
index 7c48f1c61687..217aeb0d9809 100644
--- a/dom/workers/ServiceWorkerManager.h
+++ b/dom/workers/ServiceWorkerManager.h
@@ -72,6 +72,8 @@ public:
   RefPtr<ServiceWorkerInfo> mWaitingWorker;
   RefPtr<ServiceWorkerInfo> mInstallingWorker;
 
+  nsTArray<nsCOMPtr<nsIServiceWorkerRegistrationInfoListener>> mListeners;
+
   uint64_t mLastUpdateCheckTime;
 
   // When unregister() is called on a registration, it is not immediately
@@ -138,6 +140,9 @@ public:
 
   bool
   IsLastUpdateCheckTimeOverOneDay() const;
+
+  void
+  NotifyListenersOnChange();
 };
 
 class ServiceWorkerUpdateFinishCallback
diff --git a/dom/workers/test/serviceworkers/chrome.ini b/dom/workers/test/serviceworkers/chrome.ini
index 60a1b6a4eff1..d69307536107 100644
--- a/dom/workers/test/serviceworkers/chrome.ini
+++ b/dom/workers/test/serviceworkers/chrome.ini
@@ -3,11 +3,15 @@ skip-if = buildapp == 'b2g' || os == 'android'
 support-files =
   app/*
   app2/*
+  chrome_helpers.js
   serviceworkermanager_iframe.html
+  serviceworkerregistrationinfo_iframe.html
   worker.js
+  worker2.js
 
 [test_aboutserviceworkers.html]
 skip-if = true #bug 1193319
 [test_app_installation.html]
 [test_privateBrowsing.html]
 [test_serviceworkermanager.xul]
+[test_serviceworkerregistrationinfo.xul]
diff --git a/dom/workers/test/serviceworkers/chrome_helpers.js b/dom/workers/test/serviceworkers/chrome_helpers.js
new file mode 100644
index 000000000000..315019c3fdf1
--- /dev/null
+++ b/dom/workers/test/serviceworkers/chrome_helpers.js
@@ -0,0 +1,59 @@
+let { classes: Cc, interfaces: Ci, utils: Cu } = Components;
+
+Cu.import("resource://gre/modules/Task.jsm");
+
+let swm = Cc["@mozilla.org/serviceworkers/manager;1"].
+          getService(Ci.nsIServiceWorkerManager);
+
+let EXAMPLE_URL = "https://example.com/chrome/dom/workers/test/serviceworkers/";
+
+function waitForIframeLoad(iframe) {
+  return new Promise(function (resolve) {
+    iframe.onload = resolve;
+  });
+}
+
+function waitForRegister(scope, callback) {
+  return new Promise(function (resolve) {
+    let listener = {
+      onRegister: function (registration) {
+        if (registration.scope !== scope) {
+          return;
+        }
+        swm.removeListener(listener);
+        resolve(callback ? callback(registration) : registration);
+      }
+    };
+    swm.addListener(listener);
+  });
+}
+
+function waitForUnregister(scope) {
+  return new Promise(function (resolve) {
+    let listener = {
+      onUnregister: function (registration) {
+        if (registration.scope !== scope) {
+          return;
+        }
+        swm.removeListener(listener);
+        resolve(registration);
+      }
+    };
+    swm.addListener(listener);
+  });
+}
+
+function waitForServiceWorkerRegistrationChange(registration, callback) {
+  return new Promise(function (resolve) {
+    let listener = {
+      onChange: function () {
+        registration.removeListener(listener);
+        if (callback) {
+          callback();
+        }
+        resolve(callback ? callback() : undefined);
+      }
+    };
+    registration.addListener(listener);
+  });
+}
diff --git a/dom/workers/test/serviceworkers/serviceworkermanager_iframe.html b/dom/workers/test/serviceworkers/serviceworkermanager_iframe.html
index a0a2de76030e..0df93da96d4e 100644
--- a/dom/workers/test/serviceworkers/serviceworkermanager_iframe.html
+++ b/dom/workers/test/serviceworkers/serviceworkermanager_iframe.html
@@ -9,13 +9,21 @@
         }
         var promise = navigator.serviceWorker.register("worker.js");
         window.onmessage = function (event) {
-          if (event.data !== "unregister") {
+          if (event.data !== "register") {
             return;
           }
-          promise.then(function (registration) {
-            registration.unregister();
+          promise = promise.then(function (registration) {
+            return navigator.serviceWorker.register("worker2.js");
           });
-          window.onmessage = null;
+          window.onmessage = function (event) {
+            if (event.data !== "unregister") {
+              return;
+            }
+            promise.then(function (registration) {
+              registration.unregister();
+            });
+            window.onmessage = null;
+          };
         };
       };
     </script>
diff --git a/dom/workers/test/serviceworkers/serviceworkerregistrationinfo_iframe.html b/dom/workers/test/serviceworkers/serviceworkerregistrationinfo_iframe.html
new file mode 100644
index 000000000000..e18af92d161d
--- /dev/null
+++ b/dom/workers/test/serviceworkers/serviceworkerregistrationinfo_iframe.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8">
+    <script>
+      window.onmessage = function (event) {
+        if (event.data !== "register") {
+          return;
+        }
+        var promise = navigator.serviceWorker.register("worker.js");
+        window.onmessage = function (event) {
+          if (event.data !== "register") {
+            return;
+          }
+          promise.then(function (registration) {
+            return navigator.serviceWorker.register("worker2.js");
+          });
+        };
+      };
+    </script>
+  </head>
+  <body>
+    This is a test page.
+  </body>
+<html>
diff --git a/dom/workers/test/serviceworkers/test_serviceworkermanager.xul b/dom/workers/test/serviceworkers/test_serviceworkermanager.xul
index cbb4c29e711c..ead935a3c4f4 100644
--- a/dom/workers/test/serviceworkers/test_serviceworkermanager.xul
+++ b/dom/workers/test/serviceworkers/test_serviceworkermanager.xul
@@ -8,53 +8,10 @@
         onload="test();">
   <script type="application/javascript"
           src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"/>
+  <script type="application/javascript" src="chrome_helpers.js"/>
   <script type="application/javascript">
   <![CDATA[
 
-    let { classes: Cc, interfaces: Ci, utils: Cu } = Components;
-
-    Cu.import("resource://gre/modules/Task.jsm");
-
-    let swm = Cc["@mozilla.org/serviceworkers/manager;1"].
-              getService(Ci.nsIServiceWorkerManager);
-
-    function waitForIframeLoad(iframe) {
-      return new Promise(function (resolve) {
-        iframe.onload = resolve;
-      });
-    }
-
-    function waitForRegister(scope) {
-      return new Promise(function (resolve) {
-        let listener = {
-          onRegister: function (registration) {
-            if (registration.scope !== scope) {
-              return;
-            }
-            swm.removeListener(listener);
-            resolve(registration);
-          }
-        };
-        swm.addListener(listener);
-      });
-    }
-
-    function waitForUnregister(scope) {
-      return new Promise(function (resolve) {
-        let listener = {
-          onUnregister: function (registration) {
-            if (registration.scope !== scope) {
-              return;
-            }
-            swm.removeListener(listener);
-            resolve(registration);
-          }
-        };
-        swm.addListener(listener);
-      });
-    }
-
-    let EXAMPLE_URL = "https://example.com/chrome/dom/workers/test/serviceworkers/";
     let IFRAME_URL = EXAMPLE_URL + "serviceworkermanager_iframe.html";
 
     function test() {
@@ -64,7 +21,7 @@
         ["dom.serviceWorkers.enabled", true],
         ["dom.serviceWorkers.testing.enabled", true],
       ]}, function () {
-        Task.spawn(function *() {
+        Task.spawn(function* () {
           let registrations = swm.getAllRegistrations();
           is(registrations.length, 0);
 
@@ -84,11 +41,23 @@
           is(registrations.queryElementAt(0, Ci.nsIServiceWorkerRegistrationInfo),
              registration);
 
+          info("Check that the service worker manager does not notify its " +
+               "listeners when a service worker is registered with the same " +
+               "scope as an existing registration.");
+          let listener = {
+            onRegister: function () {
+              ok(false, "Listener should not have been notified.");
+            }
+          };
+          swm.addListener(listener);
+          iframe.contentWindow.postMessage("register", "*");
+
           info("Check that the service worker manager notifies its listeners " +
                "when a service worker is unregistered.");
           promise = waitForUnregister(EXAMPLE_URL);
           iframe.contentWindow.postMessage("unregister", "*");
           registration = yield promise;
+          swm.removeListener(listener);
 
           registrations = swm.getAllRegistrations();
           is(registrations.length, 0);
diff --git a/dom/workers/test/serviceworkers/test_serviceworkerregistrationinfo.xul b/dom/workers/test/serviceworkers/test_serviceworkerregistrationinfo.xul
new file mode 100644
index 000000000000..f46657215a0a
--- /dev/null
+++ b/dom/workers/test/serviceworkers/test_serviceworkerregistrationinfo.xul
@@ -0,0 +1,117 @@
+<?xml version="1.0"?>
+<!--
+  Any copyright is dedicated to the Public Domain.
+  http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<window title="Test for ServiceWorkerRegistrationInfo"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        onload="test();">
+  <script type="application/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"/>
+  <script type="application/javascript" src="chrome_helpers.js"/>
+  <script type="application/javascript">
+  <![CDATA[
+
+    let IFRAME_URL = EXAMPLE_URL + "serviceworkerregistrationinfo_iframe.html";
+
+    function test() {
+      SimpleTest.waitForExplicitFinish();
+
+      SpecialPowers.pushPrefEnv({'set': [
+        ["dom.serviceWorkers.enabled", true],
+        ["dom.serviceWorkers.testing.enabled", true],
+      ]}, function () {
+        Task.spawn(function* () {
+          let iframe = $("iframe");
+          let promise = waitForIframeLoad(iframe);
+          iframe.src = IFRAME_URL;
+          yield promise;
+
+          // The change handler is not guaranteed to be called within the same
+          // tick of the event loop as the one in which the change happened.
+          // Because of this, the exact state of the service worker registration
+          // is only known until the handler returns.
+          //
+          // Because then-handlers are resolved asynchronously, the following
+          // checks are done using callbacks, which are called synchronously
+          // when then handler is called. These callbacks can return a promise,
+          // which is used to resolve the promise returned by the function.
+
+          info("Check that a service worker registration notifies its " +
+               "listeners when its state changes.");
+          promise = waitForRegister(EXAMPLE_URL, function (registration) {
+            is(registration.scriptSpec, "");
+            ok(registration.installingWorker === null);
+            ok(registration.waitingWorker === null);
+            ok(registration.activeWorker === null);
+
+            return waitForServiceWorkerRegistrationChange(registration, function  () {
+              is(registration.scriptSpec, EXAMPLE_URL + "worker.js");
+
+              return waitForServiceWorkerRegistrationChange(registration, function () {
+                ok(registration.installingWorker !== null);
+                ok(registration.waitingWorker === null);
+                ok(registration.activeWorker === null);
+
+                return waitForServiceWorkerRegistrationChange(registration, function () {
+                  ok(registration.installingWorker === null);
+                  ok(registration.waitingWorker !== null);
+                  ok(registration.activeWorker === null);
+
+                  return waitForServiceWorkerRegistrationChange(registration, function () {
+                    ok(registration.installingWorker === null);
+                    ok(registration.waitingWorker === null);
+                    ok(registration.activeWorker !== null);
+
+                    return registration;
+                  });
+                });
+              });
+            });
+          });
+          iframe.contentWindow.postMessage("register", "*");
+          let registration = yield promise;
+
+          promise = waitForServiceWorkerRegistrationChange(registration, function () {
+            is(registration.scriptSpec, EXAMPLE_URL + "worker2.js");
+
+            return waitForServiceWorkerRegistrationChange(registration, function () {
+              ok(registration.installingWorker !== null);
+              ok(registration.waitingWorker === null);
+              ok(registration.activeWorker !== null);
+
+              return waitForServiceWorkerRegistrationChange(registration, function () {
+                ok(registration.installingWorker === null);
+                ok(registration.waitingWorker !== null);
+                ok(registration.activeWorker !== null);
+
+                return waitForServiceWorkerRegistrationChange(registration, function () {
+                  ok(registration.installingWorker === null);
+                  ok(registration.waitingWorker === null);
+                  ok(registration.activeWorker !== null);
+
+                  return registration;
+                });
+              });
+
+            });
+          });
+          iframe.contentWindow.postMessage("register", "*");
+          yield promise;
+
+          SimpleTest.finish();
+        });
+      });
+    }
+
+  ]]>
+  </script>
+
+  <body xmlns="http://www.w3.org/1999/xhtml">
+    <p id="display"></p>
+    <div id="content" style="display:none;"></div>
+    <pre id="test"></pre>
+    <iframe id="iframe"></iframe>
+  </body>
+  <label id="test-result"/>
+</window>
diff --git a/dom/xul/nsXULElement.cpp b/dom/xul/nsXULElement.cpp
index 2ddbbb271fa7..01636f635e4c 100644
--- a/dom/xul/nsXULElement.cpp
+++ b/dom/xul/nsXULElement.cpp
@@ -2007,7 +2007,7 @@ public:
     explicit MarginSetter(nsIWidget* aWidget) :
         mWidget(aWidget), mMargin(-1, -1, -1, -1)
     {}
-    MarginSetter(nsIWidget *aWidget, const nsIntMargin& aMargin) :
+    MarginSetter(nsIWidget *aWidget, const LayoutDeviceIntMargin& aMargin) :
         mWidget(aWidget), mMargin(aMargin)
     {}
 
@@ -2021,7 +2021,7 @@ public:
 
 private:
     nsCOMPtr<nsIWidget> mWidget;
-    nsIntMargin mMargin;
+    LayoutDeviceIntMargin mMargin;
 };
 
 void
@@ -2046,7 +2046,9 @@ nsXULElement::SetChromeMargins(const nsAttrValue* aValue)
         gotMargins = nsContentUtils::ParseIntMarginValue(tmp, margins);
     }
     if (gotMargins) {
-        nsContentUtils::AddScriptRunner(new MarginSetter(mainWidget, margins));
+        nsContentUtils::AddScriptRunner(
+            new MarginSetter(
+                mainWidget, LayoutDeviceIntMargin::FromUnknownMargin(margins)));
     }
 }
 
diff --git a/gfx/2d/Rect.h b/gfx/2d/Rect.h
index c2e8d7a2bddd..2a674c99e475 100644
--- a/gfx/2d/Rect.h
+++ b/gfx/2d/Rect.h
@@ -32,6 +32,19 @@ struct IntMarginTyped:
     IntMarginTyped() : Super() {}
     IntMarginTyped(int32_t aTop, int32_t aRight, int32_t aBottom, int32_t aLeft) :
         Super(aTop, aRight, aBottom, aLeft) {}
+
+    // XXX When all of the code is ported, the following functions to convert
+    // to and from unknown types should be removed.
+
+    static IntMarginTyped<units> FromUnknownMargin(const IntMarginTyped<UnknownUnits>& aMargin) {
+        return IntMarginTyped<units>(aMargin.top, aMargin.right,
+                                     aMargin.bottom, aMargin.left);
+    }
+
+    IntMarginTyped<UnknownUnits> ToUnknownMargin() const {
+        return IntMarginTyped<UnknownUnits>(this->top, this->right,
+                                            this->bottom, this->left);
+    }
 };
 typedef IntMarginTyped<UnknownUnits> IntMargin;
 
@@ -83,8 +96,8 @@ struct IntRectTyped :
     void RoundIn() {}
     void RoundOut() {}
 
-    // XXX When all of the code is ported, the following functions to convert to and from
-    // unknown types should be removed.
+    // XXX When all of the code is ported, the following functions to convert
+    // to and from unknown types should be removed.
 
     static IntRectTyped<units> FromUnknownRect(const IntRectTyped<UnknownUnits>& rect) {
         return IntRectTyped<units>(rect.x, rect.y, rect.width, rect.height);
diff --git a/gfx/gl/GLBlitHelper.cpp b/gfx/gl/GLBlitHelper.cpp
index 350266477789..9181c2f4f7ab 100644
--- a/gfx/gl/GLBlitHelper.cpp
+++ b/gfx/gl/GLBlitHelper.cpp
@@ -12,6 +12,7 @@
 #include "ImageContainer.h"
 #include "HeapCopyOfStackArray.h"
 #include "mozilla/gfx/Matrix.h"
+#include "mozilla/UniquePtr.h"
 
 #ifdef MOZ_WIDGET_GONK
 #include "GrallocImages.h"
@@ -330,8 +331,8 @@ GLBlitHelper::InitTexQuadProgram(BlitType target)
                     break;
                 }
 
-                nsAutoArrayPtr<char> buffer(new char[length]);
-                mGL->fGetShaderInfoLog(mTexBlit_VertShader, length, nullptr, buffer);
+                auto buffer = MakeUnique<char[]>(length);
+                mGL->fGetShaderInfoLog(mTexBlit_VertShader, length, nullptr, buffer.get());
 
                 printf_stderr("Shader info log (%d bytes): %s\n", length, buffer.get());
                 break;
@@ -349,8 +350,8 @@ GLBlitHelper::InitTexQuadProgram(BlitType target)
                     break;
                 }
 
-                nsAutoArrayPtr<char> buffer(new char[length]);
-                mGL->fGetShaderInfoLog(fragShader, length, nullptr, buffer);
+                auto buffer = MakeUnique<char[]>(length);
+                mGL->fGetShaderInfoLog(fragShader, length, nullptr, buffer.get());
 
                 printf_stderr("Shader info log (%d bytes): %s\n", length, buffer.get());
                 break;
@@ -369,8 +370,8 @@ GLBlitHelper::InitTexQuadProgram(BlitType target)
                     break;
                 }
 
-                nsAutoArrayPtr<char> buffer(new char[length]);
-                mGL->fGetProgramInfoLog(program, length, nullptr, buffer);
+                auto buffer = MakeUnique<char[]>(length);
+                mGL->fGetProgramInfoLog(program, length, nullptr, buffer.get());
 
                 printf_stderr("Program info log (%d bytes): %s\n", length, buffer.get());
             }
diff --git a/gfx/layers/ImageContainer.cpp b/gfx/layers/ImageContainer.cpp
index 2025de0008e4..0c9cc0a7845f 100644
--- a/gfx/layers/ImageContainer.cpp
+++ b/gfx/layers/ImageContainer.cpp
@@ -116,7 +116,7 @@ BufferRecycleBin::BufferRecycleBin()
 }
 
 void
-BufferRecycleBin::RecycleBuffer(uint8_t* aBuffer, uint32_t aSize)
+BufferRecycleBin::RecycleBuffer(UniquePtr<uint8_t[]> aBuffer, uint32_t aSize)
 {
   MutexAutoLock lock(mLock);
 
@@ -124,19 +124,19 @@ BufferRecycleBin::RecycleBuffer(uint8_t* aBuffer, uint32_t aSize)
     mRecycledBuffers.Clear();
   }
   mRecycledBufferSize = aSize;
-  mRecycledBuffers.AppendElement(aBuffer);
+  mRecycledBuffers.AppendElement(Move(aBuffer));
 }
 
-uint8_t*
+UniquePtr<uint8_t[]>
 BufferRecycleBin::GetBuffer(uint32_t aSize)
 {
   MutexAutoLock lock(mLock);
 
   if (mRecycledBuffers.IsEmpty() || mRecycledBufferSize != aSize)
-    return new uint8_t[aSize];
+    return MakeUnique<uint8_t[]>(aSize);
 
   uint32_t last = mRecycledBuffers.Length() - 1;
-  uint8_t* result = mRecycledBuffers[last].forget();
+  UniquePtr<uint8_t[]> result = Move(mRecycledBuffers[last]);
   mRecycledBuffers.RemoveElementAt(last);
   return result;
 }
@@ -439,7 +439,7 @@ PlanarYCbCrImage::PlanarYCbCrImage()
 RecyclingPlanarYCbCrImage::~RecyclingPlanarYCbCrImage()
 {
   if (mBuffer) {
-    mRecycleBin->RecycleBuffer(mBuffer.forget(), mBufferSize);
+    mRecycleBin->RecycleBuffer(Move(mBuffer), mBufferSize);
   }
 }
 
@@ -454,7 +454,7 @@ RecyclingPlanarYCbCrImage::SizeOfExcludingThis(MallocSizeOf aMallocSizeOf) const
   //   - mImplData is not used
   // Not owned:
   // - mRecycleBin
-  size_t size = mBuffer.SizeOfExcludingThis(aMallocSizeOf);
+  size_t size = aMallocSizeOf(mBuffer.get());
 
   // Could add in the future:
   // - mBackendData (from base class)
@@ -462,7 +462,7 @@ RecyclingPlanarYCbCrImage::SizeOfExcludingThis(MallocSizeOf aMallocSizeOf) const
   return size;
 }
 
-uint8_t*
+UniquePtr<uint8_t[]>
 RecyclingPlanarYCbCrImage::AllocateBuffer(uint32_t aSize)
 {
   return mRecycleBin->GetBuffer(aSize);
@@ -509,7 +509,7 @@ RecyclingPlanarYCbCrImage::CopyData(const Data& aData)
   // update buffer size
   mBufferSize = size;
 
-  mData.mYChannel = mBuffer;
+  mData.mYChannel = mBuffer.get();
   mData.mCbChannel = mData.mYChannel + mData.mYStride * mData.mYSize.height;
   mData.mCrChannel = mData.mCbChannel + mData.mCbCrStride * mData.mCbCrSize.height;
 
@@ -555,7 +555,7 @@ RecyclingPlanarYCbCrImage::AllocateAndGetNewBuffer(uint32_t aSize)
     // update buffer size
     mBufferSize = aSize;
   }
-  return mBuffer;
+  return mBuffer.get();
 }
 
 already_AddRefed<gfx::SourceSurface>
diff --git a/gfx/layers/ImageContainer.h b/gfx/layers/ImageContainer.h
index debf82f6e553..4b92af1b6680 100644
--- a/gfx/layers/ImageContainer.h
+++ b/gfx/layers/ImageContainer.h
@@ -30,6 +30,7 @@
 #include "mozilla/gfx/2D.h"
 #include "nsDataHashtable.h"
 #include "mozilla/EnumeratedArray.h"
+#include "mozilla/UniquePtr.h"
 
 #ifndef XPCOM_GLUE_AVOID_NSPR
 /**
@@ -203,9 +204,9 @@ class BufferRecycleBin final {
 public:
   BufferRecycleBin();
 
-  void RecycleBuffer(uint8_t* aBuffer, uint32_t aSize);
+  void RecycleBuffer(mozilla::UniquePtr<uint8_t[]> aBuffer, uint32_t aSize);
   // Returns a recycled buffer of the right size, or allocates a new buffer.
-  uint8_t* GetBuffer(uint32_t aSize);
+  mozilla::UniquePtr<uint8_t[]> GetBuffer(uint32_t aSize);
 
 private:
   typedef mozilla::Mutex Mutex;
@@ -221,7 +222,7 @@ private:
 
   // We should probably do something to prune this list on a timer so we don't
   // eat excess memory while video is paused...
-  nsTArray<nsAutoArrayPtr<uint8_t> > mRecycledBuffers;
+  nsTArray<mozilla::UniquePtr<uint8_t[]>> mRecycledBuffers;
   // This is only valid if mRecycledBuffers is non-empty
   uint32_t mRecycledBufferSize;
 };
@@ -733,13 +734,11 @@ protected:
 
   /**
    * Return a buffer to store image data in.
-   * The default implementation returns memory that can
-   * be freed wit delete[]
    */
-  uint8_t* AllocateBuffer(uint32_t aSize);
+  mozilla::UniquePtr<uint8_t[]> AllocateBuffer(uint32_t aSize);
 
   RefPtr<BufferRecycleBin> mRecycleBin;
-  nsAutoArrayPtr<uint8_t> mBuffer;
+  mozilla::UniquePtr<uint8_t[]> mBuffer;
 };
 
 /**
diff --git a/gfx/layers/Layers.cpp b/gfx/layers/Layers.cpp
index bb8f801a5271..88eef5ff7804 100644
--- a/gfx/layers/Layers.cpp
+++ b/gfx/layers/Layers.cpp
@@ -1914,8 +1914,9 @@ Layer::PrintInfo(std::stringstream& aStream, const char* aPrefix)
   }
   if (GetIsFixedPosition()) {
     LayerPoint anchor = GetFixedPositionAnchor();
-    aStream << nsPrintfCString(" [isFixedPosition scrollId=%lld anchor=%s%s]",
+    aStream << nsPrintfCString(" [isFixedPosition scrollId=%lld sides=0x%x anchor=%s%s]",
                      GetFixedPositionScrollContainerId(),
+                     GetFixedPositionSides(),
                      ToString(anchor).c_str(),
                      IsClipFixed() ? "" : " scrollingClip").get();
   }
diff --git a/gfx/layers/MacIOSurfaceImage.cpp b/gfx/layers/MacIOSurfaceImage.cpp
index ac29393d141f..4587e1845019 100644
--- a/gfx/layers/MacIOSurfaceImage.cpp
+++ b/gfx/layers/MacIOSurfaceImage.cpp
@@ -7,6 +7,7 @@
 #include "mozilla/layers/CompositableClient.h"
 #include "mozilla/layers/CompositableForwarder.h"
 #include "mozilla/layers/MacIOSurfaceTextureClientOGL.h"
+#include "mozilla/UniquePtr.h"
 #include "YCbCrUtils.h"
 
 using namespace mozilla;
@@ -55,12 +56,12 @@ MacIOSurfaceImage::GetAsSourceSurface()
     size_t cbCrWidth = mSurface->GetDevicePixelWidth(1);
     size_t cbCrHeight = mSurface->GetDevicePixelHeight(1);
 
-    nsAutoArrayPtr<uint8_t> cbPlane(new uint8_t[cbCrWidth * cbCrHeight]);
-    nsAutoArrayPtr<uint8_t> crPlane(new uint8_t[cbCrWidth * cbCrHeight]);
+    auto cbPlane = MakeUnique<uint8_t[]>(cbCrWidth * cbCrHeight);
+    auto crPlane = MakeUnique<uint8_t[]>(cbCrWidth * cbCrHeight);
 
     uint8_t* src = (uint8_t*)mSurface->GetBaseAddressOfPlane(1);
-    uint8_t* cbDest = cbPlane;
-    uint8_t* crDest = crPlane;
+    uint8_t* cbDest = cbPlane.get();
+    uint8_t* crDest = crPlane.get();
 
     for (size_t i = 0; i < cbCrHeight; i++) {
       uint8_t* rowSrc = src + cbCrStride * i;
@@ -79,8 +80,8 @@ MacIOSurfaceImage::GetAsSourceSurface()
     data.mYChannel = (uint8_t*)mSurface->GetBaseAddressOfPlane(0);
     data.mYStride = mSurface->GetBytesPerRow(0);
     data.mYSize = IntSize(mSurface->GetDevicePixelWidth(0), mSurface->GetDevicePixelHeight(0));
-    data.mCbChannel = cbPlane;
-    data.mCrChannel = crPlane;
+    data.mCbChannel = cbPlane.get();
+    data.mCrChannel = crPlane.get();
     data.mCbCrStride = cbCrWidth;
     data.mCbCrSize = IntSize(cbCrWidth, cbCrHeight);
     data.mPicSize = data.mYSize;
diff --git a/gfx/layers/apz/util/APZEventState.cpp b/gfx/layers/apz/util/APZEventState.cpp
index 37c8a0c88c4c..9b86edd415e5 100644
--- a/gfx/layers/apz/util/APZEventState.cpp
+++ b/gfx/layers/apz/util/APZEventState.cpp
@@ -231,9 +231,12 @@ APZEventState::ProcessLongTap(const nsCOMPtr<nsIPresShell>& aPresShell,
                          nsIDOMMouseEvent::MOZ_SOURCE_TOUCH);
 
   APZES_LOG("Contextmenu event handled: %d\n", eventHandled);
-
-  // If no one handle context menu, fire MOZLONGTAP event
-  if (!eventHandled) {
+  if (eventHandled) {
+    // If the contextmenu event was handled then we're showing a contextmenu,
+    // and so we should remove any activation
+    mActiveElementManager->ClearActivation();
+  } else {
+    // If no one handle context menu, fire MOZLONGTAP event
     LayoutDevicePoint currentPoint =
         APZCCallbackHelper::ApplyCallbackTransform(aPoint, aGuid)
       * widget->GetDefaultScale();
@@ -407,7 +410,8 @@ APZEventState::ProcessAPZStateChange(const nsCOMPtr<nsIDocument>& aDocument,
   }
   case APZStateChange::StartPanning:
   {
-    mActiveElementManager->HandlePanStart();
+    // The user started to pan, so we don't want anything to be :active.
+    mActiveElementManager->ClearActivation();
     break;
   }
   case APZStateChange::EndTouch:
@@ -423,6 +427,17 @@ APZEventState::ProcessAPZStateChange(const nsCOMPtr<nsIDocument>& aDocument,
   }
 }
 
+void
+APZEventState::ProcessClusterHit()
+{
+  // If we hit a cluster of links then we shouldn't activate any of them,
+  // as we will be showing the zoomed view. (This is only called on Fennec).
+#ifndef MOZ_ANDROID_APZ
+  MOZ_ASSERT(false);
+#endif
+  mActiveElementManager->ClearActivation();
+}
+
 bool
 APZEventState::SendPendingTouchPreventedResponse(bool aPreventDefault)
 {
diff --git a/gfx/layers/apz/util/APZEventState.h b/gfx/layers/apz/util/APZEventState.h
index a5d9c5d4527c..5572d5b1bee7 100644
--- a/gfx/layers/apz/util/APZEventState.h
+++ b/gfx/layers/apz/util/APZEventState.h
@@ -69,6 +69,7 @@ public:
                              ViewID aViewId,
                              APZStateChange aChange,
                              int aArg);
+  void ProcessClusterHit();
 private:
   ~APZEventState();
   bool SendPendingTouchPreventedResponse(bool aPreventDefault);
diff --git a/gfx/layers/apz/util/ActiveElementManager.cpp b/gfx/layers/apz/util/ActiveElementManager.cpp
index 57025f3261b4..6f8198c8ac75 100644
--- a/gfx/layers/apz/util/ActiveElementManager.cpp
+++ b/gfx/layers/apz/util/ActiveElementManager.cpp
@@ -101,12 +101,9 @@ ActiveElementManager::TriggerElementActivation()
 }
 
 void
-ActiveElementManager::HandlePanStart()
+ActiveElementManager::ClearActivation()
 {
-  AEM_LOG("Handle pan start\n");
-
-  // The user started to pan, so we don't want mTarget to be :active.
-  // Make it not :active, and clear any pending task to make it :active.
+  AEM_LOG("Clearing element activation\n");
   CancelTask();
   ResetActive();
 }
diff --git a/gfx/layers/apz/util/ActiveElementManager.h b/gfx/layers/apz/util/ActiveElementManager.h
index 3b3e1354e284..184a71df2dd7 100644
--- a/gfx/layers/apz/util/ActiveElementManager.h
+++ b/gfx/layers/apz/util/ActiveElementManager.h
@@ -45,9 +45,9 @@ public:
    */
   void HandleTouchStart(bool aCanBePan);
   /**
-   * Handle the start of panning.
+   * Clear the active element.
    */
-  void HandlePanStart();
+  void ClearActivation();
   /**
    * Handle a touch-end or touch-cancel event.
    * @param aWasClick whether the touch was a click
diff --git a/gfx/layers/apz/util/ChromeProcessController.h b/gfx/layers/apz/util/ChromeProcessController.h
index 1ed7343bdb6d..e6f64130d67f 100644
--- a/gfx/layers/apz/util/ChromeProcessController.h
+++ b/gfx/layers/apz/util/ChromeProcessController.h
@@ -28,6 +28,7 @@ class APZEventState;
 // tree.
 class ChromeProcessController : public mozilla::layers::GeckoContentController
 {
+protected:
   typedef mozilla::layers::FrameMetrics FrameMetrics;
   typedef mozilla::layers::ScrollableLayerGuid ScrollableLayerGuid;
 
diff --git a/gfx/layers/basic/BasicImages.cpp b/gfx/layers/basic/BasicImages.cpp
index d8547a3c357c..d2a7a88557a2 100644
--- a/gfx/layers/basic/BasicImages.cpp
+++ b/gfx/layers/basic/BasicImages.cpp
@@ -12,7 +12,8 @@
 #include "gfxPlatform.h"                // for gfxPlatform, gfxImageFormat
 #include "gfxUtils.h"                   // for gfxUtils
 #include "mozilla/mozalloc.h"           // for operator delete[], etc
-#include "nsAutoPtr.h"                  // for nsRefPtr, nsAutoArrayPtr
+#include "mozilla/RefPtr.h"
+#include "mozilla/UniquePtr.h"
 #include "nsAutoRef.h"                  // for nsCountedRef
 #include "nsCOMPtr.h"                   // for already_AddRefed
 #include "nsDebug.h"                    // for NS_ERROR, NS_ASSERTION
@@ -44,7 +45,7 @@ public:
     if (mDecodedBuffer) {
       // Right now this only happens if the Image was never drawn, otherwise
       // this will have been tossed away at surface destruction.
-      mRecycleBin->RecycleBuffer(mDecodedBuffer.forget(), mSize.height * mStride);
+      mRecycleBin->RecycleBuffer(Move(mDecodedBuffer), mSize.height * mStride);
     }
   }
 
@@ -61,12 +62,12 @@ public:
   virtual size_t SizeOfExcludingThis(MallocSizeOf aMallocSizeOf) const override
   {
     size_t size = RecyclingPlanarYCbCrImage::SizeOfExcludingThis(aMallocSizeOf);
-    size += mDecodedBuffer.SizeOfExcludingThis(aMallocSizeOf);
+    size += aMallocSizeOf(mDecodedBuffer.get());
     return size;
   }
 
 private:
-  nsAutoArrayPtr<uint8_t> mDecodedBuffer;
+  UniquePtr<uint8_t[]> mDecodedBuffer;
   gfx::IntSize mScaleHint;
   int mStride;
   bool mDelayedConversion;
@@ -125,7 +126,7 @@ BasicPlanarYCbCrImage::SetData(const Data& aData)
     return false;
   }
 
-  gfx::ConvertYCbCrToRGB(aData, format, size, mDecodedBuffer, mStride);
+  gfx::ConvertYCbCrToRGB(aData, format, size, mDecodedBuffer.get(), mStride);
   SetOffscreenFormat(iFormat);
   mSize = size;
 
@@ -154,7 +155,7 @@ BasicPlanarYCbCrImage::GetAsSourceSurface()
     // We create the target out of mDecodedBuffer, and get a snapshot from it.
     // The draw target is destroyed on scope exit and the surface owns the data.
     RefPtr<gfx::DrawTarget> drawTarget
-      = gfxPlatform::GetPlatform()->CreateDrawTargetForData(mDecodedBuffer,
+      = gfxPlatform::GetPlatform()->CreateDrawTargetForData(mDecodedBuffer.get(),
                                                             mSize,
                                                             mStride,
                                                             gfx::ImageFormatToSurfaceFormat(format));
@@ -165,7 +166,7 @@ BasicPlanarYCbCrImage::GetAsSourceSurface()
     surface = drawTarget->Snapshot();
   }
 
-  mRecycleBin->RecycleBuffer(mDecodedBuffer.forget(), mSize.height * mStride);
+  mRecycleBin->RecycleBuffer(Move(mDecodedBuffer), mSize.height * mStride);
 
   mSourceSurface = surface;
   return surface.forget();
diff --git a/gfx/layers/composite/LayerManagerComposite.cpp b/gfx/layers/composite/LayerManagerComposite.cpp
index a135a99f0fa4..3fdf179aaec4 100644
--- a/gfx/layers/composite/LayerManagerComposite.cpp
+++ b/gfx/layers/composite/LayerManagerComposite.cpp
@@ -976,7 +976,7 @@ LayerManagerComposite::RenderToPresentationSurface()
   }
   GLContext* gl = compositor->gl();
   GLContextEGL* egl = GLContextEGL::Cast(gl);
-  const IntSize windowSize = mirrorScreen->GetNaturalBoundsUntyped().Size();
+  const IntSize windowSize = mirrorScreen->GetNaturalBounds().Size().ToUnknownSize();
 #endif
 
   if ((windowSize.width <= 0) || (windowSize.height <= 0)) {
diff --git a/gfx/layers/d3d11/CompositorD3D11.cpp b/gfx/layers/d3d11/CompositorD3D11.cpp
index 79f0154bf9f2..ae3f787358af 100644
--- a/gfx/layers/d3d11/CompositorD3D11.cpp
+++ b/gfx/layers/d3d11/CompositorD3D11.cpp
@@ -149,6 +149,7 @@ CompositorD3D11::CompositorD3D11(nsIWidget* aWidget)
   , mWidget(aWidget)
   , mHwnd(nullptr)
   , mDisableSequenceForNextFrame(false)
+  , mVerifyBuffersFailed(false)
 {
 }
 
@@ -1219,9 +1220,10 @@ CompositorD3D11::VerifyBufferSize()
     return false;
   }
 
-  if ((swapDesc.BufferDesc.Width == mSize.width &&
+  if (((swapDesc.BufferDesc.Width == mSize.width &&
        swapDesc.BufferDesc.Height == mSize.height) ||
-      mSize.width <= 0 || mSize.height <= 0) {
+       mSize.width <= 0 || mSize.height <= 0) &&
+      !mVerifyBuffersFailed) {
     return true;
   }
 
@@ -1241,6 +1243,7 @@ CompositorD3D11::VerifyBufferSize()
   if (Failed(hr)) {
     gfxCriticalNote << "D3D11 swap resize buffers failed " << hexa(hr) << " on " << mSize;
   }
+  mVerifyBuffersFailed = FAILED(hr);
 
   return Succeeded(hr);
 }
diff --git a/gfx/layers/d3d11/CompositorD3D11.h b/gfx/layers/d3d11/CompositorD3D11.h
index cb8359abb949..65cc9121e8f5 100644
--- a/gfx/layers/d3d11/CompositorD3D11.h
+++ b/gfx/layers/d3d11/CompositorD3D11.h
@@ -199,6 +199,8 @@ private:
   // This is the clip rect applied to the default DrawTarget (i.e. the window)
   gfx::IntRect mCurrentClip;
   nsIntRegion mInvalidRegion;
+
+  bool mVerifyBuffersFailed;
 };
 
 }
diff --git a/gfx/layers/ipc/ShadowLayers.cpp b/gfx/layers/ipc/ShadowLayers.cpp
index 2e6e0c674232..a5bb1de44bc9 100644
--- a/gfx/layers/ipc/ShadowLayers.cpp
+++ b/gfx/layers/ipc/ShadowLayers.cpp
@@ -513,7 +513,7 @@ ShadowLayerForwarder::StorePluginWidgetConfigurations(const nsTArray<nsIWidget::
     const nsIWidget::Configuration& configuration = aConfigurations[idx];
     mPluginWindowData.AppendElement(PluginWindowData(configuration.mWindowID,
                                                      configuration.mClipRegion,
-                                                     configuration.mBounds,
+                                                     configuration.mBounds.ToUnknownRect(),
                                                      configuration.mVisible));
   }
 }
@@ -598,6 +598,7 @@ ShadowLayerForwarder::EndTransaction(InfallibleTArray<EditReply>* aReplies,
     if (mutant->GetIsFixedPosition()) {
       common.fixedPositionScrollContainerId() = mutant->GetFixedPositionScrollContainerId();
       common.fixedPositionAnchor() = mutant->GetFixedPositionAnchor();
+      common.fixedPositionSides() = mutant->GetFixedPositionSides();
       common.isClipFixed() = mutant->IsClipFixed();
     }
     common.isStickyPosition() = mutant->GetIsStickyPosition();
diff --git a/gfx/layers/opengl/CompositorOGL.cpp b/gfx/layers/opengl/CompositorOGL.cpp
index 76718f38bf58..6a2efdf99087 100644
--- a/gfx/layers/opengl/CompositorOGL.cpp
+++ b/gfx/layers/opengl/CompositorOGL.cpp
@@ -740,13 +740,13 @@ CompositorOGL::CreateFBOWithTexture(const IntRect& aRect, bool aCopyFromSource,
 
       // RGBA
       size_t bufferSize = clampedRect.width * clampedRect.height * 4;
-      nsAutoArrayPtr<uint8_t> buf(new uint8_t[bufferSize]);
+      auto buf = MakeUnique<uint8_t[]>(bufferSize);
 
       mGLContext->fReadPixels(clampedRect.x, clampedRect.y,
                               clampedRect.width, clampedRect.height,
                               LOCAL_GL_RGBA,
                               LOCAL_GL_UNSIGNED_BYTE,
-                              buf);
+                              buf.get());
       mGLContext->fTexImage2D(mFBOTextureTarget,
                               0,
                               LOCAL_GL_RGBA,
@@ -754,7 +754,7 @@ CompositorOGL::CreateFBOWithTexture(const IntRect& aRect, bool aCopyFromSource,
                               0,
                               LOCAL_GL_RGBA,
                               LOCAL_GL_UNSIGNED_BYTE,
-                              buf);
+                              buf.get());
     }
     GLenum error = mGLContext->fGetError();
     if (error != LOCAL_GL_NO_ERROR) {
diff --git a/gfx/thebes/gfxCoreTextShaper.cpp b/gfx/thebes/gfxCoreTextShaper.cpp
index d790f5380ce5..28ae7a74571f 100644
--- a/gfx/thebes/gfxCoreTextShaper.cpp
+++ b/gfx/thebes/gfxCoreTextShaper.cpp
@@ -9,6 +9,7 @@
 #include "gfxFontUtils.h"
 #include "gfxTextRun.h"
 #include "mozilla/gfx/2D.h"
+#include "mozilla/UniquePtrExtensions.h"
 
 #include <algorithm>
 
@@ -247,9 +248,9 @@ gfxCoreTextShaper::SetGlyphsFromRun(gfxShapedText *aShapedText,
     }
 
     // retrieve the laid-out glyph data from the CTRun
-    nsAutoArrayPtr<CGGlyph> glyphsArray;
-    nsAutoArrayPtr<CGPoint> positionsArray;
-    nsAutoArrayPtr<CFIndex> glyphToCharArray;
+    UniquePtr<CGGlyph[]> glyphsArray;
+    UniquePtr<CGPoint[]> positionsArray;
+    UniquePtr<CFIndex[]> glyphToCharArray;
     const CGGlyph* glyphs = nullptr;
     const CGPoint* positions = nullptr;
     const CFIndex* glyphToChar = nullptr;
@@ -264,7 +265,7 @@ gfxCoreTextShaper::SetGlyphsFromRun(gfxShapedText *aShapedText,
     // may become an attractive option.
     glyphs = ::CTRunGetGlyphsPtr(aCTRun);
     if (!glyphs) {
-        glyphsArray = new (std::nothrow) CGGlyph[numGlyphs];
+        glyphsArray = MakeUniqueFallible<CGGlyph[]>(numGlyphs);
         if (!glyphsArray) {
             return NS_ERROR_OUT_OF_MEMORY;
         }
@@ -274,7 +275,7 @@ gfxCoreTextShaper::SetGlyphsFromRun(gfxShapedText *aShapedText,
 
     positions = ::CTRunGetPositionsPtr(aCTRun);
     if (!positions) {
-        positionsArray = new (std::nothrow) CGPoint[numGlyphs];
+        positionsArray = MakeUniqueFallible<CGPoint[]>(numGlyphs);
         if (!positionsArray) {
             return NS_ERROR_OUT_OF_MEMORY;
         }
@@ -287,7 +288,7 @@ gfxCoreTextShaper::SetGlyphsFromRun(gfxShapedText *aShapedText,
     // or the stringRange of the glyph run
     glyphToChar = ::CTRunGetStringIndicesPtr(aCTRun);
     if (!glyphToChar) {
-        glyphToCharArray = new (std::nothrow) CFIndex[numGlyphs];
+        glyphToCharArray = MakeUniqueFallible<CFIndex[]>(numGlyphs);
         if (!glyphToCharArray) {
             return NS_ERROR_OUT_OF_MEMORY;
         }
diff --git a/gfx/thebes/gfxFT2FontList.cpp b/gfx/thebes/gfxFT2FontList.cpp
index beda5b7a723f..8fd86da32367 100644
--- a/gfx/thebes/gfxFT2FontList.cpp
+++ b/gfx/thebes/gfxFT2FontList.cpp
@@ -10,7 +10,8 @@
 #include "mozilla/dom/ContentChild.h"
 #include "gfxAndroidPlatform.h"
 #include "mozilla/Omnijar.h"
-#include "nsAutoPtr.h"
+#include "mozilla/UniquePtr.h"
+#include "mozilla/UniquePtrExtensions.h"
 #include "nsIInputStream.h"
 #define gfxToolkitPlatform gfxAndroidPlatform
 
@@ -1069,12 +1070,12 @@ gfxFT2FontList::AppendFacesFromOmnijarEntry(nsZipArchive* aArchive,
     uint32_t bufSize = item->RealSize();
     // We use fallible allocation here; if there's not enough RAM, we'll simply
     // ignore the bundled fonts and fall back to the device's installed fonts.
-    nsAutoArrayPtr<uint8_t> buf(new (fallible) uint8_t[bufSize]);
+    auto buf = MakeUniqueFallible<uint8_t[]>(bufSize);
     if (!buf) {
         return;
     }
 
-    nsZipCursor cursor(item, aArchive, buf, bufSize);
+    nsZipCursor cursor(item, aArchive, buf.get(), bufSize);
     uint8_t* data = cursor.Copy(&bufSize);
     NS_ASSERTION(data && bufSize == item->RealSize(),
                  "error reading bundled font");
@@ -1085,13 +1086,13 @@ gfxFT2FontList::AppendFacesFromOmnijarEntry(nsZipArchive* aArchive,
     FT_Library ftLibrary = gfxAndroidPlatform::GetPlatform()->GetFTLibrary();
 
     FT_Face dummy;
-    if (FT_Err_Ok != FT_New_Memory_Face(ftLibrary, buf, bufSize, 0, &dummy)) {
+    if (FT_Err_Ok != FT_New_Memory_Face(ftLibrary, buf.get(), bufSize, 0, &dummy)) {
         return;
     }
 
     for (FT_Long i = 0; i < dummy->num_faces; i++) {
         FT_Face face;
-        if (FT_Err_Ok != FT_New_Memory_Face(ftLibrary, buf, bufSize, i, &face)) {
+        if (FT_Err_Ok != FT_New_Memory_Face(ftLibrary, buf.get(), bufSize, i, &face)) {
             continue;
         }
         AddFaceToList(aEntryName, i, kStandard, FT2FontFamily::kVisible,
diff --git a/gfx/thebes/gfxFontEntry.cpp b/gfx/thebes/gfxFontEntry.cpp
index dcf7c314f0d4..23c12e28d642 100644
--- a/gfx/thebes/gfxFontEntry.cpp
+++ b/gfx/thebes/gfxFontEntry.cpp
@@ -211,7 +211,7 @@ nsresult gfxFontEntry::InitializeUVSMap()
             return NS_ERROR_FAILURE;
         }
 
-        uint8_t* uvsData;
+        UniquePtr<uint8_t[]> uvsData;
         unsigned int cmapLen;
         const char* cmapData = hb_blob_get_data(cmapTable, &cmapLen);
         nsresult rv = gfxFontUtils::ReadCMAPTableFormat14(
@@ -223,7 +223,7 @@ nsresult gfxFontEntry::InitializeUVSMap()
             return rv;
         }
 
-        mUVSData = uvsData;
+        mUVSData = Move(uvsData);
     }
 
     return NS_OK;
@@ -234,7 +234,7 @@ uint16_t gfxFontEntry::GetUVSGlyph(uint32_t aCh, uint32_t aVS)
     InitializeUVSMap();
 
     if (mUVSData) {
-        return gfxFontUtils::MapUVSToGlyphFormat14(mUVSData, aCh, aVS);
+        return gfxFontUtils::MapUVSToGlyphFormat14(mUVSData.get(), aCh, aVS);
     }
 
     return 0;
diff --git a/gfx/thebes/gfxFontEntry.h b/gfx/thebes/gfxFontEntry.h
index 87a7eaab4087..392ff720da35 100644
--- a/gfx/thebes/gfxFontEntry.h
+++ b/gfx/thebes/gfxFontEntry.h
@@ -20,6 +20,7 @@
 #include "nsDataHashtable.h"
 #include "harfbuzz/hb.h"
 #include "mozilla/gfx/2D.h"
+#include "mozilla/UniquePtr.h"
 
 typedef struct gr_face gr_face;
 
@@ -429,7 +430,7 @@ public:
 
     RefPtr<gfxCharacterMap> mCharacterMap;
     uint32_t         mUVSOffset;
-    nsAutoArrayPtr<uint8_t> mUVSData;
+    mozilla::UniquePtr<uint8_t[]> mUVSData;
     nsAutoPtr<gfxUserFontData> mUserFontData;
     nsAutoPtr<gfxSVGGlyphs> mSVGGlyphs;
     // list of gfxFonts that are using SVG glyphs
diff --git a/gfx/thebes/gfxFontUtils.cpp b/gfx/thebes/gfxFontUtils.cpp
index a0779ea3fe1f..044949a8d922 100644
--- a/gfx/thebes/gfxFontUtils.cpp
+++ b/gfx/thebes/gfxFontUtils.cpp
@@ -289,7 +289,7 @@ gfxFontUtils::ReadCMAPTableFormat4(const uint8_t *aBuf, uint32_t aLength,
 
 nsresult
 gfxFontUtils::ReadCMAPTableFormat14(const uint8_t *aBuf, uint32_t aLength,
-                                    uint8_t*& aTable)
+                                    UniquePtr<uint8_t[]>& aTable)
 {
     enum {
         OffsetFormat = 0,
@@ -371,8 +371,8 @@ gfxFontUtils::ReadCMAPTableFormat14(const uint8_t *aBuf, uint32_t aLength,
         }
     }
 
-    aTable = new uint8_t[tablelen];
-    memcpy(aTable, aBuf, tablelen);
+    aTable = MakeUnique<uint8_t[]>(tablelen);
+    memcpy(aTable.get(), aBuf, tablelen);
 
     return NS_OK;
 }
diff --git a/gfx/thebes/gfxFontUtils.h b/gfx/thebes/gfxFontUtils.h
index 36b2c30c9029..15c08541ada2 100644
--- a/gfx/thebes/gfxFontUtils.h
+++ b/gfx/thebes/gfxFontUtils.h
@@ -13,6 +13,7 @@
 #include "mozilla/Likely.h"
 #include "mozilla/Endian.h"
 #include "mozilla/MemoryReporting.h"
+#include "mozilla/UniquePtr.h"
 
 #include "zlib.h"
 #include <algorithm>
@@ -786,7 +787,7 @@ public:
 
     static nsresult
     ReadCMAPTableFormat14(const uint8_t *aBuf, uint32_t aLength, 
-                          uint8_t*& aTable);
+                          mozilla::UniquePtr<uint8_t[]>& aTable);
 
     static uint32_t
     FindPreferredSubtable(const uint8_t *aBuf, uint32_t aBufLength,
diff --git a/gfx/thebes/gfxTextRun.cpp b/gfx/thebes/gfxTextRun.cpp
index 871da3e12e63..d9e1653c46b8 100644
--- a/gfx/thebes/gfxTextRun.cpp
+++ b/gfx/thebes/gfxTextRun.cpp
@@ -24,6 +24,7 @@
 #include "mozilla/Likely.h"
 #include "gfx2DGlue.h"
 #include "mozilla/gfx/Logging.h"        // for gfxCriticalError
+#include "mozilla/UniquePtr.h"
 
 #if defined(MOZ_WIDGET_GTK)
 #include "gfxPlatformGtk.h" // xxx - for UseFcFontList
@@ -2107,7 +2108,7 @@ gfxFontGroup::InitTextRun(gfxContext *aContext,
     // we need to do numeral processing even on 8-bit text,
     // in case we're converting Western to Hindi/Arabic digits
     int32_t numOption = gfxPlatform::GetPlatform()->GetBidiNumeralOption();
-    nsAutoArrayPtr<char16_t> transformedString;
+    UniquePtr<char16_t[]> transformedString;
     if (numOption != IBMBIDI_NUMERAL_NOMINAL) {
         // scan the string for numerals that may need to be transformed;
         // if we find any, we'll make a local copy here and use that for
@@ -2119,7 +2120,7 @@ gfxFontGroup::InitTextRun(gfxContext *aContext,
             char16_t newCh = HandleNumberInChar(origCh, prevIsArabic, numOption);
             if (newCh != origCh) {
                 if (!transformedString) {
-                    transformedString = new char16_t[aLength];
+                    transformedString = MakeUnique<char16_t[]>(aLength);
                     if (sizeof(T) == sizeof(char16_t)) {
                         memcpy(transformedString.get(), aString, i * sizeof(char16_t));
                     } else {
diff --git a/js/public/Id.h b/js/public/Id.h
index a62b2c8dd0b4..d5ddef9bab94 100644
--- a/js/public/Id.h
+++ b/js/public/Id.h
@@ -168,7 +168,8 @@ extern JS_PUBLIC_DATA(const JS::HandleId) JSID_EMPTYHANDLE;
 
 namespace js {
 
-template <> struct GCMethods<jsid>
+template <>
+struct GCMethods<jsid>
 {
     static jsid initial() { return JSID_VOID; }
     static void postBarrier(jsid* idp, jsid prev, jsid next) {}
diff --git a/js/src/builtin/WeakMapObject.cpp b/js/src/builtin/WeakMapObject.cpp
index 6429b3307256..240398b71be5 100644
--- a/js/src/builtin/WeakMapObject.cpp
+++ b/js/src/builtin/WeakMapObject.cpp
@@ -148,13 +148,6 @@ TryPreserveReflector(JSContext* cx, HandleObject obj)
     return true;
 }
 
-static inline void
-WeakMapPostWriteBarrier(JSRuntime* rt, ObjectValueMap* weakMap, JSObject* key)
-{
-    if (key && IsInsideNursery(key))
-        rt->gc.storeBuffer.putGeneric(gc::HashKeyRef<ObjectValueMap, JSObject*>(weakMap, key));
-}
-
 static MOZ_ALWAYS_INLINE bool
 SetWeakMapEntryInternal(JSContext* cx, Handle<WeakMapObject*> mapObj,
                         HandleObject key, HandleValue value)
@@ -189,7 +182,6 @@ SetWeakMapEntryInternal(JSContext* cx, Handle<WeakMapObject*> mapObj,
         JS_ReportOutOfMemory(cx);
         return false;
     }
-    WeakMapPostWriteBarrier(cx->runtime(), map, key.get());
     return true;
 }
 
diff --git a/js/src/configure.in b/js/src/configure.in
index 37bff6341ab1..45c0a9582500 100644
--- a/js/src/configure.in
+++ b/js/src/configure.in
@@ -3881,6 +3881,9 @@ fi
 MOZ_SUBCONFIGURE_FFI()
 MOZ_SUBCONFIGURE_JEMALLOC()
 
+# Avoid using obsolete NSPR features
+AC_DEFINE(NO_NSPR_10_SUPPORT)
+
 dnl Spit out some output
 dnl ========================================================
 MOZ_CREATE_CONFIG_STATUS()
diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitter.cpp
index fd7338c6c962..829be1b9ab7f 100644
--- a/js/src/frontend/BytecodeEmitter.cpp
+++ b/js/src/frontend/BytecodeEmitter.cpp
@@ -7126,12 +7126,25 @@ BytecodeEmitter::emitPropertyList(ParseNode* pn, MutableHandlePlainObject objp,
                 return false;
         }
 
+        // Class methods are not enumerable.
+        if (type == ClassBody) {
+            switch (op) {
+              case JSOP_INITPROP:        op = JSOP_INITHIDDENPROP;          break;
+              case JSOP_INITPROP_GETTER: op = JSOP_INITHIDDENPROP_GETTER;   break;
+              case JSOP_INITPROP_SETTER: op = JSOP_INITHIDDENPROP_SETTER;   break;
+              default: MOZ_CRASH("Invalid op");
+            }
+        }
+
         if (isIndex) {
             objp.set(nullptr);
             switch (op) {
-              case JSOP_INITPROP:        op = JSOP_INITELEM;        break;
-              case JSOP_INITPROP_GETTER: op = JSOP_INITELEM_GETTER; break;
-              case JSOP_INITPROP_SETTER: op = JSOP_INITELEM_SETTER; break;
+              case JSOP_INITPROP:               op = JSOP_INITELEM;              break;
+              case JSOP_INITHIDDENPROP:         op = JSOP_INITHIDDENELEM;        break;
+              case JSOP_INITPROP_GETTER:        op = JSOP_INITELEM_GETTER;       break;
+              case JSOP_INITHIDDENPROP_GETTER:  op = JSOP_INITHIDDENELEM_GETTER; break;
+              case JSOP_INITPROP_SETTER:        op = JSOP_INITELEM_SETTER;       break;
+              case JSOP_INITHIDDENPROP_SETTER:  op = JSOP_INITHIDDENELEM_SETTER; break;
               default: MOZ_CRASH("Invalid op");
             }
             if (!emit1(op))
@@ -7144,6 +7157,8 @@ BytecodeEmitter::emitPropertyList(ParseNode* pn, MutableHandlePlainObject objp,
                 return false;
 
             if (objp) {
+                MOZ_ASSERT(type == ObjectLiteral);
+                MOZ_ASSERT(!IsHiddenInitOp(op));
                 MOZ_ASSERT(!objp->inDictionaryMode());
                 Rooted<jsid> id(cx, AtomToId(key->pn_atom));
                 RootedValue undefinedValue(cx, UndefinedValue());
@@ -8466,11 +8481,9 @@ CGBlockScopeList::findEnclosingScope(uint32_t index)
             // scope contains POS, it should still be open, so its length should
             // be zero.
             return list[index].index;
-        } else {
-            // Conversely, if the length is not zero, it should not contain
-            // POS.
-            MOZ_ASSERT_IF(inPrologue == list[index].endInPrologue, list[index].end <= pos);
         }
+        // Conversely, if the length is not zero, it should not contain POS.
+        MOZ_ASSERT_IF(inPrologue == list[index].endInPrologue, list[index].end <= pos);
     }
 
     return BlockScopeNote::NoBlockScopeIndex;
diff --git a/js/src/gc/Barrier.cpp b/js/src/gc/Barrier.cpp
index e75399cd08e8..845dda3f6e92 100644
--- a/js/src/gc/Barrier.cpp
+++ b/js/src/gc/Barrier.cpp
@@ -162,7 +162,8 @@ MovableCellHasher<T>::match(const Key& k, const Lookup& l)
 template struct MovableCellHasher<JSObject*>;
 template struct MovableCellHasher<GlobalObject*>;
 template struct MovableCellHasher<SavedFrame*>;
-template struct MovableCellHasher<ReadBarriered<ScopeObject*>>;
+template struct MovableCellHasher<ScopeObject*>;
+template struct MovableCellHasher<JSScript*>;
 
 } // namespace js
 
diff --git a/js/src/gc/Barrier.h b/js/src/gc/Barrier.h
index ddff73496158..ea4c0c3db6f7 100644
--- a/js/src/gc/Barrier.h
+++ b/js/src/gc/Barrier.h
@@ -482,7 +482,9 @@ class RelocatablePtr : public WriteBarrieredBase<T>
 {
   public:
     RelocatablePtr() : WriteBarrieredBase<T>(GCMethods<T>::initial()) {}
-    explicit RelocatablePtr(T v) : WriteBarrieredBase<T>(v) {
+
+    // Implicitly adding barriers is a reasonable default.
+    MOZ_IMPLICIT RelocatablePtr(const T& v) : WriteBarrieredBase<T>(v) {
         this->post(GCMethods<T>::initial(), this->value);
     }
 
@@ -560,14 +562,18 @@ class ReadBarriered : public ReadBarrieredBase<T>
   public:
     ReadBarriered() : ReadBarrieredBase<T>(GCMethods<T>::initial()) {}
 
+    // It is okay to add barriers implicitly.
     MOZ_IMPLICIT ReadBarriered(const T& v) : ReadBarrieredBase<T>(v) {
         this->post(GCMethods<T>::initial(), v);
     }
 
+    // Copy is creating a new edge, so we must read barrier the source edge.
     explicit ReadBarriered(const ReadBarriered& v) : ReadBarrieredBase<T>(v) {
         this->post(GCMethods<T>::initial(), v.get());
     }
 
+    // Move retains the lifetime status of the source edge, so does not fire
+    // the read barrier of the defunct edge.
     ReadBarriered(ReadBarriered&& v)
       : ReadBarrieredBase<T>(mozilla::Forward<ReadBarriered<T>>(v))
     {
@@ -604,6 +610,7 @@ class ReadBarriered : public ReadBarrieredBase<T>
 
     const T operator->() const { return get(); }
 
+    T* unsafeGet() { return &this->value; }
     T const* unsafeGet() const { return &this->value; }
 
     void set(const T& v)
@@ -799,6 +806,41 @@ struct MovableCellHasher
     static void rekey(Key& k, const Key& newKey) { k = newKey; }
 };
 
+template <typename T>
+struct MovableCellHasher<PreBarriered<T>>
+{
+    using Key = PreBarriered<T>;
+    using Lookup = T;
+
+    static HashNumber hash(const Lookup& l) { return MovableCellHasher<T>::hash(l); }
+    static bool match(const Key& k, const Lookup& l) { return MovableCellHasher<T>::match(k, l); }
+    static void rekey(Key& k, const Key& newKey) { k.unsafeSet(newKey); }
+};
+
+template <typename T>
+struct MovableCellHasher<RelocatablePtr<T>>
+{
+    using Key = RelocatablePtr<T>;
+    using Lookup = T;
+
+    static HashNumber hash(const Lookup& l) { return MovableCellHasher<T>::hash(l); }
+    static bool match(const Key& k, const Lookup& l) { return MovableCellHasher<T>::match(k, l); }
+    static void rekey(Key& k, const Key& newKey) { k.unsafeSet(newKey); }
+};
+
+template <typename T>
+struct MovableCellHasher<ReadBarriered<T>>
+{
+    using Key = ReadBarriered<T>;
+    using Lookup = T;
+
+    static HashNumber hash(const Lookup& l) { return MovableCellHasher<T>::hash(l); }
+    static bool match(const Key& k, const Lookup& l) {
+        return MovableCellHasher<T>::match(k.unbarrieredGet(), l);
+    }
+    static void rekey(Key& k, const Key& newKey) { k.unsafeSet(newKey); }
+};
+
 /* Useful for hashtables with a HeapPtr as key. */
 template <class T>
 struct HeapPtrHasher
diff --git a/js/src/jit/BaselineCompiler.cpp b/js/src/jit/BaselineCompiler.cpp
index 7d9c0e52769e..d5212b05fff4 100644
--- a/js/src/jit/BaselineCompiler.cpp
+++ b/js/src/jit/BaselineCompiler.cpp
@@ -1964,6 +1964,12 @@ BaselineCompiler::emit_JSOP_INITELEM()
     return true;
 }
 
+bool
+BaselineCompiler::emit_JSOP_INITHIDDENELEM()
+{
+    return emit_JSOP_INITELEM();
+}
+
 typedef bool (*MutateProtoFn)(JSContext* cx, HandlePlainObject obj, HandleValue newProto);
 static const VMFunction MutateProtoInfo = FunctionInfo<MutateProtoFn>(MutatePrototype);
 
@@ -2569,7 +2575,9 @@ bool
 BaselineCompiler::emitInitPropGetterSetter()
 {
     MOZ_ASSERT(JSOp(*pc) == JSOP_INITPROP_GETTER ||
-               JSOp(*pc) == JSOP_INITPROP_SETTER);
+               JSOp(*pc) == JSOP_INITHIDDENPROP_GETTER ||
+               JSOp(*pc) == JSOP_INITPROP_SETTER ||
+               JSOp(*pc) == JSOP_INITHIDDENPROP_SETTER);
 
     // Keep values on the stack for the decompiler.
     frame.syncStack(0);
@@ -2597,12 +2605,24 @@ BaselineCompiler::emit_JSOP_INITPROP_GETTER()
     return emitInitPropGetterSetter();
 }
 
+bool
+BaselineCompiler::emit_JSOP_INITHIDDENPROP_GETTER()
+{
+    return emitInitPropGetterSetter();
+}
+
 bool
 BaselineCompiler::emit_JSOP_INITPROP_SETTER()
 {
     return emitInitPropGetterSetter();
 }
 
+bool
+BaselineCompiler::emit_JSOP_INITHIDDENPROP_SETTER()
+{
+    return emitInitPropGetterSetter();
+}
+
 typedef bool (*InitElemGetterSetterFn)(JSContext*, jsbytecode*, HandleObject, HandleValue,
                                        HandleObject);
 static const VMFunction InitElemGetterSetterInfo =
@@ -2612,7 +2632,9 @@ bool
 BaselineCompiler::emitInitElemGetterSetter()
 {
     MOZ_ASSERT(JSOp(*pc) == JSOP_INITELEM_GETTER ||
-               JSOp(*pc) == JSOP_INITELEM_SETTER);
+               JSOp(*pc) == JSOP_INITHIDDENELEM_GETTER ||
+               JSOp(*pc) == JSOP_INITELEM_SETTER ||
+               JSOp(*pc) == JSOP_INITHIDDENELEM_SETTER);
 
     // Load index and value in R0 and R1, but keep values on the stack for the
     // decompiler.
@@ -2641,12 +2663,24 @@ BaselineCompiler::emit_JSOP_INITELEM_GETTER()
     return emitInitElemGetterSetter();
 }
 
+bool
+BaselineCompiler::emit_JSOP_INITHIDDENELEM_GETTER()
+{
+    return emitInitElemGetterSetter();
+}
+
 bool
 BaselineCompiler::emit_JSOP_INITELEM_SETTER()
 {
     return emitInitElemGetterSetter();
 }
 
+bool
+BaselineCompiler::emit_JSOP_INITHIDDENELEM_SETTER()
+{
+    return emitInitElemGetterSetter();
+}
+
 bool
 BaselineCompiler::emit_JSOP_INITELEM_INC()
 {
diff --git a/js/src/jit/BaselineCompiler.h b/js/src/jit/BaselineCompiler.h
index c1ce9a717bbf..ff0dd3e32fd0 100644
--- a/js/src/jit/BaselineCompiler.h
+++ b/js/src/jit/BaselineCompiler.h
@@ -208,7 +208,12 @@ namespace jit {
     _(JSOP_SUPERCALL)          \
     _(JSOP_SPREADSUPERCALL)    \
     _(JSOP_THROWSETCONST)      \
-    _(JSOP_THROWSETALIASEDCONST)
+    _(JSOP_THROWSETALIASEDCONST) \
+    _(JSOP_INITHIDDENPROP_GETTER) \
+    _(JSOP_INITHIDDENPROP_SETTER) \
+    _(JSOP_INITHIDDENELEM)     \
+    _(JSOP_INITHIDDENELEM_GETTER) \
+    _(JSOP_INITHIDDENELEM_SETTER)
 
 class BaselineCompiler : public BaselineCompilerSpecific
 {
diff --git a/js/src/jit/BaselineIC.cpp b/js/src/jit/BaselineIC.cpp
index 370fd9dc5062..247faac70f27 100644
--- a/js/src/jit/BaselineIC.cpp
+++ b/js/src/jit/BaselineIC.cpp
@@ -3477,6 +3477,7 @@ DoSetElemFallback(JSContext* cx, BaselineFrame* frame, ICSetElem_Fallback* stub_
     MOZ_ASSERT(op == JSOP_SETELEM ||
                op == JSOP_STRICTSETELEM ||
                op == JSOP_INITELEM ||
+               op == JSOP_INITHIDDENELEM ||
                op == JSOP_INITELEM_ARRAY ||
                op == JSOP_INITELEM_INC);
 
@@ -3494,8 +3495,8 @@ DoSetElemFallback(JSContext* cx, BaselineFrame* frame, ICSetElem_Fallback* stub_
         oldInitLength = GetAnyBoxedOrUnboxedInitializedLength(obj);
     }
 
-    if (op == JSOP_INITELEM) {
-        if (!InitElemOperation(cx, obj, index, rhs))
+    if (op == JSOP_INITELEM || op == JSOP_INITHIDDENELEM) {
+        if (!InitElemOperation(cx, pc, obj, index, rhs))
             return false;
     } else if (op == JSOP_INITELEM_ARRAY) {
         MOZ_ASSERT(uint32_t(index.toInt32()) <= INT32_MAX,
diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index a432430e70e5..73a40ee4e8f8 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -4848,7 +4848,7 @@ CodeGenerator::visitNewStringObject(LNewStringObject* lir)
     masm.bind(ool->rejoin());
 }
 
-typedef bool(*InitElemFn)(JSContext* cx, HandleObject obj,
+typedef bool(*InitElemFn)(JSContext* cx, jsbytecode* pc, HandleObject obj,
                           HandleValue id, HandleValue value);
 static const VMFunction InitElemInfo =
     FunctionInfo<InitElemFn>(InitElemOperation);
@@ -4861,6 +4861,7 @@ CodeGenerator::visitInitElem(LInitElem* lir)
     pushArg(ToValue(lir, LInitElem::ValueIndex));
     pushArg(ToValue(lir, LInitElem::IdIndex));
     pushArg(objReg);
+    pushArg(ImmPtr(lir->mir()->resumePoint()->pc()));
 
     callVM(InitElemInfo, lir);
 }
diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index 9df05a6e1813..9f4e3400c379 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -161,6 +161,7 @@ IonBuilder::IonBuilder(JSContext* analysisContext, CompileCompartment* comp,
     maybeFallbackFunctionGetter_(nullptr)
 {
     script_ = info->script();
+    scriptHasIonScript_ = script_->hasIonScript();
     pc = info->startPC();
     abortReason_ = AbortReason_Disable;
 
@@ -1838,6 +1839,7 @@ IonBuilder::inspectOpcode(JSOp op)
         return jsop_newobject();
 
       case JSOP_INITELEM:
+      case JSOP_INITHIDDENELEM:
         return jsop_initelem();
 
       case JSOP_INITELEM_ARRAY:
@@ -1857,13 +1859,17 @@ IonBuilder::inspectOpcode(JSOp op)
       }
 
       case JSOP_INITPROP_GETTER:
-      case JSOP_INITPROP_SETTER: {
+      case JSOP_INITHIDDENPROP_GETTER:
+      case JSOP_INITPROP_SETTER:
+      case JSOP_INITHIDDENPROP_SETTER: {
         PropertyName* name = info().getAtom(pc)->asPropertyName();
         return jsop_initprop_getter_setter(name);
       }
 
       case JSOP_INITELEM_GETTER:
+      case JSOP_INITHIDDENELEM_GETTER:
       case JSOP_INITELEM_SETTER:
+      case JSOP_INITHIDDENELEM_SETTER:
         return jsop_initelem_getter_setter();
 
       case JSOP_FUNCALL:
diff --git a/js/src/jit/IonBuilder.h b/js/src/jit/IonBuilder.h
index af306b00544e..e562c35b328c 100644
--- a/js/src/jit/IonBuilder.h
+++ b/js/src/jit/IonBuilder.h
@@ -1016,6 +1016,10 @@ class IonBuilder
     // A builder is inextricably tied to a particular script.
     JSScript* script_;
 
+    // script->hasIonScript() at the start of the compilation. Used to avoid
+    // calling hasIonScript() from background compilation threads.
+    bool scriptHasIonScript_;
+
     // If off thread compilation is successful, the final code generator is
     // attached here. Code has been generated, but not linked (there is not yet
     // an IonScript). This is heap allocated, and must be explicitly destroyed,
@@ -1035,6 +1039,7 @@ class IonBuilder
     JSObject* checkNurseryObject(JSObject* obj);
 
     JSScript* script() const { return script_; }
+    bool scriptHasIonScript() const { return scriptHasIonScript_; }
 
     CodeGenerator* backgroundCodegen() const { return backgroundCodegen_; }
     void setBackgroundCodegen(CodeGenerator* codegen) { backgroundCodegen_ = codegen; }
diff --git a/js/src/json.cpp b/js/src/json.cpp
index 38c797b15976..5f55f8a6c8e9 100644
--- a/js/src/json.cpp
+++ b/js/src/json.cpp
@@ -136,7 +136,7 @@ class StringifyContext
       : sb(sb),
         gap(gap),
         replacer(cx, replacer),
-        stack(cx, TraceableHashSet<JSObject*>(cx)),
+        stack(cx, TraceableHashSet<JSObject*, MovableCellHasher<JSObject*>>(cx)),
         propertyList(propertyList),
         depth(0)
     {}
@@ -148,7 +148,7 @@ class StringifyContext
     StringBuffer& sb;
     const StringBuffer& gap;
     RootedObject replacer;
-    Rooted<TraceableHashSet<JSObject*>> stack;
+    Rooted<TraceableHashSet<JSObject*, MovableCellHasher<JSObject*>>> stack;
     const AutoIdVector& propertyList;
     uint32_t depth;
 };
@@ -324,7 +324,7 @@ class CycleDetector
     }
 
   private:
-    MutableHandle<TraceableHashSet<JSObject*>> stack;
+    MutableHandle<TraceableHashSet<JSObject*, MovableCellHasher<JSObject*>>> stack;
     HandleObject obj_;
 };
 
diff --git a/js/src/jsopcode.h b/js/src/jsopcode.h
index 105013dc385e..225152f21dcd 100644
--- a/js/src/jsopcode.h
+++ b/js/src/jsopcode.h
@@ -703,6 +703,14 @@ IsGetPropPC(jsbytecode* pc)
     return op == JSOP_LENGTH  || op == JSOP_GETPROP || op == JSOP_CALLPROP;
 }
 
+inline bool
+IsHiddenInitOp(JSOp op)
+{
+    return op == JSOP_INITHIDDENPROP || op == JSOP_INITHIDDENELEM ||
+           op == JSOP_INITHIDDENPROP_GETTER || op == JSOP_INITHIDDENELEM_GETTER ||
+           op == JSOP_INITHIDDENPROP_SETTER || op == JSOP_INITHIDDENELEM_SETTER;
+}
+
 inline bool
 IsStrictSetPC(jsbytecode* pc)
 {
diff --git a/js/src/jswatchpoint.cpp b/js/src/jswatchpoint.cpp
index 28ca0f0d3a61..2321fadf84eb 100644
--- a/js/src/jswatchpoint.cpp
+++ b/js/src/jswatchpoint.cpp
@@ -18,9 +18,9 @@ using namespace js;
 using namespace js::gc;
 
 inline HashNumber
-DefaultHasher<WatchKey>::hash(const Lookup& key)
+WatchKeyHasher::hash(const Lookup& key)
 {
-    return DefaultHasher<JSObject*>::hash(key.object.get()) ^ HashId(key.id.get());
+    return MovableCellHasher<PreBarrieredObject>::hash(key.object) ^ HashId(key.id);
 }
 
 namespace {
diff --git a/js/src/jswatchpoint.h b/js/src/jswatchpoint.h
index c344ec8e3abd..bb4b94ebe46f 100644
--- a/js/src/jswatchpoint.h
+++ b/js/src/jswatchpoint.h
@@ -20,6 +20,9 @@ struct WatchKey {
     WatchKey() {}
     WatchKey(JSObject* obj, jsid id) : object(obj), id(id) {}
     WatchKey(const WatchKey& key) : object(key.object.get()), id(key.id.get()) {}
+
+    // These are traced unconditionally during minor GC, so do not require
+    // post-barriers.
     PreBarrieredObject object;
     PreBarrieredId id;
 
@@ -40,14 +43,14 @@ struct Watchpoint {
       : handler(handler), closure(closure), held(held) {}
 };
 
-template <>
-struct DefaultHasher<WatchKey>
+struct WatchKeyHasher
 {
     typedef WatchKey Lookup;
     static inline js::HashNumber hash(const Lookup& key);
 
     static bool match(const WatchKey& k, const Lookup& l) {
-        return k.object == l.object && k.id.get() == l.id.get();
+        return MovableCellHasher<PreBarrieredObject>::match(k.object, l.object) &&
+               DefaultHasher<PreBarrieredId>::match(k.id, l.id);
     }
 
     static void rekey(WatchKey& k, const WatchKey& newKey) {
@@ -58,7 +61,7 @@ struct DefaultHasher<WatchKey>
 
 class WatchpointMap {
   public:
-    typedef HashMap<WatchKey, Watchpoint, DefaultHasher<WatchKey>, SystemAllocPolicy> Map;
+    typedef HashMap<WatchKey, Watchpoint, WatchKeyHasher, SystemAllocPolicy> Map;
 
     bool init();
     bool watch(JSContext* cx, HandleObject obj, HandleId id,
diff --git a/js/src/jsweakmap.cpp b/js/src/jsweakmap.cpp
index 20859a628bec..004c04806bb6 100644
--- a/js/src/jsweakmap.cpp
+++ b/js/src/jsweakmap.cpp
@@ -188,8 +188,6 @@ ObjectWeakMap::add(JSContext* cx, JSObject* obj, JSObject* target)
         ReportOutOfMemory(cx);
         return false;
     }
-    if (IsInsideNursery(obj))
-        cx->runtime()->gc.storeBuffer.putGeneric(StoreBufferRef(&map, obj));
 
     return true;
 }
diff --git a/js/src/jsweakmap.h b/js/src/jsweakmap.h
index 5d256e631336..a82d6ea42f09 100644
--- a/js/src/jsweakmap.h
+++ b/js/src/jsweakmap.h
@@ -392,11 +392,14 @@ extern JSObject*
 InitWeakMapClass(JSContext* cx, HandleObject obj);
 
 
-class ObjectValueMap : public WeakMap<PreBarrieredObject, RelocatableValue>
+class ObjectValueMap : public WeakMap<RelocatablePtrObject, RelocatableValue,
+                                      MovableCellHasher<RelocatablePtrObject>>
 {
   public:
     ObjectValueMap(JSContext* cx, JSObject* obj)
-      : WeakMap<PreBarrieredObject, RelocatableValue>(cx, obj) {}
+      : WeakMap<RelocatablePtrObject, RelocatableValue,
+                MovableCellHasher<RelocatablePtrObject>>(cx, obj)
+    {}
 
     virtual bool findZoneEdges();
 };
@@ -405,9 +408,7 @@ class ObjectValueMap : public WeakMap<PreBarrieredObject, RelocatableValue>
 // Generic weak map for mapping objects to other objects.
 class ObjectWeakMap
 {
-  private:
     ObjectValueMap map;
-    typedef gc::HashKeyRef<ObjectValueMap, JSObject*> StoreBufferRef;
 
   public:
     explicit ObjectWeakMap(JSContext* cx);
diff --git a/js/src/tests/ecma_6/Class/methodInstallation.js b/js/src/tests/ecma_6/Class/methodInstallation.js
index dad5803df4eb..cceb0bfbc787 100644
--- a/js/src/tests/ecma_6/Class/methodInstallation.js
+++ b/js/src/tests/ecma_6/Class/methodInstallation.js
@@ -52,20 +52,20 @@ for (let a of [testClass,
     var aMethDesc = Object.getOwnPropertyDescriptor(a.prototype, \"__proto__\");
     assertEq(aMethDesc.writable, true);
     assertEq(aMethDesc.configurable, true);
-    assertEq(aMethDesc.enumerable, true);
+    assertEq(aMethDesc.enumerable, false);
     aMethDesc.value();
     assertEq(methodCalled, true);
 
     var aGetDesc = Object.getOwnPropertyDescriptor(a.prototype, \"getter\");
     assertEq(aGetDesc.configurable, true);
-    assertEq(aGetDesc.enumerable, true);
+    assertEq(aGetDesc.enumerable, false);
     aGetDesc.get();
     assertThrowsInstanceOf(() => new aGetDesc.get, TypeError);
     assertEq(getterCalled, true);
 
     var aSetDesc = Object.getOwnPropertyDescriptor(a.prototype, \"setter\");
     assertEq(aSetDesc.configurable, true);
-    assertEq(aSetDesc.enumerable, true);
+    assertEq(aSetDesc.enumerable, false);
     aSetDesc.set();
     assertThrowsInstanceOf(() => new aSetDesc.set, TypeError);
     assertEq(setterCalled, true);
@@ -74,7 +74,7 @@ for (let a of [testClass,
     assertEq(Object.getOwnPropertyDescriptor(new a(), \"staticMethod\"), undefined);
     var aStaticMethDesc = Object.getOwnPropertyDescriptor(a, \"staticMethod\");
     assertEq(aStaticMethDesc.configurable, true);
-    assertEq(aStaticMethDesc.enumerable, true);
+    assertEq(aStaticMethDesc.enumerable, false);
     assertEq(aStaticMethDesc.writable, true);
     aStaticMethDesc.value();
     assertThrowsInstanceOf(() => new aStaticMethDesc.value, TypeError);
@@ -83,7 +83,7 @@ for (let a of [testClass,
     assertEq(Object.getOwnPropertyDescriptor(new a(), \"staticGetter\"), undefined);
     var aStaticGetDesc = Object.getOwnPropertyDescriptor(a, \"staticGetter\");
     assertEq(aStaticGetDesc.configurable, true);
-    assertEq(aStaticGetDesc.enumerable, true);
+    assertEq(aStaticGetDesc.enumerable, false);
     aStaticGetDesc.get();
     assertThrowsInstanceOf(() => new aStaticGetDesc.get, TypeError);
     assertEq(staticGetterCalled, true);
@@ -91,7 +91,7 @@ for (let a of [testClass,
     assertEq(Object.getOwnPropertyDescriptor(new a(), \"staticSetter\"), undefined);
     var aStaticSetDesc = Object.getOwnPropertyDescriptor(a, \"staticSetter\");
     assertEq(aStaticSetDesc.configurable, true);
-    assertEq(aStaticSetDesc.enumerable, true);
+    assertEq(aStaticSetDesc.enumerable, false);
     aStaticSetDesc.set();
     assertThrowsInstanceOf(() => new aStaticSetDesc.set, TypeError);
     assertEq(staticSetterCalled, true);
diff --git a/js/src/vm/ArrayBufferObject.cpp b/js/src/vm/ArrayBufferObject.cpp
index badc83fa599d..d68ddae867a9 100644
--- a/js/src/vm/ArrayBufferObject.cpp
+++ b/js/src/vm/ArrayBufferObject.cpp
@@ -1082,6 +1082,8 @@ InnerViewTable::addView(JSContext* cx, ArrayBufferObject* buffer, ArrayBufferVie
             ReportOutOfMemory(cx);
             return false;
         }
+        // ViewVector has one inline element, so the first insertion is
+        // guaranteed to succeed.
         MOZ_ALWAYS_TRUE(p->value().append(view));
     }
 
@@ -1138,11 +1140,8 @@ InnerViewTable::sweep(JSRuntime* rt)
         return;
 
     for (Map::Enum e(map); !e.empty(); e.popFront()) {
-        JSObject* key = e.front().key();
-        if (sweepEntry(&key, e.front().value()))
+        if (sweepEntry(&e.front().mutableKey(), e.front().value()))
             e.removeFront();
-        else if (key != e.front().key())
-            e.rekeyFront(key);
     }
 }
 
@@ -1153,15 +1152,13 @@ InnerViewTable::sweepAfterMinorGC(JSRuntime* rt)
 
     if (nurseryKeysValid) {
         for (size_t i = 0; i < nurseryKeys.length(); i++) {
-            JSObject* key = nurseryKeys[i];
-            Map::Ptr p = map.lookup(key);
+            JSObject* buffer = MaybeForwarded(nurseryKeys[i]);
+            Map::Ptr p = map.lookup(buffer);
             if (!p)
                 continue;
 
-            if (sweepEntry(&key, p->value()))
-                map.remove(nurseryKeys[i]);
-            else
-                map.rekeyIfMoved(nurseryKeys[i], key);
+            if (sweepEntry(&p->mutableKey(), p->value()))
+                map.remove(buffer);
         }
         nurseryKeys.clear();
     } else {
diff --git a/js/src/vm/ArrayBufferObject.h b/js/src/vm/ArrayBufferObject.h
index 6ab676af387a..998ed35bda3a 100644
--- a/js/src/vm/ArrayBufferObject.h
+++ b/js/src/vm/ArrayBufferObject.h
@@ -501,9 +501,17 @@ class InnerViewTable
     friend class ArrayBufferObject;
 
   private:
+    // This key is a raw pointer and not a ReadBarriered because the post-
+    // barrier would hold nursery-allocated entries live unconditionally. It is
+    // a very common pattern in low-level and performance-oriented JavaScript
+    // to create hundreds or thousands of very short lived temporary views on a
+    // larger buffer; having to tenured all of these would be a catastrophic
+    // performance regression. Thus, it is vital that nursery pointers in this
+    // map not be held live. Special support is required in the minor GC,
+    // implemented in sweepAfterMinorGC.
     typedef HashMap<JSObject*,
                     ViewVector,
-                    DefaultHasher<JSObject*>,
+                    MovableCellHasher<JSObject*>,
                     SystemAllocPolicy> Map;
 
     // For all objects sharing their storage with some other view, this maps
@@ -511,7 +519,10 @@ class InnerViewTable
     Map map;
 
     // List of keys from innerViews where either the source or at least one
-    // target is in the nursery.
+    // target is in the nursery. The raw pointer to a JSObject is allowed here
+    // because this vector is cleared after every minor collection. Users in
+    // sweepAfterMinorCollection must be careful to use MaybeForwarded before
+    // touching these pointers.
     Vector<JSObject*, 0, SystemAllocPolicy> nurseryKeys;
 
     // Whether nurseryKeys is a complete list.
diff --git a/js/src/vm/Debugger.cpp b/js/src/vm/Debugger.cpp
index 4ee8700ec93a..dc9db7f74a45 100644
--- a/js/src/vm/Debugger.cpp
+++ b/js/src/vm/Debugger.cpp
@@ -1462,7 +1462,8 @@ Debugger::onTrap(JSContext* cx, MutableHandleValue vp)
          * global the script is running against.
          */
         Debugger* dbg = bp->debugger;
-        if (dbg->enabled && dbg->debuggees.lookup(scriptGlobal)) {
+        bool hasDebuggee = dbg->enabled && dbg->debuggees.has(scriptGlobal);
+        if (hasDebuggee) {
             Maybe<AutoCompartment> ac;
             ac.emplace(cx, dbg->object);
 
@@ -2536,13 +2537,8 @@ Debugger::markAll(JSTracer* trc)
 {
     JSRuntime* rt = trc->runtime();
     for (Debugger* dbg : rt->debuggerList) {
-        WeakGlobalObjectSet& debuggees = dbg->debuggees;
-        for (WeakGlobalObjectSet::Enum e(debuggees); !e.empty(); e.popFront()) {
-            GlobalObject* global = e.front().unbarrieredGet();
-            TraceManuallyBarrieredEdge(trc, &global, "Global Object");
-            if (global != e.front().unbarrieredGet())
-                e.rekeyFront(global, ReadBarrieredGlobalObject(global));
-        }
+        for (WeakGlobalObjectSet::Enum e(dbg->debuggees); !e.empty(); e.popFront())
+            TraceManuallyBarrieredEdge(trc, e.mutableFront().unsafeGet(), "Global Object");
 
         HeapPtrNativeObject& dbgobj = dbg->toJSObjectRef();
         TraceEdge(trc, &dbgobj, "Debugger Object");
diff --git a/js/src/vm/Debugger.h b/js/src/vm/Debugger.h
index 20484b3b9424..1a78eeab9537 100644
--- a/js/src/vm/Debugger.h
+++ b/js/src/vm/Debugger.h
@@ -42,7 +42,7 @@ class Breakpoint;
 class DebuggerMemory;
 
 typedef HashSet<ReadBarrieredGlobalObject,
-                DefaultHasher<ReadBarrieredGlobalObject>,
+                MovableCellHasher<ReadBarrieredGlobalObject>,
                 SystemAllocPolicy> WeakGlobalObjectSet;
 
 /*
@@ -70,10 +70,11 @@ typedef HashSet<ReadBarrieredGlobalObject,
  * transitions.
  */
 template <class UnbarrieredKey, bool InvisibleKeysOk=false>
-class DebuggerWeakMap : private WeakMap<PreBarriered<UnbarrieredKey>, RelocatablePtrObject>
+class DebuggerWeakMap : private WeakMap<RelocatablePtr<UnbarrieredKey>, RelocatablePtrObject,
+                                        MovableCellHasher<RelocatablePtr<UnbarrieredKey>>>
 {
   private:
-    typedef PreBarriered<UnbarrieredKey> Key;
+    typedef RelocatablePtr<UnbarrieredKey> Key;
     typedef RelocatablePtrObject Value;
 
     typedef HashMap<JS::Zone*,
@@ -85,7 +86,7 @@ class DebuggerWeakMap : private WeakMap<PreBarriered<UnbarrieredKey>, Relocatabl
     JSCompartment* compartment;
 
   public:
-    typedef WeakMap<Key, Value, DefaultHasher<Key> > Base;
+    typedef WeakMap<Key, Value, MovableCellHasher<Key>> Base;
 
     explicit DebuggerWeakMap(JSContext* cx)
         : Base(cx),
@@ -156,13 +157,9 @@ class DebuggerWeakMap : private WeakMap<PreBarriered<UnbarrieredKey>, Relocatabl
     /* Override sweep method to also update our edge cache. */
     void sweep() {
         for (Enum e(*static_cast<Base*>(this)); !e.empty(); e.popFront()) {
-            Key k(e.front().key());
-            if (gc::IsAboutToBeFinalized(&k)) {
+            if (gc::IsAboutToBeFinalized(&e.front().mutableKey())) {
+                decZoneCount(e.front().key()->zone());
                 e.removeFront();
-                decZoneCount(k->zone());
-            } else {
-                // markKeys() should have done any necessary relocation.
-                MOZ_ASSERT(k == e.front().key());
             }
         }
         Base::assertEntriesNotAboutToBeFinalized();
diff --git a/js/src/vm/HelperThreads.cpp b/js/src/vm/HelperThreads.cpp
index a48fa3cca61d..ddac7c3eb805 100644
--- a/js/src/vm/HelperThreads.cpp
+++ b/js/src/vm/HelperThreads.cpp
@@ -762,8 +762,8 @@ IonBuilderHasHigherPriority(jit::IonBuilder* first, jit::IonBuilder* second)
         return first->optimizationInfo().level() < second->optimizationInfo().level();
 
     // A script without an IonScript has precedence on one with.
-    if (first->script()->hasIonScript() != second->script()->hasIonScript())
-        return !first->script()->hasIonScript();
+    if (first->scriptHasIonScript() != second->scriptHasIonScript())
+        return !first->scriptHasIonScript();
 
     // A higher warm-up counter indicates a higher priority.
     return first->script()->getWarmUpCount() / first->script()->length() >
diff --git a/js/src/vm/Interpreter-inl.h b/js/src/vm/Interpreter-inl.h
index 878510f205fb..62b30ee92c27 100644
--- a/js/src/vm/Interpreter-inl.h
+++ b/js/src/vm/Interpreter-inl.h
@@ -616,7 +616,7 @@ TypeOfObjectOperation(JSObject* obj, JSRuntime* rt)
 }
 
 static MOZ_ALWAYS_INLINE bool
-InitElemOperation(JSContext* cx, HandleObject obj, HandleValue idval, HandleValue val)
+InitElemOperation(JSContext* cx, jsbytecode* pc, HandleObject obj, HandleValue idval, HandleValue val)
 {
     MOZ_ASSERT(!val.isMagic(JS_ELEMENTS_HOLE));
     MOZ_ASSERT(!obj->getClass()->getProperty);
@@ -626,7 +626,8 @@ InitElemOperation(JSContext* cx, HandleObject obj, HandleValue idval, HandleValu
     if (!ToPropertyKey(cx, idval, &id))
         return false;
 
-    return DefineProperty(cx, obj, id, val, nullptr, nullptr, JSPROP_ENUMERATE);
+    unsigned flags = JSOp(*pc) == JSOP_INITHIDDENELEM ? 0 : JSPROP_ENUMERATE;
+    return DefineProperty(cx, obj, id, val, nullptr, nullptr, flags);
 }
 
 static MOZ_ALWAYS_INLINE bool
diff --git a/js/src/vm/Interpreter.cpp b/js/src/vm/Interpreter.cpp
index 48af1c59efdb..257b0121ae6c 100644
--- a/js/src/vm/Interpreter.cpp
+++ b/js/src/vm/Interpreter.cpp
@@ -1693,11 +1693,6 @@ CASE(JSOP_NOP)
 CASE(JSOP_UNUSED14)
 CASE(JSOP_BACKPATCH)
 CASE(JSOP_UNUSED145)
-CASE(JSOP_UNUSED171)
-CASE(JSOP_UNUSED172)
-CASE(JSOP_UNUSED173)
-CASE(JSOP_UNUSED174)
-CASE(JSOP_UNUSED175)
 CASE(JSOP_UNUSED176)
 CASE(JSOP_UNUSED177)
 CASE(JSOP_UNUSED178)
@@ -3205,7 +3200,9 @@ CASE(JSOP_CALLEE)
 END_CASE(JSOP_CALLEE)
 
 CASE(JSOP_INITPROP_GETTER)
+CASE(JSOP_INITHIDDENPROP_GETTER)
 CASE(JSOP_INITPROP_SETTER)
+CASE(JSOP_INITHIDDENPROP_SETTER)
 {
     MOZ_ASSERT(REGS.stackDepth() >= 2);
 
@@ -3221,7 +3218,9 @@ CASE(JSOP_INITPROP_SETTER)
 END_CASE(JSOP_INITPROP_GETTER)
 
 CASE(JSOP_INITELEM_GETTER)
+CASE(JSOP_INITHIDDENELEM_GETTER)
 CASE(JSOP_INITELEM_SETTER)
+CASE(JSOP_INITHIDDENELEM_SETTER)
 {
     MOZ_ASSERT(REGS.stackDepth() >= 3);
 
@@ -3336,6 +3335,7 @@ CASE(JSOP_INITHIDDENPROP)
 END_CASE(JSOP_INITPROP)
 
 CASE(JSOP_INITELEM)
+CASE(JSOP_INITHIDDENELEM)
 {
     MOZ_ASSERT(REGS.stackDepth() >= 3);
     HandleValue val = REGS.stackHandleAt(-1);
@@ -3343,7 +3343,7 @@ CASE(JSOP_INITELEM)
 
     ReservedRooted<JSObject*> obj(&rootObject0, &REGS.sp[-3].toObject());
 
-    if (!InitElemOperation(cx, obj, id, val))
+    if (!InitElemOperation(cx, REGS.pc, obj, id, val))
         goto error;
 
     REGS.sp -= 2;
@@ -4326,16 +4326,22 @@ js::InitGetterSetterOperation(JSContext* cx, jsbytecode* pc, HandleObject obj, H
     MOZ_ASSERT(val->isCallable());
     GetterOp getter;
     SetterOp setter;
-    unsigned attrs = JSPROP_ENUMERATE | JSPROP_SHARED;
+    unsigned attrs = JSPROP_SHARED;
 
     JSOp op = JSOp(*pc);
 
-    if (op == JSOP_INITPROP_GETTER || op == JSOP_INITELEM_GETTER) {
+    if (!IsHiddenInitOp(op))
+        attrs |= JSPROP_ENUMERATE;
+
+    if (op == JSOP_INITPROP_GETTER || op == JSOP_INITELEM_GETTER ||
+        op == JSOP_INITHIDDENPROP_GETTER || op == JSOP_INITHIDDENELEM_GETTER)
+    {
         getter = CastAsGetterOp(val);
         setter = nullptr;
         attrs |= JSPROP_GETTER;
     } else {
-        MOZ_ASSERT(op == JSOP_INITPROP_SETTER || op == JSOP_INITELEM_SETTER);
+        MOZ_ASSERT(op == JSOP_INITPROP_SETTER || op == JSOP_INITELEM_SETTER ||
+                   op == JSOP_INITHIDDENPROP_SETTER || op == JSOP_INITHIDDENELEM_SETTER);
         getter = nullptr;
         setter = CastAsSetterOp(val);
         attrs |= JSPROP_SETTER;
diff --git a/js/src/vm/Opcodes.h b/js/src/vm/Opcodes.h
index 703eb998b565..9a245d47dd96 100644
--- a/js/src/vm/Opcodes.h
+++ b/js/src/vm/Opcodes.h
@@ -1744,11 +1744,63 @@
      *   Stack: =>
      */ \
     macro(JSOP_THROWSETALIASEDCONST, 170, "throwsetaliasedconst", NULL, 5,  1,  1, JOF_SCOPECOORD|JOF_NAME|JOF_SET|JOF_DETECTING) \
-    macro(JSOP_UNUSED171,     171,"unused171",  NULL,     1,  0,  0,  JOF_BYTE) \
-    macro(JSOP_UNUSED172,     172,"unused172",  NULL,     1,  0,  0,  JOF_BYTE) \
-    macro(JSOP_UNUSED173,     173,"unused173",  NULL,     1,  0,  0,  JOF_BYTE) \
-    macro(JSOP_UNUSED174,     174,"unused174",  NULL,     1,  0,  0,  JOF_BYTE) \
-    macro(JSOP_UNUSED175,     175,"unused175",  NULL,     1,  0,  0,  JOF_BYTE) \
+    /*
+     * Initialize a non-enumerable getter in an object literal.
+     *
+     * Pops the top two values on the stack as 'val' and 'obj', defines
+     * getter of 'obj' as 'val', pushes 'obj' onto the stack.
+     *   Category: Literals
+     *   Type: Object
+     *   Operands: uint32_t nameIndex
+     *   Stack: obj, val => obj
+     */ \
+    macro(JSOP_INITHIDDENPROP_GETTER,  171, "inithiddenprop_getter",   NULL, 5,  2,  1, JOF_ATOM|JOF_PROP|JOF_SET|JOF_DETECTING) \
+    /*
+     * Initialize a non-enumerable setter in an object literal.
+     *
+     * Pops the top two values on the stack as 'val' and 'obj', defines
+     * setter of 'obj' as 'val', pushes 'obj' onto the stack.
+     *   Category: Literals
+     *   Type: Object
+     *   Operands: uint32_t nameIndex
+     *   Stack: obj, val => obj
+     */ \
+    macro(JSOP_INITHIDDENPROP_SETTER,  172, "inithiddenprop_setter",   NULL, 5,  2,  1, JOF_ATOM|JOF_PROP|JOF_SET|JOF_DETECTING) \
+    /*
+     * Initialize a non-enumerable numeric getter in an object literal like
+     * '{get 2() {}}'.
+     *
+     * Pops the top three values on the stack as 'val', 'id' and 'obj', defines
+     * 'id' getter of 'obj' as 'val', pushes 'obj' onto the stack.
+     *   Category: Literals
+     *   Type: Object
+     *   Operands:
+     *   Stack: obj, id, val => obj
+     */ \
+    macro(JSOP_INITHIDDENELEM_GETTER,  173, "inithiddenelem_getter",   NULL, 1,  3,  1, JOF_BYTE|JOF_ELEM|JOF_SET|JOF_DETECTING) \
+    /*
+     * Initialize a non-enumerable numeric setter in an object literal like
+     * '{set 2(v) {}}'.
+     *
+     * Pops the top three values on the stack as 'val', 'id' and 'obj', defines
+     * 'id' setter of 'obj' as 'val', pushes 'obj' onto the stack.
+     *   Category: Literals
+     *   Type: Object
+     *   Operands:
+     *   Stack: obj, id, val => obj
+     */ \
+    macro(JSOP_INITHIDDENELEM_SETTER, 174, "inithiddenelem_setter",   NULL, 1,  3,  1, JOF_BYTE|JOF_ELEM|JOF_SET|JOF_DETECTING) \
+    /*
+     * Initialize a non-enumerable numeric property in an object literal, like '{1: x}'.
+     *
+     * Pops the top three values on the stack as 'val', 'id' and 'obj', defines
+     * 'id' property of 'obj' as 'val', pushes 'obj' onto the stack.
+     *   Category: Literals
+     *   Type: Object
+     *   Operands:
+     *   Stack: obj, id, val => obj
+     */ \
+    macro(JSOP_INITHIDDENELEM,  175, "inithiddenelem",   NULL,         1,  3,  1, JOF_BYTE|JOF_ELEM|JOF_SET|JOF_DETECTING) \
     macro(JSOP_UNUSED176,     176,"unused176",  NULL,     1,  0,  0,  JOF_BYTE) \
     macro(JSOP_UNUSED177,     177,"unused177",  NULL,     1,  0,  0,  JOF_BYTE) \
     macro(JSOP_UNUSED178,     178,"unused178",  NULL,     1,  0,  0,  JOF_BYTE) \
diff --git a/js/src/vm/SavedFrame.h b/js/src/vm/SavedFrame.h
index d1979e6a484b..74c2726b3c28 100644
--- a/js/src/vm/SavedFrame.h
+++ b/js/src/vm/SavedFrame.h
@@ -185,7 +185,7 @@ class SavedFrame : public NativeObject {
 struct SavedFrame::HashPolicy
 {
     typedef SavedFrame::Lookup              Lookup;
-    typedef PointerHasher<SavedFrame*, 3>   SavedFramePtrHasher;
+    typedef MovableCellHasher<SavedFrame*>  SavedFramePtrHasher;
     typedef PointerHasher<JSPrincipals*, 3> JSPrincipalsPtrHasher;
 
     static HashNumber hash(const Lookup& lookup);
diff --git a/js/src/vm/SavedStacks.cpp b/js/src/vm/SavedStacks.cpp
index 02d76ae808d3..5a053efd3d22 100644
--- a/js/src/vm/SavedStacks.cpp
+++ b/js/src/vm/SavedStacks.cpp
@@ -1037,26 +1037,8 @@ SavedStacks::sweep(JSRuntime* rt)
 {
     if (frames.initialized()) {
         for (SavedFrame::Set::Enum e(frames); !e.empty(); e.popFront()) {
-            JSObject* obj = e.front().unbarrieredGet();
-            JSObject* temp = obj;
-
-            if (IsAboutToBeFinalizedUnbarriered(&obj)) {
+            if (IsAboutToBeFinalized(&e.mutableFront()))
                 e.removeFront();
-            } else {
-                SavedFrame* frame = &obj->as<SavedFrame>();
-
-                SavedFrame* parent = frame->getParent();
-                bool parentMoved = parent && IsForwarded(parent);
-                if (parentMoved)
-                    parent = Forwarded(parent);
-
-                if (obj != temp || parentMoved) {
-                    MOZ_ASSERT(!IsForwarded(frame));
-                    SavedFrame::Lookup newLocation(*frame);
-                    newLocation.parent = parent;
-                    e.rekeyFront(newLocation, ReadBarriered<SavedFrame*>(frame));
-                }
-            }
         }
     }
 
diff --git a/js/src/vm/Stopwatch.cpp b/js/src/vm/Stopwatch.cpp
index b3c80b7f3e76..3644f36bb932 100644
--- a/js/src/vm/Stopwatch.cpp
+++ b/js/src/vm/Stopwatch.cpp
@@ -4,6 +4,15 @@
 #include "mozilla/IntegerTypeTraits.h"
 #include "mozilla/unused.h"
 
+#if defined(XP_WIN)
+#include <processthreadsapi.h>
+#include <windows.h>
+#endif // defined(XP_WIN)
+
+#include "jscompartment.h"
+
+#include "gc/Zone.h"
+
 namespace js {
 
 bool
diff --git a/js/src/vm/Stopwatch.h b/js/src/vm/Stopwatch.h
index 89bf17d6936d..9c5729334a75 100644
--- a/js/src/vm/Stopwatch.h
+++ b/js/src/vm/Stopwatch.h
@@ -7,6 +7,11 @@
 #ifndef vm_Stopwatch_h
 #define vm_Stopwatch_h
 
+#include "mozilla/RefPtr.h"
+#include "mozilla/Vector.h"
+
+#include "jsapi.h"
+
 /*
   An API for following in real-time the amount of CPU spent executing
   webpages, add-ons, etc.
diff --git a/js/src/vm/StructuredClone.cpp b/js/src/vm/StructuredClone.cpp
index 24b156a55d61..06217d78909f 100644
--- a/js/src/vm/StructuredClone.cpp
+++ b/js/src/vm/StructuredClone.cpp
@@ -342,7 +342,7 @@ struct JSStructuredCloneWriter {
     // The "memory" list described in the HTML5 internal structured cloning algorithm.
     // memory is a superset of objs; items are never removed from Memory
     // until a serialization operation is finished
-    using CloneMemory = TraceableHashMap<JSObject*, uint32_t>;
+    using CloneMemory = TraceableHashMap<JSObject*, uint32_t, MovableCellHasher<JSObject*>>;
     Rooted<CloneMemory> memory;
 
     // The user defined callbacks that will be used for cloning.
diff --git a/js/xpconnect/idl/xpccomponents.idl b/js/xpconnect/idl/xpccomponents.idl
index b531ae911f52..bcb2302c4f3a 100644
--- a/js/xpconnect/idl/xpccomponents.idl
+++ b/js/xpconnect/idl/xpccomponents.idl
@@ -123,7 +123,7 @@ interface ScheduledGCCallback : nsISupports
 /**
 * interface of Components.utils
 */
-[scriptable, uuid(eaeab2c0-ada3-4c22-b36d-70320dd923ba)]
+[scriptable, uuid(3ce3a6f8-2b59-439c-a57e-74e7b122fb3c)]
 interface nsIXPCComponents_Utils : nsISupports
 {
 
@@ -344,21 +344,6 @@ interface nsIXPCComponents_Utils : nsISupports
      */
     void unlinkGhostWindows();
 
-    /**
-     * Return the keys in a weak map.  This operation is
-     * non-deterministic because it is affected by the scheduling of the
-     * garbage collector and the cycle collector.
-     *
-     * This should only be used to write tests of the interaction of
-     * the GC and CC with weak maps.
-     *
-     * @param aMap weak map or other JavaScript value
-     * @returns If aMap is a weak map object, return the keys of the weak
-                map as an array.  Otherwise, return undefined.
-     */
-    [implicit_jscontext]
-    jsval nondeterministicGetWeakMapKeys(in jsval aMap);
-
     [implicit_jscontext]
     jsval getJSTestingFunctions();
 
diff --git a/js/xpconnect/src/XPCComponents.cpp b/js/xpconnect/src/XPCComponents.cpp
index 5aa0a0b33bd5..982c615cdacf 100644
--- a/js/xpconnect/src/XPCComponents.cpp
+++ b/js/xpconnect/src/XPCComponents.cpp
@@ -2658,23 +2658,6 @@ nsXPCComponents_Utils::UnlinkGhostWindows()
 #endif
 }
 
-NS_IMETHODIMP
-nsXPCComponents_Utils::NondeterministicGetWeakMapKeys(HandleValue aMap,
-                                                      JSContext* aCx,
-                                                      MutableHandleValue aKeys)
-{
-    if (!aMap.isObject()) {
-        aKeys.setUndefined();
-        return NS_OK;
-    }
-    RootedObject objRet(aCx);
-    RootedObject mapObj(aCx, &aMap.toObject());
-    if (!JS_NondeterministicGetWeakMapKeys(aCx, mapObj, &objRet))
-        return NS_ERROR_OUT_OF_MEMORY;
-     aKeys.set(objRet ? ObjectValue(*objRet) : UndefinedValue());
-    return NS_OK;
-}
-
 NS_IMETHODIMP
 nsXPCComponents_Utils::GetJSTestingFunctions(JSContext* cx,
                                              MutableHandleValue retval)
diff --git a/js/xpconnect/tests/chrome/test_getweakmapkeys.xul b/js/xpconnect/tests/chrome/test_getweakmapkeys.xul
index 90c59fb2c04d..38edde562812 100644
--- a/js/xpconnect/tests/chrome/test_getweakmapkeys.xul
+++ b/js/xpconnect/tests/chrome/test_getweakmapkeys.xul
@@ -22,16 +22,16 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=688277
   let Cu = Components.utils;
 
   /* Fail gracefully if junk is passed in. */
-  is(Cu.nondeterministicGetWeakMapKeys(11), undefined,
+  is(ThreadSafeChromeUtils.nondeterministicGetWeakMapKeys(11), undefined,
     "nondeterministicGetWeakMapKeys should return undefined for non-objects");
-  is(Cu.nondeterministicGetWeakMapKeys({}), undefined,
+  is(ThreadSafeChromeUtils.nondeterministicGetWeakMapKeys({}), undefined,
     "nondeterministicGetWeakMapKeys should return undefined for non-weakmap objects");
-  is(Cu.nondeterministicGetWeakMapKeys(null), undefined,
+  is(ThreadSafeChromeUtils.nondeterministicGetWeakMapKeys(null), undefined,
     "nondeterministicGetWeakMapKeys should return undefined for null");
 
   /* return an empty array for an empty WeakMap */
   let mempty = new WeakMap();
-  is(Cu.nondeterministicGetWeakMapKeys(mempty).length, 0,
+  is(ThreadSafeChromeUtils.nondeterministicGetWeakMapKeys(mempty).length, 0,
     "nondeterministicGetWeakMapKeys should return empty array for empty weakmap");
 
   /* Test freeing/nonfreeing. */
@@ -53,7 +53,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=688277
   add_elements();
 
   Cu.schedulePreciseGC(function () {
-    let keys = Cu.nondeterministicGetWeakMapKeys(m);
+    let keys = ThreadSafeChromeUtils.nondeterministicGetWeakMapKeys(m);
     is(liveKeys.length, 1, "Wrong number of live keys.");
     is(keys.length, 1, "Should have one weak map key.");
     is(m.get(keys[0]), "live1", "live1 should be live");
diff --git a/js/xpconnect/tests/chrome/test_paris_weakmap_keys.xul b/js/xpconnect/tests/chrome/test_paris_weakmap_keys.xul
index 98598238d8b6..ac7ff041dfb0 100644
--- a/js/xpconnect/tests/chrome/test_paris_weakmap_keys.xul
+++ b/js/xpconnect/tests/chrome/test_paris_weakmap_keys.xul
@@ -67,7 +67,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=777385
     SpecialPowers.DOMWindowUtils.garbageCollect();
     SpecialPowers.DOMWindowUtils.garbageCollect();
 
-    is(Cu.nondeterministicGetWeakMapKeys(live_map).length, 1,
+    is(ThreadSafeChromeUtils.nondeterministicGetWeakMapKeys(live_map).length, 1,
        "Live nsISupports new DOM bindings wrappercached native weak map key should not be removed.");
 
     is(live_map.get(get_div_style()), 12345, "Live map should have live style with right value after GC.");
diff --git a/js/xpconnect/tests/chrome/test_watchpoints.xul b/js/xpconnect/tests/chrome/test_watchpoints.xul
index e16c84792e71..2262b1a90244 100644
--- a/js/xpconnect/tests/chrome/test_watchpoints.xul
+++ b/js/xpconnect/tests/chrome/test_watchpoints.xul
@@ -31,7 +31,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=693527
 
   /* Check to see if a weak reference is dead. */
   let weak_ref_dead = function (r) {
-    return Cu.nondeterministicGetWeakMapKeys(r).length == 0;
+    return ThreadSafeChromeUtils.nondeterministicGetWeakMapKeys(r).length == 0;
   }
 
 
diff --git a/js/xpconnect/tests/chrome/test_weakmap_keys_preserved2.xul b/js/xpconnect/tests/chrome/test_weakmap_keys_preserved2.xul
index c9fb230a5536..c6931af3698d 100644
--- a/js/xpconnect/tests/chrome/test_weakmap_keys_preserved2.xul
+++ b/js/xpconnect/tests/chrome/test_weakmap_keys_preserved2.xul
@@ -54,7 +54,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=673468
 
     live_dom.xyzabc = {wrappee: wrappee, m: map, sb: sandbox};
 
-    let key = Cu.nondeterministicGetWeakMapKeys(map)[0];
+    let key = ThreadSafeChromeUtils.nondeterministicGetWeakMapKeys(map)[0];
     let value = map.get(key);
     is(value.children.length, 1, "children have wrong length");
   }
@@ -65,9 +65,9 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=673468
     let live_dom = window.eeeevent.data.dummy;
     let live_map = live_dom.xyzabc.m;
     let sandbox = live_dom.xyzabc.sb;
-    is(Cu.nondeterministicGetWeakMapKeys(live_map).length, 1,
+    is(ThreadSafeChromeUtils.nondeterministicGetWeakMapKeys(live_map).length, 1,
       "Map should not be empty.");
-    let key = Cu.nondeterministicGetWeakMapKeys(live_map)[0];
+    let key = ThreadSafeChromeUtils.nondeterministicGetWeakMapKeys(live_map)[0];
     let value = live_map.get(key);
     is(value.children.length, 1, "children have wrong length");
   }
diff --git a/js/xpconnect/tests/chrome/test_weakmaps.xul b/js/xpconnect/tests/chrome/test_weakmaps.xul
index 19dab9c6f2b7..e741a41c6c38 100644
--- a/js/xpconnect/tests/chrome/test_weakmaps.xul
+++ b/js/xpconnect/tests/chrome/test_weakmaps.xul
@@ -31,7 +31,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=668855
 
   /* Check to see if a weak reference is dead. */
   let weak_ref_dead = function (r) {
-    return Cu.nondeterministicGetWeakMapKeys(r).length == 0;
+    return ThreadSafeChromeUtils.nondeterministicGetWeakMapKeys(r).length == 0;
   }
 
   /* Deterministically grab an arbitrary DOM element. */
@@ -118,7 +118,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=668855
       "Live key should have the same value in live map.");
     is(live_map.get(black_key).my_key, 'live_black',
       "Black key should have the same value in live map.");
-    is(Cu.nondeterministicGetWeakMapKeys(live_map).length, 2,
+    is(ThreadSafeChromeUtils.nondeterministicGetWeakMapKeys(live_map).length, 2,
       "Live map should have two entries.");
 
     // check the live black map
@@ -126,7 +126,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=668855
       "Live key should have the same value in black map.");
     is(black_map.get(black_key).my_key, 'black_black',
       "Black key should have the same value in black map.");
-    is(Cu.nondeterministicGetWeakMapKeys(black_map).length, 2,
+    is(ThreadSafeChromeUtils.nondeterministicGetWeakMapKeys(black_map).length, 2,
       "Black map should have two entries.");    
 
   };
@@ -250,16 +250,16 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=668855
 
     check_nested_cc_maps();
 
-    is(Cu.nondeterministicGetWeakMapKeys(garbage_map).length, 0, "Chained garbage weak map entries should not leak.");
+    is(ThreadSafeChromeUtils.nondeterministicGetWeakMapKeys(garbage_map).length, 0, "Chained garbage weak map entries should not leak.");
 
     check_basic_unit();
 
     // fixed by Bug 680937
-    is(Cu.nondeterministicGetWeakMapKeys(wn_garbage_map).length, 0,
+    is(ThreadSafeChromeUtils.nondeterministicGetWeakMapKeys(wn_garbage_map).length, 0,
        "Chained garbage WN weak map entries should not leak.");
 
     // fixed by Bug 680937
-    is(Cu.nondeterministicGetWeakMapKeys(wn_live_map).length, 1,
+    is(ThreadSafeChromeUtils.nondeterministicGetWeakMapKeys(wn_live_map).length, 1,
        "Live weak map wrapped native key should not be removed.");
 
     ok(wn_live_map.has(get_live_dom()), "Live map should have live dom.");
diff --git a/layout/base/nsPresContext.cpp b/layout/base/nsPresContext.cpp
index 3d47477b428e..27e953190418 100644
--- a/layout/base/nsPresContext.cpp
+++ b/layout/base/nsPresContext.cpp
@@ -3132,7 +3132,7 @@ SortConfigurations(nsTArray<nsIWidget::Configuration>* aConfigurations)
         nsAutoTArray<nsIntRect,1> clipRects;
         pluginsToMove[j].mChild->GetWindowClipRegion(&clipRects);
         if (HasOverlap(bounds.TopLeft(), clipRects,
-                       config->mBounds.TopLeft(),
+                       config->mBounds.ToUnknownRect().TopLeft(),
                        config->mClipRegion)) {
           foundOverlap = true;
           break;
diff --git a/layout/generic/nsBlockFrame.cpp b/layout/generic/nsBlockFrame.cpp
index 0797c0e83389..ed0f34161f85 100644
--- a/layout/generic/nsBlockFrame.cpp
+++ b/layout/generic/nsBlockFrame.cpp
@@ -728,7 +728,7 @@ nsBlockFrame::GetMinISize(nsRenderingContext *aRenderingContext)
         // XXX Bug NNNNNN Should probably handle percentage text-indent.
 
         data.line = &line;
-        data.lineContainer = curFrame;
+        data.SetLineContainer(curFrame);
         nsIFrame *kid = line->mFirstChild;
         for (int32_t i = 0, i_end = line->GetChildCount(); i != i_end;
              ++i, kid = kid->GetNextSibling()) {
@@ -813,7 +813,7 @@ nsBlockFrame::GetPrefISize(nsRenderingContext *aRenderingContext)
         // XXX Bug NNNNNN Should probably handle percentage text-indent.
 
         data.line = &line;
-        data.lineContainer = curFrame;
+        data.SetLineContainer(curFrame);
         nsIFrame *kid = line->mFirstChild;
         for (int32_t i = 0, i_end = line->GetChildCount(); i != i_end;
              ++i, kid = kid->GetNextSibling()) {
@@ -887,7 +887,7 @@ nsBlockFrame::GetPrefWidthTightBounds(nsRenderingContext* aRenderingContext,
         // XXX Bug NNNNNN Should probably handle percentage text-indent.
 
         data.line = &line;
-        data.lineContainer = curFrame;
+        data.SetLineContainer(curFrame);
         nsIFrame *kid = line->mFirstChild;
         for (int32_t i = 0, i_end = line->GetChildCount(); i != i_end;
              ++i, kid = kid->GetNextSibling()) {
diff --git a/layout/generic/nsContainerFrame.cpp b/layout/generic/nsContainerFrame.cpp
index 2dcba6521cd9..2311c6c68346 100644
--- a/layout/generic/nsContainerFrame.cpp
+++ b/layout/generic/nsContainerFrame.cpp
@@ -850,7 +850,7 @@ nsContainerFrame::DoInlineIntrinsicISize(nsRenderingContext *aRenderingContext,
   }
 
   const nsLineList_iterator* savedLine = aData->line;
-  nsIFrame* const savedLineContainer = aData->lineContainer;
+  nsIFrame* const savedLineContainer = aData->LineContainer();
 
   nsContainerFrame *lastInFlow;
   for (nsContainerFrame *nif = this; nif;
@@ -870,13 +870,13 @@ nsContainerFrame::DoInlineIntrinsicISize(nsRenderingContext *aRenderingContext,
     // After we advance to our next-in-flow, the stored line and line container
     // may no longer be correct. Just forget them.
     aData->line = nullptr;
-    aData->lineContainer = nullptr;
+    aData->SetLineContainer(nullptr);
 
     lastInFlow = nif;
   }
 
   aData->line = savedLine;
-  aData->lineContainer = savedLineContainer;
+  aData->SetLineContainer(savedLineContainer);
 
   // This goes at the end no matter how things are broken and how
   // messy the bidi situations are, since per CSS2.1 section 8.6
diff --git a/layout/generic/nsFrame.cpp b/layout/generic/nsFrame.cpp
index 0c462d9e37f6..66006a5acd86 100644
--- a/layout/generic/nsFrame.cpp
+++ b/layout/generic/nsFrame.cpp
@@ -4115,12 +4115,10 @@ nsIFrame::InlinePrefISizeData::ForceBreak(nsRenderingContext *aRenderingContext)
             floats_cur_left = 0,
             floats_cur_right = 0;
 
-    WritingMode wm = lineContainer->GetWritingMode();
-
     for (uint32_t i = 0, i_end = floats.Length(); i != i_end; ++i) {
       const FloatInfo& floatInfo = floats[i];
       const nsStyleDisplay *floatDisp = floatInfo.Frame()->StyleDisplay();
-      uint8_t breakType = floatDisp->PhysicalBreakType(wm);
+      uint8_t breakType = floatDisp->PhysicalBreakType(lineContainerWM);
       if (breakType == NS_STYLE_CLEAR_LEFT ||
           breakType == NS_STYLE_CLEAR_RIGHT ||
           breakType == NS_STYLE_CLEAR_BOTH) {
@@ -4137,7 +4135,7 @@ nsIFrame::InlinePrefISizeData::ForceBreak(nsRenderingContext *aRenderingContext)
         }
       }
 
-      uint8_t floatStyle = floatDisp->PhysicalFloats(wm);
+      uint8_t floatStyle = floatDisp->PhysicalFloats(lineContainerWM);
       nscoord& floats_cur = floatStyle == NS_STYLE_FLOAT_LEFT
                               ? floats_cur_left : floats_cur_right;
       nscoord floatWidth = floatInfo.Width();
diff --git a/layout/generic/nsGfxScrollFrame.cpp b/layout/generic/nsGfxScrollFrame.cpp
index b616de09ab82..3812a49dc0f5 100644
--- a/layout/generic/nsGfxScrollFrame.cpp
+++ b/layout/generic/nsGfxScrollFrame.cpp
@@ -3706,8 +3706,11 @@ GetScrollPortSizeExcludingHeadersAndFooters(nsIFrame* aViewportFrame,
   for (nsFrameList::Enumerator iterator(fixedFrames); !iterator.AtEnd();
        iterator.Next()) {
     nsIFrame* f = iterator.get();
-    nsRect r = f->GetRect().Intersect(aScrollPort);
-    if (r.x == 0 && r.width == aScrollPort.width &&
+    nsRect r = f->GetRectRelativeToSelf();
+    r = nsLayoutUtils::TransformFrameRectToAncestor(f, r, aViewportFrame);
+    r = r.Intersect(aScrollPort);
+    if ((r.width >= aScrollPort.width / 2 ||
+         r.width >= NSIntPixelsToAppUnits(800, AppUnitsPerCSSPixel())) &&
         r.height <= aScrollPort.height/3) {
       list.AppendElement(TopAndBottom(r.y, r.YMost()));
     }
diff --git a/layout/generic/nsIFrame.h b/layout/generic/nsIFrame.h
index 1419f6d4abcd..3ccd1fdd1719 100644
--- a/layout/generic/nsIFrame.h
+++ b/layout/generic/nsIFrame.h
@@ -1563,17 +1563,34 @@ public:
       , lineContainer(nullptr)
       , prevLines(0)
       , currentLine(0)
-      , skipWhitespace(true)
       , trailingWhitespace(0)
+      , skipWhitespace(true)
     {}
 
     // The line. This may be null if the inlines are not associated with
     // a block or if we just don't know the line.
     const nsLineList_iterator* line;
 
-    // The line container.
+    // The line container. Private, to ensure we always use SetLineContainer
+    // to update it (so that we have a chance to store the lineContainerWM).
+    //
+    // Note that nsContainerFrame::DoInlineIntrinsicISize will clear the
+    // |line| and |lineContainer| fields when following a next-in-flow link,
+    // so we must not assume these can always be dereferenced.
+  private:
     nsIFrame* lineContainer;
 
+    // Setter and getter for the lineContainer field:
+  public:
+    void SetLineContainer(nsIFrame* aLineContainer)
+    {
+      lineContainer = aLineContainer;
+      if (lineContainer) {
+        lineContainerWM = lineContainer->GetWritingMode();
+      }
+    }
+    nsIFrame* LineContainer() const { return lineContainer; }
+
     // The maximum intrinsic width for all previous lines.
     nscoord prevLines;
 
@@ -1582,14 +1599,18 @@ public:
     // the caller should call |Break()|.
     nscoord currentLine;
 
+    // This contains the width of the trimmable whitespace at the end of
+    // |currentLine|; it is zero if there is no such whitespace.
+    nscoord trailingWhitespace;
+
     // True if initial collapsable whitespace should be skipped.  This
     // should be true at the beginning of a block, after hard breaks
     // and when the last text ended with whitespace.
     bool skipWhitespace;
 
-    // This contains the width of the trimmable whitespace at the end of
-    // |currentLine|; it is zero if there is no such whitespace.
-    nscoord trailingWhitespace;
+    // Writing mode of the line container (stored here so that we don't
+    // lose track of it if the lineContainer field is reset).
+    mozilla::WritingMode lineContainerWM;
 
     // Floats encountered in the lines.
     class FloatInfo {
diff --git a/layout/generic/nsPluginFrame.cpp b/layout/generic/nsPluginFrame.cpp
index d1e9f15154be..9614e875d78a 100644
--- a/layout/generic/nsPluginFrame.cpp
+++ b/layout/generic/nsPluginFrame.cpp
@@ -408,7 +408,8 @@ nsPluginFrame::GetWidgetConfiguration(nsTArray<nsIWidget::Configuration>* aConfi
 
   nsIWidget::Configuration* configuration = aConfigurations->AppendElement();
   configuration->mChild = mWidget;
-  configuration->mBounds = mNextConfigurationBounds;
+  configuration->mBounds =
+    LayoutDeviceIntRect::FromUnknownRect(mNextConfigurationBounds);
   configuration->mClipRegion = mNextConfigurationClipRegion;
 #if defined(XP_WIN) || defined(MOZ_WIDGET_GTK)
   if (XRE_IsContentProcess()) {
diff --git a/layout/generic/nsRubyBaseContainerFrame.cpp b/layout/generic/nsRubyBaseContainerFrame.cpp
index be33805ab777..1187eaae6820 100644
--- a/layout/generic/nsRubyBaseContainerFrame.cpp
+++ b/layout/generic/nsRubyBaseContainerFrame.cpp
@@ -148,13 +148,13 @@ CalculateColumnPrefISize(nsRenderingContext* aRenderingContext,
     if (frame) {
       nsIFrame::InlinePrefISizeData data;
       if (i == 0) {
-        data.lineContainer = aBaseISizeData->lineContainer;
+        data.SetLineContainer(aBaseISizeData->LineContainer());
         data.skipWhitespace = aBaseISizeData->skipWhitespace;
         data.trailingWhitespace = aBaseISizeData->trailingWhitespace;
       } else {
         // The line container of ruby text frames is their parent,
         // ruby text container frame.
-        data.lineContainer = frame->GetParent();
+        data.SetLineContainer(frame->GetParent());
       }
       frame->AddInlinePrefISize(aRenderingContext, &data);
       MOZ_ASSERT(data.prevLines == 0, "Shouldn't have prev lines");
@@ -182,7 +182,7 @@ nsRubyBaseContainerFrame::AddInlineMinISize(
       // Since spans are not breakable internally, use our pref isize
       // directly if there is any span.
       nsIFrame::InlinePrefISizeData data;
-      data.lineContainer = aData->lineContainer;
+      data.SetLineContainer(aData->LineContainer());
       data.skipWhitespace = aData->skipWhitespace;
       data.trailingWhitespace = aData->trailingWhitespace;
       AddInlinePrefISize(aRenderingContext, &data);
diff --git a/layout/generic/nsTextFrame.cpp b/layout/generic/nsTextFrame.cpp
index 0e847808dec2..d60115904e72 100644
--- a/layout/generic/nsTextFrame.cpp
+++ b/layout/generic/nsTextFrame.cpp
@@ -7643,7 +7643,7 @@ nsTextFrame::AddInlineMinISizeForFlow(nsRenderingContext *aRenderingContext,
   uint32_t flowEndInTextRun;
   gfxContext* ctx = aRenderingContext->ThebesContext();
   gfxSkipCharsIterator iter =
-    EnsureTextRun(aTextRunType, ctx, aData->lineContainer,
+    EnsureTextRun(aTextRunType, ctx, aData->LineContainer(),
                   aData->line, &flowEndInTextRun);
   gfxTextRun *textRun = GetTextRun(aTextRunType);
   if (!textRun)
@@ -7792,12 +7792,12 @@ nsTextFrame::AddInlineMinISize(nsRenderingContext *aRenderingContext,
     // lastTextRun will only be null for the first text frame.
     if (f == this || f->GetTextRun(trtype) != lastTextRun) {
       nsIFrame* lc;
-      if (aData->lineContainer &&
-          aData->lineContainer != (lc = FindLineContainer(f))) {
+      if (aData->LineContainer() &&
+          aData->LineContainer() != (lc = FindLineContainer(f))) {
         NS_ASSERTION(f != this, "wrong InlineMinISizeData container"
                                 " for first continuation");
         aData->line = nullptr;
-        aData->lineContainer = lc;
+        aData->SetLineContainer(lc);
       }
 
       // This will process all the text frames that share the same textrun as f.
@@ -7817,7 +7817,7 @@ nsTextFrame::AddInlinePrefISizeForFlow(nsRenderingContext *aRenderingContext,
   uint32_t flowEndInTextRun;
   gfxContext* ctx = aRenderingContext->ThebesContext();
   gfxSkipCharsIterator iter =
-    EnsureTextRun(aTextRunType, ctx, aData->lineContainer,
+    EnsureTextRun(aTextRunType, ctx, aData->LineContainer(),
                   aData->line, &flowEndInTextRun);
   gfxTextRun *textRun = GetTextRun(aTextRunType);
   if (!textRun)
@@ -7930,12 +7930,12 @@ nsTextFrame::AddInlinePrefISize(nsRenderingContext *aRenderingContext,
     // lastTextRun will only be null for the first text frame.
     if (f == this || f->GetTextRun(trtype) != lastTextRun) {
       nsIFrame* lc;
-      if (aData->lineContainer &&
-          aData->lineContainer != (lc = FindLineContainer(f))) {
+      if (aData->LineContainer() &&
+          aData->LineContainer() != (lc = FindLineContainer(f))) {
         NS_ASSERTION(f != this, "wrong InlinePrefISizeData container"
                                 " for first continuation");
         aData->line = nullptr;
-        aData->lineContainer = lc;
+        aData->SetLineContainer(lc);
       }
 
       // This will process all the text frames that share the same textrun as f.
diff --git a/layout/generic/test/mochitest.ini b/layout/generic/test/mochitest.ini
index 12b25224b9d9..9e56313ab8ef 100644
--- a/layout/generic/test/mochitest.ini
+++ b/layout/generic/test/mochitest.ini
@@ -113,7 +113,7 @@ skip-if = buildapp == 'mulet' || buildapp == 'b2g' || toolkit == 'android' || e1
 skip-if = (toolkit == "gtk2") || (toolkit == "gtk3") || (os == "win")
 [test_overflow_event.html]
 [test_page_scroll_with_fixed_pos.html]
-skip-if = (buildapp == 'b2g' && (toolkit != 'gonk' || debug)) # b2g-debug(opened window too small?) b2g-desktop(opened window too small?)
+skip-if = buildapp == 'mulet' || (buildapp == 'b2g' && (toolkit != 'gonk' || debug)) # b2g-debug(opened window too small?) b2g-desktop(opened window too small?)
 support-files = page_scroll_with_fixed_pos_window.html
 [test_plugin_clipping.xhtml]
 skip-if = (buildapp == 'b2g' && toolkit != 'gonk') || e10s #Bug 931116, b2g desktop specific, initial triage
diff --git a/layout/generic/test/page_scroll_with_fixed_pos_window.html b/layout/generic/test/page_scroll_with_fixed_pos_window.html
index b4755cc83ec5..8647e7252dea 100644
--- a/layout/generic/test/page_scroll_with_fixed_pos_window.html
+++ b/layout/generic/test/page_scroll_with_fixed_pos_window.html
@@ -83,11 +83,28 @@ function runTest() {
           scrollDownOnePageWithContinuation(function() {
             is(document.documentElement.scrollTop, fullPageScrollDown - (10 + 11 + 9 + 12),
                "Combine multiple overlapping elements");
+            showFixedPosElements2(false);
 
-            // Scroll back up so test results are visible
-            document.documentElement.scrollTop = 0;
-            SimpleTest.finish();
-            window.close();
+            document.getElementById("top").style.width = "400px";
+            scrollDownOnePageWithContinuation(function() {
+              is(document.documentElement.scrollTop, fullPageScrollDown - (10 + 13),
+                 "Don't ignore elements that span more than half the viewport side");
+              document.getElementById("top").style.width = "100%";
+
+              document.getElementById("top").style.top = "-40px";
+              document.getElementById("top").style.transform = "translateY(38px)";
+              scrollDownOnePageWithContinuation(function() {
+                is(document.documentElement.scrollTop,
+                   fullPageScrollDown - (10 + 13 - 40 + 38),
+                   "Account for offset and transform");
+                document.getElementById("top").style.width = "100%";
+
+                // Scroll back up so test results are visible
+                document.documentElement.scrollTop = 0;
+                SimpleTest.finish();
+                window.close();
+              });
+            });
           });
         });
       });
diff --git a/layout/xul/nsMenuPopupFrame.cpp b/layout/xul/nsMenuPopupFrame.cpp
index 85606af48990..7c68d052f202 100644
--- a/layout/xul/nsMenuPopupFrame.cpp
+++ b/layout/xul/nsMenuPopupFrame.cpp
@@ -1501,7 +1501,7 @@ nsMenuPopupFrame::SetPopupPosition(nsIFrame* aAnchorFrame, bool aIsMove, bool aS
   // to save time since they will never have a titlebar.
   nsIWidget* widget = view->GetWidget();
   if (mPopupType == ePopupTypePanel && widget) {
-    mLastClientOffset = widget->GetClientOffset();
+    mLastClientOffset = widget->GetClientOffsetUntyped();
     viewPoint.x += presContext->DevPixelsToAppUnits(mLastClientOffset.x);
     viewPoint.y += presContext->DevPixelsToAppUnits(mLastClientOffset.y);
   }
@@ -2168,7 +2168,7 @@ nsMenuPopupFrame::MoveTo(const CSSIntPoint& aPos, bool aUpdateAttrs)
 {
   nsIWidget* widget = GetWidget();
   if ((mScreenRect.x == aPos.x && mScreenRect.y == aPos.y) &&
-      (!widget || widget->GetClientOffset() == mLastClientOffset)) {
+      (!widget || widget->GetClientOffsetUntyped() == mLastClientOffset)) {
     return;
   }
 
diff --git a/layout/xul/nsResizerFrame.cpp b/layout/xul/nsResizerFrame.cpp
index 92056f093812..3893b27b4e16 100644
--- a/layout/xul/nsResizerFrame.cpp
+++ b/layout/xul/nsResizerFrame.cpp
@@ -253,7 +253,7 @@ nsResizerFrame::HandleEvent(nsPresContext* aPresContext,
             widget->GetScreenBounds(oldRect);
 
           // convert the new rectangle into outer window coordinates
-          nsIntPoint clientOffset = widget->GetClientOffset();
+          LayoutDeviceIntPoint clientOffset = widget->GetClientOffset();
           rect.x -= clientOffset.x;
           rect.y -= clientOffset.y;
         }
diff --git a/layout/xul/nsXULPopupManager.cpp b/layout/xul/nsXULPopupManager.cpp
index 88db9c2b0030..e432f707fe53 100644
--- a/layout/xul/nsXULPopupManager.cpp
+++ b/layout/xul/nsXULPopupManager.cpp
@@ -473,7 +473,7 @@ nsXULPopupManager::PopupMoved(nsIFrame* aFrame, nsIntPoint aPnt)
   nsIntRect curDevSize = view->CalcWidgetBounds(eWindowType_popup);
   nsIWidget* widget = menuPopupFrame->GetWidget();
   if (curDevSize.x == aPnt.x && curDevSize.y == aPnt.y &&
-      (!widget || widget->GetClientOffset() == menuPopupFrame->GetLastClientOffset())) {
+      (!widget || widget->GetClientOffsetUntyped() == menuPopupFrame->GetLastClientOffset())) {
     return;
   }
 
diff --git a/media/libcubeb/src/cubeb_opensl.c b/media/libcubeb/src/cubeb_opensl.c
index a46489b750f7..7642e029ef6e 100644
--- a/media/libcubeb/src/cubeb_opensl.c
+++ b/media/libcubeb/src/cubeb_opensl.c
@@ -641,6 +641,9 @@ opensl_stream_init(cubeb * ctx, cubeb_stream ** stream, char const * stream_name
     return CUBEB_ERROR;
   }
 
+  // Work around wilhelm/AudioTrack badness, bug 1221228
+  (*stm->play)->SetMarkerPosition(stm->play, (SLmillisecond)0);
+
   res = (*stm->play)->SetCallbackEventsMask(stm->play, (SLuint32)SL_PLAYEVENT_HEADATMARKER);
   if (res != SL_RESULT_SUCCESS) {
     opensl_stream_destroy(stm);
diff --git a/media/libvpx/update.py b/media/libvpx/update.py
index 1606b1e07c24..d6c7a08e6dc6 100755
--- a/media/libvpx/update.py
+++ b/media/libvpx/update.py
@@ -592,6 +592,8 @@ def apply_patches():
     # Cherry pick https://chromium-review.googlesource.com/#/c/276889/
     # to fix crash on 32bit
     os.system("patch -p1 < vp9_filter_restore_aligment.patch")
+    # Patch win32 vpx_once.
+    os.system("patch -p3 < vpx_once.patch")
 
 def update_readme(commit):
     with open('README_MOZILLA') as f:
diff --git a/media/libvpx/vpx_once.patch b/media/libvpx/vpx_once.patch
new file mode 100644
index 000000000000..08a83fb8cfb5
--- /dev/null
+++ b/media/libvpx/vpx_once.patch
@@ -0,0 +1,145 @@
+commit 64f73cc1f7f57ca6643b027eae63041fec408ea8
+Author: Ralph Giles <giles@mozilla.com>
+Date:   Fri Nov 6 16:42:49 2015 -0800
+
+    Bug 1218124 - Use InterlockCompare in win32 vpx_once(). r=gerald
+
+diff --git a/media/libvpx/vpx_ports/vpx_once.h b/media/libvpx/vpx_ports/vpx_once.h
+index f1df394..da04db4 100644
+--- a/media/libvpx/vpx_ports/vpx_once.h
++++ b/media/libvpx/vpx_ports/vpx_once.h
+@@ -1,5 +1,5 @@
+ /*
+- *  Copyright (c) 2011 The WebM project authors. All Rights Reserved.
++ *  Copyright (c) 2015 The WebM project authors. All Rights Reserved.
+  *
+  *  Use of this source code is governed by a BSD-style license
+  *  that can be found in the LICENSE file in the root of the source
+@@ -13,63 +13,83 @@
+ 
+ #include "vpx_config.h"
+ 
++/* Implement a function wrapper to guarantee initialization
++ * thread-safety for library singletons.
++ *
++ * NOTE: These functions use static locks, and can only be
++ * used with one common argument per compilation unit. So
++ *
++ * file1.c:
++ *   vpx_once(foo);
++ *   ...
++ *   vpx_once(foo);
++ *
++ *   file2.c:
++ *     vpx_once(bar);
++ *
++ * will ensure foo() and bar() are each called only once, but in
++ *
++ * file1.c:
++ *   vpx_once(foo);
++ *   vpx_once(bar):
++ *
++ * bar() will never be called because the lock is used up
++ * by the call to foo().
++ */
++
+ #if CONFIG_MULTITHREAD && defined(_WIN32)
+ #include <windows.h>
+ #include <stdlib.h>
++/* Declare a per-compilation-unit state variable to track the progress
++ * of calling func() only once. This must be at global scope because
++ * local initializers are not thread-safe in MSVC prior to Visual
++ * Studio 2015.
++ *
++ * As a static, once_state will be zero-initialized as program start.
++ */
++static LONG once_state;
+ static void once(void (*func)(void))
+ {
+-    static CRITICAL_SECTION *lock;
+-    static LONG waiters;
+-    static int done;
+-    void *lock_ptr = &lock;
+-
+-    /* If the initialization is complete, return early. This isn't just an
+-     * optimization, it prevents races on the destruction of the global
+-     * lock.
++    /* Try to advance once_state from its initial value of 0 to 1.
++     * Only one thread can succeed in doing so.
+      */
+-    if(done)
++    if (InterlockedCompareExchange(&once_state, 1, 0) == 0) {
++        /* We're the winning thread, having set once_state to 1.
++         * Call our function. */
++        func();
++        /* Now advance once_state to 2, unblocking any other threads. */
++        InterlockedIncrement(&once_state);
+         return;
+-
+-    InterlockedIncrement(&waiters);
+-
+-    /* Get a lock. We create one and try to make it the one-true-lock,
+-     * throwing it away if we lost the race.
+-     */
+-
+-    {
+-        /* Scope to protect access to new_lock */
+-        CRITICAL_SECTION *new_lock = malloc(sizeof(CRITICAL_SECTION));
+-        InitializeCriticalSection(new_lock);
+-        if (InterlockedCompareExchangePointer(lock_ptr, new_lock, NULL) != NULL)
+-        {
+-            DeleteCriticalSection(new_lock);
+-            free(new_lock);
+-        }
+     }
+ 
+-    /* At this point, we have a lock that can be synchronized on. We don't
+-     * care which thread actually performed the allocation.
++    /* We weren't the winning thread, but we want to block on
++     * the state variable so we don't return before func()
++     * has finished executing elsewhere.
++     *
++     * Try to advance once_state from 2 to 2, which is only possible
++     * after the winning thead advances it from 1 to 2.
+      */
+-
+-    EnterCriticalSection(lock);
+-
+-    if (!done)
+-    {
+-        func();
+-        done = 1;
++    while (InterlockedCompareExchange(&once_state, 2, 2) != 2) {
++        /* State isn't yet 2. Try again.
++         *
++         * We are used for singleton initialization functions,
++         * which should complete quickly. Contention will likewise
++         * be rare, so it's worthwhile to use a simple but cpu-
++         * intensive busy-wait instead of successive backoff,
++         * waiting on a kernel object, or another heavier-weight scheme.
++         *
++         * We can at least yield our timeslice.
++         */
++        Sleep(0);
+     }
+ 
+-    LeaveCriticalSection(lock);
+-
+-    /* Last one out should free resources. The destructed objects are
+-     * protected by checking if(done) above.
++    /* We've seen once_state advance to 2, so we know func()
++     * has been called. And we've left once_state as we found it,
++     * so other threads will have the same experience.
++     *
++     * It's safe to return now.
+      */
+-    if(!InterlockedDecrement(&waiters))
+-    {
+-        DeleteCriticalSection(lock);
+-        free(lock);
+-        lock = NULL;
+-    }
++    return;
+ }
+ 
+ 
diff --git a/media/libvpx/vpx_ports/vpx_once.h b/media/libvpx/vpx_ports/vpx_once.h
index f1df3943457a..da04db459075 100644
--- a/media/libvpx/vpx_ports/vpx_once.h
+++ b/media/libvpx/vpx_ports/vpx_once.h
@@ -1,5 +1,5 @@
 /*
- *  Copyright (c) 2011 The WebM project authors. All Rights Reserved.
+ *  Copyright (c) 2015 The WebM project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
@@ -13,63 +13,83 @@
 
 #include "vpx_config.h"
 
+/* Implement a function wrapper to guarantee initialization
+ * thread-safety for library singletons.
+ *
+ * NOTE: These functions use static locks, and can only be
+ * used with one common argument per compilation unit. So
+ *
+ * file1.c:
+ *   vpx_once(foo);
+ *   ...
+ *   vpx_once(foo);
+ *
+ *   file2.c:
+ *     vpx_once(bar);
+ *
+ * will ensure foo() and bar() are each called only once, but in
+ *
+ * file1.c:
+ *   vpx_once(foo);
+ *   vpx_once(bar):
+ *
+ * bar() will never be called because the lock is used up
+ * by the call to foo().
+ */
+
 #if CONFIG_MULTITHREAD && defined(_WIN32)
 #include <windows.h>
 #include <stdlib.h>
+/* Declare a per-compilation-unit state variable to track the progress
+ * of calling func() only once. This must be at global scope because
+ * local initializers are not thread-safe in MSVC prior to Visual
+ * Studio 2015.
+ *
+ * As a static, once_state will be zero-initialized as program start.
+ */
+static LONG once_state;
 static void once(void (*func)(void))
 {
-    static CRITICAL_SECTION *lock;
-    static LONG waiters;
-    static int done;
-    void *lock_ptr = &lock;
-
-    /* If the initialization is complete, return early. This isn't just an
-     * optimization, it prevents races on the destruction of the global
-     * lock.
+    /* Try to advance once_state from its initial value of 0 to 1.
+     * Only one thread can succeed in doing so.
      */
-    if(done)
-        return;
-
-    InterlockedIncrement(&waiters);
-
-    /* Get a lock. We create one and try to make it the one-true-lock,
-     * throwing it away if we lost the race.
-     */
-
-    {
-        /* Scope to protect access to new_lock */
-        CRITICAL_SECTION *new_lock = malloc(sizeof(CRITICAL_SECTION));
-        InitializeCriticalSection(new_lock);
-        if (InterlockedCompareExchangePointer(lock_ptr, new_lock, NULL) != NULL)
-        {
-            DeleteCriticalSection(new_lock);
-            free(new_lock);
-        }
-    }
-
-    /* At this point, we have a lock that can be synchronized on. We don't
-     * care which thread actually performed the allocation.
-     */
-
-    EnterCriticalSection(lock);
-
-    if (!done)
-    {
+    if (InterlockedCompareExchange(&once_state, 1, 0) == 0) {
+        /* We're the winning thread, having set once_state to 1.
+         * Call our function. */
         func();
-        done = 1;
+        /* Now advance once_state to 2, unblocking any other threads. */
+        InterlockedIncrement(&once_state);
+        return;
     }
 
-    LeaveCriticalSection(lock);
-
-    /* Last one out should free resources. The destructed objects are
-     * protected by checking if(done) above.
+    /* We weren't the winning thread, but we want to block on
+     * the state variable so we don't return before func()
+     * has finished executing elsewhere.
+     *
+     * Try to advance once_state from 2 to 2, which is only possible
+     * after the winning thead advances it from 1 to 2.
      */
-    if(!InterlockedDecrement(&waiters))
-    {
-        DeleteCriticalSection(lock);
-        free(lock);
-        lock = NULL;
+    while (InterlockedCompareExchange(&once_state, 2, 2) != 2) {
+        /* State isn't yet 2. Try again.
+         *
+         * We are used for singleton initialization functions,
+         * which should complete quickly. Contention will likewise
+         * be rare, so it's worthwhile to use a simple but cpu-
+         * intensive busy-wait instead of successive backoff,
+         * waiting on a kernel object, or another heavier-weight scheme.
+         *
+         * We can at least yield our timeslice.
+         */
+        Sleep(0);
     }
+
+    /* We've seen once_state advance to 2, so we know func()
+     * has been called. And we've left once_state as we found it,
+     * so other threads will have the same experience.
+     *
+     * It's safe to return now.
+     */
+    return;
 }
 
 
diff --git a/media/webrtc/signaling/test/moz.build b/media/webrtc/signaling/test/moz.build
index 2504fbb5a85c..0f2c71980513 100644
--- a/media/webrtc/signaling/test/moz.build
+++ b/media/webrtc/signaling/test/moz.build
@@ -10,6 +10,7 @@ if CONFIG['OS_TARGET'] != 'WINNT' and CONFIG['MOZ_WIDGET_TOOLKIT'] != 'gonk' and
         'jsep_session_unittest',
         'mediaconduit_unittests',
         'mediapipeline_unittest',
+        'sdp_file_parser',
         'sdp_unittests',
         'signaling_unittests',
     ])
diff --git a/media/webrtc/signaling/test/sdp_file_parser.cpp b/media/webrtc/signaling/test/sdp_file_parser.cpp
new file mode 100644
index 000000000000..b79843031298
--- /dev/null
+++ b/media/webrtc/signaling/test/sdp_file_parser.cpp
@@ -0,0 +1,81 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include <string>
+#include <iostream>
+#include <fstream>
+
+#define GTEST_HAS_RTTI 0
+#include "gtest/gtest.h"
+#include "gtest_utils.h"
+
+// without this include linking fails
+#include "FakeMediaStreamsImpl.h"
+
+#include "signaling/src/sdp/SipccSdpParser.h"
+
+namespace mozilla {
+
+const std::string kDefaultFilename((char *)"/tmp/sdp.bin");
+std::string filename(kDefaultFilename);
+
+class SdpParseTest : public ::testing::Test
+{
+  public:
+    SdpParseTest() {}
+
+    void ParseSdp(const std::string &sdp) {
+      mSdp = mParser.Parse(sdp);
+    }
+
+    void SerializeSdp() {
+      if (mSdp) {
+          mSdp->Serialize(os);
+          std::cout << "Serialized SDP:" << std::endl <<
+            os.str() << std::endl;;
+      }
+    }
+
+    SipccSdpParser mParser;
+    mozilla::UniquePtr<Sdp> mSdp;
+    std::stringstream os;
+}; // class SdpParseTest
+
+TEST_F(SdpParseTest, parseSdpFromFile)
+{
+  std::ifstream file(filename.c_str(),
+                     std::ios::in|std::ios::binary|std::ios::ate);
+  ASSERT_TRUE(file.is_open());
+  std::streampos size = file.tellg();
+  size_t nsize = size;
+  nsize+=1;
+  char *memblock = new char [nsize];
+  memset(memblock, '\0', nsize);
+  file.seekg(0, std::ios::beg);
+  file.read(memblock, size);
+  file.close();
+  std::cout << "Read file " << filename << std::endl;
+  ParseSdp(memblock);
+  std::cout << "Parsed SDP" << std::endl;
+  SerializeSdp();
+  delete[] memblock;
+}
+
+} // End namespace mozilla.
+
+int main(int argc, char **argv)
+{
+  ::testing::InitGoogleTest(&argc, argv);
+
+  if (argc == 2) {
+    mozilla::filename = argv[1];
+  } else if (argc > 2) {
+    std::cerr << "Usage: ./sdp_file_parser [filename]" << std::endl;
+    return(1);
+  }
+
+  return RUN_ALL_TESTS();
+}
diff --git a/mobile/android/b2gdroid/installer/package-manifest.in b/mobile/android/b2gdroid/installer/package-manifest.in
index fbcc459b38f1..53a2475a5f52 100644
--- a/mobile/android/b2gdroid/installer/package-manifest.in
+++ b/mobile/android/b2gdroid/installer/package-manifest.in
@@ -624,8 +624,6 @@ bin/libfreebl_32int64_3.so
 @BINPATH@/components/ContentDispatchChooser.js
 @BINPATH@/components/ContentPermissionPrompt.js
 @BINPATH@/components/DirectoryProvider.js
-@BINPATH@/components/FilePicker.js
-@BINPATH@/components/HelperAppDialog.js
 @BINPATH@/components/LoginManagerPrompter.js
 @BINPATH@/components/MobileComponents.manifest
 @BINPATH@/components/MobileComponents.xpt
diff --git a/mobile/android/base/locales/Makefile.in b/mobile/android/base/locales/Makefile.in
index e94e52a7a153..7cb50de7c908 100644
--- a/mobile/android/base/locales/Makefile.in
+++ b/mobile/android/base/locales/Makefile.in
@@ -66,6 +66,7 @@ $(if $(MOZ_ANDROID_SHARED_FXACCOUNT_TYPE),,$(error Missing MOZ_ANDROID_SHARED_FX
 $(dir-strings-xml)/strings.xml: $(strings-xml-preqs)
 	$(call py_action,preprocessor, \
       $(DEFINES) \
+      $(ACDEFINES) \
 	  -DANDROID_PACKAGE_NAME=$(ANDROID_PACKAGE_NAME) \
 	  -DBRANDPATH='$(BRANDPATH)' \
 	  -DMOZ_ANDROID_SHARED_ACCOUNT_TYPE=$(MOZ_ANDROID_SHARED_ACCOUNT_TYPE) \
diff --git a/mobile/android/chrome/content/browser.js b/mobile/android/chrome/content/browser.js
index ffdf6eb9a077..f15791e33a46 100644
--- a/mobile/android/chrome/content/browser.js
+++ b/mobile/android/chrome/content/browser.js
@@ -421,11 +421,7 @@ var BrowserApp = {
 
     this.deck = document.getElementById("browsers");
 
-    // This check and BrowserEventHandler should be removed once we have
-    // switched over to the C++ APZ code
-    if (!AppConstants.MOZ_ANDROID_APZ) {
-      BrowserEventHandler.init();
-    }
+    BrowserEventHandler.init();
 
     ViewportHandler.init();
 
@@ -4776,14 +4772,19 @@ var BrowserEventHandler = {
   init: function init() {
     this._clickInZoomedView = false;
     Services.obs.addObserver(this, "Gesture:SingleTap", false);
-    Services.obs.addObserver(this, "Gesture:CancelTouch", false);
     Services.obs.addObserver(this, "Gesture:ClickInZoomedView", false);
-    Services.obs.addObserver(this, "Gesture:DoubleTap", false);
-    Services.obs.addObserver(this, "Gesture:Scroll", false);
-    Services.obs.addObserver(this, "dom-touch-listener-added", false);
+
+    if (!AppConstants.MOZ_ANDROID_APZ) {
+      Services.obs.addObserver(this, "Gesture:CancelTouch", false);
+      Services.obs.addObserver(this, "Gesture:DoubleTap", false);
+      Services.obs.addObserver(this, "Gesture:Scroll", false);
+      Services.obs.addObserver(this, "dom-touch-listener-added", false);
+      BrowserApp.deck.addEventListener("touchstart", this, true);
+    } else {
+      BrowserApp.deck.addEventListener("touchend", this, true);
+    }
 
     BrowserApp.deck.addEventListener("DOMUpdatePageReport", PopupBlockerObserver.onUpdatePageReport, false);
-    BrowserApp.deck.addEventListener("touchstart", this, true);
     BrowserApp.deck.addEventListener("MozMouseHittest", this, true);
 
     InitLater(() => BrowserApp.deck.addEventListener("click", InputWidgetHelper, true));
@@ -4803,6 +4804,11 @@ var BrowserEventHandler = {
       case 'touchstart':
         this._handleTouchStart(aEvent);
         break;
+      case 'touchend':
+        if (this._inCluster) {
+          aEvent.preventDefault();
+        }
+        break;
       case 'MozMouseHittest':
         this._handleRetargetedTouchStart(aEvent);
         break;
@@ -4987,16 +4993,20 @@ var BrowserEventHandler = {
           if (this._clickInZoomedView != true) {
             this._closeZoomedView();
           }
-          // The _highlightElement was chosen after fluffing the touch events
-          // that led to this SingleTap, so by fluffing the mouse events, they
-          // should find the same target since we fluff them again below.
-          this._sendMouseEvent("mousemove", x, y);
-          this._sendMouseEvent("mousedown", x, y);
-          this._sendMouseEvent("mouseup",   x, y);
+          if (!AppConstants.MOZ_ANDROID_APZ) {
+            // The _highlightElement was chosen after fluffing the touch events
+            // that led to this SingleTap, so by fluffing the mouse events, they
+            // should find the same target since we fluff them again below.
+            this._sendMouseEvent("mousemove", x, y);
+            this._sendMouseEvent("mousedown", x, y);
+            this._sendMouseEvent("mouseup",   x, y);
+          }
         }
         this._clickInZoomedView = false;
-        // scrollToFocusedInput does its own checks to find out if an element should be zoomed into
-        BrowserApp.scrollToFocusedInput(BrowserApp.selectedBrowser);
+        if (!AppConstants.MOZ_ANDROID_APZ) {
+          // scrollToFocusedInput does its own checks to find out if an element should be zoomed into
+          BrowserApp.scrollToFocusedInput(BrowserApp.selectedBrowser);
+        }
 
         this._cancelTapHighlight();
         break;
@@ -5071,7 +5081,9 @@ var BrowserEventHandler = {
   _highlightElement: null,
 
   _doTapHighlight: function _doTapHighlight(aElement) {
-    DOMUtils.setContentState(aElement, kStateActive);
+    if (!AppConstants.MOZ_ANDROID_APZ) {
+      DOMUtils.setContentState(aElement, kStateActive);
+    }
     this._highlightElement = aElement;
   },
 
@@ -5079,12 +5091,15 @@ var BrowserEventHandler = {
     if (!this._highlightElement)
       return;
 
-    // If the active element is in a sub-frame, we need to make that frame's document
-    // active to remove the element's active state.
-    if (this._highlightElement.ownerDocument != BrowserApp.selectedBrowser.contentWindow.document)
-      DOMUtils.setContentState(this._highlightElement.ownerDocument.documentElement, kStateActive);
+    if (!AppConstants.MOZ_ANDROID_APZ) {
+      // If the active element is in a sub-frame, we need to make that frame's document
+      // active to remove the element's active state.
+      if (this._highlightElement.ownerDocument != BrowserApp.selectedBrowser.contentWindow.document)
+        DOMUtils.setContentState(this._highlightElement.ownerDocument.documentElement, kStateActive);
+
+      DOMUtils.setContentState(BrowserApp.selectedBrowser.contentWindow.document.documentElement, kStateActive);
+    }
 
-    DOMUtils.setContentState(BrowserApp.selectedBrowser.contentWindow.document.documentElement, kStateActive);
     this._highlightElement = null;
   },
 
diff --git a/mobile/android/components/moz.build b/mobile/android/components/moz.build
index 1d143460fcb6..726318b57bc1 100644
--- a/mobile/android/components/moz.build
+++ b/mobile/android/components/moz.build
@@ -19,12 +19,9 @@ EXTRA_COMPONENTS += [
     'ColorPicker.js',
     'ContentDispatchChooser.js',
     'DirectoryProvider.js',
-    'FilePicker.js',
-    'HelperAppDialog.js',
     'ImageBlockingPolicy.js',
     'LoginManagerPrompter.js',
     'NSSDialogService.js',
-    'SiteSpecificUserAgent.js',
     'Snippets.js',
     'TabSource.js',
     'XPIDialogService.js',
@@ -33,14 +30,20 @@ EXTRA_COMPONENTS += [
 if not CONFIG['MOZ_B2GDROID']:
     EXTRA_COMPONENTS += [
         'ContentPermissionPrompt.js',
+        'FilePicker.js',
+        'HelperAppDialog.js',
         'PromptService.js',
         'SessionStore.js',
+        'SiteSpecificUserAgent.js',
         'WebappsUpdateTimer.js',
     ]
 
 if CONFIG['MOZ_PAY']:
+    if not CONFIG['MOZ_B2GDROID']:
+        EXTRA_COMPONENTS += [
+            'PaymentProviderStrategy.js',
+        ]
     EXTRA_COMPONENTS += [
-        'PaymentProviderStrategy.js',
         'PaymentsUI.js'
     ]
 
diff --git a/mobile/android/modules/moz.build b/mobile/android/modules/moz.build
index 9a641d43147e..5a1b521dcbe3 100644
--- a/mobile/android/modules/moz.build
+++ b/mobile/android/modules/moz.build
@@ -11,7 +11,6 @@ EXTRA_JS_MODULES += [
     'dbg-browser-actors.js',
     'DelayedInit.jsm',
     'DownloadNotifications.jsm',
-    'FxAccountsWebChannel.jsm',
     'HelperApps.jsm',
     'Home.jsm',
     'HomeProvider.jsm',
@@ -34,3 +33,8 @@ EXTRA_JS_MODULES += [
     'WebappManager.jsm',
     'WebappManagerWorker.js',
 ]
+
+if not CONFIG['MOZ_B2GDROID']:
+    EXTRA_JS_MODULES += [
+        'FxAccountsWebChannel.jsm',
+    ]
diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js
index 05fc1451621f..cd3ae642ff3c 100644
--- a/modules/libpref/init/all.js
+++ b/modules/libpref/init/all.js
@@ -471,10 +471,10 @@ pref("media.getusermedia.screensharing.enabled", true);
 #endif
 
 #ifdef RELEASE_BUILD
-pref("media.getusermedia.screensharing.allowed_domains", "webex.com,*.webex.com,ciscospark.com,*.ciscospark.com,projectsquared.com,*.projectsquared.com,*.room.co,room.co,beta.talky.io,talky.io,*.clearslide.com,appear.in,*.appear.in,tokbox.com,*.tokbox.com,*.sso.francetelecom.fr,*.si.francetelecom.fr,*.sso.infra.ftgroup,*.multimedia-conference.orange-business.com,*.espacecollaboration.orange-business.com,free.gotomeeting.com,g2m.me,*.g2m.me,example.com,*.mypurecloud.com,*.mypurecloud.com.au,spreed.me,*.spreed.me,*.spreed.com,air.mozilla.org");
+pref("media.getusermedia.screensharing.allowed_domains", "webex.com,*.webex.com,ciscospark.com,*.ciscospark.com,projectsquared.com,*.projectsquared.com,*.room.co,room.co,beta.talky.io,talky.io,*.clearslide.com,appear.in,*.appear.in,tokbox.com,*.tokbox.com,*.sso.francetelecom.fr,*.si.francetelecom.fr,*.sso.infra.ftgroup,*.multimedia-conference.orange-business.com,*.espacecollaboration.orange-business.com,free.gotomeeting.com,g2m.me,*.g2m.me,example.com,*.mypurecloud.com,*.mypurecloud.com.au,spreed.me,*.spreed.me,*.spreed.com,air.mozilla.org,*.circuit.com,*.yourcircuit.com,circuit.siemens.com,yourcircuit.siemens.com,circuitsandbox.net,*.unify.com,tandi.circuitsandbox.net");
 #else
  // temporary value, not intended for release - bug 1049087
-pref("media.getusermedia.screensharing.allowed_domains", "mozilla.github.io,webex.com,*.webex.com,ciscospark.com,*.ciscospark.com,projectsquared.com,*.projectsquared.com,*.room.co,room.co,beta.talky.io,talky.io,*.clearslide.com,appear.in,*.appear.in,tokbox.com,*.tokbox.com,*.sso.francetelecom.fr,*.si.francetelecom.fr,*.sso.infra.ftgroup,*.multimedia-conference.orange-business.com,*.espacecollaboration.orange-business.com,free.gotomeeting.com,g2m.me,*.g2m.me,example.com,*.mypurecloud.com,*.mypurecloud.com.au,spreed.me,*.spreed.me,*.spreed.com,air.mozilla.org");
+pref("media.getusermedia.screensharing.allowed_domains", "mozilla.github.io,webex.com,*.webex.com,ciscospark.com,*.ciscospark.com,projectsquared.com,*.projectsquared.com,*.room.co,room.co,beta.talky.io,talky.io,*.clearslide.com,appear.in,*.appear.in,tokbox.com,*.tokbox.com,*.sso.francetelecom.fr,*.si.francetelecom.fr,*.sso.infra.ftgroup,*.multimedia-conference.orange-business.com,*.espacecollaboration.orange-business.com,free.gotomeeting.com,g2m.me,*.g2m.me,example.com,*.mypurecloud.com,*.mypurecloud.com.au,spreed.me,*.spreed.me,*.spreed.com,air.mozilla.org,*.circuit.com,*.yourcircuit.com,circuit.siemens.com,yourcircuit.siemens.com,circuitsandbox.net,*.unify.com,tandi.circuitsandbox.net");
 #endif
 // OS/X 10.6 and XP have screen/window sharing off by default due to various issues - Caveat emptor
 pref("media.getusermedia.screensharing.allow_on_old_platforms", false);
diff --git a/mozglue/misc/StackWalk.cpp b/mozglue/misc/StackWalk.cpp
index cd8d177c8638..e064eb4766cd 100644
--- a/mozglue/misc/StackWalk.cpp
+++ b/mozglue/misc/StackWalk.cpp
@@ -54,6 +54,16 @@ static CriticalAddress gCriticalAddress;
 #include <CoreServices/CoreServices.h>
 #endif
 
+#if __GLIBC__ > 2 || (__GLIBC__ == 2 && __GLIBC_MINOR__ >= 1)
+#define HAVE___LIBC_STACK_END 1
+#else
+#define HAVE___LIBC_STACK_END 0
+#endif
+
+#if HAVE___LIBC_STACK_END
+extern MOZ_EXPORT void* __libc_stack_end; // from ld-linux.so
+#endif
+
 typedef void
 malloc_logger_t(uint32_t aType,
                 uintptr_t aArg1, uintptr_t aArg2, uintptr_t aArg3,
@@ -873,67 +883,6 @@ void DemangleSymbol(const char* aSymbol,
 #endif // MOZ_DEMANGLE_SYMBOLS
 }
 
-#if __GLIBC__ > 2 || (__GLIBC__ == 2 && __GLIBC_MINOR__ >= 1)
-#define HAVE___LIBC_STACK_END 1
-#else
-#define HAVE___LIBC_STACK_END 0
-#endif
-
-#if HAVE___LIBC_STACK_END
-extern MOZ_EXPORT void* __libc_stack_end; // from ld-linux.so
-#endif
-namespace mozilla {
-bool
-FramePointerStackWalk(MozWalkStackCallback aCallback, uint32_t aSkipFrames,
-                      uint32_t aMaxFrames, void* aClosure, void** bp,
-                      void* aStackEnd)
-{
-  // Stack walking code courtesy Kipp's "leaky".
-
-  int32_t skip = aSkipFrames;
-  uint32_t numFrames = 0;
-  while (bp) {
-    void** next = (void**)*bp;
-    // bp may not be a frame pointer on i386 if code was compiled with
-    // -fomit-frame-pointer, so do some sanity checks.
-    // (bp should be a frame pointer on ppc(64) but checking anyway may help
-    // a little if the stack has been corrupted.)
-    // We don't need to check against the begining of the stack because
-    // we can assume that bp > sp
-    if (next <= bp ||
-        next > aStackEnd ||
-        (long(next) & 3)) {
-      break;
-    }
-#if (defined(__ppc__) && defined(XP_MACOSX)) || defined(__powerpc64__)
-    // ppc mac or powerpc64 linux
-    void* pc = *(bp + 2);
-    bp += 3;
-#else // i386 or powerpc32 linux
-    void* pc = *(bp + 1);
-    bp += 2;
-#endif
-    if (IsCriticalAddress(pc)) {
-      return false;
-    }
-    if (--skip < 0) {
-      // Assume that the SP points to the BP of the function
-      // it called. We can't know the exact location of the SP
-      // but this should be sufficient for our use the SP
-      // to order elements on the stack.
-      numFrames++;
-      (*aCallback)(numFrames, pc, bp, aClosure);
-      if (aMaxFrames != 0 && numFrames == aMaxFrames) {
-        break;
-      }
-    }
-    bp = next;
-  }
-  return numFrames != 0;
-}
-
-} // namespace mozilla
-
 #define X86_OR_PPC (defined(__i386) || defined(PPC) || defined(__ppc__))
 #if X86_OR_PPC && (MOZ_STACKWALK_SUPPORTS_MACOSX || MOZ_STACKWALK_SUPPORTS_LINUX) // i386 or PPC Linux or Mac stackwalking code
 
@@ -1089,15 +1038,6 @@ MozStackWalk(MozWalkStackCallback aCallback, uint32_t aSkipFrames,
   return false;
 }
 
-namespace mozilla {
-MFBT_API bool
-FramePointerStackWalk(MozWalkStackCallback aCallback, uint32_t aSkipFrames,
-                      void* aClosure, void** aBp)
-{
-  return false;
-}
-}
-
 MFBT_API bool
 MozDescribeCodeAddress(void* aPC, MozCodeAddressDetails* aDetails)
 {
@@ -1112,6 +1052,71 @@ MozDescribeCodeAddress(void* aPC, MozCodeAddressDetails* aDetails)
 
 #endif
 
+#if defined(XP_WIN) || defined (XP_MACOSX) || defined (XP_LINUX)
+namespace mozilla {
+bool
+FramePointerStackWalk(MozWalkStackCallback aCallback, uint32_t aSkipFrames,
+                      uint32_t aMaxFrames, void* aClosure, void** bp,
+                      void* aStackEnd)
+{
+  // Stack walking code courtesy Kipp's "leaky".
+
+  int32_t skip = aSkipFrames;
+  uint32_t numFrames = 0;
+  while (bp) {
+    void** next = (void**)*bp;
+    // bp may not be a frame pointer on i386 if code was compiled with
+    // -fomit-frame-pointer, so do some sanity checks.
+    // (bp should be a frame pointer on ppc(64) but checking anyway may help
+    // a little if the stack has been corrupted.)
+    // We don't need to check against the begining of the stack because
+    // we can assume that bp > sp
+    if (next <= bp ||
+        next > aStackEnd ||
+        (long(next) & 3)) {
+      break;
+    }
+#if (defined(__ppc__) && defined(XP_MACOSX)) || defined(__powerpc64__)
+    // ppc mac or powerpc64 linux
+    void* pc = *(bp + 2);
+    bp += 3;
+#else // i386 or powerpc32 linux
+    void* pc = *(bp + 1);
+    bp += 2;
+#endif
+    if (IsCriticalAddress(pc)) {
+      return false;
+    }
+    if (--skip < 0) {
+      // Assume that the SP points to the BP of the function
+      // it called. We can't know the exact location of the SP
+      // but this should be sufficient for our use the SP
+      // to order elements on the stack.
+      numFrames++;
+      (*aCallback)(numFrames, pc, bp, aClosure);
+      if (aMaxFrames != 0 && numFrames == aMaxFrames) {
+        break;
+      }
+    }
+    bp = next;
+  }
+  return numFrames != 0;
+}
+} // namespace mozilla
+
+#else
+
+namespace mozilla {
+MFBT_API bool
+FramePointerStackWalk(MozWalkStackCallback aCallback, uint32_t aSkipFrames,
+                      void* aClosure, void** aBp)
+{
+  return false;
+}
+}
+
+#endif
+
 MFBT_API void
 MozFormatCodeAddressDetails(char* aBuffer, uint32_t aBufferSize,
                             uint32_t aFrameNumber, void* aPC,
diff --git a/netwerk/cache2/CacheIOThread.cpp b/netwerk/cache2/CacheIOThread.cpp
index 856ce2dd1b92..4edee9caf3d0 100644
--- a/netwerk/cache2/CacheIOThread.cpp
+++ b/netwerk/cache2/CacheIOThread.cpp
@@ -21,6 +21,7 @@ NS_IMPL_ISUPPORTS(CacheIOThread, nsIThreadObserver)
 CacheIOThread::CacheIOThread()
 : mMonitor("CacheIOThread")
 , mThread(nullptr)
+, mXPCOMThread(nullptr)
 , mLowestLevelWaiting(LAST_LEVEL)
 , mCurrentlyExecutingLevel(0)
 , mHasXPCOMEvents(false)
@@ -33,6 +34,11 @@ CacheIOThread::CacheIOThread()
 
 CacheIOThread::~CacheIOThread()
 {
+  if (mXPCOMThread) {
+    nsIThread *thread = mXPCOMThread;
+    thread->Release();
+  }
+
   sSelf = nullptr;
 #ifdef DEBUG
   for (uint32_t level = 0; level < LAST_LEVEL; ++level) {
@@ -182,7 +188,7 @@ void CacheIOThread::ThreadFunc()
     if (threadInternal)
       threadInternal->SetObserver(this);
 
-    mXPCOMThread.swap(xpcomThread);
+    mXPCOMThread = xpcomThread.forget().take();
 
     lock.NotifyAll();
 
@@ -203,7 +209,8 @@ loopStart:
         bool processedEvent;
         nsresult rv;
         do {
-          rv = mXPCOMThread->ProcessNextEvent(false, &processedEvent);
+          nsIThread *thread = mXPCOMThread;
+          rv = thread->ProcessNextEvent(false, &processedEvent);
         } while (NS_SUCCEEDED(rv) && processedEvent);
       }
 
diff --git a/netwerk/cache2/CacheIOThread.h b/netwerk/cache2/CacheIOThread.h
index 077d4d98db0b..d685fa32565a 100644
--- a/netwerk/cache2/CacheIOThread.h
+++ b/netwerk/cache2/CacheIOThread.h
@@ -88,7 +88,7 @@ private:
 
   mozilla::Monitor mMonitor;
   PRThread* mThread;
-  nsCOMPtr<nsIThread> mXPCOMThread;
+  Atomic<nsIThread *> mXPCOMThread;
   Atomic<uint32_t, Relaxed> mLowestLevelWaiting;
   uint32_t mCurrentlyExecutingLevel;
   nsTArray<nsCOMPtr<nsIRunnable> > mEventQueue[LAST_LEVEL];
diff --git a/netwerk/protocol/http/Http2Compression.cpp b/netwerk/protocol/http/Http2Compression.cpp
index 8fc30393de63..0f52ec6e4b0d 100644
--- a/netwerk/protocol/http/Http2Compression.cpp
+++ b/netwerk/protocol/http/Http2Compression.cpp
@@ -860,6 +860,9 @@ Http2Decompressor::DoLiteralInternal(nsACString &name, nsACString &value,
            value.BeginReading()));
       return NS_ERROR_ILLEGAL_VALUE;
     }
+    // Increment this to avoid always finding the same newline and looping
+    // forever
+    ++newline;
   }
 
   LOG(("Http2Decompressor::DoLiteralInternal value %s", value.BeginReading()));
diff --git a/netwerk/streamconv/nsStreamConverterService.cpp b/netwerk/streamconv/nsStreamConverterService.cpp
index 205d0a419c0a..9486f26214dc 100644
--- a/netwerk/streamconv/nsStreamConverterService.cpp
+++ b/netwerk/streamconv/nsStreamConverterService.cpp
@@ -192,19 +192,6 @@ typedef nsClassHashtable<nsCStringHashKey, BFSTableData> BFSHashTable;
 
 // nsObjectHashtable enumerator functions.
 
-// Initializes the BFS state table.
-static PLDHashOperator
-InitBFSTable(const nsACString &aKey, nsCOMArray<nsIAtom> *aData, void* aClosure) {
-    MOZ_ASSERT(aData, "no data in the table enumeration");
-
-    BFSHashTable *bfsTable = static_cast<BFSHashTable*>(aClosure);
-    if (!bfsTable) return PL_DHASH_STOP;
-
-    BFSTableData *data = new BFSTableData(aKey);
-    bfsTable->Put(aKey, data);
-    return PL_DHASH_NEXT;
-}
-
 class CStreamConvDeallocator : public nsDequeFunctor {
 public:
     virtual void* operator()(void* anObject) {
@@ -232,7 +219,11 @@ nsStreamConverterService::FindConverter(const char *aContractID, nsTArray<nsCStr
 
     // Create a corresponding color table for each vertex in the graph.
     BFSHashTable lBFSTable;
-    mAdjacencyList.EnumerateRead(InitBFSTable, &lBFSTable);
+    for (auto iter = mAdjacencyList.Iter(); !iter.Done(); iter.Next()) {
+        const nsACString &key = iter.Key();
+        MOZ_ASSERT(iter.UserData(), "no data in the table iteration");
+        lBFSTable.Put(key, new BFSTableData(key));
+    }
 
     NS_ASSERTION(lBFSTable.Count() == vertexCount, "strmconv BFS table init problem");
 
diff --git a/python/mozbuild/mozbuild/action/xpidl-process.py b/python/mozbuild/mozbuild/action/xpidl-process.py
index 3fc07418210a..07ea3cf967a3 100755
--- a/python/mozbuild/mozbuild/action/xpidl-process.py
+++ b/python/mozbuild/mozbuild/action/xpidl-process.py
@@ -45,7 +45,6 @@ def process(input_dir, inc_paths, cache_dir, header_dir, xpt_dir, deps_dir, modu
         idl.resolve([input_dir] + inc_paths, p)
 
         header_path = os.path.join(header_dir, '%s.h' % stem)
-        deps_path = os.path.join(deps_dir, '%s.pp' % stem)
 
         xpt = BytesIO()
         write_typelib(idl, xpt, path)
@@ -62,23 +61,24 @@ def process(input_dir, inc_paths, cache_dir, header_dir, xpt_dir, deps_dir, modu
     xpt_link(xpts.values()).write(xpt_path)
 
     rule.add_targets([xpt_path])
-    deps_path = os.path.join(deps_dir, '%s.pp' % module)
-    with FileAvoidWrite(deps_path) as fh:
-        mk.dump(fh)
+    if deps_dir:
+        deps_path = os.path.join(deps_dir, '%s.pp' % module)
+        with FileAvoidWrite(deps_path) as fh:
+            mk.dump(fh)
 
 
 def main(argv):
     parser = argparse.ArgumentParser()
     parser.add_argument('--cache-dir',
         help='Directory in which to find or write cached lexer data.')
+    parser.add_argument('--depsdir',
+        help='Directory in which to write dependency files.')
     parser.add_argument('inputdir',
         help='Directory in which to find source .idl files.')
     parser.add_argument('headerdir',
         help='Directory in which to write header files.')
     parser.add_argument('xptdir',
         help='Directory in which to write xpt file.')
-    parser.add_argument('depsdir',
-        help='Directory in which to write dependency files.')
     parser.add_argument('module',
         help='Final module name to use for linked output xpt file.')
     parser.add_argument('idls', nargs='+',
diff --git a/python/mozbuild/mozbuild/backend/fastermake.py b/python/mozbuild/mozbuild/backend/fastermake.py
index 4703cf9cdc42..079ac8d1c035 100644
--- a/python/mozbuild/mozbuild/backend/fastermake.py
+++ b/python/mozbuild/mozbuild/backend/fastermake.py
@@ -28,19 +28,6 @@ import os
 import sys
 
 
-class OverwriteInstallManifest(InstallManifest):
-    def _add_entry(self, dest, entry):
-        # Because of bug 1210703, we can't let the default behavior of
-        # InstallManifest._add_entry, which is to error out.
-        # To match the current behavior of the recursive make libs tier, we
-        # keep the last one given, but still warn about it.
-        if dest in self._dests:
-            print('Warning: Item already in manifest: %s' % dest,
-                  file=sys.stderr)
-
-        self._dests[dest] = entry
-
-
 class FasterMakeBackend(CommonBackend):
     def _init(self):
         super(FasterMakeBackend, self)._init()
@@ -50,7 +37,7 @@ class FasterMakeBackend(CommonBackend):
 
         self._manifest_entries = OrderedDefaultDict(list)
 
-        self._install_manifests = OrderedDefaultDict(OverwriteInstallManifest)
+        self._install_manifests = OrderedDefaultDict(InstallManifest)
 
         self._dependencies = OrderedDefaultDict(list)
 
diff --git a/python/mozbuild/mozpack/copier.py b/python/mozbuild/mozpack/copier.py
index 106da615b8ff..e8046b8751ef 100644
--- a/python/mozbuild/mozpack/copier.py
+++ b/python/mozbuild/mozpack/copier.py
@@ -35,17 +35,23 @@ class FileRegistry(object):
     def __init__(self):
         self._files = OrderedDict()
         self._required_directories = Counter()
+        self._partial_paths_cache = {}
 
     def _partial_paths(self, path):
         '''
         Turn "foo/bar/baz/zot" into ["foo/bar/baz", "foo/bar", "foo"].
         '''
-        partial_paths = []
-        partial_path = path
-        while partial_path:
-            partial_path = mozpath.dirname(partial_path)
-            if partial_path:
-                partial_paths.append(partial_path)
+        dir_name = path.rpartition('/')[0]
+        if not dir_name:
+            return []
+
+        partial_paths = self._partial_paths_cache.get(dir_name)
+        if partial_paths:
+            return partial_paths
+
+        partial_paths = [dir_name] + self._partial_paths(dir_name)
+
+        self._partial_paths_cache[dir_name] = partial_paths
         return partial_paths
 
     def add(self, path, content):
diff --git a/python/mozbuild/mozpack/test/test_copier.py b/python/mozbuild/mozpack/test/test_copier.py
index 2098d4a06719..cd3212beb486 100644
--- a/python/mozbuild/mozpack/test/test_copier.py
+++ b/python/mozbuild/mozpack/test/test_copier.py
@@ -38,6 +38,16 @@ class TestFileRegistry(MatchTestTemplate, unittest.TestCase):
             self.assertFalse(self.registry.contains(pattern))
         self.assertEqual(self.registry.match(pattern), result)
 
+    def test_partial_paths(self):
+        cases = {
+            'foo/bar/baz/zot': ['foo/bar/baz', 'foo/bar', 'foo'],
+            'foo/bar': ['foo'],
+            'bar': [],
+        }
+        reg = FileRegistry()
+        for path, parts in cases.iteritems():
+            self.assertEqual(reg._partial_paths(path), parts)
+
     def test_file_registry(self):
         self.registry = FileRegistry()
         self.registry.add('foo', GeneratedFile('foo'))
diff --git a/security/certverifier/CertVerifier.cpp b/security/certverifier/CertVerifier.cpp
index fda14b301b6b..069af61145d8 100644
--- a/security/certverifier/CertVerifier.cpp
+++ b/security/certverifier/CertVerifier.cpp
@@ -28,6 +28,7 @@ namespace mozilla { namespace psm {
 
 const CertVerifier::Flags CertVerifier::FLAG_LOCAL_ONLY = 1;
 const CertVerifier::Flags CertVerifier::FLAG_MUST_BE_EV = 2;
+const CertVerifier::Flags CertVerifier::FLAG_TLS_IGNORE_STATUS_REQUEST = 4;
 
 CertVerifier::CertVerifier(OcspDownloadConfig odc,
                            OcspStrictConfig osc,
@@ -583,6 +584,29 @@ CertVerifier::VerifySSLServerCert(CERTCertificate* peerCert,
     PR_SetError(MapResultToPRErrorCode(result), 0);
     return SECFailure;
   }
+
+  Input stapledOCSPResponseInput;
+  Input* responseInputPtr = nullptr;
+  if (stapledOCSPResponse) {
+    result = stapledOCSPResponseInput.Init(stapledOCSPResponse->data,
+                                           stapledOCSPResponse->len);
+    if (result != Success) {
+      // The stapled OCSP response was too big.
+      PR_SetError(SEC_ERROR_OCSP_MALFORMED_RESPONSE, 0);
+      return SECFailure;
+    }
+    responseInputPtr = &stapledOCSPResponseInput;
+  }
+
+  if (!(flags & FLAG_TLS_IGNORE_STATUS_REQUEST)) {
+    result = CheckTLSFeaturesAreSatisfied(peerCertInput, responseInputPtr);
+
+    if (result != Success) {
+      PR_SetError(MapResultToPRErrorCode(result), 0);
+      return SECFailure;
+    }
+  }
+
   Input hostnameInput;
   result = hostnameInput.Init(uint8_t_ptr_cast(hostname), strlen(hostname));
   if (result != Success) {
diff --git a/security/certverifier/CertVerifier.h b/security/certverifier/CertVerifier.h
index 4fd53b07ae53..98b2abc221f8 100644
--- a/security/certverifier/CertVerifier.h
+++ b/security/certverifier/CertVerifier.h
@@ -54,6 +54,8 @@ public:
   static const Flags FLAG_LOCAL_ONLY;
   // Don't perform fallback DV validation on EV validation failure.
   static const Flags FLAG_MUST_BE_EV;
+  // TLS feature request_status should be ignored
+  static const Flags FLAG_TLS_IGNORE_STATUS_REQUEST;
 
   // These values correspond to the SSL_OCSP_STAPLING telemetry.
   enum OCSPStaplingStatus {
diff --git a/security/manager/locales/en-US/chrome/pipnss/nsserrors.properties b/security/manager/locales/en-US/chrome/pipnss/nsserrors.properties
index 256557155226..e771b1586be3 100644
--- a/security/manager/locales/en-US/chrome/pipnss/nsserrors.properties
+++ b/security/manager/locales/en-US/chrome/pipnss/nsserrors.properties
@@ -319,3 +319,4 @@ MOZILLA_PKIX_ERROR_NOT_YET_VALID_ISSUER_CERTIFICATE=A certificate that is not ye
 MOZILLA_PKIX_ERROR_SIGNATURE_ALGORITHM_MISMATCH=The signature algorithm in the signature field of the certificate does not match the algorithm in its signatureAlgorithm field.
 MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING=The OCSP response does not include a status for the certificate being verified.
 MOZILLA_PKIX_ERROR_VALIDITY_TOO_LONG=The server presented a certificate that is valid for too long.
+MOZILLA_PKIX_ERROR_REQUIRED_TLS_FEATURE_MISSING=A required TLS feature is missing.
diff --git a/security/manager/ssl/SSLServerCertVerification.cpp b/security/manager/ssl/SSLServerCertVerification.cpp
index c70600fbcad6..b54e019c00fb 100644
--- a/security/manager/ssl/SSLServerCertVerification.cpp
+++ b/security/manager/ssl/SSLServerCertVerification.cpp
@@ -214,7 +214,7 @@ void StopSSLServerCertVerificationThreads()
 namespace {
 
 void
-LogInvalidCertError(TransportSecurityInfo* socketInfo,
+LogInvalidCertError(nsNSSSocketInfo* socketInfo,
                     PRErrorCode errorCode,
                     ::mozilla::psm::SSLErrorMessageType errorMessageType)
 {
@@ -236,7 +236,7 @@ class SSLServerCertVerificationResult : public nsRunnable
 public:
   NS_DECL_NSIRUNNABLE
 
-  SSLServerCertVerificationResult(TransportSecurityInfo* infoObject,
+  SSLServerCertVerificationResult(nsNSSSocketInfo* infoObject,
                                   PRErrorCode errorCode,
                                   Telemetry::ID telemetryID = Telemetry::HistogramCount,
                                   uint32_t telemetryValue = -1,
@@ -245,7 +245,7 @@ public:
 
   void Dispatch();
 private:
-  const RefPtr<TransportSecurityInfo> mInfoObject;
+  const RefPtr<nsNSSSocketInfo> mInfoObject;
 public:
   const PRErrorCode mErrorCode;
   const SSLErrorMessageType mErrorMessageType;
@@ -258,7 +258,7 @@ class CertErrorRunnable : public SyncRunnableBase
  public:
   CertErrorRunnable(const void* fdForLogging,
                     nsIX509Cert* cert,
-                    TransportSecurityInfo* infoObject,
+                    nsNSSSocketInfo* infoObject,
                     PRErrorCode defaultErrorCodeToReport,
                     uint32_t collectedErrors,
                     PRErrorCode errorCodeTrust,
@@ -282,7 +282,7 @@ private:
 
   const void* const mFdForLogging; // may become an invalid pointer; do not dereference
   const nsCOMPtr<nsIX509Cert> mCert;
-  const RefPtr<TransportSecurityInfo> mInfoObject;
+  const RefPtr<nsNSSSocketInfo> mInfoObject;
   const PRErrorCode mDefaultErrorCodeToReport;
   const uint32_t mCollectedErrors;
   const PRErrorCode mErrorCodeTrust;
@@ -622,7 +622,7 @@ CertErrorRunnable::RunOnTargetThread()
 CertErrorRunnable*
 CreateCertErrorRunnable(CertVerifier& certVerifier,
                         PRErrorCode defaultErrorCodeToReport,
-                        TransportSecurityInfo* infoObject,
+                        nsNSSSocketInfo* infoObject,
                         CERTCertificate* cert,
                         const void* fdForLogging,
                         uint32_t providerFlags,
@@ -715,7 +715,7 @@ public:
   // Must be called only on the socket transport thread
   static SECStatus Dispatch(const RefPtr<SharedCertVerifier>& certVerifier,
                             const void* fdForLogging,
-                            TransportSecurityInfo* infoObject,
+                            nsNSSSocketInfo* infoObject,
                             CERTCertificate* serverCert,
                             ScopedCERTCertList& peerCertChain,
                             SECItem* stapledOCSPResponse,
@@ -728,7 +728,7 @@ private:
   // Must be called only on the socket transport thread
   SSLServerCertVerificationJob(const RefPtr<SharedCertVerifier>& certVerifier,
                                const void* fdForLogging,
-                               TransportSecurityInfo* infoObject,
+                               nsNSSSocketInfo* infoObject,
                                CERTCertificate* cert,
                                CERTCertList* peerCertChain,
                                SECItem* stapledOCSPResponse,
@@ -737,7 +737,7 @@ private:
                                PRTime prtime);
   const RefPtr<SharedCertVerifier> mCertVerifier;
   const void* const mFdForLogging;
-  const RefPtr<TransportSecurityInfo> mInfoObject;
+  const RefPtr<nsNSSSocketInfo> mInfoObject;
   const ScopedCERTCertificate mCert;
   ScopedCERTCertList mPeerCertChain;
   const uint32_t mProviderFlags;
@@ -749,7 +749,7 @@ private:
 
 SSLServerCertVerificationJob::SSLServerCertVerificationJob(
     const RefPtr<SharedCertVerifier>& certVerifier, const void* fdForLogging,
-    TransportSecurityInfo* infoObject, CERTCertificate* cert,
+    nsNSSSocketInfo* infoObject, CERTCertificate* cert,
     CERTCertList* peerCertChain, SECItem* stapledOCSPResponse,
     uint32_t providerFlags, Time time, PRTime prtime)
   : mCertVerifier(certVerifier)
@@ -1200,7 +1200,7 @@ GatherSuccessfulValidationTelemetry(const ScopedCERTCertList& certList)
 
 SECStatus
 AuthCertificate(CertVerifier& certVerifier,
-                TransportSecurityInfo* infoObject,
+                nsNSSSocketInfo* infoObject,
                 CERTCertificate* cert,
                 ScopedCERTCertList& peerCertChain,
                 SECItem* stapledOCSPResponse,
@@ -1225,10 +1225,16 @@ AuthCertificate(CertVerifier& certVerifier,
   SignatureDigestStatus sigDigestStatus = SignatureDigestStatus::NeverChecked;
   PinningTelemetryInfo pinningTelemetryInfo;
 
+  int flags = 0;
+  if (!infoObject->SharedState().IsOCSPStaplingEnabled() ||
+      !infoObject->SharedState().IsOCSPMustStapleEnabled()) {
+    flags |= CertVerifier::FLAG_TLS_IGNORE_STATUS_REQUEST;
+  }
+
   rv = certVerifier.VerifySSLServerCert(cert, stapledOCSPResponse,
                                         time, infoObject,
                                         infoObject->GetHostNameRaw(),
-                                        saveIntermediates, 0, &certList,
+                                        saveIntermediates, flags, &certList,
                                         &evOidPolicy, &ocspStaplingStatus,
                                         &keySizeStatus, &sigDigestStatus,
                                         &pinningTelemetryInfo);
@@ -1327,7 +1333,7 @@ AuthCertificate(CertVerifier& certVerifier,
 SSLServerCertVerificationJob::Dispatch(
   const RefPtr<SharedCertVerifier>& certVerifier,
   const void* fdForLogging,
-  TransportSecurityInfo* infoObject,
+  nsNSSSocketInfo* infoObject,
   CERTCertificate* serverCert,
   ScopedCERTCertList& peerCertChain,
   SECItem* stapledOCSPResponse,
@@ -1662,7 +1668,7 @@ void EnsureServerVerificationInitialized()
 }
 
 SSLServerCertVerificationResult::SSLServerCertVerificationResult(
-        TransportSecurityInfo* infoObject, PRErrorCode errorCode,
+        nsNSSSocketInfo* infoObject, PRErrorCode errorCode,
         Telemetry::ID telemetryID, uint32_t telemetryValue,
         SSLErrorMessageType errorMessageType)
   : mInfoObject(infoObject)
diff --git a/security/manager/ssl/SharedSSLState.h b/security/manager/ssl/SharedSSLState.h
index 396f5fef6984..d134a189e2f1 100644
--- a/security/manager/ssl/SharedSSLState.h
+++ b/security/manager/ssl/SharedSSLState.h
@@ -39,12 +39,17 @@ public:
   {
     mOCSPStaplingEnabled = staplingEnabled;
   }
+  void SetOCSPMustStapleEnabled(bool mustStapleEnabled)
+  {
+    mOCSPMustStapleEnabled = mustStapleEnabled;
+  }
 
   // The following methods may be called from any thread
   bool SocketCreated();
   void NoteSocketCreated();
   static void NoteCertOverrideServiceInstantiated();
   bool IsOCSPStaplingEnabled() const { return mOCSPStaplingEnabled; }
+  bool IsOCSPMustStapleEnabled() const { return mOCSPMustStapleEnabled; }
 
 private:
   ~SharedSSLState();
@@ -61,6 +66,7 @@ private:
   Mutex mMutex;
   bool mSocketCreated;
   bool mOCSPStaplingEnabled;
+  bool mOCSPMustStapleEnabled;
 };
 
 SharedSSLState* PublicSSLState();
diff --git a/security/manager/ssl/nsNSSComponent.cpp b/security/manager/ssl/nsNSSComponent.cpp
index bdb0454f9c26..976793580b74 100644
--- a/security/manager/ssl/nsNSSComponent.cpp
+++ b/security/manager/ssl/nsNSSComponent.cpp
@@ -228,7 +228,6 @@ nsNSSComponent::nsNSSComponent()
   NS_ASSERTION( (0 == mInstanceCount), "nsNSSComponent is a singleton, but instantiated multiple times!");
   ++mInstanceCount;
   mShutdownObjectList = nsNSSShutDownList::construct();
-  mIsNetworkDown = false;
 }
 
 void
@@ -847,6 +846,11 @@ void nsNSSComponent::setValidationOptions(bool isInitialSetting,
   PublicSSLState()->SetOCSPStaplingEnabled(ocspStaplingEnabled);
   PrivateSSLState()->SetOCSPStaplingEnabled(ocspStaplingEnabled);
 
+  bool ocspMustStapleEnabled = Preferences::GetBool("security.ssl.enable_ocsp_must_staple",
+                                                    false);
+  PublicSSLState()->SetOCSPMustStapleEnabled(ocspMustStapleEnabled);
+  PrivateSSLState()->SetOCSPMustStapleEnabled(ocspMustStapleEnabled);
+
   CertVerifier::PinningMode pinningMode =
     static_cast<CertVerifier::PinningMode>
       (Preferences::GetInt("security.cert_pinning.enforcement_level",
@@ -1234,10 +1238,6 @@ nsNSSComponent::RandomUpdate(void* entropy, int32_t bufLen)
   return NS_OK;
 }
 
-static const char* const PROFILE_CHANGE_NET_TEARDOWN_TOPIC
-  = "profile-change-net-teardown";
-static const char* const PROFILE_CHANGE_NET_RESTORE_TOPIC
-  = "profile-change-net-restore";
 static const char* const PROFILE_BEFORE_CHANGE_TOPIC = "profile-before-change";
 static const char* const PROFILE_DO_CHANGE_TOPIC = "profile-do-change";
 
@@ -1247,7 +1247,7 @@ nsNSSComponent::Observe(nsISupports* aSubject, const char* aTopic,
 {
   if (nsCRT::strcmp(aTopic, PROFILE_BEFORE_CHANGE_TOPIC) == 0) {
     MOZ_LOG(gPIPNSSLog, LogLevel::Debug, ("receiving profile change topic\n"));
-    DoProfileBeforeChange(aSubject);
+    DoProfileBeforeChange();
   }
   else if (nsCRT::strcmp(aTopic, PROFILE_DO_CHANGE_TOPIC) == 0) {
     if (someData && NS_LITERAL_STRING("startup").Equals(someData)) {
@@ -1258,9 +1258,7 @@ nsNSSComponent::Observe(nsISupports* aSubject, const char* aTopic,
       // it again. We use the same cleanup functionality used when switching
       // profiles. The order of function calls must correspond to the order
       // of notifications sent by Profile Manager (nsProfile).
-      DoProfileChangeNetTeardown();
-      DoProfileBeforeChange(aSubject);
-      DoProfileChangeNetRestore();
+      DoProfileBeforeChange();
     }
 
     bool needsInit = true;
@@ -1332,6 +1330,7 @@ nsNSSComponent::Observe(nsISupports* aSubject, const char* aTopic,
                prefName.EqualsLiteral("security.OCSP.GET.enabled") ||
                prefName.EqualsLiteral("security.pki.cert_short_lifetime_in_days") ||
                prefName.EqualsLiteral("security.ssl.enable_ocsp_stapling") ||
+               prefName.EqualsLiteral("security.ssl.enable_ocsp_must_staple") ||
                prefName.EqualsLiteral("security.cert_pinning.enforcement_level") ||
                prefName.EqualsLiteral("security.pki.sha1_enforcement_level")) {
       MutexAutoLock lock(mutex);
@@ -1342,14 +1341,6 @@ nsNSSComponent::Observe(nsISupports* aSubject, const char* aTopic,
     if (clearSessionCache)
       SSL_ClearSessionCache();
   }
-  else if (nsCRT::strcmp(aTopic, PROFILE_CHANGE_NET_TEARDOWN_TOPIC) == 0) {
-    MOZ_LOG(gPIPNSSLog, LogLevel::Debug, ("receiving network teardown topic\n"));
-    DoProfileChangeNetTeardown();
-  }
-  else if (nsCRT::strcmp(aTopic, PROFILE_CHANGE_NET_RESTORE_TOPIC) == 0) {
-    MOZ_LOG(gPIPNSSLog, LogLevel::Debug, ("receiving network restore topic\n"));
-    DoProfileChangeNetRestore();
-  }
 
   return NS_OK;
 }
@@ -1436,25 +1427,13 @@ nsNSSComponent::RegisterObservers()
   observerService->AddObserver(this, NS_XPCOM_SHUTDOWN_OBSERVER_ID, false);
   observerService->AddObserver(this, PROFILE_BEFORE_CHANGE_TOPIC, false);
   observerService->AddObserver(this, PROFILE_DO_CHANGE_TOPIC, false);
-  observerService->AddObserver(this, PROFILE_CHANGE_NET_TEARDOWN_TOPIC, false);
-  observerService->AddObserver(this, PROFILE_CHANGE_NET_RESTORE_TOPIC, false);
 
   return NS_OK;
 }
 
 void
-nsNSSComponent::DoProfileChangeNetTeardown()
+nsNSSComponent::DoProfileBeforeChange()
 {
-  if (mCertVerificationThread)
-    mCertVerificationThread->requestExit();
-  mIsNetworkDown = true;
-}
-
-void
-nsNSSComponent::DoProfileBeforeChange(nsISupports* aSubject)
-{
-  NS_ASSERTION(mIsNetworkDown, "nsNSSComponent relies on profile manager to wait for synchronous shutdown of all network activity");
-
   bool needsCleanup = true;
 
   {
@@ -1473,15 +1452,6 @@ nsNSSComponent::DoProfileBeforeChange(nsISupports* aSubject)
   }
 }
 
-void
-nsNSSComponent::DoProfileChangeNetRestore()
-{
-  // XXX this doesn't work well, since nothing expects null pointers
-  deleteBackgroundThreads();
-  createBackgroundThreads();
-  mIsNetworkDown = false;
-}
-
 NS_IMETHODIMP
 nsNSSComponent::IsNSSInitialized(bool* initialized)
 {
diff --git a/security/manager/ssl/nsNSSComponent.h b/security/manager/ssl/nsNSSComponent.h
index 277d13922c42..26017e20b806 100644
--- a/security/manager/ssl/nsNSSComponent.h
+++ b/security/manager/ssl/nsNSSComponent.h
@@ -160,11 +160,7 @@ private:
   nsresult ConfigureInternalPKCS11Token();
   nsresult RegisterObservers();
 
-  // Methods that we use to handle the profile change notifications (and to
-  // synthesize a full profile change when we're just doing a profile startup):
-  void DoProfileChangeNetTeardown();
-  void DoProfileBeforeChange(nsISupports* aSubject);
-  void DoProfileChangeNetRestore();
+  void DoProfileBeforeChange();
 
   mozilla::Mutex mutex;
 
@@ -176,7 +172,6 @@ private:
 #ifndef MOZ_NO_SMART_CARDS
   SmartCardThreadList* mThreadList;
 #endif
-  bool mIsNetworkDown;
 
   void deleteBackgroundThreads();
   void createBackgroundThreads();
diff --git a/security/manager/ssl/tests/unit/head_psm.js b/security/manager/ssl/tests/unit/head_psm.js
index 5bb6b1abef17..54a5eca9cd72 100644
--- a/security/manager/ssl/tests/unit/head_psm.js
+++ b/security/manager/ssl/tests/unit/head_psm.js
@@ -75,6 +75,7 @@ const MOZILLA_PKIX_ERROR_V1_CERT_USED_AS_CA             = MOZILLA_PKIX_ERROR_BAS
 const MOZILLA_PKIX_ERROR_NOT_YET_VALID_CERTIFICATE      = MOZILLA_PKIX_ERROR_BASE +   5;
 const MOZILLA_PKIX_ERROR_NOT_YET_VALID_ISSUER_CERTIFICATE = MOZILLA_PKIX_ERROR_BASE + 6;
 const MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING = MOZILLA_PKIX_ERROR_BASE +   8;
+const MOZILLA_PKIX_ERROR_REQUIRED_TLS_FEATURE_MISSING   = MOZILLA_PKIX_ERROR_BASE +  10;
 
 // Supported Certificate Usages
 const certificateUsageSSLClient              = 0x0001;
diff --git a/security/manager/ssl/tests/unit/ocsp_certs/moz.build b/security/manager/ssl/tests/unit/ocsp_certs/moz.build
index 7d27a912931a..5dcf24f6a659 100644
--- a/security/manager/ssl/tests/unit/ocsp_certs/moz.build
+++ b/security/manager/ssl/tests/unit/ocsp_certs/moz.build
@@ -13,12 +13,19 @@ test_certificates = (
     'invalidDelegatedSignerKeyUsageCrlSigning.pem',
     'invalidDelegatedSignerNoExtKeyUsage.pem',
     'invalidDelegatedSignerWrongExtKeyUsage.pem',
+    'multi-tls-feature-bad-ee.pem',
+    'multi-tls-feature-good-ee.pem',
+    'must-staple-ee.pem',
+    'must-staple-ee-with-must-staple-int.pem',
+    'must-staple-missing-ee.pem',
     'ocspEEWithIntermediate.pem',
     'ocspOtherEndEntity.pem',
     'other-test-ca.pem',
     'rsa-1016-keysizeDelegatedSigner.pem',
     'test-ca.pem',
     'test-int.pem',
+    'test-multi-tls-feature-int.pem',
+    'test-must-staple-int.pem',
 )
 
 for test_certificate in test_certificates:
diff --git a/security/manager/ssl/tests/unit/ocsp_certs/multi-tls-feature-bad-ee.pem.certspec b/security/manager/ssl/tests/unit/ocsp_certs/multi-tls-feature-bad-ee.pem.certspec
new file mode 100644
index 000000000000..3fa2793b3040
--- /dev/null
+++ b/security/manager/ssl/tests/unit/ocsp_certs/multi-tls-feature-bad-ee.pem.certspec
@@ -0,0 +1,4 @@
+issuer:Test Intermediate With Multiple TLS Features
+subject:Multi TLS Feature Test End-Entity
+extension:subjectAlternativeName:*.example.com
+extension:TLSFeature:OCSPMustStaple
diff --git a/security/manager/ssl/tests/unit/ocsp_certs/multi-tls-feature-good-ee.pem.certspec b/security/manager/ssl/tests/unit/ocsp_certs/multi-tls-feature-good-ee.pem.certspec
new file mode 100644
index 000000000000..7a8dd223d042
--- /dev/null
+++ b/security/manager/ssl/tests/unit/ocsp_certs/multi-tls-feature-good-ee.pem.certspec
@@ -0,0 +1,4 @@
+issuer:Test Intermediate With Multiple TLS Features
+subject:Multi TLS Feature Test End-Entity
+extension:subjectAlternativeName:*.example.com
+extension:TLSFeature:OCSPMustStaple,6
diff --git a/security/manager/ssl/tests/unit/ocsp_certs/must-staple-ee-with-must-staple-int.pem.certspec b/security/manager/ssl/tests/unit/ocsp_certs/must-staple-ee-with-must-staple-int.pem.certspec
new file mode 100644
index 000000000000..352a60675d0b
--- /dev/null
+++ b/security/manager/ssl/tests/unit/ocsp_certs/must-staple-ee-with-must-staple-int.pem.certspec
@@ -0,0 +1,4 @@
+issuer:Test Intermediate With Must-Staple
+subject:Test End-entity
+extension:subjectAlternativeName:*.example.com
+extension:TLSFeature:OCSPMustStaple
diff --git a/security/manager/ssl/tests/unit/ocsp_certs/must-staple-ee.pem.certspec b/security/manager/ssl/tests/unit/ocsp_certs/must-staple-ee.pem.certspec
new file mode 100644
index 000000000000..2cda40dc04bd
--- /dev/null
+++ b/security/manager/ssl/tests/unit/ocsp_certs/must-staple-ee.pem.certspec
@@ -0,0 +1,4 @@
+issuer:Test CA
+subject:Test End-entity
+extension:subjectAlternativeName:*.example.com
+extension:TLSFeature:OCSPMustStaple
diff --git a/security/manager/ssl/tests/unit/ocsp_certs/must-staple-missing-ee.pem.certspec b/security/manager/ssl/tests/unit/ocsp_certs/must-staple-missing-ee.pem.certspec
new file mode 100644
index 000000000000..8e4a6ac0c54d
--- /dev/null
+++ b/security/manager/ssl/tests/unit/ocsp_certs/must-staple-missing-ee.pem.certspec
@@ -0,0 +1,3 @@
+issuer:Test Intermediate With Must-Staple
+subject:Test End-entity
+extension:subjectAlternativeName:*.example.com
diff --git a/security/manager/ssl/tests/unit/ocsp_certs/test-multi-tls-feature-int.pem.certspec b/security/manager/ssl/tests/unit/ocsp_certs/test-multi-tls-feature-int.pem.certspec
new file mode 100644
index 000000000000..3f0e925aae12
--- /dev/null
+++ b/security/manager/ssl/tests/unit/ocsp_certs/test-multi-tls-feature-int.pem.certspec
@@ -0,0 +1,5 @@
+issuer:Test CA
+subject:Test Intermediate With Multiple TLS Features
+extension:basicConstraints:cA,
+extension:keyUsage:cRLSign,keyCertSign
+extension:TLSFeature:OCSPMustStaple,6
diff --git a/security/manager/ssl/tests/unit/ocsp_certs/test-must-staple-int.pem.certspec b/security/manager/ssl/tests/unit/ocsp_certs/test-must-staple-int.pem.certspec
new file mode 100644
index 000000000000..7c29aa0ad13c
--- /dev/null
+++ b/security/manager/ssl/tests/unit/ocsp_certs/test-must-staple-int.pem.certspec
@@ -0,0 +1,5 @@
+issuer:Test CA
+subject:Test Intermediate With Must-Staple
+extension:basicConstraints:cA,
+extension:keyUsage:cRLSign,keyCertSign
+extension:TLSFeature:OCSPMustStaple
diff --git a/security/manager/ssl/tests/unit/pycert.py b/security/manager/ssl/tests/unit/pycert.py
index e0616c3ced1a..461a81fa235b 100755
--- a/security/manager/ssl/tests/unit/pycert.py
+++ b/security/manager/ssl/tests/unit/pycert.py
@@ -33,6 +33,7 @@ authorityInformationAccess:<OCSP URI>
 certificatePolicies:<policy OID>
 nameConstraints:{permitted,excluded}:[<dNSName|directoryName>,...]
 nsCertType:sslServer
+TLSFeature:[<TLSFeature>,...]
 
 Where:
   [] indicates an optional field or component of a field
@@ -69,6 +70,10 @@ a nameConstraints extension, the implicit form may not be used.
 
 If an extension name has '[critical]' after it, it will be marked as
 critical. Otherwise (by default), it will not be marked as critical.
+
+TLSFeature values can either consist of a named value (currently only
+'OCSPMustStaple' which corresponds to status_request) or a numeric tls feature
+value (see rfc7633 for more information).
 """
 
 from pyasn1.codec.der import decoder
@@ -191,6 +196,13 @@ class UnknownNSCertTypeError(UnknownBaseError):
         UnknownBaseError.__init__(self, value)
         self.category = 'nsCertType'
 
+class UnknownTLSFeature(UnknownBaseError):
+    """Helper exception type to handle unknown TLS Features."""
+
+    def __init__(self, value):
+        UnknownBaseError.__init__(self, value)
+        self.category = 'TLSFeature'
+
 
 def getASN1Tag(asn1Type):
     """Helper function for returning the base tag value of a given
@@ -412,6 +424,8 @@ class Certificate(object):
             self.addNameConstraints(value, critical)
         elif extensionType == 'nsCertType':
             self.addNSCertType(value, critical)
+        elif extensionType == 'TLSFeature':
+            self.addTLSFeature(value, critical)
         else:
             raise UnknownExtensionTypeError(extensionType)
 
@@ -536,6 +550,25 @@ class Certificate(object):
         self.addExtension(univ.ObjectIdentifier('2.16.840.1.113730.1.1'), univ.BitString("'01'B"),
                           critical)
 
+    def addTLSFeature(self, features, critical):
+        namedFeatures = {'OCSPMustStaple': 5}
+        featureList = [f.strip() for f in features.split(',')]
+        print "FeatureList is",featureList
+        sequence = univ.Sequence()
+        for feature in featureList:
+            featureValue = 0
+            try:
+                featureValue = int(feature)
+            except:
+                try:
+                    featureValue = namedFeatures[feature]
+                except:
+                    raise UnknownTLSFeature(feature)
+            sequence.setComponentByPosition(len(sequence),
+                                            univ.Integer(featureValue))
+        self.addExtension(univ.ObjectIdentifier('1.3.6.1.5.5.7.1.24'), sequence,
+                          critical)
+
     def getVersion(self):
         return rfc2459.Version(self.versionValue).subtype(
             explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))
diff --git a/security/manager/ssl/tests/unit/test_ocsp_stapling.js b/security/manager/ssl/tests/unit/test_ocsp_stapling.js
index ac2c85ebb537..da703d179ad6 100644
--- a/security/manager/ssl/tests/unit/test_ocsp_stapling.js
+++ b/security/manager/ssl/tests/unit/test_ocsp_stapling.js
@@ -155,6 +155,61 @@ function add_tests() {
   add_ocsp_test("ocsp-stapling-delegated-wrong-extKeyUsage.example.com",
                 SEC_ERROR_OCSP_INVALID_SIGNING_CERT, true);
 
+  // TLS Must Staple tests
+  add_test(function() {
+    clearSessionCache();
+    Services.prefs.setBoolPref("security.ssl.enable_ocsp_must_staple", true);
+    run_next_test();
+  });
+
+  // ensure that the chain is checked for required features in children:
+  // First a case where intermediate and ee both have the extension
+  add_ocsp_test("ocsp-stapling-must-staple-ee-with-must-staple-int.example.com",
+                PRErrorCodeSuccess, true);
+
+  // Next, a case where it's present in the intermediate, not the ee
+  add_ocsp_test("ocsp-stapling-plain-ee-with-must-staple-int.example.com",
+                MOZILLA_PKIX_ERROR_REQUIRED_TLS_FEATURE_MISSING, true);
+
+  // We disable OCSP must-staple in the next two tests so we can perform checks
+  // on TLS Features in the chain without needint to support the TLS
+  // extension values used.
+  // Test an issuer with multiple TLS features in matched in the EE
+  add_ocsp_test("multi-tls-feature-good.example.com",
+                PRErrorCodeSuccess, false);
+
+  // Finally, an inssuer with multiple TLS features not matched by the EE
+  add_ocsp_test("multi-tls-feature-bad.example.com",
+                MOZILLA_PKIX_ERROR_REQUIRED_TLS_FEATURE_MISSING, false);
+
+
+
+  // Now a bunch of operations with only a must-staple ee
+  add_ocsp_test("ocsp-stapling-must-staple.example.com",
+                PRErrorCodeSuccess, true);
+
+  add_ocsp_test("ocsp-stapling-must-staple-revoked.example.com",
+                SEC_ERROR_REVOKED_CERTIFICATE, true);
+
+  add_ocsp_test("ocsp-stapling-must-staple-missing.example.com",
+                MOZILLA_PKIX_ERROR_REQUIRED_TLS_FEATURE_MISSING, true);
+
+  add_ocsp_test("ocsp-stapling-must-staple-empty.example.com",
+                SEC_ERROR_OCSP_MALFORMED_RESPONSE, true);
+
+  add_ocsp_test("ocsp-stapling-must-staple-missing.example.com",
+                PRErrorCodeSuccess, false);
+
+  // check that disabling must-staple works
+  add_test(function() {
+    clearSessionCache();
+    Services.prefs.setBoolPref("security.ssl.enable_ocsp_must_staple", false);
+    run_next_test();
+  });
+
+  add_ocsp_test("ocsp-stapling-must-staple-missing.example.com",
+                PRErrorCodeSuccess, true);
+
   // ocsp-stapling-expired.example.com and
   // ocsp-stapling-expired-fresh-ca.example.com are handled in
   // test_ocsp_stapling_expired.js
@@ -175,13 +230,13 @@ function check_ocsp_stapling_telemetry() {
                     .snapshot();
   equal(histogram.counts[0], 0,
         "Should have 0 connections for unused histogram bucket 0");
-  equal(histogram.counts[1], 5,
+  equal(histogram.counts[1], 7,
         "Actual and expected connections with a good response should match");
-  equal(histogram.counts[2], 18,
+  equal(histogram.counts[2], 22,
         "Actual and expected connections with no stapled response should match");
   equal(histogram.counts[3], 0,
         "Actual and expected connections with an expired response should match");
-  equal(histogram.counts[4], 21,
+  equal(histogram.counts[4], 23,
         "Actual and expected connections with bad responses should match");
   run_next_test();
 }
diff --git a/security/manager/ssl/tests/unit/test_pkcs11_safe_mode.js b/security/manager/ssl/tests/unit/test_pkcs11_safe_mode.js
index 64f471f068b4..39e8a0f1e550 100644
--- a/security/manager/ssl/tests/unit/test_pkcs11_safe_mode.js
+++ b/security/manager/ssl/tests/unit/test_pkcs11_safe_mode.js
@@ -69,7 +69,6 @@ function testFindTestModule(shouldSucceed) {
 
 function simulateShutdown() {
   let psmComponent = Cc["@mozilla.org/psm;1"].getService(Ci.nsIObserver);
-  psmComponent.observe(null, "profile-change-net-teardown", null);
   psmComponent.observe(null, "profile-before-change", null);
   psmComponent.observe(null, "xpcom-shutdown", null);
 }
diff --git a/security/manager/ssl/tests/unit/tlsserver/cmd/OCSPStaplingServer.cpp b/security/manager/ssl/tests/unit/tlsserver/cmd/OCSPStaplingServer.cpp
index 0d61fdef0f0d..fa7160c32335 100644
--- a/security/manager/ssl/tests/unit/tlsserver/cmd/OCSPStaplingServer.cpp
+++ b/security/manager/ssl/tests/unit/tlsserver/cmd/OCSPStaplingServer.cpp
@@ -21,40 +21,48 @@ using namespace mozilla::test;
 
 const OCSPHost sOCSPHosts[] =
 {
-  { "ocsp-stapling-good.example.com", ORTGood, nullptr },
-  { "ocsp-stapling-revoked.example.com", ORTRevoked, nullptr },
-  { "ocsp-stapling-revoked-old.example.com", ORTRevokedOld, nullptr },
-  { "ocsp-stapling-unknown.example.com", ORTUnknown, nullptr },
-  { "ocsp-stapling-unknown-old.example.com", ORTUnknownOld, nullptr },
-  { "ocsp-stapling-good-other.example.com", ORTGoodOtherCert, "ocspOtherEndEntity" },
-  { "ocsp-stapling-good-other-ca.example.com", ORTGoodOtherCA, "other-test-ca" },
-  { "ocsp-stapling-expired.example.com", ORTExpired, nullptr },
-  { "ocsp-stapling-expired-fresh-ca.example.com", ORTExpiredFreshCA, nullptr },
-  { "ocsp-stapling-none.example.com", ORTNone, nullptr },
-  { "ocsp-stapling-empty.example.com", ORTEmpty, nullptr },
-  { "ocsp-stapling-malformed.example.com", ORTMalformed, nullptr },
-  { "ocsp-stapling-srverr.example.com", ORTSrverr, nullptr },
-  { "ocsp-stapling-trylater.example.com", ORTTryLater, nullptr },
-  { "ocsp-stapling-needssig.example.com", ORTNeedsSig, nullptr },
-  { "ocsp-stapling-unauthorized.example.com", ORTUnauthorized, nullptr },
-  { "ocsp-stapling-with-intermediate.example.com", ORTGood, "ocspEEWithIntermediate" },
-  { "ocsp-stapling-bad-signature.example.com", ORTBadSignature, nullptr },
-  { "ocsp-stapling-skip-responseBytes.example.com", ORTSkipResponseBytes, nullptr },
-  { "ocsp-stapling-critical-extension.example.com", ORTCriticalExtension, nullptr },
-  { "ocsp-stapling-noncritical-extension.example.com", ORTNoncriticalExtension, nullptr },
-  { "ocsp-stapling-empty-extensions.example.com", ORTEmptyExtensions, nullptr },
-  { "ocsp-stapling-delegated-included.example.com", ORTDelegatedIncluded, "delegatedSigner" },
-  { "ocsp-stapling-delegated-included-last.example.com", ORTDelegatedIncludedLast, "delegatedSigner" },
-  { "ocsp-stapling-delegated-missing.example.com", ORTDelegatedMissing, "delegatedSigner" },
-  { "ocsp-stapling-delegated-missing-multiple.example.com", ORTDelegatedMissingMultiple, "delegatedSigner" },
-  { "ocsp-stapling-delegated-no-extKeyUsage.example.com", ORTDelegatedIncluded, "invalidDelegatedSignerNoExtKeyUsage" },
-  { "ocsp-stapling-delegated-from-intermediate.example.com", ORTDelegatedIncluded, "invalidDelegatedSignerFromIntermediate" },
-  { "ocsp-stapling-delegated-keyUsage-crlSigning.example.com", ORTDelegatedIncluded, "invalidDelegatedSignerKeyUsageCrlSigning" },
-  { "ocsp-stapling-delegated-wrong-extKeyUsage.example.com", ORTDelegatedIncluded, "invalidDelegatedSignerWrongExtKeyUsage" },
-  { "ocsp-stapling-ancient-valid.example.com", ORTAncientAlmostExpired, nullptr},
-  { "keysize-ocsp-delegated.example.com", ORTDelegatedIncluded, "rsa-1016-keysizeDelegatedSigner" },
-  { "revoked-ca-cert-used-as-end-entity.example.com", ORTRevoked, "ca-used-as-end-entity" },
-  { nullptr, ORTNull, nullptr }
+  { "ocsp-stapling-good.example.com", ORTGood, nullptr, nullptr },
+  { "ocsp-stapling-revoked.example.com", ORTRevoked, nullptr, nullptr },
+  { "ocsp-stapling-revoked-old.example.com", ORTRevokedOld, nullptr, nullptr },
+  { "ocsp-stapling-unknown.example.com", ORTUnknown, nullptr, nullptr },
+  { "ocsp-stapling-unknown-old.example.com", ORTUnknownOld, nullptr, nullptr },
+  { "ocsp-stapling-good-other.example.com", ORTGoodOtherCert, "ocspOtherEndEntity", nullptr },
+  { "ocsp-stapling-good-other-ca.example.com", ORTGoodOtherCA, "other-test-ca", nullptr },
+  { "ocsp-stapling-expired.example.com", ORTExpired, nullptr, nullptr },
+  { "ocsp-stapling-expired-fresh-ca.example.com", ORTExpiredFreshCA, nullptr, nullptr },
+  { "ocsp-stapling-none.example.com", ORTNone, nullptr, nullptr },
+  { "ocsp-stapling-empty.example.com", ORTEmpty, nullptr, nullptr },
+  { "ocsp-stapling-malformed.example.com", ORTMalformed, nullptr, nullptr },
+  { "ocsp-stapling-srverr.example.com", ORTSrverr, nullptr, nullptr },
+  { "ocsp-stapling-trylater.example.com", ORTTryLater, nullptr, nullptr },
+  { "ocsp-stapling-needssig.example.com", ORTNeedsSig, nullptr, nullptr },
+  { "ocsp-stapling-unauthorized.example.com", ORTUnauthorized, nullptr, nullptr },
+  { "ocsp-stapling-with-intermediate.example.com", ORTGood, nullptr, "ocspEEWithIntermediate" },
+  { "ocsp-stapling-bad-signature.example.com", ORTBadSignature, nullptr, nullptr },
+  { "ocsp-stapling-skip-responseBytes.example.com", ORTSkipResponseBytes, nullptr, nullptr },
+  { "ocsp-stapling-critical-extension.example.com", ORTCriticalExtension, nullptr, nullptr },
+  { "ocsp-stapling-noncritical-extension.example.com", ORTNoncriticalExtension, nullptr, nullptr },
+  { "ocsp-stapling-empty-extensions.example.com", ORTEmptyExtensions, nullptr, nullptr },
+  { "ocsp-stapling-delegated-included.example.com", ORTDelegatedIncluded, "delegatedSigner", nullptr },
+  { "ocsp-stapling-delegated-included-last.example.com", ORTDelegatedIncludedLast, "delegatedSigner", nullptr },
+  { "ocsp-stapling-delegated-missing.example.com", ORTDelegatedMissing, "delegatedSigner", nullptr },
+  { "ocsp-stapling-delegated-missing-multiple.example.com", ORTDelegatedMissingMultiple, "delegatedSigner", nullptr },
+  { "ocsp-stapling-delegated-no-extKeyUsage.example.com", ORTDelegatedIncluded, "invalidDelegatedSignerNoExtKeyUsage", nullptr },
+  { "ocsp-stapling-delegated-from-intermediate.example.com", ORTDelegatedIncluded, "invalidDelegatedSignerFromIntermediate", nullptr },
+  { "ocsp-stapling-delegated-keyUsage-crlSigning.example.com", ORTDelegatedIncluded, "invalidDelegatedSignerKeyUsageCrlSigning", nullptr },
+  { "ocsp-stapling-delegated-wrong-extKeyUsage.example.com", ORTDelegatedIncluded, "invalidDelegatedSignerWrongExtKeyUsage", nullptr },
+  { "ocsp-stapling-ancient-valid.example.com", ORTAncientAlmostExpired, nullptr, nullptr },
+  { "keysize-ocsp-delegated.example.com", ORTDelegatedIncluded, "rsa-1016-keysizeDelegatedSigner", nullptr },
+  { "revoked-ca-cert-used-as-end-entity.example.com", ORTRevoked, "ca-used-as-end-entity", nullptr },
+  { "ocsp-stapling-must-staple.example.com", ORTGood, nullptr, "must-staple-ee" },
+  { "ocsp-stapling-must-staple-revoked.example.com", ORTRevoked, nullptr, "must-staple-ee" },
+  { "ocsp-stapling-must-staple-missing.example.com", ORTNone, nullptr, "must-staple-ee" },
+  { "ocsp-stapling-must-staple-empty.example.com", ORTEmpty, nullptr, "must-staple-ee" },
+  { "ocsp-stapling-must-staple-ee-with-must-staple-int.example.com", ORTGood, nullptr, "must-staple-ee-with-must-staple-int" },
+  { "ocsp-stapling-plain-ee-with-must-staple-int.example.com", ORTGood, nullptr, "must-staple-missing-ee" },
+  { "multi-tls-feature-good.example.com", ORTNone, nullptr, "multi-tls-feature-good-ee" },
+  { "multi-tls-feature-bad.example.com", ORTNone, nullptr, "multi-tls-feature-bad-ee" },
+  { nullptr, ORTNull, nullptr, nullptr }
 };
 
 int32_t
@@ -71,13 +79,8 @@ DoSNISocketConfig(PRFileDesc *aFd, const SECItem *aSrvNameArr,
     fprintf(stderr, "found pre-defined host '%s'\n", host->mHostName);
   }
 
-  const char *certNickname;
-  if (strcmp(host->mHostName,
-             "ocsp-stapling-with-intermediate.example.com") == 0) {
-    certNickname = host->mAdditionalCertName;
-  } else {
-    certNickname = DEFAULT_CERT_NICKNAME;
-  }
+  const char *certNickname = host->mServerCertName ? host->mServerCertName
+                                                   : DEFAULT_CERT_NICKNAME;
 
   ScopedCERTCertificate cert;
   SSLKEAType certKEA;
diff --git a/security/manager/ssl/tests/unit/tlsserver/lib/OCSPCommon.h b/security/manager/ssl/tests/unit/tlsserver/lib/OCSPCommon.h
index b2466074042b..8121a3ec26fa 100644
--- a/security/manager/ssl/tests/unit/tlsserver/lib/OCSPCommon.h
+++ b/security/manager/ssl/tests/unit/tlsserver/lib/OCSPCommon.h
@@ -48,6 +48,7 @@ struct OCSPHost
   const char *mHostName;
   OCSPResponseType mORT;
   const char *mAdditionalCertName; // useful for ORTGoodOtherCert, etc.
+  const char *mServerCertName;
 };
 
 SECItemArray *
diff --git a/security/nss/TAG-INFO b/security/nss/TAG-INFO
index f932004a2054..8882305ffb2c 100644
--- a/security/nss/TAG-INFO
+++ b/security/nss/TAG-INFO
@@ -1 +1 @@
-NSS_3_21_Beta3
+NSS_3_21_RTM
diff --git a/security/nss/cmd/modutil/pk11.c b/security/nss/cmd/modutil/pk11.c
index d630e4eee719..c0a6ccb712d8 100644
--- a/security/nss/cmd/modutil/pk11.c
+++ b/security/nss/cmd/modutil/pk11.c
@@ -712,6 +712,8 @@ ChangePW(char *tokenName, char *pwFile, char *newpwFile)
 	    newpw2 = SECU_GetPasswordString(NULL, "Re-enter new password: ");
 	    if(strcmp(newpw, newpw2)) {
 		PR_fprintf(PR_STDOUT, msgStrings[PW_MATCH_MSG]);
+		PORT_ZFree(newpw, strlen(newpw));
+		PORT_ZFree(newpw2, strlen(newpw2));
 	    } else {
 		matching = PR_TRUE;
 	    }
@@ -738,16 +740,13 @@ ChangePW(char *tokenName, char *pwFile, char *newpwFile)
 
 loser:
     if(oldpw) {
-	memset(oldpw, 0, strlen(oldpw));
-	PORT_Free(oldpw);
+	PORT_ZFree(oldpw, strlen(oldpw));
     }
     if(newpw) {
-	memset(newpw, 0, strlen(newpw));
-	PORT_Free(newpw);
+	PORT_ZFree(newpw, strlen(newpw));
     }
     if(newpw2) {
-	memset(newpw2, 0, strlen(newpw2));
-	PORT_Free(newpw2);
+	PORT_ZFree(newpw2, strlen(newpw2));
     }
     PK11_FreeSlot(slot);
 
diff --git a/security/nss/coreconf/Darwin.mk b/security/nss/coreconf/Darwin.mk
index 85af903efbeb..9c992289fcc2 100644
--- a/security/nss/coreconf/Darwin.mk
+++ b/security/nss/coreconf/Darwin.mk
@@ -4,6 +4,7 @@
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 include $(CORE_DEPTH)/coreconf/UNIX.mk
+include $(CORE_DEPTH)/coreconf/Werror.mk
 
 DEFAULT_COMPILER = gcc
 
@@ -81,44 +82,7 @@ endif
 # definitions so that the linker can catch multiply-defined symbols.
 # Also, common symbols are not allowed with Darwin dynamic libraries.
 
-OS_CFLAGS	= $(DSO_CFLAGS) $(OS_REL_CFLAGS) -Wall -fno-common -pipe -DDARWIN -DHAVE_STRERROR -DHAVE_BSD_FLOCK $(DARWIN_SDK_CFLAGS)
-
-# This tests to see if enabling the warning is possible before
-# setting an option to disable it.
-disable_warning=$(shell $(CC) -x c -E -Werror -W$(1) /dev/null >/dev/null 2>&1 && echo -Wno-$(1)) 
-
-COMPILER_NAME = $(shell $(CC) -? 2>&1 >/dev/null | sed -e 's/:.*//;1q')
-ifeq ($(COMPILER_NAME),clang)
-  # -Qunused-arguments : clang objects to arguments that it doesn't understand
-  #    and fixing this would require rearchitecture
-  OS_CFLAGS += -Qunused-arguments
-  # -Wno-parentheses-equality : because clang warns about macro expansions
-  OS_CFLAGS += $(call disable_warning,parentheses-equality)
-endif
-
-ifndef NSS_ENABLE_WERROR
-  ifeq ($(COMPILER_NAME),clang)
-    NSS_ENABLE_WERROR = 1
-  else
-    NSS_ENABLE_WERROR := $(shell \
-    [ `$(CC) -dumpversion | cut -f 1 -d . -` -eq 4 -a \
-      `$(CC) -dumpversion | cut -f 2 -d . -` -ge 8 -o \
-      `$(CC) -dumpversion | cut -f 1 -d . -` -ge 5 ] && \
-      echo 1 || echo 0)
-    ifneq ($(NSS_ENABLE_WERROR),1)
-      $(warning Unable to find gcc >= 4.8 disabling -Werror)
-    endif
-  endif
-  export NSS_ENABLE_WERROR
-endif
-
-ifeq ($(NSS_ENABLE_WERROR),1)
-  OS_CFLAGS += -Werror
-else
-  # Old versions of gcc (< 4.8) don't support #pragma diagnostic in functions.
-  # Use this to disable use of that #pragma and the warnings it suppresses.
-  OS_CFLAGS += -DNSS_NO_GCC48
-endif
+OS_CFLAGS	= $(DSO_CFLAGS) $(OS_REL_CFLAGS) $(WARNING_CFLAGS) -fno-common -pipe -DDARWIN -DHAVE_STRERROR -DHAVE_BSD_FLOCK $(DARWIN_SDK_CFLAGS)
 
 ifdef BUILD_OPT
 ifeq (11,$(ALLOW_OPT_CODE_SIZE)$(OPT_CODE_SIZE))
diff --git a/security/nss/coreconf/Linux.mk b/security/nss/coreconf/Linux.mk
index b3b5e408d2c4..7a2411876dd9 100644
--- a/security/nss/coreconf/Linux.mk
+++ b/security/nss/coreconf/Linux.mk
@@ -4,6 +4,7 @@
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 include $(CORE_DEPTH)/coreconf/UNIX.mk
+include $(CORE_DEPTH)/coreconf/Werror.mk
 
 #
 # The default implementation strategy for Linux is now pthreads
@@ -132,70 +133,16 @@ endif
 endif
 
 ifndef COMPILER_TAG
-COMPILER_TAG = _$(shell $(CC) -? 2>&1 >/dev/null | sed -e 's/:.*//;1q')
-CCC_COMPILER_TAG = _$(shell $(CCC) -? 2>&1 >/dev/null | sed -e 's/:.*//;1q')
+COMPILER_TAG := _$(CC_NAME)
 endif
 
 ifeq ($(USE_PTHREADS),1)
 OS_PTHREAD = -lpthread 
 endif
 
-OS_CFLAGS		= $(DSO_CFLAGS) $(OS_REL_CFLAGS) $(ARCHFLAG) -Wall -pipe -ffunction-sections -fdata-sections -DLINUX -Dlinux -DHAVE_STRERROR
+OS_CFLAGS		= $(DSO_CFLAGS) $(OS_REL_CFLAGS) $(ARCHFLAG) $(WARNING_CFLAGS) -pipe -ffunction-sections -fdata-sections -DLINUX -Dlinux -DHAVE_STRERROR
 OS_LIBS			= $(OS_PTHREAD) -ldl -lc
 
-# This tests to see if enabling the warning is possible before
-# setting an option to disable it.
-disable_warning=$(shell $(CC) -x c -E -Werror -W$(1) /dev/null >/dev/null 2>&1 && echo -Wno-$(1))
-
-ifeq ($(COMPILER_TAG),_clang)
-  # -Qunused-arguments : clang objects to arguments that it doesn't understand
-  #    and fixing this would require rearchitecture
-  OS_CFLAGS += -Qunused-arguments
-  # -Wno-parentheses-equality : because clang warns about macro expansions
-  OS_CFLAGS += $(call disable_warning,parentheses-equality)
-  ifdef BUILD_OPT
-    # clang is unable to handle glib's expansion of strcmp and similar for optimized
-    # builds, so ignore the resulting errors.
-    # See https://llvm.org/bugs/show_bug.cgi?id=20144
-    OS_CFLAGS += $(call disable_warning,array-bounds)
-    OS_CFLAGS += $(call disable_warning,unevaluated-expression)
-  endif
-endif
-
-ifndef NSS_ENABLE_WERROR
-  ifneq ($(OS_TARGET),Android)
-    # Android lollipop generates the following warning:
-    # error: call to 'sprintf' declared with attribute warning:
-    #   sprintf is often misused; please use snprintf [-Werror]
-    # So, just suppress -Werror entirely on Android
-    NSS_ENABLE_WERROR = 0
-    $(warning !!! OS_TARGET is Android, disabling -Werror)
-  else
-    ifeq ($(COMPILER_TAG),_clang)
-      # Clang reports its version as an older gcc, but it's OK
-      NSS_ENABLE_WERROR = 1
-    else
-      NSS_ENABLE_WERROR := $(shell \
-        [ `$(CC) -dumpversion | cut -f 1 -d . -` -eq 4 -a \
-          `$(CC) -dumpversion | cut -f 2 -d . -` -ge 8 -o \
-          `$(CC) -dumpversion | cut -f 1 -d . -` -ge 5 ] && \
-        echo 1 || echo 0)
-      ifneq ($(NSS_ENABLE_WERROR),1)
-        $(warning !!! Unable to find gcc 4.8 or greater, disabling -Werror)
-      endif
-    endif
-  endif
-  export NSS_ENABLE_WERROR
-endif
-
-ifeq (1,$(NSS_ENABLE_WERROR))
-  OS_CFLAGS += -Werror
-else
-  # Old versions of gcc (< 4.8) don't support #pragma diagnostic in functions.
-  # Use this to disable use of that #pragma and the warnings it suppresses.
-  OS_CFLAGS += -DNSS_NO_GCC48
-endif
-
 ifdef USE_PTHREADS
 	DEFINES		+= -D_REENTRANT
 endif
diff --git a/security/nss/coreconf/WIN32.mk b/security/nss/coreconf/WIN32.mk
index ad5858ff6a5e..10e7b52c0800 100644
--- a/security/nss/coreconf/WIN32.mk
+++ b/security/nss/coreconf/WIN32.mk
@@ -113,19 +113,25 @@ ifdef NS_USE_GCC
 	else
 		OPTIMIZER += -O2
 	endif
-	DEFINES    += -UDEBUG -U_DEBUG -DNDEBUG
+	DEFINES    += -UDEBUG -DNDEBUG
     else
 	OPTIMIZER  += -g
 	NULLSTRING :=
 	SPACE      := $(NULLSTRING) # end of the line
 	USERNAME   := $(subst $(SPACE),_,$(USERNAME))
 	USERNAME   := $(subst -,_,$(USERNAME))
-	DEFINES    += -DDEBUG -D_DEBUG -UNDEBUG -DDEBUG_$(USERNAME)
+	DEFINES    += -DDEBUG -UNDEBUG -DDEBUG_$(USERNAME)
     endif
 else # !NS_USE_GCC
-    OS_CFLAGS += -W3 -WX -nologo -D_CRT_SECURE_NO_WARNINGS \
+    OS_CFLAGS += -W3 -nologo -D_CRT_SECURE_NO_WARNINGS \
 		 -D_CRT_NONSTDC_NO_WARNINGS
     OS_DLLFLAGS += -nologo -DLL -SUBSYSTEM:WINDOWS
+    ifndef NSS_ENABLE_WERROR
+        NSS_ENABLE_WERROR = 1
+    endif
+    ifeq ($(NSS_ENABLE_WERROR),1)
+        OS_CFLAGS += -WX
+    endif
     ifeq ($(_MSC_VER),$(_MSC_VER_6))
     ifndef MOZ_DEBUG_SYMBOLS
 	OS_DLLFLAGS += -PDB:NONE
@@ -159,7 +165,7 @@ else # !NS_USE_GCC
 	else
 		OPTIMIZER += -O2
 	endif
-	DEFINES    += -UDEBUG -U_DEBUG -DNDEBUG
+	DEFINES    += -UDEBUG -DNDEBUG
 	DLLFLAGS   += -OUT:$@
 	ifdef MOZ_DEBUG_SYMBOLS
 		ifdef MOZ_DEBUG_FLAGS
@@ -176,7 +182,7 @@ else # !NS_USE_GCC
 	SPACE      := $(NULLSTRING) # end of the line
 	USERNAME   := $(subst $(SPACE),_,$(USERNAME))
 	USERNAME   := $(subst -,_,$(USERNAME))
-	DEFINES    += -DDEBUG -D_DEBUG -UNDEBUG -DDEBUG_$(USERNAME)
+	DEFINES    += -DDEBUG -UNDEBUG -DDEBUG_$(USERNAME)
 	DLLFLAGS   += -DEBUG -OUT:$@
 	LDFLAGS    += -DEBUG 
 ifeq ($(_MSC_VER),$(_MSC_VER_6))
diff --git a/security/nss/coreconf/Werror.mk b/security/nss/coreconf/Werror.mk
new file mode 100644
index 000000000000..6e2588ceba8c
--- /dev/null
+++ b/security/nss/coreconf/Werror.mk
@@ -0,0 +1,70 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+# This sets warning flags for unix-like operating systems.
+
+ifndef CC_NAME
+  CC_NAME := $(shell $(CC) -? 2>&1 >/dev/null | sed -e 's/:.*//;1q')
+  export CC_NAME
+endif
+
+ifndef WARNING_CFLAGS
+  # This tests to see if enabling the warning is possible before
+  # setting an option to disable it.
+  disable_warning = $(shell $(CC) -x c -E -Werror -W$(1) /dev/null >/dev/null 2>&1 && echo -Wno-$(1))
+
+  WARNING_CFLAGS = -Wall
+  ifeq ($(CC_NAME),clang)
+    # -Qunused-arguments : clang objects to arguments that it doesn't understand
+    #    and fixing this would require rearchitecture
+    WARNING_CFLAGS += -Qunused-arguments
+    # -Wno-parentheses-equality : because clang warns about macro expansions
+    OS_CFLAGS += $(call disable_warning,parentheses-equality)
+    ifdef BUILD_OPT
+      # clang is unable to handle glib's expansion of strcmp and similar for optimized
+      # builds, so ignore the resulting errors.
+      # See https://llvm.org/bugs/show_bug.cgi?id=20144
+      WARNING_CFLAGS += $(call disable_warning,array-bounds)
+      WARNING_CFLAGS += $(call disable_warning,unevaluated-expression)
+    endif
+  endif # if clang
+
+  ifndef NSS_ENABLE_WERROR
+    ifeq ($(OS_TARGET),Android)
+      # Android lollipop generates the following warning:
+      # error: call to 'sprintf' declared with attribute warning:
+      #   sprintf is often misused; please use snprintf [-Werror]
+      # So, just suppress -Werror entirely on Android
+      NSS_ENABLE_WERROR = 0
+      $(warning OS_TARGET is Android, disabling -Werror)
+    else
+      ifeq ($(CC_NAME),clang)
+        # Clang reports its version as an older gcc, but it's OK
+        NSS_ENABLE_WERROR = 1
+      else
+        CC_VERSION := $(subst ., ,$(shell $(CC) -dumpversion))
+        ifneq (,$(filter 4.8 4.9,$(word 1,$(CC_VERSION)).$(word 2,$(CC_VERSION))))
+          NSS_ENABLE_WERROR = 1
+        endif
+        ifeq (,$(filter 0 1 2 3 4,$(word 1,$(CC_VERSION))))
+          NSS_ENABLE_WERROR = 1
+        endif
+        ifndef NSS_ENABLE_WERROR
+          $(warning Unable to find gcc 4.8 or greater, disabling -Werror)
+          NSS_ENABLE_WERROR = 0
+        endif
+      endif
+    endif
+  endif #ndef NSS_ENABLE_WERROR
+
+  ifeq ($(NSS_ENABLE_WERROR),1)
+    WARNING_CFLAGS += -Werror
+  else
+    # Old versions of gcc (< 4.8) don't support #pragma diagnostic in functions.
+    # Use this to disable use of that #pragma and the warnings it suppresses.
+    WARNING_CFLAGS += -DNSS_NO_GCC48
+  endif
+  export WARNING_CFLAGS
+endif # ndef WARNING_CFLAGS
diff --git a/security/nss/coreconf/coreconf.dep b/security/nss/coreconf/coreconf.dep
index 590d1bfaeee3..5182f75552c8 100644
--- a/security/nss/coreconf/coreconf.dep
+++ b/security/nss/coreconf/coreconf.dep
@@ -10,4 +10,3 @@
  */
 
 #error "Do not include this header file."
-
diff --git a/security/nss/external_tests/google_test/Makefile b/security/nss/external_tests/google_test/Makefile
index 8a3c1fae6a7b..c0b762f2698c 100644
--- a/security/nss/external_tests/google_test/Makefile
+++ b/security/nss/external_tests/google_test/Makefile
@@ -44,10 +44,8 @@ include $(CORE_DEPTH)/coreconf/rules.mk
 
 MKSHLIB	= $(CCC) $(DSO_LDOPTS) $(DARWIN_SDK_SHLIBFLAGS)
 ifeq (WINNT,$(OS_ARCH))
-    # -MTd (not -MD) because that makes it link to the right library
     # -EHsc because gtest has exception handlers
-    OS_CFLAGS := $(filterout -MD,$(OS_CFLAGS))
-    OS_CFLAGS += -MTd -EHsc
+    OS_CFLAGS += -EHsc
     # On windows, we need to create the parent directory
     # Needed because we include files from a subdirectory
     MAKE_OBJDIR = $(INSTALL) -D $(dir $@)
diff --git a/security/nss/external_tests/ssl_gtest/Makefile b/security/nss/external_tests/ssl_gtest/Makefile
index 7a2f354f06fe..e3bf89d3914e 100644
--- a/security/nss/external_tests/ssl_gtest/Makefile
+++ b/security/nss/external_tests/ssl_gtest/Makefile
@@ -48,10 +48,8 @@ CFLAGS += -I$(CORE_DEPTH)/lib/ssl
 include ../../cmd/platrules.mk
 
 ifeq (WINNT,$(OS_ARCH))
-    # -MTd (not -MD) because that makes it link to the right library
     # -EHsc because gtest has exception handlers
-    OS_CFLAGS := $(filterout -MD,$(OS_CFLAGS))
-    OS_CFLAGS += -MTd -EHsc -nologo
+    OS_CFLAGS += -EHsc -nologo
     # http://www.suodenjoki.dk/us/archive/2010/min-max.htm
     OS_CFLAGS += -DNOMINMAX
 
diff --git a/security/nss/external_tests/ssl_gtest/tls_agent.cc b/security/nss/external_tests/ssl_gtest/tls_agent.cc
index bb82a8daa508..2a41ecbc67ac 100644
--- a/security/nss/external_tests/ssl_gtest/tls_agent.cc
+++ b/security/nss/external_tests/ssl_gtest/tls_agent.cc
@@ -405,7 +405,7 @@ void TlsAgent::EnableExtendedMasterSecret() {
 }
 
 void TlsAgent::CheckExtendedMasterSecret(bool expected) {
-  ASSERT_EQ(expected, static_cast<bool>(info_.extendedMasterSecretUsed))
+  ASSERT_EQ(expected, info_.extendedMasterSecretUsed != PR_FALSE)
       << "unexpected extended master secret state for " << name_;
 }
 
diff --git a/security/nss/lib/ckfw/builtins/certdata.txt b/security/nss/lib/ckfw/builtins/certdata.txt
index db18537abeef..d6d4b4fbb7ec 100644
--- a/security/nss/lib/ckfw/builtins/certdata.txt
+++ b/security/nss/lib/ckfw/builtins/certdata.txt
@@ -187,9 +187,9 @@ END
 CKA_SERIAL_NUMBER MULTILINE_OCTAL
 \002\004\065\336\364\317
 END
-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 # Distrust "Distrust a pb.com certificate that does not comply with the baseline requirements."
@@ -220,252 +220,6 @@ CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_NOT_TRUSTED
 CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_NOT_TRUSTED
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
-#
-# Certificate "Digital Signature Trust Co. Global CA 1"
-#
-# Issuer: OU=DSTCA E1,O=Digital Signature Trust Co.,C=US
-# Serial Number: 913315222 (0x36701596)
-# Subject: OU=DSTCA E1,O=Digital Signature Trust Co.,C=US
-# Not Valid Before: Thu Dec 10 18:10:23 1998
-# Not Valid After : Mon Dec 10 18:40:23 2018
-# Fingerprint (MD5): 25:7A:BA:83:2E:B6:A2:0B:DA:FE:F5:02:0F:08:D7:AD
-# Fingerprint (SHA1): 81:96:8B:3A:EF:1C:DC:70:F5:FA:32:69:C2:92:A3:63:5B:D1:23:D3
-CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "Digital Signature Trust Co. Global CA 1"
-CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
-CKA_SUBJECT MULTILINE_OCTAL
-\060\106\061\013\060\011\006\003\125\004\006\023\002\125\123\061
-\044\060\042\006\003\125\004\012\023\033\104\151\147\151\164\141
-\154\040\123\151\147\156\141\164\165\162\145\040\124\162\165\163
-\164\040\103\157\056\061\021\060\017\006\003\125\004\013\023\010
-\104\123\124\103\101\040\105\061
-END
-CKA_ID UTF8 "0"
-CKA_ISSUER MULTILINE_OCTAL
-\060\106\061\013\060\011\006\003\125\004\006\023\002\125\123\061
-\044\060\042\006\003\125\004\012\023\033\104\151\147\151\164\141
-\154\040\123\151\147\156\141\164\165\162\145\040\124\162\165\163
-\164\040\103\157\056\061\021\060\017\006\003\125\004\013\023\010
-\104\123\124\103\101\040\105\061
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\004\066\160\025\226
-END
-CKA_VALUE MULTILINE_OCTAL
-\060\202\003\051\060\202\002\222\240\003\002\001\002\002\004\066
-\160\025\226\060\015\006\011\052\206\110\206\367\015\001\001\005
-\005\000\060\106\061\013\060\011\006\003\125\004\006\023\002\125
-\123\061\044\060\042\006\003\125\004\012\023\033\104\151\147\151
-\164\141\154\040\123\151\147\156\141\164\165\162\145\040\124\162
-\165\163\164\040\103\157\056\061\021\060\017\006\003\125\004\013
-\023\010\104\123\124\103\101\040\105\061\060\036\027\015\071\070
-\061\062\061\060\061\070\061\060\062\063\132\027\015\061\070\061
-\062\061\060\061\070\064\060\062\063\132\060\106\061\013\060\011
-\006\003\125\004\006\023\002\125\123\061\044\060\042\006\003\125
-\004\012\023\033\104\151\147\151\164\141\154\040\123\151\147\156
-\141\164\165\162\145\040\124\162\165\163\164\040\103\157\056\061
-\021\060\017\006\003\125\004\013\023\010\104\123\124\103\101\040
-\105\061\060\201\235\060\015\006\011\052\206\110\206\367\015\001
-\001\001\005\000\003\201\213\000\060\201\207\002\201\201\000\240
-\154\201\251\317\064\036\044\335\376\206\050\314\336\203\057\371
-\136\324\102\322\350\164\140\146\023\230\006\034\251\121\022\151
-\157\061\125\271\111\162\000\010\176\323\245\142\104\067\044\231
-\217\331\203\110\217\231\155\225\023\273\103\073\056\111\116\210
-\067\301\273\130\177\376\341\275\370\273\141\315\363\107\300\231
-\246\361\363\221\350\170\174\000\313\141\311\104\047\161\151\125
-\112\176\111\115\355\242\243\276\002\114\000\312\002\250\356\001
-\002\061\144\017\122\055\023\164\166\066\265\172\264\055\161\002
-\001\003\243\202\001\044\060\202\001\040\060\021\006\011\140\206
-\110\001\206\370\102\001\001\004\004\003\002\000\007\060\150\006
-\003\125\035\037\004\141\060\137\060\135\240\133\240\131\244\127
-\060\125\061\013\060\011\006\003\125\004\006\023\002\125\123\061
-\044\060\042\006\003\125\004\012\023\033\104\151\147\151\164\141
-\154\040\123\151\147\156\141\164\165\162\145\040\124\162\165\163
-\164\040\103\157\056\061\021\060\017\006\003\125\004\013\023\010
-\104\123\124\103\101\040\105\061\061\015\060\013\006\003\125\004
-\003\023\004\103\122\114\061\060\053\006\003\125\035\020\004\044
-\060\042\200\017\061\071\071\070\061\062\061\060\061\070\061\060
-\062\063\132\201\017\062\060\061\070\061\062\061\060\061\070\061
-\060\062\063\132\060\013\006\003\125\035\017\004\004\003\002\001
-\006\060\037\006\003\125\035\043\004\030\060\026\200\024\152\171
-\176\221\151\106\030\023\012\002\167\245\131\133\140\230\045\016
-\242\370\060\035\006\003\125\035\016\004\026\004\024\152\171\176
-\221\151\106\030\023\012\002\167\245\131\133\140\230\045\016\242
-\370\060\014\006\003\125\035\023\004\005\060\003\001\001\377\060
-\031\006\011\052\206\110\206\366\175\007\101\000\004\014\060\012
-\033\004\126\064\056\060\003\002\004\220\060\015\006\011\052\206
-\110\206\367\015\001\001\005\005\000\003\201\201\000\042\022\330
-\172\035\334\201\006\266\011\145\262\207\310\037\136\264\057\351
-\304\036\362\074\301\273\004\220\021\112\203\116\176\223\271\115
-\102\307\222\046\240\134\064\232\070\162\370\375\153\026\076\040
-\356\202\213\061\052\223\066\205\043\210\212\074\003\150\323\311
-\011\017\115\374\154\244\332\050\162\223\016\211\200\260\175\376
-\200\157\145\155\030\063\227\213\302\153\211\356\140\075\310\233
-\357\177\053\062\142\163\223\313\074\343\173\342\166\170\105\274
-\241\223\004\273\206\237\072\133\103\172\303\212\145
-END
-
-# Trust for Certificate "Digital Signature Trust Co. Global CA 1"
-# Issuer: OU=DSTCA E1,O=Digital Signature Trust Co.,C=US
-# Serial Number: 913315222 (0x36701596)
-# Subject: OU=DSTCA E1,O=Digital Signature Trust Co.,C=US
-# Not Valid Before: Thu Dec 10 18:10:23 1998
-# Not Valid After : Mon Dec 10 18:40:23 2018
-# Fingerprint (MD5): 25:7A:BA:83:2E:B6:A2:0B:DA:FE:F5:02:0F:08:D7:AD
-# Fingerprint (SHA1): 81:96:8B:3A:EF:1C:DC:70:F5:FA:32:69:C2:92:A3:63:5B:D1:23:D3
-CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "Digital Signature Trust Co. Global CA 1"
-CKA_CERT_SHA1_HASH MULTILINE_OCTAL
-\201\226\213\072\357\034\334\160\365\372\062\151\302\222\243\143
-\133\321\043\323
-END
-CKA_CERT_MD5_HASH MULTILINE_OCTAL
-\045\172\272\203\056\266\242\013\332\376\365\002\017\010\327\255
-END
-CKA_ISSUER MULTILINE_OCTAL
-\060\106\061\013\060\011\006\003\125\004\006\023\002\125\123\061
-\044\060\042\006\003\125\004\012\023\033\104\151\147\151\164\141
-\154\040\123\151\147\156\141\164\165\162\145\040\124\162\165\163
-\164\040\103\157\056\061\021\060\017\006\003\125\004\013\023\010
-\104\123\124\103\101\040\105\061
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\004\066\160\025\226
-END
-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
-CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
-CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
-
-#
-# Certificate "Digital Signature Trust Co. Global CA 3"
-#
-# Issuer: OU=DSTCA E2,O=Digital Signature Trust Co.,C=US
-# Serial Number: 913232846 (0x366ed3ce)
-# Subject: OU=DSTCA E2,O=Digital Signature Trust Co.,C=US
-# Not Valid Before: Wed Dec 09 19:17:26 1998
-# Not Valid After : Sun Dec 09 19:47:26 2018
-# Fingerprint (MD5): 93:C2:8E:11:7B:D4:F3:03:19:BD:28:75:13:4A:45:4A
-# Fingerprint (SHA1): AB:48:F3:33:DB:04:AB:B9:C0:72:DA:5B:0C:C1:D0:57:F0:36:9B:46
-CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "Digital Signature Trust Co. Global CA 3"
-CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
-CKA_SUBJECT MULTILINE_OCTAL
-\060\106\061\013\060\011\006\003\125\004\006\023\002\125\123\061
-\044\060\042\006\003\125\004\012\023\033\104\151\147\151\164\141
-\154\040\123\151\147\156\141\164\165\162\145\040\124\162\165\163
-\164\040\103\157\056\061\021\060\017\006\003\125\004\013\023\010
-\104\123\124\103\101\040\105\062
-END
-CKA_ID UTF8 "0"
-CKA_ISSUER MULTILINE_OCTAL
-\060\106\061\013\060\011\006\003\125\004\006\023\002\125\123\061
-\044\060\042\006\003\125\004\012\023\033\104\151\147\151\164\141
-\154\040\123\151\147\156\141\164\165\162\145\040\124\162\165\163
-\164\040\103\157\056\061\021\060\017\006\003\125\004\013\023\010
-\104\123\124\103\101\040\105\062
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\004\066\156\323\316
-END
-CKA_VALUE MULTILINE_OCTAL
-\060\202\003\051\060\202\002\222\240\003\002\001\002\002\004\066
-\156\323\316\060\015\006\011\052\206\110\206\367\015\001\001\005
-\005\000\060\106\061\013\060\011\006\003\125\004\006\023\002\125
-\123\061\044\060\042\006\003\125\004\012\023\033\104\151\147\151
-\164\141\154\040\123\151\147\156\141\164\165\162\145\040\124\162
-\165\163\164\040\103\157\056\061\021\060\017\006\003\125\004\013
-\023\010\104\123\124\103\101\040\105\062\060\036\027\015\071\070
-\061\062\060\071\061\071\061\067\062\066\132\027\015\061\070\061
-\062\060\071\061\071\064\067\062\066\132\060\106\061\013\060\011
-\006\003\125\004\006\023\002\125\123\061\044\060\042\006\003\125
-\004\012\023\033\104\151\147\151\164\141\154\040\123\151\147\156
-\141\164\165\162\145\040\124\162\165\163\164\040\103\157\056\061
-\021\060\017\006\003\125\004\013\023\010\104\123\124\103\101\040
-\105\062\060\201\235\060\015\006\011\052\206\110\206\367\015\001
-\001\001\005\000\003\201\213\000\060\201\207\002\201\201\000\277
-\223\217\027\222\357\063\023\030\353\020\177\116\026\277\377\006
-\217\052\205\274\136\371\044\246\044\210\266\003\267\301\303\137
-\003\133\321\157\256\176\102\352\146\043\270\143\203\126\373\050
-\055\341\070\213\264\356\250\001\341\316\034\266\210\052\042\106
-\205\373\237\247\160\251\107\024\077\316\336\145\360\250\161\367
-\117\046\154\214\274\306\265\357\336\111\047\377\110\052\175\350
-\115\003\314\307\262\122\306\027\061\023\073\265\115\333\310\304
-\366\303\017\044\052\332\014\235\347\221\133\200\315\224\235\002
-\001\003\243\202\001\044\060\202\001\040\060\021\006\011\140\206
-\110\001\206\370\102\001\001\004\004\003\002\000\007\060\150\006
-\003\125\035\037\004\141\060\137\060\135\240\133\240\131\244\127
-\060\125\061\013\060\011\006\003\125\004\006\023\002\125\123\061
-\044\060\042\006\003\125\004\012\023\033\104\151\147\151\164\141
-\154\040\123\151\147\156\141\164\165\162\145\040\124\162\165\163
-\164\040\103\157\056\061\021\060\017\006\003\125\004\013\023\010
-\104\123\124\103\101\040\105\062\061\015\060\013\006\003\125\004
-\003\023\004\103\122\114\061\060\053\006\003\125\035\020\004\044
-\060\042\200\017\061\071\071\070\061\062\060\071\061\071\061\067
-\062\066\132\201\017\062\060\061\070\061\062\060\071\061\071\061
-\067\062\066\132\060\013\006\003\125\035\017\004\004\003\002\001
-\006\060\037\006\003\125\035\043\004\030\060\026\200\024\036\202
-\115\050\145\200\074\311\101\156\254\065\056\132\313\336\356\370
-\071\133\060\035\006\003\125\035\016\004\026\004\024\036\202\115
-\050\145\200\074\311\101\156\254\065\056\132\313\336\356\370\071
-\133\060\014\006\003\125\035\023\004\005\060\003\001\001\377\060
-\031\006\011\052\206\110\206\366\175\007\101\000\004\014\060\012
-\033\004\126\064\056\060\003\002\004\220\060\015\006\011\052\206
-\110\206\367\015\001\001\005\005\000\003\201\201\000\107\215\203
-\255\142\362\333\260\236\105\042\005\271\242\326\003\016\070\162
-\347\236\374\173\346\223\266\232\245\242\224\310\064\035\221\321
-\305\327\364\012\045\017\075\170\201\236\017\261\147\304\220\114
-\143\335\136\247\342\272\237\365\367\115\245\061\173\234\051\055
-\114\376\144\076\354\266\123\376\352\233\355\202\333\164\165\113
-\007\171\156\036\330\031\203\163\336\365\076\320\265\336\347\113
-\150\175\103\056\052\040\341\176\240\170\104\236\010\365\230\371
-\307\177\033\033\326\006\040\002\130\241\303\242\003
-END
-
-# Trust for Certificate "Digital Signature Trust Co. Global CA 3"
-# Issuer: OU=DSTCA E2,O=Digital Signature Trust Co.,C=US
-# Serial Number: 913232846 (0x366ed3ce)
-# Subject: OU=DSTCA E2,O=Digital Signature Trust Co.,C=US
-# Not Valid Before: Wed Dec 09 19:17:26 1998
-# Not Valid After : Sun Dec 09 19:47:26 2018
-# Fingerprint (MD5): 93:C2:8E:11:7B:D4:F3:03:19:BD:28:75:13:4A:45:4A
-# Fingerprint (SHA1): AB:48:F3:33:DB:04:AB:B9:C0:72:DA:5B:0C:C1:D0:57:F0:36:9B:46
-CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "Digital Signature Trust Co. Global CA 3"
-CKA_CERT_SHA1_HASH MULTILINE_OCTAL
-\253\110\363\063\333\004\253\271\300\162\332\133\014\301\320\127
-\360\066\233\106
-END
-CKA_CERT_MD5_HASH MULTILINE_OCTAL
-\223\302\216\021\173\324\363\003\031\275\050\165\023\112\105\112
-END
-CKA_ISSUER MULTILINE_OCTAL
-\060\106\061\013\060\011\006\003\125\004\006\023\002\125\123\061
-\044\060\042\006\003\125\004\012\023\033\104\151\147\151\164\141
-\154\040\123\151\147\156\141\164\165\162\145\040\124\162\165\163
-\164\040\103\157\056\061\021\060\017\006\003\125\004\013\023\010
-\104\123\124\103\101\040\105\062
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\004\066\156\323\316
-END
-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
-CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
-CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
-
 #
 # Certificate "Verisign Class 3 Public Primary Certification Authority"
 #
@@ -1890,170 +1644,6 @@ CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_NOT_TRUSTED
 CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_NOT_TRUSTED
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
-#
-# Certificate "Verisign Class 4 Public Primary Certification Authority - G3"
-#
-# Issuer: CN=VeriSign Class 4 Public Primary Certification Authority - G3,OU="(c) 1999 VeriSign, Inc. - For authorized use only",OU=VeriSign Trust Network,O="VeriSign, Inc.",C=US
-# Serial Number:00:ec:a0:a7:8b:6e:75:6a:01:cf:c4:7c:cc:2f:94:5e:d7
-# Subject: CN=VeriSign Class 4 Public Primary Certification Authority - G3,OU="(c) 1999 VeriSign, Inc. - For authorized use only",OU=VeriSign Trust Network,O="VeriSign, Inc.",C=US
-# Not Valid Before: Fri Oct 01 00:00:00 1999
-# Not Valid After : Wed Jul 16 23:59:59 2036
-# Fingerprint (MD5): DB:C8:F2:27:2E:B1:EA:6A:29:23:5D:FE:56:3E:33:DF
-# Fingerprint (SHA1): C8:EC:8C:87:92:69:CB:4B:AB:39:E9:8D:7E:57:67:F3:14:95:73:9D
-CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "Verisign Class 4 Public Primary Certification Authority - G3"
-CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
-CKA_SUBJECT MULTILINE_OCTAL
-\060\201\312\061\013\060\011\006\003\125\004\006\023\002\125\123
-\061\027\060\025\006\003\125\004\012\023\016\126\145\162\151\123
-\151\147\156\054\040\111\156\143\056\061\037\060\035\006\003\125
-\004\013\023\026\126\145\162\151\123\151\147\156\040\124\162\165
-\163\164\040\116\145\164\167\157\162\153\061\072\060\070\006\003
-\125\004\013\023\061\050\143\051\040\061\071\071\071\040\126\145
-\162\151\123\151\147\156\054\040\111\156\143\056\040\055\040\106
-\157\162\040\141\165\164\150\157\162\151\172\145\144\040\165\163
-\145\040\157\156\154\171\061\105\060\103\006\003\125\004\003\023
-\074\126\145\162\151\123\151\147\156\040\103\154\141\163\163\040
-\064\040\120\165\142\154\151\143\040\120\162\151\155\141\162\171
-\040\103\145\162\164\151\146\151\143\141\164\151\157\156\040\101
-\165\164\150\157\162\151\164\171\040\055\040\107\063
-END
-CKA_ID UTF8 "0"
-CKA_ISSUER MULTILINE_OCTAL
-\060\201\312\061\013\060\011\006\003\125\004\006\023\002\125\123
-\061\027\060\025\006\003\125\004\012\023\016\126\145\162\151\123
-\151\147\156\054\040\111\156\143\056\061\037\060\035\006\003\125
-\004\013\023\026\126\145\162\151\123\151\147\156\040\124\162\165
-\163\164\040\116\145\164\167\157\162\153\061\072\060\070\006\003
-\125\004\013\023\061\050\143\051\040\061\071\071\071\040\126\145
-\162\151\123\151\147\156\054\040\111\156\143\056\040\055\040\106
-\157\162\040\141\165\164\150\157\162\151\172\145\144\040\165\163
-\145\040\157\156\154\171\061\105\060\103\006\003\125\004\003\023
-\074\126\145\162\151\123\151\147\156\040\103\154\141\163\163\040
-\064\040\120\165\142\154\151\143\040\120\162\151\155\141\162\171
-\040\103\145\162\164\151\146\151\143\141\164\151\157\156\040\101
-\165\164\150\157\162\151\164\171\040\055\040\107\063
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\021\000\354\240\247\213\156\165\152\001\317\304\174\314\057
-\224\136\327
-END
-CKA_VALUE MULTILINE_OCTAL
-\060\202\004\032\060\202\003\002\002\021\000\354\240\247\213\156
-\165\152\001\317\304\174\314\057\224\136\327\060\015\006\011\052
-\206\110\206\367\015\001\001\005\005\000\060\201\312\061\013\060
-\011\006\003\125\004\006\023\002\125\123\061\027\060\025\006\003
-\125\004\012\023\016\126\145\162\151\123\151\147\156\054\040\111
-\156\143\056\061\037\060\035\006\003\125\004\013\023\026\126\145
-\162\151\123\151\147\156\040\124\162\165\163\164\040\116\145\164
-\167\157\162\153\061\072\060\070\006\003\125\004\013\023\061\050
-\143\051\040\061\071\071\071\040\126\145\162\151\123\151\147\156
-\054\040\111\156\143\056\040\055\040\106\157\162\040\141\165\164
-\150\157\162\151\172\145\144\040\165\163\145\040\157\156\154\171
-\061\105\060\103\006\003\125\004\003\023\074\126\145\162\151\123
-\151\147\156\040\103\154\141\163\163\040\064\040\120\165\142\154
-\151\143\040\120\162\151\155\141\162\171\040\103\145\162\164\151
-\146\151\143\141\164\151\157\156\040\101\165\164\150\157\162\151
-\164\171\040\055\040\107\063\060\036\027\015\071\071\061\060\060
-\061\060\060\060\060\060\060\132\027\015\063\066\060\067\061\066
-\062\063\065\071\065\071\132\060\201\312\061\013\060\011\006\003
-\125\004\006\023\002\125\123\061\027\060\025\006\003\125\004\012
-\023\016\126\145\162\151\123\151\147\156\054\040\111\156\143\056
-\061\037\060\035\006\003\125\004\013\023\026\126\145\162\151\123
-\151\147\156\040\124\162\165\163\164\040\116\145\164\167\157\162
-\153\061\072\060\070\006\003\125\004\013\023\061\050\143\051\040
-\061\071\071\071\040\126\145\162\151\123\151\147\156\054\040\111
-\156\143\056\040\055\040\106\157\162\040\141\165\164\150\157\162
-\151\172\145\144\040\165\163\145\040\157\156\154\171\061\105\060
-\103\006\003\125\004\003\023\074\126\145\162\151\123\151\147\156
-\040\103\154\141\163\163\040\064\040\120\165\142\154\151\143\040
-\120\162\151\155\141\162\171\040\103\145\162\164\151\146\151\143
-\141\164\151\157\156\040\101\165\164\150\157\162\151\164\171\040
-\055\040\107\063\060\202\001\042\060\015\006\011\052\206\110\206
-\367\015\001\001\001\005\000\003\202\001\017\000\060\202\001\012
-\002\202\001\001\000\255\313\245\021\151\306\131\253\361\217\265
-\031\017\126\316\314\265\037\040\344\236\046\045\113\340\163\145
-\211\131\336\320\203\344\365\017\265\273\255\361\174\350\041\374
-\344\350\014\356\174\105\042\031\166\222\264\023\267\040\133\011
-\372\141\256\250\362\245\215\205\302\052\326\336\146\066\322\233
-\002\364\250\222\140\174\234\151\264\217\044\036\320\206\122\366
-\062\234\101\130\036\042\275\315\105\142\225\010\156\320\146\335
-\123\242\314\360\020\334\124\163\213\004\241\106\063\063\134\027
-\100\271\236\115\323\363\276\125\203\350\261\211\216\132\174\232
-\226\042\220\073\210\045\362\322\123\210\002\014\013\170\362\346
-\067\027\113\060\106\007\344\200\155\246\330\226\056\350\054\370
-\021\263\070\015\146\246\233\352\311\043\133\333\216\342\363\023
-\216\032\131\055\252\002\360\354\244\207\146\334\301\077\365\330
-\271\364\354\202\306\322\075\225\035\345\300\117\204\311\331\243
-\104\050\006\152\327\105\254\360\153\152\357\116\137\370\021\202
-\036\070\143\064\146\120\324\076\223\163\372\060\303\146\255\377
-\223\055\227\357\003\002\003\001\000\001\060\015\006\011\052\206
-\110\206\367\015\001\001\005\005\000\003\202\001\001\000\217\372
-\045\153\117\133\344\244\116\047\125\253\042\025\131\074\312\265
-\012\324\112\333\253\335\241\137\123\305\240\127\071\302\316\107
-\053\276\072\310\126\277\302\331\047\020\072\261\005\074\300\167
-\061\273\072\323\005\173\155\232\034\060\214\200\313\223\223\052
-\203\253\005\121\202\002\000\021\147\153\363\210\141\107\137\003
-\223\325\133\015\340\361\324\241\062\065\205\262\072\333\260\202
-\253\321\313\012\274\117\214\133\305\113\000\073\037\052\202\246
-\176\066\205\334\176\074\147\000\265\344\073\122\340\250\353\135
-\025\371\306\155\360\255\035\016\205\267\251\232\163\024\132\133
-\217\101\050\300\325\350\055\115\244\136\315\252\331\355\316\334
-\330\325\074\102\035\027\301\022\135\105\070\303\070\363\374\205
-\056\203\106\110\262\327\040\137\222\066\217\347\171\017\230\136
-\231\350\360\320\244\273\365\123\275\052\316\131\260\257\156\177
-\154\273\322\036\000\260\041\355\370\101\142\202\271\330\262\304
-\273\106\120\363\061\305\217\001\250\164\353\365\170\047\332\347
-\367\146\103\363\236\203\076\040\252\303\065\140\221\316
-END
-
-# Trust for Certificate "Verisign Class 4 Public Primary Certification Authority - G3"
-# Issuer: CN=VeriSign Class 4 Public Primary Certification Authority - G3,OU="(c) 1999 VeriSign, Inc. - For authorized use only",OU=VeriSign Trust Network,O="VeriSign, Inc.",C=US
-# Serial Number:00:ec:a0:a7:8b:6e:75:6a:01:cf:c4:7c:cc:2f:94:5e:d7
-# Subject: CN=VeriSign Class 4 Public Primary Certification Authority - G3,OU="(c) 1999 VeriSign, Inc. - For authorized use only",OU=VeriSign Trust Network,O="VeriSign, Inc.",C=US
-# Not Valid Before: Fri Oct 01 00:00:00 1999
-# Not Valid After : Wed Jul 16 23:59:59 2036
-# Fingerprint (MD5): DB:C8:F2:27:2E:B1:EA:6A:29:23:5D:FE:56:3E:33:DF
-# Fingerprint (SHA1): C8:EC:8C:87:92:69:CB:4B:AB:39:E9:8D:7E:57:67:F3:14:95:73:9D
-CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "Verisign Class 4 Public Primary Certification Authority - G3"
-CKA_CERT_SHA1_HASH MULTILINE_OCTAL
-\310\354\214\207\222\151\313\113\253\071\351\215\176\127\147\363
-\024\225\163\235
-END
-CKA_CERT_MD5_HASH MULTILINE_OCTAL
-\333\310\362\047\056\261\352\152\051\043\135\376\126\076\063\337
-END
-CKA_ISSUER MULTILINE_OCTAL
-\060\201\312\061\013\060\011\006\003\125\004\006\023\002\125\123
-\061\027\060\025\006\003\125\004\012\023\016\126\145\162\151\123
-\151\147\156\054\040\111\156\143\056\061\037\060\035\006\003\125
-\004\013\023\026\126\145\162\151\123\151\147\156\040\124\162\165
-\163\164\040\116\145\164\167\157\162\153\061\072\060\070\006\003
-\125\004\013\023\061\050\143\051\040\061\071\071\071\040\126\145
-\162\151\123\151\147\156\054\040\111\156\143\056\040\055\040\106
-\157\162\040\141\165\164\150\157\162\151\172\145\144\040\165\163
-\145\040\157\156\154\171\061\105\060\103\006\003\125\004\003\023
-\074\126\145\162\151\123\151\147\156\040\103\154\141\163\163\040
-\064\040\120\165\142\154\151\143\040\120\162\151\155\141\162\171
-\040\103\145\162\164\151\146\151\143\141\164\151\157\156\040\101
-\165\164\150\157\162\151\164\171\040\055\040\107\063
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\021\000\354\240\247\213\156\165\152\001\317\304\174\314\057
-\224\136\327
-END
-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
-
 #
 # Certificate "Entrust.net Premium 2048 Secure Server CA"
 #
@@ -4024,169 +3614,6 @@ CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
-#
-# Certificate "UTN-USER First-Network Applications"
-#
-# Issuer: CN=UTN-USERFirst-Network Applications,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
-# Serial Number:44:be:0c:8b:50:00:24:b4:11:d3:36:30:4b:c0:33:77
-# Subject: CN=UTN-USERFirst-Network Applications,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
-# Not Valid Before: Fri Jul 09 18:48:39 1999
-# Not Valid After : Tue Jul 09 18:57:49 2019
-# Fingerprint (MD5): BF:60:59:A3:5B:BA:F6:A7:76:42:DA:6F:1A:7B:50:CF
-# Fingerprint (SHA1): 5D:98:9C:DB:15:96:11:36:51:65:64:1B:56:0F:DB:EA:2A:C2:3E:F1
-CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "UTN-USER First-Network Applications"
-CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
-CKA_SUBJECT MULTILINE_OCTAL
-\060\201\243\061\013\060\011\006\003\125\004\006\023\002\125\123
-\061\013\060\011\006\003\125\004\010\023\002\125\124\061\027\060
-\025\006\003\125\004\007\023\016\123\141\154\164\040\114\141\153
-\145\040\103\151\164\171\061\036\060\034\006\003\125\004\012\023
-\025\124\150\145\040\125\123\105\122\124\122\125\123\124\040\116
-\145\164\167\157\162\153\061\041\060\037\006\003\125\004\013\023
-\030\150\164\164\160\072\057\057\167\167\167\056\165\163\145\162
-\164\162\165\163\164\056\143\157\155\061\053\060\051\006\003\125
-\004\003\023\042\125\124\116\055\125\123\105\122\106\151\162\163
-\164\055\116\145\164\167\157\162\153\040\101\160\160\154\151\143
-\141\164\151\157\156\163
-END
-CKA_ID UTF8 "0"
-CKA_ISSUER MULTILINE_OCTAL
-\060\201\243\061\013\060\011\006\003\125\004\006\023\002\125\123
-\061\013\060\011\006\003\125\004\010\023\002\125\124\061\027\060
-\025\006\003\125\004\007\023\016\123\141\154\164\040\114\141\153
-\145\040\103\151\164\171\061\036\060\034\006\003\125\004\012\023
-\025\124\150\145\040\125\123\105\122\124\122\125\123\124\040\116
-\145\164\167\157\162\153\061\041\060\037\006\003\125\004\013\023
-\030\150\164\164\160\072\057\057\167\167\167\056\165\163\145\162
-\164\162\165\163\164\056\143\157\155\061\053\060\051\006\003\125
-\004\003\023\042\125\124\116\055\125\123\105\122\106\151\162\163
-\164\055\116\145\164\167\157\162\153\040\101\160\160\154\151\143
-\141\164\151\157\156\163
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\020\104\276\014\213\120\000\044\264\021\323\066\060\113\300
-\063\167
-END
-CKA_VALUE MULTILINE_OCTAL
-\060\202\004\144\060\202\003\114\240\003\002\001\002\002\020\104
-\276\014\213\120\000\044\264\021\323\066\060\113\300\063\167\060
-\015\006\011\052\206\110\206\367\015\001\001\005\005\000\060\201
-\243\061\013\060\011\006\003\125\004\006\023\002\125\123\061\013
-\060\011\006\003\125\004\010\023\002\125\124\061\027\060\025\006
-\003\125\004\007\023\016\123\141\154\164\040\114\141\153\145\040
-\103\151\164\171\061\036\060\034\006\003\125\004\012\023\025\124
-\150\145\040\125\123\105\122\124\122\125\123\124\040\116\145\164
-\167\157\162\153\061\041\060\037\006\003\125\004\013\023\030\150
-\164\164\160\072\057\057\167\167\167\056\165\163\145\162\164\162
-\165\163\164\056\143\157\155\061\053\060\051\006\003\125\004\003
-\023\042\125\124\116\055\125\123\105\122\106\151\162\163\164\055
-\116\145\164\167\157\162\153\040\101\160\160\154\151\143\141\164
-\151\157\156\163\060\036\027\015\071\071\060\067\060\071\061\070
-\064\070\063\071\132\027\015\061\071\060\067\060\071\061\070\065
-\067\064\071\132\060\201\243\061\013\060\011\006\003\125\004\006
-\023\002\125\123\061\013\060\011\006\003\125\004\010\023\002\125
-\124\061\027\060\025\006\003\125\004\007\023\016\123\141\154\164
-\040\114\141\153\145\040\103\151\164\171\061\036\060\034\006\003
-\125\004\012\023\025\124\150\145\040\125\123\105\122\124\122\125
-\123\124\040\116\145\164\167\157\162\153\061\041\060\037\006\003
-\125\004\013\023\030\150\164\164\160\072\057\057\167\167\167\056
-\165\163\145\162\164\162\165\163\164\056\143\157\155\061\053\060
-\051\006\003\125\004\003\023\042\125\124\116\055\125\123\105\122
-\106\151\162\163\164\055\116\145\164\167\157\162\153\040\101\160
-\160\154\151\143\141\164\151\157\156\163\060\202\001\042\060\015
-\006\011\052\206\110\206\367\015\001\001\001\005\000\003\202\001
-\017\000\060\202\001\012\002\202\001\001\000\263\373\221\241\344
-\066\125\205\254\006\064\133\240\232\130\262\370\265\017\005\167
-\203\256\062\261\166\222\150\354\043\112\311\166\077\343\234\266
-\067\171\003\271\253\151\215\007\045\266\031\147\344\260\033\030
-\163\141\112\350\176\315\323\057\144\343\246\174\014\372\027\200
-\243\015\107\211\117\121\161\057\356\374\077\371\270\026\200\207
-\211\223\045\040\232\103\202\151\044\166\050\131\065\241\035\300
-\177\203\006\144\026\040\054\323\111\244\205\264\300\141\177\121
-\010\370\150\025\221\200\313\245\325\356\073\072\364\204\004\136
-\140\131\247\214\064\162\356\270\170\305\321\073\022\112\157\176
-\145\047\271\244\125\305\271\157\103\244\305\035\054\231\300\122
-\244\170\114\025\263\100\230\010\153\103\306\001\260\172\173\365
-\153\034\042\077\313\357\377\250\320\072\113\166\025\236\322\321
-\306\056\343\333\127\033\062\242\270\157\350\206\246\077\160\253
-\345\160\222\253\104\036\100\120\373\234\243\142\344\154\156\240
-\310\336\342\200\102\372\351\057\350\316\062\004\217\174\215\267
-\034\243\065\074\025\335\236\303\256\227\245\002\003\001\000\001
-\243\201\221\060\201\216\060\013\006\003\125\035\017\004\004\003
-\002\001\306\060\017\006\003\125\035\023\001\001\377\004\005\060
-\003\001\001\377\060\035\006\003\125\035\016\004\026\004\024\372
-\206\311\333\340\272\351\170\365\113\250\326\025\337\360\323\341
-\152\024\074\060\117\006\003\125\035\037\004\110\060\106\060\104
-\240\102\240\100\206\076\150\164\164\160\072\057\057\143\162\154
-\056\165\163\145\162\164\162\165\163\164\056\143\157\155\057\125
-\124\116\055\125\123\105\122\106\151\162\163\164\055\116\145\164
-\167\157\162\153\101\160\160\154\151\143\141\164\151\157\156\163
-\056\143\162\154\060\015\006\011\052\206\110\206\367\015\001\001
-\005\005\000\003\202\001\001\000\244\363\045\314\321\324\221\203
-\042\320\314\062\253\233\226\116\064\221\124\040\045\064\141\137
-\052\002\025\341\213\252\377\175\144\121\317\012\377\274\175\330
-\041\152\170\313\057\121\157\370\102\035\063\275\353\265\173\224
-\303\303\251\240\055\337\321\051\037\035\376\217\077\273\250\105
-\052\177\321\156\125\044\342\273\002\373\061\077\276\350\274\354
-\100\053\370\001\324\126\070\344\312\104\202\265\141\040\041\147
-\145\366\360\013\347\064\370\245\302\234\243\134\100\037\205\223
-\225\006\336\117\324\047\251\266\245\374\026\315\163\061\077\270
-\145\047\317\324\123\032\360\254\156\237\117\005\014\003\201\247
-\204\051\304\132\275\144\127\162\255\073\317\067\030\246\230\306
-\255\006\264\334\010\243\004\325\051\244\226\232\022\147\112\214
-\140\105\235\361\043\232\260\000\234\150\265\230\120\323\357\216
-\056\222\145\261\110\076\041\276\025\060\052\015\265\014\243\153
-\077\256\177\127\365\037\226\174\337\157\335\202\060\054\145\033
-\100\112\315\150\271\162\354\161\166\354\124\216\037\205\014\001
-\152\372\246\070\254\037\304\204
-END
-
-# Trust for Certificate "UTN-USER First-Network Applications"
-# Issuer: CN=UTN-USERFirst-Network Applications,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
-# Serial Number:44:be:0c:8b:50:00:24:b4:11:d3:36:30:4b:c0:33:77
-# Subject: CN=UTN-USERFirst-Network Applications,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
-# Not Valid Before: Fri Jul 09 18:48:39 1999
-# Not Valid After : Tue Jul 09 18:57:49 2019
-# Fingerprint (MD5): BF:60:59:A3:5B:BA:F6:A7:76:42:DA:6F:1A:7B:50:CF
-# Fingerprint (SHA1): 5D:98:9C:DB:15:96:11:36:51:65:64:1B:56:0F:DB:EA:2A:C2:3E:F1
-CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "UTN-USER First-Network Applications"
-CKA_CERT_SHA1_HASH MULTILINE_OCTAL
-\135\230\234\333\025\226\021\066\121\145\144\033\126\017\333\352
-\052\302\076\361
-END
-CKA_CERT_MD5_HASH MULTILINE_OCTAL
-\277\140\131\243\133\272\366\247\166\102\332\157\032\173\120\317
-END
-CKA_ISSUER MULTILINE_OCTAL
-\060\201\243\061\013\060\011\006\003\125\004\006\023\002\125\123
-\061\013\060\011\006\003\125\004\010\023\002\125\124\061\027\060
-\025\006\003\125\004\007\023\016\123\141\154\164\040\114\141\153
-\145\040\103\151\164\171\061\036\060\034\006\003\125\004\012\023
-\025\124\150\145\040\125\123\105\122\124\122\125\123\124\040\116
-\145\164\167\157\162\153\061\041\060\037\006\003\125\004\013\023
-\030\150\164\164\160\072\057\057\167\167\167\056\165\163\145\162
-\164\162\165\163\164\056\143\157\155\061\053\060\051\006\003\125
-\004\003\023\042\125\124\116\055\125\123\105\122\106\151\162\163
-\164\055\116\145\164\167\157\162\153\040\101\160\160\154\151\143
-\141\164\151\157\156\163
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\020\104\276\014\213\120\000\044\264\021\323\066\060\113\300
-\063\167
-END
-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
-CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
-CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
-
 #
 # Certificate "Visa eCommerce Root"
 #
@@ -5921,166 +5348,6 @@ CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
-#
-# Certificate "UTN DATACorp SGC Root CA"
-#
-# Issuer: CN=UTN - DATACorp SGC,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
-# Serial Number:44:be:0c:8b:50:00:21:b4:11:d3:2a:68:06:a9:ad:69
-# Subject: CN=UTN - DATACorp SGC,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
-# Not Valid Before: Thu Jun 24 18:57:21 1999
-# Not Valid After : Mon Jun 24 19:06:30 2019
-# Fingerprint (MD5): B3:A5:3E:77:21:6D:AC:4A:C0:C9:FB:D5:41:3D:CA:06
-# Fingerprint (SHA1): 58:11:9F:0E:12:82:87:EA:50:FD:D9:87:45:6F:4F:78:DC:FA:D6:D4
-CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "UTN DATACorp SGC Root CA"
-CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
-CKA_SUBJECT MULTILINE_OCTAL
-\060\201\223\061\013\060\011\006\003\125\004\006\023\002\125\123
-\061\013\060\011\006\003\125\004\010\023\002\125\124\061\027\060
-\025\006\003\125\004\007\023\016\123\141\154\164\040\114\141\153
-\145\040\103\151\164\171\061\036\060\034\006\003\125\004\012\023
-\025\124\150\145\040\125\123\105\122\124\122\125\123\124\040\116
-\145\164\167\157\162\153\061\041\060\037\006\003\125\004\013\023
-\030\150\164\164\160\072\057\057\167\167\167\056\165\163\145\162
-\164\162\165\163\164\056\143\157\155\061\033\060\031\006\003\125
-\004\003\023\022\125\124\116\040\055\040\104\101\124\101\103\157
-\162\160\040\123\107\103
-END
-CKA_ID UTF8 "0"
-CKA_ISSUER MULTILINE_OCTAL
-\060\201\223\061\013\060\011\006\003\125\004\006\023\002\125\123
-\061\013\060\011\006\003\125\004\010\023\002\125\124\061\027\060
-\025\006\003\125\004\007\023\016\123\141\154\164\040\114\141\153
-\145\040\103\151\164\171\061\036\060\034\006\003\125\004\012\023
-\025\124\150\145\040\125\123\105\122\124\122\125\123\124\040\116
-\145\164\167\157\162\153\061\041\060\037\006\003\125\004\013\023
-\030\150\164\164\160\072\057\057\167\167\167\056\165\163\145\162
-\164\162\165\163\164\056\143\157\155\061\033\060\031\006\003\125
-\004\003\023\022\125\124\116\040\055\040\104\101\124\101\103\157
-\162\160\040\123\107\103
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\020\104\276\014\213\120\000\041\264\021\323\052\150\006\251
-\255\151
-END
-CKA_VALUE MULTILINE_OCTAL
-\060\202\004\136\060\202\003\106\240\003\002\001\002\002\020\104
-\276\014\213\120\000\041\264\021\323\052\150\006\251\255\151\060
-\015\006\011\052\206\110\206\367\015\001\001\005\005\000\060\201
-\223\061\013\060\011\006\003\125\004\006\023\002\125\123\061\013
-\060\011\006\003\125\004\010\023\002\125\124\061\027\060\025\006
-\003\125\004\007\023\016\123\141\154\164\040\114\141\153\145\040
-\103\151\164\171\061\036\060\034\006\003\125\004\012\023\025\124
-\150\145\040\125\123\105\122\124\122\125\123\124\040\116\145\164
-\167\157\162\153\061\041\060\037\006\003\125\004\013\023\030\150
-\164\164\160\072\057\057\167\167\167\056\165\163\145\162\164\162
-\165\163\164\056\143\157\155\061\033\060\031\006\003\125\004\003
-\023\022\125\124\116\040\055\040\104\101\124\101\103\157\162\160
-\040\123\107\103\060\036\027\015\071\071\060\066\062\064\061\070
-\065\067\062\061\132\027\015\061\071\060\066\062\064\061\071\060
-\066\063\060\132\060\201\223\061\013\060\011\006\003\125\004\006
-\023\002\125\123\061\013\060\011\006\003\125\004\010\023\002\125
-\124\061\027\060\025\006\003\125\004\007\023\016\123\141\154\164
-\040\114\141\153\145\040\103\151\164\171\061\036\060\034\006\003
-\125\004\012\023\025\124\150\145\040\125\123\105\122\124\122\125
-\123\124\040\116\145\164\167\157\162\153\061\041\060\037\006\003
-\125\004\013\023\030\150\164\164\160\072\057\057\167\167\167\056
-\165\163\145\162\164\162\165\163\164\056\143\157\155\061\033\060
-\031\006\003\125\004\003\023\022\125\124\116\040\055\040\104\101
-\124\101\103\157\162\160\040\123\107\103\060\202\001\042\060\015
-\006\011\052\206\110\206\367\015\001\001\001\005\000\003\202\001
-\017\000\060\202\001\012\002\202\001\001\000\337\356\130\020\242
-\053\156\125\304\216\277\056\106\011\347\340\010\017\056\053\172
-\023\224\033\275\366\266\200\216\145\005\223\000\036\274\257\342
-\017\216\031\015\022\107\354\254\255\243\372\056\160\370\336\156
-\373\126\102\025\236\056\134\357\043\336\041\271\005\166\047\031
-\017\117\326\303\234\264\276\224\031\143\362\246\021\012\353\123
-\110\234\276\362\051\073\026\350\032\240\114\246\311\364\030\131
-\150\300\160\362\123\000\300\136\120\202\245\126\157\066\371\112
-\340\104\206\240\115\116\326\107\156\111\112\313\147\327\246\304
-\005\271\216\036\364\374\377\315\347\066\340\234\005\154\262\063
-\042\025\320\264\340\314\027\300\262\300\364\376\062\077\051\052
-\225\173\330\362\247\116\017\124\174\241\015\200\263\011\003\301
-\377\134\335\136\232\076\274\256\274\107\212\152\256\161\312\037
-\261\052\270\137\102\005\013\354\106\060\321\162\013\312\351\126
-\155\365\357\337\170\276\141\272\262\245\256\004\114\274\250\254
-\151\025\227\275\357\353\264\214\277\065\370\324\303\321\050\016
-\134\072\237\160\030\063\040\167\304\242\257\002\003\001\000\001
-\243\201\253\060\201\250\060\013\006\003\125\035\017\004\004\003
-\002\001\306\060\017\006\003\125\035\023\001\001\377\004\005\060
-\003\001\001\377\060\035\006\003\125\035\016\004\026\004\024\123
-\062\321\263\317\177\372\340\361\240\135\205\116\222\322\236\105
-\035\264\117\060\075\006\003\125\035\037\004\066\060\064\060\062
-\240\060\240\056\206\054\150\164\164\160\072\057\057\143\162\154
-\056\165\163\145\162\164\162\165\163\164\056\143\157\155\057\125
-\124\116\055\104\101\124\101\103\157\162\160\123\107\103\056\143
-\162\154\060\052\006\003\125\035\045\004\043\060\041\006\010\053
-\006\001\005\005\007\003\001\006\012\053\006\001\004\001\202\067
-\012\003\003\006\011\140\206\110\001\206\370\102\004\001\060\015
-\006\011\052\206\110\206\367\015\001\001\005\005\000\003\202\001
-\001\000\047\065\227\000\212\213\050\275\306\063\060\036\051\374
-\342\367\325\230\324\100\273\140\312\277\253\027\054\011\066\177
-\120\372\101\334\256\226\072\012\043\076\211\131\311\243\007\355
-\033\067\255\374\174\276\121\111\132\336\072\012\124\010\026\105
-\302\231\261\207\315\214\150\340\151\003\351\304\116\230\262\073
-\214\026\263\016\240\014\230\120\233\223\251\160\011\310\054\243
-\217\337\002\344\340\161\072\361\264\043\162\240\252\001\337\337
-\230\076\024\120\240\061\046\275\050\351\132\060\046\165\371\173
-\140\034\215\363\315\120\046\155\004\047\232\337\325\015\105\107
-\051\153\054\346\166\331\251\051\175\062\335\311\066\074\275\256
-\065\361\021\236\035\273\220\077\022\107\116\216\327\176\017\142
-\163\035\122\046\070\034\030\111\375\060\164\232\304\345\042\057
-\330\300\215\355\221\172\114\000\217\162\177\135\332\335\033\213
-\105\153\347\335\151\227\250\305\126\114\017\014\366\237\172\221
-\067\366\227\202\340\335\161\151\377\166\077\140\115\074\317\367
-\231\371\306\127\364\311\125\071\170\272\054\171\311\246\210\053
-\364\010
-END
-
-# Trust for Certificate "UTN DATACorp SGC Root CA"
-# Issuer: CN=UTN - DATACorp SGC,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
-# Serial Number:44:be:0c:8b:50:00:21:b4:11:d3:2a:68:06:a9:ad:69
-# Subject: CN=UTN - DATACorp SGC,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
-# Not Valid Before: Thu Jun 24 18:57:21 1999
-# Not Valid After : Mon Jun 24 19:06:30 2019
-# Fingerprint (MD5): B3:A5:3E:77:21:6D:AC:4A:C0:C9:FB:D5:41:3D:CA:06
-# Fingerprint (SHA1): 58:11:9F:0E:12:82:87:EA:50:FD:D9:87:45:6F:4F:78:DC:FA:D6:D4
-CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "UTN DATACorp SGC Root CA"
-CKA_CERT_SHA1_HASH MULTILINE_OCTAL
-\130\021\237\016\022\202\207\352\120\375\331\207\105\157\117\170
-\334\372\326\324
-END
-CKA_CERT_MD5_HASH MULTILINE_OCTAL
-\263\245\076\167\041\155\254\112\300\311\373\325\101\075\312\006
-END
-CKA_ISSUER MULTILINE_OCTAL
-\060\201\223\061\013\060\011\006\003\125\004\006\023\002\125\123
-\061\013\060\011\006\003\125\004\010\023\002\125\124\061\027\060
-\025\006\003\125\004\007\023\016\123\141\154\164\040\114\141\153
-\145\040\103\151\164\171\061\036\060\034\006\003\125\004\012\023
-\025\124\150\145\040\125\123\105\122\124\122\125\123\124\040\116
-\145\164\167\157\162\153\061\041\060\037\006\003\125\004\013\023
-\030\150\164\164\160\072\057\057\167\167\167\056\165\163\145\162
-\164\162\165\163\164\056\143\157\155\061\033\060\031\006\003\125
-\004\003\023\022\125\124\116\040\055\040\104\101\124\101\103\157
-\162\160\040\123\107\103
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\020\104\276\014\213\120\000\041\264\021\323\052\150\006\251
-\255\151
-END
-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
-CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
-
 #
 # Certificate "UTN USERFirst Email Root CA"
 #
@@ -9442,170 +8709,6 @@ CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
-#
-# Certificate "TURKTRUST Certificate Services Provider Root 2"
-#
-# Issuer: O=T..RKTRUST Bilgi ..leti..im ve Bili..im G..venli..i Hizmetleri A...,L=Ankara,C=TR,CN=T..RKTRUST Elektronik Sertifika Hizmet Sa..lay..c..s..
-# Serial Number: 1 (0x1)
-# Subject: O=T..RKTRUST Bilgi ..leti..im ve Bili..im G..venli..i Hizmetleri A...,L=Ankara,C=TR,CN=T..RKTRUST Elektronik Sertifika Hizmet Sa..lay..c..s..
-# Not Valid Before: Mon Nov 07 10:07:57 2005
-# Not Valid After : Wed Sep 16 10:07:57 2015
-# Fingerprint (MD5): 37:A5:6E:D4:B1:25:84:97:B7:FD:56:15:7A:F9:A2:00
-# Fingerprint (SHA1): B4:35:D4:E1:11:9D:1C:66:90:A7:49:EB:B3:94:BD:63:7B:A7:82:B7
-CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "TURKTRUST Certificate Services Provider Root 2"
-CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
-CKA_SUBJECT MULTILINE_OCTAL
-\060\201\276\061\077\060\075\006\003\125\004\003\014\066\124\303
-\234\122\113\124\122\125\123\124\040\105\154\145\153\164\162\157
-\156\151\153\040\123\145\162\164\151\146\151\153\141\040\110\151
-\172\155\145\164\040\123\141\304\237\154\141\171\304\261\143\304
-\261\163\304\261\061\013\060\011\006\003\125\004\006\023\002\124
-\122\061\017\060\015\006\003\125\004\007\014\006\101\156\153\141
-\162\141\061\135\060\133\006\003\125\004\012\014\124\124\303\234
-\122\113\124\122\125\123\124\040\102\151\154\147\151\040\304\260
-\154\145\164\151\305\237\151\155\040\166\145\040\102\151\154\151
-\305\237\151\155\040\107\303\274\166\145\156\154\151\304\237\151
-\040\110\151\172\155\145\164\154\145\162\151\040\101\056\305\236
-\056\040\050\143\051\040\113\141\163\304\261\155\040\062\060\060
-\065
-END
-CKA_ID UTF8 "0"
-CKA_ISSUER MULTILINE_OCTAL
-\060\201\276\061\077\060\075\006\003\125\004\003\014\066\124\303
-\234\122\113\124\122\125\123\124\040\105\154\145\153\164\162\157
-\156\151\153\040\123\145\162\164\151\146\151\153\141\040\110\151
-\172\155\145\164\040\123\141\304\237\154\141\171\304\261\143\304
-\261\163\304\261\061\013\060\011\006\003\125\004\006\023\002\124
-\122\061\017\060\015\006\003\125\004\007\014\006\101\156\153\141
-\162\141\061\135\060\133\006\003\125\004\012\014\124\124\303\234
-\122\113\124\122\125\123\124\040\102\151\154\147\151\040\304\260
-\154\145\164\151\305\237\151\155\040\166\145\040\102\151\154\151
-\305\237\151\155\040\107\303\274\166\145\156\154\151\304\237\151
-\040\110\151\172\155\145\164\154\145\162\151\040\101\056\305\236
-\056\040\050\143\051\040\113\141\163\304\261\155\040\062\060\060
-\065
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\001\001
-END
-CKA_VALUE MULTILINE_OCTAL
-\060\202\004\074\060\202\003\044\240\003\002\001\002\002\001\001
-\060\015\006\011\052\206\110\206\367\015\001\001\005\005\000\060
-\201\276\061\077\060\075\006\003\125\004\003\014\066\124\303\234
-\122\113\124\122\125\123\124\040\105\154\145\153\164\162\157\156
-\151\153\040\123\145\162\164\151\146\151\153\141\040\110\151\172
-\155\145\164\040\123\141\304\237\154\141\171\304\261\143\304\261
-\163\304\261\061\013\060\011\006\003\125\004\006\023\002\124\122
-\061\017\060\015\006\003\125\004\007\014\006\101\156\153\141\162
-\141\061\135\060\133\006\003\125\004\012\014\124\124\303\234\122
-\113\124\122\125\123\124\040\102\151\154\147\151\040\304\260\154
-\145\164\151\305\237\151\155\040\166\145\040\102\151\154\151\305
-\237\151\155\040\107\303\274\166\145\156\154\151\304\237\151\040
-\110\151\172\155\145\164\154\145\162\151\040\101\056\305\236\056
-\040\050\143\051\040\113\141\163\304\261\155\040\062\060\060\065
-\060\036\027\015\060\065\061\061\060\067\061\060\060\067\065\067
-\132\027\015\061\065\060\071\061\066\061\060\060\067\065\067\132
-\060\201\276\061\077\060\075\006\003\125\004\003\014\066\124\303
-\234\122\113\124\122\125\123\124\040\105\154\145\153\164\162\157
-\156\151\153\040\123\145\162\164\151\146\151\153\141\040\110\151
-\172\155\145\164\040\123\141\304\237\154\141\171\304\261\143\304
-\261\163\304\261\061\013\060\011\006\003\125\004\006\023\002\124
-\122\061\017\060\015\006\003\125\004\007\014\006\101\156\153\141
-\162\141\061\135\060\133\006\003\125\004\012\014\124\124\303\234
-\122\113\124\122\125\123\124\040\102\151\154\147\151\040\304\260
-\154\145\164\151\305\237\151\155\040\166\145\040\102\151\154\151
-\305\237\151\155\040\107\303\274\166\145\156\154\151\304\237\151
-\040\110\151\172\155\145\164\154\145\162\151\040\101\056\305\236
-\056\040\050\143\051\040\113\141\163\304\261\155\040\062\060\060
-\065\060\202\001\042\060\015\006\011\052\206\110\206\367\015\001
-\001\001\005\000\003\202\001\017\000\060\202\001\012\002\202\001
-\001\000\251\066\176\303\221\103\114\303\031\230\010\310\307\130
-\173\117\026\214\245\316\111\001\037\163\016\254\165\023\246\372
-\236\054\040\336\330\220\016\012\321\151\322\047\373\252\167\237
-\047\122\045\342\313\135\330\330\203\120\027\175\212\265\202\077
-\004\216\264\325\360\111\247\144\267\036\056\137\040\234\120\165
-\117\257\341\265\101\024\364\230\222\210\307\345\345\144\107\141
-\107\171\375\300\121\361\301\231\347\334\316\152\373\257\265\001
-\060\334\106\034\357\212\354\225\357\334\377\257\020\034\353\235
-\330\260\252\152\205\030\015\027\311\076\277\361\233\320\011\211
-\102\375\240\102\264\235\211\121\125\051\317\033\160\274\204\124
-\255\301\023\037\230\364\056\166\140\213\135\077\232\255\312\014
-\277\247\126\133\217\167\270\325\236\171\111\222\077\340\361\227
-\044\172\154\233\027\017\155\357\123\230\221\053\344\017\276\131
-\171\007\170\273\227\225\364\237\151\324\130\207\012\251\343\314
-\266\130\031\237\046\041\261\304\131\215\262\101\165\300\255\151
-\316\234\000\010\362\066\377\076\360\241\017\032\254\024\375\246
-\140\017\002\003\001\000\001\243\103\060\101\060\035\006\003\125
-\035\016\004\026\004\024\331\067\263\116\005\375\331\317\237\022
-\026\256\266\211\057\353\045\072\210\034\060\017\006\003\125\035
-\017\001\001\377\004\005\003\003\007\006\000\060\017\006\003\125
-\035\023\001\001\377\004\005\060\003\001\001\377\060\015\006\011
-\052\206\110\206\367\015\001\001\005\005\000\003\202\001\001\000
-\162\140\226\267\311\334\330\051\136\043\205\137\262\263\055\166
-\373\210\327\027\376\173\155\105\270\366\205\154\237\042\374\052
-\020\042\354\252\271\060\366\253\130\326\071\020\061\231\051\000
-\275\211\146\101\373\164\336\221\301\030\013\237\265\141\313\235
-\072\276\365\250\224\243\042\125\156\027\111\377\322\051\361\070
-\046\135\357\245\252\072\371\161\173\346\332\130\035\323\164\302
-\001\372\076\151\130\137\255\313\150\276\024\056\233\154\300\266
-\334\240\046\372\167\032\342\044\332\032\067\340\147\255\321\163
-\203\015\245\032\035\156\022\222\176\204\142\000\027\275\274\045
-\030\127\362\327\251\157\131\210\274\064\267\056\205\170\235\226
-\334\024\303\054\212\122\233\226\214\122\146\075\206\026\213\107
-\270\121\011\214\352\175\315\210\162\263\140\063\261\360\012\104
-\357\017\365\011\067\210\044\016\054\153\040\072\242\372\021\362
-\100\065\234\104\150\143\073\254\063\157\143\274\054\273\362\322
-\313\166\175\175\210\330\035\310\005\035\156\274\224\251\146\214
-\167\161\307\372\221\372\057\121\236\351\071\122\266\347\004\102
-END
-
-# Trust for Certificate "TURKTRUST Certificate Services Provider Root 2"
-# Issuer: O=T..RKTRUST Bilgi ..leti..im ve Bili..im G..venli..i Hizmetleri A...,L=Ankara,C=TR,CN=T..RKTRUST Elektronik Sertifika Hizmet Sa..lay..c..s..
-# Serial Number: 1 (0x1)
-# Subject: O=T..RKTRUST Bilgi ..leti..im ve Bili..im G..venli..i Hizmetleri A...,L=Ankara,C=TR,CN=T..RKTRUST Elektronik Sertifika Hizmet Sa..lay..c..s..
-# Not Valid Before: Mon Nov 07 10:07:57 2005
-# Not Valid After : Wed Sep 16 10:07:57 2015
-# Fingerprint (MD5): 37:A5:6E:D4:B1:25:84:97:B7:FD:56:15:7A:F9:A2:00
-# Fingerprint (SHA1): B4:35:D4:E1:11:9D:1C:66:90:A7:49:EB:B3:94:BD:63:7B:A7:82:B7
-CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "TURKTRUST Certificate Services Provider Root 2"
-CKA_CERT_SHA1_HASH MULTILINE_OCTAL
-\264\065\324\341\021\235\034\146\220\247\111\353\263\224\275\143
-\173\247\202\267
-END
-CKA_CERT_MD5_HASH MULTILINE_OCTAL
-\067\245\156\324\261\045\204\227\267\375\126\025\172\371\242\000
-END
-CKA_ISSUER MULTILINE_OCTAL
-\060\201\276\061\077\060\075\006\003\125\004\003\014\066\124\303
-\234\122\113\124\122\125\123\124\040\105\154\145\153\164\162\157
-\156\151\153\040\123\145\162\164\151\146\151\153\141\040\110\151
-\172\155\145\164\040\123\141\304\237\154\141\171\304\261\143\304
-\261\163\304\261\061\013\060\011\006\003\125\004\006\023\002\124
-\122\061\017\060\015\006\003\125\004\007\014\006\101\156\153\141
-\162\141\061\135\060\133\006\003\125\004\012\014\124\124\303\234
-\122\113\124\122\125\123\124\040\102\151\154\147\151\040\304\260
-\154\145\164\151\305\237\151\155\040\166\145\040\102\151\154\151
-\305\237\151\155\040\107\303\274\166\145\156\154\151\304\237\151
-\040\110\151\172\155\145\164\154\145\162\151\040\101\056\305\236
-\056\040\050\143\051\040\113\141\163\304\261\155\040\062\060\060
-\065
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\001\001
-END
-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
-
 #
 # Certificate "SwissSign Platinum CA - G2"
 #
@@ -16884,150 +15987,6 @@ CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
-#
-# Certificate "TC TrustCenter Universal CA III"
-#
-# Issuer: CN=TC TrustCenter Universal CA III,OU=TC TrustCenter Universal CA,O=TC TrustCenter GmbH,C=DE
-# Serial Number:63:25:00:01:00:02:14:8d:33:15:02:e4:6c:f4
-# Subject: CN=TC TrustCenter Universal CA III,OU=TC TrustCenter Universal CA,O=TC TrustCenter GmbH,C=DE
-# Not Valid Before: Wed Sep 09 08:15:27 2009
-# Not Valid After : Mon Dec 31 23:59:59 2029
-# Fingerprint (MD5): 9F:DD:DB:AB:FF:8E:FF:45:21:5F:F0:6C:9D:8F:FE:2B
-# Fingerprint (SHA1): 96:56:CD:7B:57:96:98:95:D0:E1:41:46:68:06:FB:B8:C6:11:06:87
-CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "TC TrustCenter Universal CA III"
-CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
-CKA_SUBJECT MULTILINE_OCTAL
-\060\173\061\013\060\011\006\003\125\004\006\023\002\104\105\061
-\034\060\032\006\003\125\004\012\023\023\124\103\040\124\162\165
-\163\164\103\145\156\164\145\162\040\107\155\142\110\061\044\060
-\042\006\003\125\004\013\023\033\124\103\040\124\162\165\163\164
-\103\145\156\164\145\162\040\125\156\151\166\145\162\163\141\154
-\040\103\101\061\050\060\046\006\003\125\004\003\023\037\124\103
-\040\124\162\165\163\164\103\145\156\164\145\162\040\125\156\151
-\166\145\162\163\141\154\040\103\101\040\111\111\111
-END
-CKA_ID UTF8 "0"
-CKA_ISSUER MULTILINE_OCTAL
-\060\173\061\013\060\011\006\003\125\004\006\023\002\104\105\061
-\034\060\032\006\003\125\004\012\023\023\124\103\040\124\162\165
-\163\164\103\145\156\164\145\162\040\107\155\142\110\061\044\060
-\042\006\003\125\004\013\023\033\124\103\040\124\162\165\163\164
-\103\145\156\164\145\162\040\125\156\151\166\145\162\163\141\154
-\040\103\101\061\050\060\046\006\003\125\004\003\023\037\124\103
-\040\124\162\165\163\164\103\145\156\164\145\162\040\125\156\151
-\166\145\162\163\141\154\040\103\101\040\111\111\111
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\016\143\045\000\001\000\002\024\215\063\025\002\344\154\364
-END
-CKA_VALUE MULTILINE_OCTAL
-\060\202\003\341\060\202\002\311\240\003\002\001\002\002\016\143
-\045\000\001\000\002\024\215\063\025\002\344\154\364\060\015\006
-\011\052\206\110\206\367\015\001\001\005\005\000\060\173\061\013
-\060\011\006\003\125\004\006\023\002\104\105\061\034\060\032\006
-\003\125\004\012\023\023\124\103\040\124\162\165\163\164\103\145
-\156\164\145\162\040\107\155\142\110\061\044\060\042\006\003\125
-\004\013\023\033\124\103\040\124\162\165\163\164\103\145\156\164
-\145\162\040\125\156\151\166\145\162\163\141\154\040\103\101\061
-\050\060\046\006\003\125\004\003\023\037\124\103\040\124\162\165
-\163\164\103\145\156\164\145\162\040\125\156\151\166\145\162\163
-\141\154\040\103\101\040\111\111\111\060\036\027\015\060\071\060
-\071\060\071\060\070\061\065\062\067\132\027\015\062\071\061\062
-\063\061\062\063\065\071\065\071\132\060\173\061\013\060\011\006
-\003\125\004\006\023\002\104\105\061\034\060\032\006\003\125\004
-\012\023\023\124\103\040\124\162\165\163\164\103\145\156\164\145
-\162\040\107\155\142\110\061\044\060\042\006\003\125\004\013\023
-\033\124\103\040\124\162\165\163\164\103\145\156\164\145\162\040
-\125\156\151\166\145\162\163\141\154\040\103\101\061\050\060\046
-\006\003\125\004\003\023\037\124\103\040\124\162\165\163\164\103
-\145\156\164\145\162\040\125\156\151\166\145\162\163\141\154\040
-\103\101\040\111\111\111\060\202\001\042\060\015\006\011\052\206
-\110\206\367\015\001\001\001\005\000\003\202\001\017\000\060\202
-\001\012\002\202\001\001\000\302\332\234\142\260\271\161\022\260
-\013\310\032\127\262\256\203\024\231\263\064\113\233\220\242\305
-\347\347\057\002\240\115\055\244\372\205\332\233\045\205\055\100
-\050\040\155\352\340\275\261\110\203\042\051\104\237\116\203\356
-\065\121\023\163\164\325\274\362\060\146\224\123\300\100\066\057
-\014\204\145\316\017\156\302\130\223\350\054\013\072\351\301\216
-\373\362\153\312\074\342\234\116\216\344\371\175\323\047\237\033
-\325\147\170\207\055\177\013\107\263\307\350\311\110\174\257\057
-\314\012\331\101\357\237\376\232\341\262\256\371\123\265\345\351
-\106\237\140\343\337\215\323\177\373\226\176\263\265\162\370\113
-\255\010\171\315\151\211\100\047\365\052\301\255\103\354\244\123
-\310\141\266\367\322\171\052\147\030\166\110\155\133\045\001\321
-\046\305\267\127\151\043\025\133\141\212\255\360\033\055\331\257
-\134\361\046\220\151\251\325\014\100\365\063\200\103\217\234\243
-\166\052\105\264\257\277\177\076\207\077\166\305\315\052\336\040
-\305\026\130\313\371\033\365\017\313\015\021\122\144\270\322\166
-\142\167\203\361\130\237\377\002\003\001\000\001\243\143\060\141
-\060\037\006\003\125\035\043\004\030\060\026\200\024\126\347\341
-\133\045\103\200\340\366\214\341\161\274\216\345\200\057\304\110
-\342\060\017\006\003\125\035\023\001\001\377\004\005\060\003\001
-\001\377\060\016\006\003\125\035\017\001\001\377\004\004\003\002
-\001\006\060\035\006\003\125\035\016\004\026\004\024\126\347\341
-\133\045\103\200\340\366\214\341\161\274\216\345\200\057\304\110
-\342\060\015\006\011\052\206\110\206\367\015\001\001\005\005\000
-\003\202\001\001\000\203\307\257\352\177\115\012\074\071\261\150
-\276\173\155\211\056\351\263\011\347\030\127\215\205\232\027\363
-\166\102\120\023\017\307\220\157\063\255\305\111\140\053\154\111
-\130\031\324\342\276\267\277\253\111\274\224\310\253\276\050\154
-\026\150\340\310\227\106\040\240\150\147\140\210\071\040\121\330
-\150\001\021\316\247\366\021\007\366\354\354\254\032\037\262\146
-\156\126\147\140\172\164\136\300\155\227\066\256\265\015\135\146
-\163\300\045\062\105\330\112\006\007\217\304\267\007\261\115\006
-\015\341\245\353\364\165\312\272\234\320\275\263\323\062\044\114
-\356\176\342\166\004\113\111\123\330\362\351\124\063\374\345\161
-\037\075\024\134\226\113\361\072\362\000\273\154\264\372\226\125
-\010\210\011\301\314\221\031\051\260\040\055\377\313\070\244\100
-\341\027\276\171\141\200\377\007\003\206\114\116\173\006\237\021
-\206\215\211\356\047\304\333\342\274\031\216\013\303\303\023\307
-\055\003\143\073\323\350\344\242\052\302\202\010\224\026\124\360
-\357\037\047\220\045\270\015\016\050\033\107\167\107\275\034\250
-\045\361\224\264\146
-END
-
-# Trust for Certificate "TC TrustCenter Universal CA III"
-# Issuer: CN=TC TrustCenter Universal CA III,OU=TC TrustCenter Universal CA,O=TC TrustCenter GmbH,C=DE
-# Serial Number:63:25:00:01:00:02:14:8d:33:15:02:e4:6c:f4
-# Subject: CN=TC TrustCenter Universal CA III,OU=TC TrustCenter Universal CA,O=TC TrustCenter GmbH,C=DE
-# Not Valid Before: Wed Sep 09 08:15:27 2009
-# Not Valid After : Mon Dec 31 23:59:59 2029
-# Fingerprint (MD5): 9F:DD:DB:AB:FF:8E:FF:45:21:5F:F0:6C:9D:8F:FE:2B
-# Fingerprint (SHA1): 96:56:CD:7B:57:96:98:95:D0:E1:41:46:68:06:FB:B8:C6:11:06:87
-CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "TC TrustCenter Universal CA III"
-CKA_CERT_SHA1_HASH MULTILINE_OCTAL
-\226\126\315\173\127\226\230\225\320\341\101\106\150\006\373\270
-\306\021\006\207
-END
-CKA_CERT_MD5_HASH MULTILINE_OCTAL
-\237\335\333\253\377\216\377\105\041\137\360\154\235\217\376\053
-END
-CKA_ISSUER MULTILINE_OCTAL
-\060\173\061\013\060\011\006\003\125\004\006\023\002\104\105\061
-\034\060\032\006\003\125\004\012\023\023\124\103\040\124\162\165
-\163\164\103\145\156\164\145\162\040\107\155\142\110\061\044\060
-\042\006\003\125\004\013\023\033\124\103\040\124\162\165\163\164
-\103\145\156\164\145\162\040\125\156\151\166\145\162\163\141\154
-\040\103\101\061\050\060\046\006\003\125\004\003\023\037\124\103
-\040\124\162\165\163\164\103\145\156\164\145\162\040\125\156\151
-\166\145\162\163\141\154\040\103\101\040\111\111\111
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\016\143\045\000\001\000\002\024\215\063\025\002\344\154\364
-END
-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
-CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
-CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
-
 #
 # Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068"
 #
@@ -20955,152 +19914,6 @@ CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
-#
-# Certificate "A-Trust-nQual-03"
-#
-# Issuer: CN=A-Trust-nQual-03,OU=A-Trust-nQual-03,O=A-Trust Ges. f. Sicherheitssysteme im elektr. Datenverkehr GmbH,C=AT
-# Serial Number: 93214 (0x16c1e)
-# Subject: CN=A-Trust-nQual-03,OU=A-Trust-nQual-03,O=A-Trust Ges. f. Sicherheitssysteme im elektr. Datenverkehr GmbH,C=AT
-# Not Valid Before: Wed Aug 17 22:00:00 2005
-# Not Valid After : Mon Aug 17 22:00:00 2015
-# Fingerprint (MD5): 49:63:AE:27:F4:D5:95:3D:D8:DB:24:86:B8:9C:07:53
-# Fingerprint (SHA1): D3:C0:63:F2:19:ED:07:3E:34:AD:5D:75:0B:32:76:29:FF:D5:9A:F2
-CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "A-Trust-nQual-03"
-CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
-CKA_SUBJECT MULTILINE_OCTAL
-\060\201\215\061\013\060\011\006\003\125\004\006\023\002\101\124
-\061\110\060\106\006\003\125\004\012\014\077\101\055\124\162\165
-\163\164\040\107\145\163\056\040\146\056\040\123\151\143\150\145
-\162\150\145\151\164\163\163\171\163\164\145\155\145\040\151\155
-\040\145\154\145\153\164\162\056\040\104\141\164\145\156\166\145
-\162\153\145\150\162\040\107\155\142\110\061\031\060\027\006\003
-\125\004\013\014\020\101\055\124\162\165\163\164\055\156\121\165
-\141\154\055\060\063\061\031\060\027\006\003\125\004\003\014\020
-\101\055\124\162\165\163\164\055\156\121\165\141\154\055\060\063
-END
-CKA_ID UTF8 "0"
-CKA_ISSUER MULTILINE_OCTAL
-\060\201\215\061\013\060\011\006\003\125\004\006\023\002\101\124
-\061\110\060\106\006\003\125\004\012\014\077\101\055\124\162\165
-\163\164\040\107\145\163\056\040\146\056\040\123\151\143\150\145
-\162\150\145\151\164\163\163\171\163\164\145\155\145\040\151\155
-\040\145\154\145\153\164\162\056\040\104\141\164\145\156\166\145
-\162\153\145\150\162\040\107\155\142\110\061\031\060\027\006\003
-\125\004\013\014\020\101\055\124\162\165\163\164\055\156\121\165
-\141\154\055\060\063\061\031\060\027\006\003\125\004\003\014\020
-\101\055\124\162\165\163\164\055\156\121\165\141\154\055\060\063
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\003\001\154\036
-END
-CKA_VALUE MULTILINE_OCTAL
-\060\202\003\317\060\202\002\267\240\003\002\001\002\002\003\001
-\154\036\060\015\006\011\052\206\110\206\367\015\001\001\005\005
-\000\060\201\215\061\013\060\011\006\003\125\004\006\023\002\101
-\124\061\110\060\106\006\003\125\004\012\014\077\101\055\124\162
-\165\163\164\040\107\145\163\056\040\146\056\040\123\151\143\150
-\145\162\150\145\151\164\163\163\171\163\164\145\155\145\040\151
-\155\040\145\154\145\153\164\162\056\040\104\141\164\145\156\166
-\145\162\153\145\150\162\040\107\155\142\110\061\031\060\027\006
-\003\125\004\013\014\020\101\055\124\162\165\163\164\055\156\121
-\165\141\154\055\060\063\061\031\060\027\006\003\125\004\003\014
-\020\101\055\124\162\165\163\164\055\156\121\165\141\154\055\060
-\063\060\036\027\015\060\065\060\070\061\067\062\062\060\060\060
-\060\132\027\015\061\065\060\070\061\067\062\062\060\060\060\060
-\132\060\201\215\061\013\060\011\006\003\125\004\006\023\002\101
-\124\061\110\060\106\006\003\125\004\012\014\077\101\055\124\162
-\165\163\164\040\107\145\163\056\040\146\056\040\123\151\143\150
-\145\162\150\145\151\164\163\163\171\163\164\145\155\145\040\151
-\155\040\145\154\145\153\164\162\056\040\104\141\164\145\156\166
-\145\162\153\145\150\162\040\107\155\142\110\061\031\060\027\006
-\003\125\004\013\014\020\101\055\124\162\165\163\164\055\156\121
-\165\141\154\055\060\063\061\031\060\027\006\003\125\004\003\014
-\020\101\055\124\162\165\163\164\055\156\121\165\141\154\055\060
-\063\060\202\001\042\060\015\006\011\052\206\110\206\367\015\001
-\001\001\005\000\003\202\001\017\000\060\202\001\012\002\202\001
-\001\000\255\075\141\156\003\363\220\073\300\101\013\204\200\315
-\354\052\243\235\153\273\156\302\102\204\367\121\024\341\240\250
-\055\121\243\121\362\336\043\360\064\104\377\224\353\314\005\043
-\225\100\271\007\170\245\045\366\012\275\105\206\350\331\275\300
-\004\216\205\104\141\357\177\247\311\372\301\045\314\205\054\143
-\077\005\140\163\111\005\340\140\170\225\020\113\334\371\021\131
-\316\161\177\100\233\212\252\044\337\013\102\342\333\126\274\112
-\322\245\014\233\267\103\076\335\203\323\046\020\002\317\352\043
-\304\111\116\345\323\351\264\210\253\014\256\142\222\324\145\207
-\331\152\327\364\205\237\344\063\042\045\245\345\310\063\272\303
-\307\101\334\137\306\152\314\000\016\155\062\250\266\207\066\000
-\142\167\233\036\037\064\313\220\074\170\210\164\005\353\171\365
-\223\161\145\312\235\307\153\030\055\075\134\116\347\325\370\077
-\061\175\217\207\354\012\042\057\043\351\376\273\175\311\340\364
-\354\353\174\304\260\303\055\142\265\232\161\326\261\152\350\354
-\331\355\325\162\354\276\127\001\316\005\125\237\336\321\140\210
-\020\263\002\003\001\000\001\243\066\060\064\060\017\006\003\125
-\035\023\001\001\377\004\005\060\003\001\001\377\060\021\006\003
-\125\035\016\004\012\004\010\104\152\225\147\125\171\021\117\060
-\016\006\003\125\035\017\001\001\377\004\004\003\002\001\006\060
-\015\006\011\052\206\110\206\367\015\001\001\005\005\000\003\202
-\001\001\000\125\324\124\321\131\110\134\263\223\205\252\277\143
-\057\344\200\316\064\243\064\142\076\366\330\356\147\210\061\004
-\003\157\013\324\007\373\116\165\017\323\056\323\300\027\307\306
-\050\354\006\015\021\044\016\016\245\135\277\214\262\023\226\161
-\334\324\316\016\015\012\150\062\154\271\101\061\031\253\261\007
-\173\115\230\323\134\260\321\360\247\102\240\265\304\216\257\376
-\361\077\364\357\117\106\000\166\353\002\373\371\235\322\100\226
-\307\210\072\270\237\021\171\363\200\145\250\275\037\323\170\201
-\240\121\114\067\264\246\135\045\160\321\146\311\150\371\056\021
-\024\150\361\124\230\010\254\046\222\017\336\211\236\324\372\263
-\171\053\322\243\171\324\354\213\254\207\123\150\102\114\121\121
-\164\036\033\047\056\343\365\037\051\164\115\355\257\367\341\222
-\231\201\350\276\072\307\027\120\366\267\306\374\233\260\212\153
-\326\210\003\221\217\006\167\072\205\002\335\230\325\103\170\077
-\306\060\025\254\233\153\313\127\267\211\121\213\072\350\311\204
-\014\333\261\120\040\012\032\112\272\152\032\275\354\033\310\305
-\204\232\315
-END
-
-# Trust for Certificate "A-Trust-nQual-03"
-# Issuer: CN=A-Trust-nQual-03,OU=A-Trust-nQual-03,O=A-Trust Ges. f. Sicherheitssysteme im elektr. Datenverkehr GmbH,C=AT
-# Serial Number: 93214 (0x16c1e)
-# Subject: CN=A-Trust-nQual-03,OU=A-Trust-nQual-03,O=A-Trust Ges. f. Sicherheitssysteme im elektr. Datenverkehr GmbH,C=AT
-# Not Valid Before: Wed Aug 17 22:00:00 2005
-# Not Valid After : Mon Aug 17 22:00:00 2015
-# Fingerprint (MD5): 49:63:AE:27:F4:D5:95:3D:D8:DB:24:86:B8:9C:07:53
-# Fingerprint (SHA1): D3:C0:63:F2:19:ED:07:3E:34:AD:5D:75:0B:32:76:29:FF:D5:9A:F2
-CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "A-Trust-nQual-03"
-CKA_CERT_SHA1_HASH MULTILINE_OCTAL
-\323\300\143\362\031\355\007\076\064\255\135\165\013\062\166\051
-\377\325\232\362
-END
-CKA_CERT_MD5_HASH MULTILINE_OCTAL
-\111\143\256\047\364\325\225\075\330\333\044\206\270\234\007\123
-END
-CKA_ISSUER MULTILINE_OCTAL
-\060\201\215\061\013\060\011\006\003\125\004\006\023\002\101\124
-\061\110\060\106\006\003\125\004\012\014\077\101\055\124\162\165
-\163\164\040\107\145\163\056\040\146\056\040\123\151\143\150\145
-\162\150\145\151\164\163\163\171\163\164\145\155\145\040\151\155
-\040\145\154\145\153\164\162\056\040\104\141\164\145\156\166\145
-\162\153\145\150\162\040\107\155\142\110\061\031\060\027\006\003
-\125\004\013\014\020\101\055\124\162\165\163\164\055\156\121\165
-\141\154\055\060\063\061\031\060\027\006\003\125\004\003\014\020
-\101\055\124\162\165\163\164\055\156\121\165\141\154\055\060\063
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\003\001\154\036
-END
-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
-CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
-
 #
 # Certificate "TWCA Root Certification Authority"
 #
@@ -29080,164 +27893,6 @@ CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
-#
-# Certificate "USERTrust-temporary-intermediate-after-1024bit-removal"
-#
-# Issuer: CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE
-# Serial Number:5d:20:61:8e:8c:0e:b9:34:40:93:b9:b1:d8:63:95:b6
-# Subject: CN=USERTrust Legacy Secure Server CA,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
-# Not Valid Before: Tue Aug 05 00:00:00 2014
-# Not Valid After : Sun Nov 01 23:59:59 2015
-# Fingerprint (SHA-256): 92:96:6E:83:44:D2:FB:3A:28:0E:B8:60:4D:81:40:77:4C:E1:A0:57:C5:82:BE:BC:83:4D:03:02:E8:59:BC:43
-# Fingerprint (SHA1): 7C:2F:91:E2:BB:96:68:A9:C6:F6:BD:10:19:2C:6B:52:5A:1B:BA:48
-CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "USERTrust-temporary-intermediate-after-1024bit-removal"
-CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
-CKA_SUBJECT MULTILINE_OCTAL
-\060\177\061\013\060\011\006\003\125\004\006\023\002\125\123\061
-\013\060\011\006\003\125\004\010\023\002\125\124\061\027\060\025
-\006\003\125\004\007\023\016\123\141\154\164\040\114\141\153\145
-\040\103\151\164\171\061\036\060\034\006\003\125\004\012\023\025
-\124\150\145\040\125\123\105\122\124\122\125\123\124\040\116\145
-\164\167\157\162\153\061\052\060\050\006\003\125\004\003\023\041
-\125\123\105\122\124\162\165\163\164\040\114\145\147\141\143\171
-\040\123\145\143\165\162\145\040\123\145\162\166\145\162\040\103
-\101
-END
-CKA_ID UTF8 "0"
-CKA_ISSUER MULTILINE_OCTAL
-\060\157\061\013\060\011\006\003\125\004\006\023\002\123\105\061
-\024\060\022\006\003\125\004\012\023\013\101\144\144\124\162\165
-\163\164\040\101\102\061\046\060\044\006\003\125\004\013\023\035
-\101\144\144\124\162\165\163\164\040\105\170\164\145\162\156\141
-\154\040\124\124\120\040\116\145\164\167\157\162\153\061\042\060
-\040\006\003\125\004\003\023\031\101\144\144\124\162\165\163\164
-\040\105\170\164\145\162\156\141\154\040\103\101\040\122\157\157
-\164
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\020\135\040\141\216\214\016\271\064\100\223\271\261\330\143
-\225\266
-END
-CKA_VALUE MULTILINE_OCTAL
-\060\202\004\231\060\202\003\201\240\003\002\001\002\002\020\135
-\040\141\216\214\016\271\064\100\223\271\261\330\143\225\266\060
-\015\006\011\052\206\110\206\367\015\001\001\005\005\000\060\157
-\061\013\060\011\006\003\125\004\006\023\002\123\105\061\024\060
-\022\006\003\125\004\012\023\013\101\144\144\124\162\165\163\164
-\040\101\102\061\046\060\044\006\003\125\004\013\023\035\101\144
-\144\124\162\165\163\164\040\105\170\164\145\162\156\141\154\040
-\124\124\120\040\116\145\164\167\157\162\153\061\042\060\040\006
-\003\125\004\003\023\031\101\144\144\124\162\165\163\164\040\105
-\170\164\145\162\156\141\154\040\103\101\040\122\157\157\164\060
-\036\027\015\061\064\060\070\060\065\060\060\060\060\060\060\132
-\027\015\061\065\061\061\060\061\062\063\065\071\065\071\132\060
-\177\061\013\060\011\006\003\125\004\006\023\002\125\123\061\013
-\060\011\006\003\125\004\010\023\002\125\124\061\027\060\025\006
-\003\125\004\007\023\016\123\141\154\164\040\114\141\153\145\040
-\103\151\164\171\061\036\060\034\006\003\125\004\012\023\025\124
-\150\145\040\125\123\105\122\124\122\125\123\124\040\116\145\164
-\167\157\162\153\061\052\060\050\006\003\125\004\003\023\041\125
-\123\105\122\124\162\165\163\164\040\114\145\147\141\143\171\040
-\123\145\143\165\162\145\040\123\145\162\166\145\162\040\103\101
-\060\202\001\042\060\015\006\011\052\206\110\206\367\015\001\001
-\001\005\000\003\202\001\017\000\060\202\001\012\002\202\001\001
-\000\331\115\040\072\346\051\060\206\362\351\206\211\166\064\116
-\150\037\226\104\367\321\371\326\202\116\246\070\236\356\313\133
-\341\216\056\275\362\127\200\375\311\077\374\220\163\104\274\217
-\273\127\133\345\055\037\024\060\165\066\365\177\274\317\126\364
-\177\201\377\256\221\315\330\322\152\313\227\371\367\315\220\152
-\105\055\304\273\244\205\023\150\127\137\357\051\272\052\312\352
-\365\314\244\004\233\143\315\000\353\375\355\215\335\043\306\173
-\036\127\035\066\177\037\010\232\015\141\333\132\154\161\002\123
-\050\302\372\215\375\253\273\263\361\215\164\113\337\275\275\314
-\006\223\143\011\225\302\020\172\235\045\220\062\235\001\302\071
-\123\260\340\025\153\307\327\164\345\244\042\233\344\224\377\204
-\221\373\055\263\031\103\055\223\017\234\022\011\344\147\271\047
-\172\062\255\172\052\314\101\130\300\156\131\137\356\070\053\027
-\042\234\211\372\156\347\345\127\065\364\132\355\222\225\223\055
-\371\314\044\077\245\034\075\047\275\042\003\163\314\365\312\363
-\251\364\334\376\317\351\320\134\320\017\253\207\374\203\375\310
-\251\002\003\001\000\001\243\202\001\037\060\202\001\033\060\037
-\006\003\125\035\043\004\030\060\026\200\024\255\275\230\172\064
-\264\046\367\372\304\046\124\357\003\275\340\044\313\124\032\060
-\035\006\003\125\035\016\004\026\004\024\257\244\100\257\237\026
-\376\253\061\375\373\325\227\213\365\221\243\044\206\026\060\016
-\006\003\125\035\017\001\001\377\004\004\003\002\001\206\060\022
-\006\003\125\035\023\001\001\377\004\010\060\006\001\001\377\002
-\001\000\060\035\006\003\125\035\045\004\026\060\024\006\010\053
-\006\001\005\005\007\003\001\006\010\053\006\001\005\005\007\003
-\002\060\031\006\003\125\035\040\004\022\060\020\060\016\006\014
-\053\006\001\004\001\262\061\001\002\001\003\004\060\104\006\003
-\125\035\037\004\075\060\073\060\071\240\067\240\065\206\063\150
-\164\164\160\072\057\057\143\162\154\056\165\163\145\162\164\162
-\165\163\164\056\143\157\155\057\101\144\144\124\162\165\163\164
-\105\170\164\145\162\156\141\154\103\101\122\157\157\164\056\143
-\162\154\060\065\006\010\053\006\001\005\005\007\001\001\004\051
-\060\047\060\045\006\010\053\006\001\005\005\007\060\001\206\031
-\150\164\164\160\072\057\057\157\143\163\160\056\165\163\145\162
-\164\162\165\163\164\056\143\157\155\060\015\006\011\052\206\110
-\206\367\015\001\001\005\005\000\003\202\001\001\000\204\256\055
-\150\070\021\154\203\121\142\300\221\302\230\274\306\073\372\245
-\305\275\073\011\346\156\140\157\060\003\206\042\032\262\213\363
-\306\316\036\273\033\171\340\026\024\115\322\232\005\113\377\217
-\354\360\050\051\352\052\004\035\075\257\021\022\325\111\230\120
-\102\237\141\146\072\266\100\231\004\014\153\020\062\351\367\317
-\206\130\117\055\315\323\254\176\350\133\152\203\174\015\240\234
-\134\120\066\165\015\155\176\102\267\337\246\334\220\134\157\043
-\116\227\035\363\042\165\277\003\065\346\135\177\307\371\233\054
-\207\366\216\326\045\226\131\235\317\352\020\036\357\156\352\132
-\233\167\030\064\314\201\167\257\232\207\302\012\345\345\236\023
-\225\123\275\275\111\032\245\166\022\366\334\362\221\267\351\032
-\341\274\115\075\225\161\175\370\215\174\076\003\117\123\355\376
-\122\375\312\137\223\341\032\001\033\002\267\163\116\272\146\351
-\170\213\120\376\021\313\321\147\320\042\117\167\352\315\024\025
-\100\256\146\135\350\056\177\036\210\157\125\171\326\271\176\343
-\265\375\221\240\300\362\046\207\113\057\235\365\240
-END
-
-# Trust for "USERTrust-temporary-intermediate-after-1024bit-removal"
-# Issuer: CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE
-# Serial Number:5d:20:61:8e:8c:0e:b9:34:40:93:b9:b1:d8:63:95:b6
-# Subject: CN=USERTrust Legacy Secure Server CA,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
-# Not Valid Before: Tue Aug 05 00:00:00 2014
-# Not Valid After : Sun Nov 01 23:59:59 2015
-# Fingerprint (SHA-256): 92:96:6E:83:44:D2:FB:3A:28:0E:B8:60:4D:81:40:77:4C:E1:A0:57:C5:82:BE:BC:83:4D:03:02:E8:59:BC:43
-# Fingerprint (SHA1): 7C:2F:91:E2:BB:96:68:A9:C6:F6:BD:10:19:2C:6B:52:5A:1B:BA:48
-CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "USERTrust-temporary-intermediate-after-1024bit-removal"
-CKA_CERT_SHA1_HASH MULTILINE_OCTAL
-\174\057\221\342\273\226\150\251\306\366\275\020\031\054\153\122
-\132\033\272\110
-END
-CKA_CERT_MD5_HASH MULTILINE_OCTAL
-\131\153\146\214\004\251\341\013\017\356\105\245\220\044\037\016
-END
-CKA_ISSUER MULTILINE_OCTAL
-\060\157\061\013\060\011\006\003\125\004\006\023\002\123\105\061
-\024\060\022\006\003\125\004\012\023\013\101\144\144\124\162\165
-\163\164\040\101\102\061\046\060\044\006\003\125\004\013\023\035
-\101\144\144\124\162\165\163\164\040\105\170\164\145\162\156\141
-\154\040\124\124\120\040\116\145\164\167\157\162\153\061\042\060
-\040\006\003\125\004\003\023\031\101\144\144\124\162\165\163\164
-\040\105\170\164\145\162\156\141\154\040\103\101\040\122\157\157
-\164
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\020\135\040\141\216\214\016\271\064\100\223\271\261\330\143
-\225\266
-END
-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
-CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
-CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
-
 #
 # Certificate "VeriSign-C3SSA-G2-temporary-intermediate-after-1024bit-removal"
 #
@@ -31316,3 +29971,383 @@ CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
+
+#
+# Certificate "OISTE WISeKey Global Root GB CA"
+#
+# Issuer: CN=OISTE WISeKey Global Root GB CA,OU=OISTE Foundation Endorsed,O=WISeKey,C=CH
+# Serial Number:76:b1:20:52:74:f0:85:87:46:b3:f8:23:1a:f6:c2:c0
+# Subject: CN=OISTE WISeKey Global Root GB CA,OU=OISTE Foundation Endorsed,O=WISeKey,C=CH
+# Not Valid Before: Mon Dec 01 15:00:32 2014
+# Not Valid After : Thu Dec 01 15:10:31 2039
+# Fingerprint (SHA-256): 6B:9C:08:E8:6E:B0:F7:67:CF:AD:65:CD:98:B6:21:49:E5:49:4A:67:F5:84:5E:7B:D1:ED:01:9F:27:B8:6B:D6
+# Fingerprint (SHA1): 0F:F9:40:76:18:D3:D7:6A:4B:98:F0:A8:35:9E:0C:FD:27:AC:CC:ED
+CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
+CKA_TOKEN CK_BBOOL CK_TRUE
+CKA_PRIVATE CK_BBOOL CK_FALSE
+CKA_MODIFIABLE CK_BBOOL CK_FALSE
+CKA_LABEL UTF8 "OISTE WISeKey Global Root GB CA"
+CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
+CKA_SUBJECT MULTILINE_OCTAL
+\060\155\061\013\060\011\006\003\125\004\006\023\002\103\110\061
+\020\060\016\006\003\125\004\012\023\007\127\111\123\145\113\145
+\171\061\042\060\040\006\003\125\004\013\023\031\117\111\123\124
+\105\040\106\157\165\156\144\141\164\151\157\156\040\105\156\144
+\157\162\163\145\144\061\050\060\046\006\003\125\004\003\023\037
+\117\111\123\124\105\040\127\111\123\145\113\145\171\040\107\154
+\157\142\141\154\040\122\157\157\164\040\107\102\040\103\101
+END
+CKA_ID UTF8 "0"
+CKA_ISSUER MULTILINE_OCTAL
+\060\155\061\013\060\011\006\003\125\004\006\023\002\103\110\061
+\020\060\016\006\003\125\004\012\023\007\127\111\123\145\113\145
+\171\061\042\060\040\006\003\125\004\013\023\031\117\111\123\124
+\105\040\106\157\165\156\144\141\164\151\157\156\040\105\156\144
+\157\162\163\145\144\061\050\060\046\006\003\125\004\003\023\037
+\117\111\123\124\105\040\127\111\123\145\113\145\171\040\107\154
+\157\142\141\154\040\122\157\157\164\040\107\102\040\103\101
+END
+CKA_SERIAL_NUMBER MULTILINE_OCTAL
+\002\020\166\261\040\122\164\360\205\207\106\263\370\043\032\366
+\302\300
+END
+CKA_VALUE MULTILINE_OCTAL
+\060\202\003\265\060\202\002\235\240\003\002\001\002\002\020\166
+\261\040\122\164\360\205\207\106\263\370\043\032\366\302\300\060
+\015\006\011\052\206\110\206\367\015\001\001\013\005\000\060\155
+\061\013\060\011\006\003\125\004\006\023\002\103\110\061\020\060
+\016\006\003\125\004\012\023\007\127\111\123\145\113\145\171\061
+\042\060\040\006\003\125\004\013\023\031\117\111\123\124\105\040
+\106\157\165\156\144\141\164\151\157\156\040\105\156\144\157\162
+\163\145\144\061\050\060\046\006\003\125\004\003\023\037\117\111
+\123\124\105\040\127\111\123\145\113\145\171\040\107\154\157\142
+\141\154\040\122\157\157\164\040\107\102\040\103\101\060\036\027
+\015\061\064\061\062\060\061\061\065\060\060\063\062\132\027\015
+\063\071\061\062\060\061\061\065\061\060\063\061\132\060\155\061
+\013\060\011\006\003\125\004\006\023\002\103\110\061\020\060\016
+\006\003\125\004\012\023\007\127\111\123\145\113\145\171\061\042
+\060\040\006\003\125\004\013\023\031\117\111\123\124\105\040\106
+\157\165\156\144\141\164\151\157\156\040\105\156\144\157\162\163
+\145\144\061\050\060\046\006\003\125\004\003\023\037\117\111\123
+\124\105\040\127\111\123\145\113\145\171\040\107\154\157\142\141
+\154\040\122\157\157\164\040\107\102\040\103\101\060\202\001\042
+\060\015\006\011\052\206\110\206\367\015\001\001\001\005\000\003
+\202\001\017\000\060\202\001\012\002\202\001\001\000\330\027\267
+\034\112\044\052\326\227\261\312\342\036\373\175\070\357\230\365
+\262\071\230\116\047\270\021\135\173\322\045\224\210\202\025\046
+\152\033\061\273\250\133\041\041\053\330\017\116\237\132\361\261
+\132\344\171\326\062\043\053\341\123\314\231\105\134\173\117\255
+\274\277\207\112\013\113\227\132\250\366\110\354\175\173\015\315
+\041\006\337\236\025\375\101\212\110\267\040\364\241\172\033\127
+\324\135\120\377\272\147\330\043\231\037\310\077\343\336\377\157
+\133\167\261\153\156\270\311\144\367\341\312\101\106\016\051\161
+\320\271\043\374\311\201\137\116\367\157\337\277\204\255\163\144
+\273\267\102\216\151\366\324\166\035\176\235\247\270\127\212\121
+\147\162\327\324\250\270\225\124\100\163\003\366\352\364\353\376
+\050\102\167\077\235\043\033\262\266\075\200\024\007\114\056\117
+\367\325\012\026\015\275\146\103\067\176\043\103\171\303\100\206
+\365\114\051\332\216\232\255\015\245\004\207\210\036\205\343\351
+\123\325\233\310\213\003\143\170\353\340\031\112\156\273\057\153
+\063\144\130\223\255\151\277\217\033\357\202\110\307\002\003\001
+\000\001\243\121\060\117\060\013\006\003\125\035\017\004\004\003
+\002\001\206\060\017\006\003\125\035\023\001\001\377\004\005\060
+\003\001\001\377\060\035\006\003\125\035\016\004\026\004\024\065
+\017\310\066\143\136\342\243\354\371\073\146\025\316\121\122\343
+\221\232\075\060\020\006\011\053\006\001\004\001\202\067\025\001
+\004\003\002\001\000\060\015\006\011\052\206\110\206\367\015\001
+\001\013\005\000\003\202\001\001\000\100\114\373\207\262\231\201
+\220\176\235\305\260\260\046\315\210\173\053\062\215\156\270\041
+\161\130\227\175\256\067\024\257\076\347\367\232\342\175\366\161
+\230\231\004\252\103\164\170\243\343\111\141\076\163\214\115\224
+\340\371\161\304\266\026\016\123\170\037\326\242\207\057\002\071
+\201\051\074\257\025\230\041\060\376\050\220\000\214\321\341\313
+\372\136\310\375\370\020\106\073\242\170\102\221\027\164\125\012
+\336\120\147\115\146\321\247\377\375\331\300\265\250\243\212\316
+\146\365\017\103\315\247\053\127\173\143\106\152\252\056\122\330
+\364\355\341\155\255\051\220\170\110\272\341\043\252\243\211\354
+\265\253\226\300\264\113\242\035\227\236\172\362\156\100\161\337
+\150\361\145\115\316\174\005\337\123\145\251\245\360\261\227\004
+\160\025\106\003\230\324\322\277\124\264\240\130\175\122\157\332
+\126\046\142\324\330\333\211\061\157\034\360\042\302\323\142\034
+\065\315\114\151\025\124\032\220\230\336\353\036\137\312\167\307
+\313\216\075\103\151\234\232\130\320\044\073\337\033\100\226\176
+\065\255\201\307\116\161\272\210\023
+END
+
+# Trust for "OISTE WISeKey Global Root GB CA"
+# Issuer: CN=OISTE WISeKey Global Root GB CA,OU=OISTE Foundation Endorsed,O=WISeKey,C=CH
+# Serial Number:76:b1:20:52:74:f0:85:87:46:b3:f8:23:1a:f6:c2:c0
+# Subject: CN=OISTE WISeKey Global Root GB CA,OU=OISTE Foundation Endorsed,O=WISeKey,C=CH
+# Not Valid Before: Mon Dec 01 15:00:32 2014
+# Not Valid After : Thu Dec 01 15:10:31 2039
+# Fingerprint (SHA-256): 6B:9C:08:E8:6E:B0:F7:67:CF:AD:65:CD:98:B6:21:49:E5:49:4A:67:F5:84:5E:7B:D1:ED:01:9F:27:B8:6B:D6
+# Fingerprint (SHA1): 0F:F9:40:76:18:D3:D7:6A:4B:98:F0:A8:35:9E:0C:FD:27:AC:CC:ED
+CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
+CKA_TOKEN CK_BBOOL CK_TRUE
+CKA_PRIVATE CK_BBOOL CK_FALSE
+CKA_MODIFIABLE CK_BBOOL CK_FALSE
+CKA_LABEL UTF8 "OISTE WISeKey Global Root GB CA"
+CKA_CERT_SHA1_HASH MULTILINE_OCTAL
+\017\371\100\166\030\323\327\152\113\230\360\250\065\236\014\375
+\047\254\314\355
+END
+CKA_CERT_MD5_HASH MULTILINE_OCTAL
+\244\353\271\141\050\056\267\057\230\260\065\046\220\231\121\035
+END
+CKA_ISSUER MULTILINE_OCTAL
+\060\155\061\013\060\011\006\003\125\004\006\023\002\103\110\061
+\020\060\016\006\003\125\004\012\023\007\127\111\123\145\113\145
+\171\061\042\060\040\006\003\125\004\013\023\031\117\111\123\124
+\105\040\106\157\165\156\144\141\164\151\157\156\040\105\156\144
+\157\162\163\145\144\061\050\060\046\006\003\125\004\003\023\037
+\117\111\123\124\105\040\127\111\123\145\113\145\171\040\107\154
+\157\142\141\154\040\122\157\157\164\040\107\102\040\103\101
+END
+CKA_SERIAL_NUMBER MULTILINE_OCTAL
+\002\020\166\261\040\122\164\360\205\207\106\263\370\043\032\366
+\302\300
+END
+CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
+
+#
+# Certificate "Certification Authority of WoSign G2"
+#
+# Issuer: CN=Certification Authority of WoSign G2,O=WoSign CA Limited,C=CN
+# Serial Number:6b:25:da:8a:88:9d:7c:bc:0f:05:b3:b1:7a:61:45:44
+# Subject: CN=Certification Authority of WoSign G2,O=WoSign CA Limited,C=CN
+# Not Valid Before: Sat Nov 08 00:58:58 2014
+# Not Valid After : Tue Nov 08 00:58:58 2044
+# Fingerprint (SHA-256): D4:87:A5:6F:83:B0:74:82:E8:5E:96:33:94:C1:EC:C2:C9:E5:1D:09:03:EE:94:6B:02:C3:01:58:1E:D9:9E:16
+# Fingerprint (SHA1): FB:ED:DC:90:65:B7:27:20:37:BC:55:0C:9C:56:DE:BB:F2:78:94:E1
+CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
+CKA_TOKEN CK_BBOOL CK_TRUE
+CKA_PRIVATE CK_BBOOL CK_FALSE
+CKA_MODIFIABLE CK_BBOOL CK_FALSE
+CKA_LABEL UTF8 "Certification Authority of WoSign G2"
+CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
+CKA_SUBJECT MULTILINE_OCTAL
+\060\130\061\013\060\011\006\003\125\004\006\023\002\103\116\061
+\032\060\030\006\003\125\004\012\023\021\127\157\123\151\147\156
+\040\103\101\040\114\151\155\151\164\145\144\061\055\060\053\006
+\003\125\004\003\023\044\103\145\162\164\151\146\151\143\141\164
+\151\157\156\040\101\165\164\150\157\162\151\164\171\040\157\146
+\040\127\157\123\151\147\156\040\107\062
+END
+CKA_ID UTF8 "0"
+CKA_ISSUER MULTILINE_OCTAL
+\060\130\061\013\060\011\006\003\125\004\006\023\002\103\116\061
+\032\060\030\006\003\125\004\012\023\021\127\157\123\151\147\156
+\040\103\101\040\114\151\155\151\164\145\144\061\055\060\053\006
+\003\125\004\003\023\044\103\145\162\164\151\146\151\143\141\164
+\151\157\156\040\101\165\164\150\157\162\151\164\171\040\157\146
+\040\127\157\123\151\147\156\040\107\062
+END
+CKA_SERIAL_NUMBER MULTILINE_OCTAL
+\002\020\153\045\332\212\210\235\174\274\017\005\263\261\172\141
+\105\104
+END
+CKA_VALUE MULTILINE_OCTAL
+\060\202\003\174\060\202\002\144\240\003\002\001\002\002\020\153
+\045\332\212\210\235\174\274\017\005\263\261\172\141\105\104\060
+\015\006\011\052\206\110\206\367\015\001\001\013\005\000\060\130
+\061\013\060\011\006\003\125\004\006\023\002\103\116\061\032\060
+\030\006\003\125\004\012\023\021\127\157\123\151\147\156\040\103
+\101\040\114\151\155\151\164\145\144\061\055\060\053\006\003\125
+\004\003\023\044\103\145\162\164\151\146\151\143\141\164\151\157
+\156\040\101\165\164\150\157\162\151\164\171\040\157\146\040\127
+\157\123\151\147\156\040\107\062\060\036\027\015\061\064\061\061
+\060\070\060\060\065\070\065\070\132\027\015\064\064\061\061\060
+\070\060\060\065\070\065\070\132\060\130\061\013\060\011\006\003
+\125\004\006\023\002\103\116\061\032\060\030\006\003\125\004\012
+\023\021\127\157\123\151\147\156\040\103\101\040\114\151\155\151
+\164\145\144\061\055\060\053\006\003\125\004\003\023\044\103\145
+\162\164\151\146\151\143\141\164\151\157\156\040\101\165\164\150
+\157\162\151\164\171\040\157\146\040\127\157\123\151\147\156\040
+\107\062\060\202\001\042\060\015\006\011\052\206\110\206\367\015
+\001\001\001\005\000\003\202\001\017\000\060\202\001\012\002\202
+\001\001\000\276\305\304\240\042\200\111\117\277\331\207\021\306
+\123\341\273\017\275\140\177\257\366\202\016\037\334\260\216\075
+\227\340\120\074\217\072\357\146\073\105\007\233\040\370\343\327
+\045\206\065\220\026\242\135\157\060\031\010\207\013\177\006\262
+\235\142\217\336\257\222\245\140\324\053\200\232\122\077\365\232
+\203\351\064\132\313\331\325\142\134\346\016\340\337\006\230\016
+\200\174\312\264\035\023\210\153\016\250\044\167\003\320\356\133
+\363\312\151\221\065\071\126\305\155\343\367\075\117\136\223\070
+\044\312\030\351\044\313\222\003\335\314\034\075\011\160\344\040
+\344\361\256\254\273\163\151\243\143\072\017\105\017\241\112\232
+\302\321\143\254\313\020\370\075\346\116\050\267\353\304\225\261
+\254\375\136\253\372\101\313\135\235\113\334\364\174\166\357\147
+\177\000\172\215\322\240\032\134\115\042\341\265\332\335\166\263
+\324\166\337\136\270\213\230\310\024\124\314\153\027\222\267\340
+\112\277\111\224\141\013\070\220\217\135\044\154\045\173\073\171
+\331\342\176\235\255\237\230\241\006\374\170\024\140\127\370\356
+\200\167\261\002\003\001\000\001\243\102\060\100\060\016\006\003
+\125\035\017\001\001\377\004\004\003\002\001\006\060\017\006\003
+\125\035\023\001\001\377\004\005\060\003\001\001\377\060\035\006
+\003\125\035\016\004\026\004\024\372\140\251\353\145\305\335\026
+\024\010\116\014\017\215\233\340\367\144\257\147\060\015\006\011
+\052\206\110\206\367\015\001\001\013\005\000\003\202\001\001\000
+\127\303\172\066\202\234\215\230\342\253\100\252\107\217\307\247
+\133\355\174\347\075\146\132\073\061\273\337\363\026\063\221\374
+\174\173\245\302\246\146\343\252\260\267\047\230\077\111\327\140
+\147\147\077\066\117\112\313\361\024\372\132\207\050\034\355\217
+\101\062\306\225\371\175\332\275\173\133\302\260\041\343\217\106
+\334\041\070\103\164\114\373\060\370\027\162\301\062\374\310\221
+\027\304\314\130\067\116\013\314\132\367\041\065\050\203\154\140
+\055\104\353\122\214\120\075\265\154\022\327\372\011\273\154\262
+\112\261\305\211\344\374\323\122\330\141\027\376\172\224\204\217
+\171\266\063\131\272\017\304\013\342\160\240\113\170\056\372\310
+\237\375\257\221\145\012\170\070\025\345\227\027\024\335\371\340
+\054\064\370\070\320\204\042\000\300\024\121\030\053\002\334\060
+\132\360\350\001\174\065\072\043\257\010\344\257\252\216\050\102
+\111\056\360\365\231\064\276\355\017\113\030\341\322\044\074\273
+\135\107\267\041\362\215\321\012\231\216\343\156\076\255\160\340
+\217\271\312\314\156\201\061\366\173\234\172\171\344\147\161\030
+END
+
+# Trust for "Certification Authority of WoSign G2"
+# Issuer: CN=Certification Authority of WoSign G2,O=WoSign CA Limited,C=CN
+# Serial Number:6b:25:da:8a:88:9d:7c:bc:0f:05:b3:b1:7a:61:45:44
+# Subject: CN=Certification Authority of WoSign G2,O=WoSign CA Limited,C=CN
+# Not Valid Before: Sat Nov 08 00:58:58 2014
+# Not Valid After : Tue Nov 08 00:58:58 2044
+# Fingerprint (SHA-256): D4:87:A5:6F:83:B0:74:82:E8:5E:96:33:94:C1:EC:C2:C9:E5:1D:09:03:EE:94:6B:02:C3:01:58:1E:D9:9E:16
+# Fingerprint (SHA1): FB:ED:DC:90:65:B7:27:20:37:BC:55:0C:9C:56:DE:BB:F2:78:94:E1
+CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
+CKA_TOKEN CK_BBOOL CK_TRUE
+CKA_PRIVATE CK_BBOOL CK_FALSE
+CKA_MODIFIABLE CK_BBOOL CK_FALSE
+CKA_LABEL UTF8 "Certification Authority of WoSign G2"
+CKA_CERT_SHA1_HASH MULTILINE_OCTAL
+\373\355\334\220\145\267\047\040\067\274\125\014\234\126\336\273
+\362\170\224\341
+END
+CKA_CERT_MD5_HASH MULTILINE_OCTAL
+\310\034\175\031\252\313\161\223\362\120\370\122\250\036\272\140
+END
+CKA_ISSUER MULTILINE_OCTAL
+\060\130\061\013\060\011\006\003\125\004\006\023\002\103\116\061
+\032\060\030\006\003\125\004\012\023\021\127\157\123\151\147\156
+\040\103\101\040\114\151\155\151\164\145\144\061\055\060\053\006
+\003\125\004\003\023\044\103\145\162\164\151\146\151\143\141\164
+\151\157\156\040\101\165\164\150\157\162\151\164\171\040\157\146
+\040\127\157\123\151\147\156\040\107\062
+END
+CKA_SERIAL_NUMBER MULTILINE_OCTAL
+\002\020\153\045\332\212\210\235\174\274\017\005\263\261\172\141
+\105\104
+END
+CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
+
+#
+# Certificate "CA WoSign ECC Root"
+#
+# Issuer: CN=CA WoSign ECC Root,O=WoSign CA Limited,C=CN
+# Serial Number:68:4a:58:70:80:6b:f0:8f:02:fa:f6:de:e8:b0:90:90
+# Subject: CN=CA WoSign ECC Root,O=WoSign CA Limited,C=CN
+# Not Valid Before: Sat Nov 08 00:58:58 2014
+# Not Valid After : Tue Nov 08 00:58:58 2044
+# Fingerprint (SHA-256): 8B:45:DA:1C:06:F7:91:EB:0C:AB:F2:6B:E5:88:F5:FB:23:16:5C:2E:61:4B:F8:85:56:2D:0D:CE:50:B2:9B:02
+# Fingerprint (SHA1): D2:7A:D2:BE:ED:94:C0:A1:3C:C7:25:21:EA:5D:71:BE:81:19:F3:2B
+CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
+CKA_TOKEN CK_BBOOL CK_TRUE
+CKA_PRIVATE CK_BBOOL CK_FALSE
+CKA_MODIFIABLE CK_BBOOL CK_FALSE
+CKA_LABEL UTF8 "CA WoSign ECC Root"
+CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
+CKA_SUBJECT MULTILINE_OCTAL
+\060\106\061\013\060\011\006\003\125\004\006\023\002\103\116\061
+\032\060\030\006\003\125\004\012\023\021\127\157\123\151\147\156
+\040\103\101\040\114\151\155\151\164\145\144\061\033\060\031\006
+\003\125\004\003\023\022\103\101\040\127\157\123\151\147\156\040
+\105\103\103\040\122\157\157\164
+END
+CKA_ID UTF8 "0"
+CKA_ISSUER MULTILINE_OCTAL
+\060\106\061\013\060\011\006\003\125\004\006\023\002\103\116\061
+\032\060\030\006\003\125\004\012\023\021\127\157\123\151\147\156
+\040\103\101\040\114\151\155\151\164\145\144\061\033\060\031\006
+\003\125\004\003\023\022\103\101\040\127\157\123\151\147\156\040
+\105\103\103\040\122\157\157\164
+END
+CKA_SERIAL_NUMBER MULTILINE_OCTAL
+\002\020\150\112\130\160\200\153\360\217\002\372\366\336\350\260
+\220\220
+END
+CKA_VALUE MULTILINE_OCTAL
+\060\202\002\011\060\202\001\217\240\003\002\001\002\002\020\150
+\112\130\160\200\153\360\217\002\372\366\336\350\260\220\220\060
+\012\006\010\052\206\110\316\075\004\003\003\060\106\061\013\060
+\011\006\003\125\004\006\023\002\103\116\061\032\060\030\006\003
+\125\004\012\023\021\127\157\123\151\147\156\040\103\101\040\114
+\151\155\151\164\145\144\061\033\060\031\006\003\125\004\003\023
+\022\103\101\040\127\157\123\151\147\156\040\105\103\103\040\122
+\157\157\164\060\036\027\015\061\064\061\061\060\070\060\060\065
+\070\065\070\132\027\015\064\064\061\061\060\070\060\060\065\070
+\065\070\132\060\106\061\013\060\011\006\003\125\004\006\023\002
+\103\116\061\032\060\030\006\003\125\004\012\023\021\127\157\123
+\151\147\156\040\103\101\040\114\151\155\151\164\145\144\061\033
+\060\031\006\003\125\004\003\023\022\103\101\040\127\157\123\151
+\147\156\040\105\103\103\040\122\157\157\164\060\166\060\020\006
+\007\052\206\110\316\075\002\001\006\005\053\201\004\000\042\003
+\142\000\004\341\375\216\270\103\044\253\226\173\205\302\272\013
+\255\215\340\072\343\044\271\322\261\276\210\072\312\277\112\270
+\371\357\054\057\257\121\120\074\107\165\154\370\224\267\233\374
+\050\036\305\124\314\143\235\026\113\123\301\347\040\253\315\254
+\045\322\177\217\302\301\132\202\136\060\213\172\124\316\003\265
+\221\177\252\224\320\321\212\110\314\202\005\046\241\325\121\022
+\326\173\066\243\102\060\100\060\016\006\003\125\035\017\001\001
+\377\004\004\003\002\001\006\060\017\006\003\125\035\023\001\001
+\377\004\005\060\003\001\001\377\060\035\006\003\125\035\016\004
+\026\004\024\252\375\325\132\243\366\207\213\062\205\375\321\062
+\133\200\105\223\363\003\270\060\012\006\010\052\206\110\316\075
+\004\003\003\003\150\000\060\145\002\061\000\344\244\204\260\201
+\325\075\260\164\254\224\244\350\016\075\000\164\114\241\227\153
+\371\015\121\074\241\331\073\364\015\253\251\237\276\116\162\312
+\205\324\331\354\265\062\105\030\157\253\255\002\060\175\307\367
+\151\143\057\241\341\230\357\023\020\321\171\077\321\376\352\073
+\177\336\126\364\220\261\025\021\330\262\042\025\320\057\303\046
+\056\153\361\221\262\220\145\364\232\346\220\356\112
+END
+
+# Trust for "CA WoSign ECC Root"
+# Issuer: CN=CA WoSign ECC Root,O=WoSign CA Limited,C=CN
+# Serial Number:68:4a:58:70:80:6b:f0:8f:02:fa:f6:de:e8:b0:90:90
+# Subject: CN=CA WoSign ECC Root,O=WoSign CA Limited,C=CN
+# Not Valid Before: Sat Nov 08 00:58:58 2014
+# Not Valid After : Tue Nov 08 00:58:58 2044
+# Fingerprint (SHA-256): 8B:45:DA:1C:06:F7:91:EB:0C:AB:F2:6B:E5:88:F5:FB:23:16:5C:2E:61:4B:F8:85:56:2D:0D:CE:50:B2:9B:02
+# Fingerprint (SHA1): D2:7A:D2:BE:ED:94:C0:A1:3C:C7:25:21:EA:5D:71:BE:81:19:F3:2B
+CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
+CKA_TOKEN CK_BBOOL CK_TRUE
+CKA_PRIVATE CK_BBOOL CK_FALSE
+CKA_MODIFIABLE CK_BBOOL CK_FALSE
+CKA_LABEL UTF8 "CA WoSign ECC Root"
+CKA_CERT_SHA1_HASH MULTILINE_OCTAL
+\322\172\322\276\355\224\300\241\074\307\045\041\352\135\161\276
+\201\031\363\053
+END
+CKA_CERT_MD5_HASH MULTILINE_OCTAL
+\200\306\123\356\141\202\050\162\360\377\041\271\027\312\262\040
+END
+CKA_ISSUER MULTILINE_OCTAL
+\060\106\061\013\060\011\006\003\125\004\006\023\002\103\116\061
+\032\060\030\006\003\125\004\012\023\021\127\157\123\151\147\156
+\040\103\101\040\114\151\155\151\164\145\144\061\033\060\031\006
+\003\125\004\003\023\022\103\101\040\127\157\123\151\147\156\040
+\105\103\103\040\122\157\157\164
+END
+CKA_SERIAL_NUMBER MULTILINE_OCTAL
+\002\020\150\112\130\160\200\153\360\217\002\372\366\336\350\260
+\220\220
+END
+CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
diff --git a/security/nss/lib/ckfw/builtins/nssckbi.h b/security/nss/lib/ckfw/builtins/nssckbi.h
index 1d261dff7233..5ef3a49fbc8a 100644
--- a/security/nss/lib/ckfw/builtins/nssckbi.h
+++ b/security/nss/lib/ckfw/builtins/nssckbi.h
@@ -45,8 +45,8 @@
  * of the comment in the CK_VERSION type definition.
  */
 #define NSS_BUILTINS_LIBRARY_VERSION_MAJOR 2
-#define NSS_BUILTINS_LIBRARY_VERSION_MINOR 5
-#define NSS_BUILTINS_LIBRARY_VERSION "2.5"
+#define NSS_BUILTINS_LIBRARY_VERSION_MINOR 6
+#define NSS_BUILTINS_LIBRARY_VERSION "2.6"
 
 /* These version numbers detail the semantic changes to the ckfw engine. */
 #define NSS_BUILTINS_HARDWARE_VERSION_MAJOR 1
diff --git a/security/nss/lib/freebl/intel-gcm.h b/security/nss/lib/freebl/intel-gcm.h
index 22f364db2874..6dfbc3c43559 100644
--- a/security/nss/lib/freebl/intel-gcm.h
+++ b/security/nss/lib/freebl/intel-gcm.h
@@ -7,15 +7,15 @@
 /* Copyright(c) 2013, Intel Corp.                                             */
 /******************************************************************************/
 /* Reference:                                                                 */
-/* [1] Shay Gueron, Michael E. Kounavis: Intel® Carry-Less Multiplication     */
+/* [1] Shay Gueron, Michael E. Kounavis: Intel(R) Carry-Less Multiplication   */
 /*     Instruction and its Usage for Computing the GCM Mode (Rev. 2.01)       */
 /*     http://software.intel.com/sites/default/files/article/165685/clmul-wp-r*/
 /*ev-2.01-2012-09-21.pdf                                                      */
 /* [2] S. Gueron, M. E. Kounavis: Efficient Implementation of the Galois      */
 /*     Counter Mode Using a Carry-less Multiplier and a Fast Reduction        */
-/*     Algorithm. Information Processing Letters 110: 549–553 (2010).         */
-/* [3] S. Gueron: AES Performance on the 2nd Generation Intel® Core™ Processor*/
-/*     Family (to be posted) (2012).                                          */
+/*     Algorithm. Information Processing Letters 110: 549-553 (2010).         */
+/* [3] S. Gueron: AES Performance on the 2nd Generation Intel(R) Core(TM)     */
+/*     Processor Family (to be posted) (2012).                                */
 /* [4] S. Gueron: Fast GHASH computations for speeding up AES-GCM (to be      */
 /*     published) (2012).                                                     */
 
@@ -41,9 +41,9 @@ SECStatus intel_AES_GCM_DecryptUpdate(intel_AES_GCMContext *gcm, unsigned char *
 			const unsigned char *inbuf, unsigned int inlen,
 			unsigned int blocksize);
 
-/* Prorotypes of functions in the assembler file for fast AES-GCM, using 
+/* Prototypes of functions in the assembler file for fast AES-GCM, using 
    Intel AES-NI and CLMUL-NI, as described in [1]
-   [1] Shay Gueron, Michael E. Kounavis: Intel® Carry-Less Multiplication 
+   [1] Shay Gueron, Michael E. Kounavis: Intel(R) Carry-Less Multiplication
        Instruction and its Usage for Computing the GCM Mode                */
        
 /* Prepares the constants used in the aggregated reduction method */
diff --git a/security/nss/lib/nss/nss.h b/security/nss/lib/nss/nss.h
index 279440019dfb..2433cfc19494 100644
--- a/security/nss/lib/nss/nss.h
+++ b/security/nss/lib/nss/nss.h
@@ -33,12 +33,12 @@
  * The format of the version string should be
  *     "<major version>.<minor version>[.<patch level>[.<build number>]][ <ECC>][ <Beta>]"
  */
-#define NSS_VERSION  "3.21" _NSS_ECC_STRING _NSS_CUSTOMIZED " Beta"
+#define NSS_VERSION  "3.21" _NSS_ECC_STRING _NSS_CUSTOMIZED
 #define NSS_VMAJOR   3
 #define NSS_VMINOR   21
 #define NSS_VPATCH   0
 #define NSS_VBUILD   0
-#define NSS_BETA     PR_TRUE
+#define NSS_BETA     PR_FALSE
 
 #ifndef RC_INVOKED
 
diff --git a/security/nss/lib/softoken/softkver.h b/security/nss/lib/softoken/softkver.h
index e284fe2e8c73..c7e25e1beac7 100644
--- a/security/nss/lib/softoken/softkver.h
+++ b/security/nss/lib/softoken/softkver.h
@@ -25,11 +25,11 @@
  * The format of the version string should be
  *     "<major version>.<minor version>[.<patch level>[.<build number>]][ <ECC>][ <Beta>]"
  */
-#define SOFTOKEN_VERSION  "3.21" SOFTOKEN_ECC_STRING " Beta"
+#define SOFTOKEN_VERSION  "3.21" SOFTOKEN_ECC_STRING
 #define SOFTOKEN_VMAJOR   3
 #define SOFTOKEN_VMINOR   21
 #define SOFTOKEN_VPATCH   0
 #define SOFTOKEN_VBUILD   0
-#define SOFTOKEN_BETA     PR_TRUE
+#define SOFTOKEN_BETA     PR_FALSE
 
 #endif /* _SOFTKVER_H_ */
diff --git a/security/nss/lib/util/nssutil.h b/security/nss/lib/util/nssutil.h
index 132fa59163fe..0c8b480f563c 100644
--- a/security/nss/lib/util/nssutil.h
+++ b/security/nss/lib/util/nssutil.h
@@ -19,12 +19,12 @@
  * The format of the version string should be
  *     "<major version>.<minor version>[.<patch level>[.<build number>]][ <Beta>]"
  */
-#define NSSUTIL_VERSION  "3.21 Beta"
+#define NSSUTIL_VERSION  "3.21"
 #define NSSUTIL_VMAJOR   3
 #define NSSUTIL_VMINOR   21
 #define NSSUTIL_VPATCH   0
 #define NSSUTIL_VBUILD   0
-#define NSSUTIL_BETA     PR_TRUE
+#define NSSUTIL_BETA     PR_FALSE
 
 SEC_BEGIN_PROTOS
 
diff --git a/security/pkix/include/pkix/Result.h b/security/pkix/include/pkix/Result.h
index 091aeaf4e1f4..9f90a5a48bb7 100644
--- a/security/pkix/include/pkix/Result.h
+++ b/security/pkix/include/pkix/Result.h
@@ -185,6 +185,8 @@ static const unsigned int FATAL_ERROR_FLAG = 0x800;
                      MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING) \
     MOZILLA_PKIX_MAP(ERROR_VALIDITY_TOO_LONG, 50, \
                      MOZILLA_PKIX_ERROR_VALIDITY_TOO_LONG) \
+    MOZILLA_PKIX_MAP(ERROR_REQUIRED_TLS_FEATURE_MISSING, 51, \
+                     MOZILLA_PKIX_ERROR_REQUIRED_TLS_FEATURE_MISSING) \
     MOZILLA_PKIX_MAP(FATAL_ERROR_INVALID_ARGS, FATAL_ERROR_FLAG | 1, \
                      SEC_ERROR_INVALID_ARGS) \
     MOZILLA_PKIX_MAP(FATAL_ERROR_INVALID_STATE, FATAL_ERROR_FLAG | 2, \
diff --git a/security/pkix/include/pkix/pkix.h b/security/pkix/include/pkix/pkix.h
index 72fedb94c8bf..ee6746b0fca5 100644
--- a/security/pkix/include/pkix/pkix.h
+++ b/security/pkix/include/pkix/pkix.h
@@ -147,6 +147,14 @@ Result VerifyEncodedOCSPResponse(TrustDomain& trustDomain,
               /* optional out */ Time* thisUpdate = nullptr,
               /* optional out */ Time* validThrough = nullptr);
 
+// Check that the TLSFeature extensions in a given end-entity cert (which is
+// assumed to have been already validated with BuildCertChain) are satisfied.
+// The only feature which we cancurrently process a requirement for is
+// status_request (OCSP stapling) so we reject any extension that specifies a
+// requirement for another value. Empty extensions are also rejected.
+Result CheckTLSFeaturesAreSatisfied(Input& cert,
+                                    const Input* stapledOCSPResponse);
+
 } } // namespace mozilla::pkix
 
 #endif // mozilla_pkix_pkix_h
diff --git a/security/pkix/include/pkix/pkixnss.h b/security/pkix/include/pkix/pkixnss.h
index 8593d7a69b0e..414557feb761 100644
--- a/security/pkix/include/pkix/pkixnss.h
+++ b/security/pkix/include/pkix/pkixnss.h
@@ -84,6 +84,7 @@ enum ErrorCode
   MOZILLA_PKIX_ERROR_SIGNATURE_ALGORITHM_MISMATCH = ERROR_BASE + 7,
   MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING = ERROR_BASE + 8,
   MOZILLA_PKIX_ERROR_VALIDITY_TOO_LONG = ERROR_BASE + 9,
+  MOZILLA_PKIX_ERROR_REQUIRED_TLS_FEATURE_MISSING = ERROR_BASE + 10,
 };
 
 void RegisterErrorTable();
diff --git a/security/pkix/lib/pkixbuild.cpp b/security/pkix/lib/pkixbuild.cpp
index cfaac2335d9c..99942cfa13bb 100644
--- a/security/pkix/lib/pkixbuild.cpp
+++ b/security/pkix/lib/pkixbuild.cpp
@@ -188,6 +188,11 @@ PathBuildingStep::Check(Input potentialIssuerDER,
     }
   }
 
+  rv = CheckTLSFeatures(subject, potentialIssuer);
+  if (rv != Success) {
+    return RecordResult(rv, keepGoing);
+  }
+
   // RFC 5280, Section 4.2.1.3: "If the keyUsage extension is present, then the
   // subject public key MUST NOT be used to verify signatures on certificates
   // or CRLs unless the corresponding keyCertSign or cRLSign bit is set."
diff --git a/security/pkix/lib/pkixcert.cpp b/security/pkix/lib/pkixcert.cpp
index ed6158385c9e..1cb452c208e9 100644
--- a/security/pkix/lib/pkixcert.cpp
+++ b/security/pkix/lib/pkixcert.cpp
@@ -219,6 +219,10 @@ BackCert::RememberExtension(Reader& extnID, Input extnValue,
   static const uint8_t Netscape_certificate_type[] = {
     0x60, 0x86, 0x48, 0x01, 0x86, 0xf8, 0x42, 0x01, 0x01
   };
+  // python DottedOIDToCode.py id-pe-tlsfeature 1.3.6.1.5.5.7.1.24
+  static const uint8_t id_pe_tlsfeature[] = {
+    0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x01, 0x18
+  };
 
   Input* out = nullptr;
 
@@ -263,6 +267,8 @@ BackCert::RememberExtension(Reader& extnID, Input extnValue,
     out = &inhibitAnyPolicy;
   } else if (extnID.MatchRest(id_pe_authorityInfoAccess)) {
     out = &authorityInfoAccess;
+  } else if (extnID.MatchRest(id_pe_tlsfeature)) {
+    out = &requiredTLSFeatures;
   } else if (extnID.MatchRest(id_pkix_ocsp_nocheck) && critical) {
     // We need to make sure we don't reject delegated OCSP response signing
     // certificates that contain the id-pkix-ocsp-nocheck extension marked as
diff --git a/security/pkix/lib/pkixcheck.cpp b/security/pkix/lib/pkixcheck.cpp
index 79d001a911d9..3e0f0a6d1cc6 100644
--- a/security/pkix/lib/pkixcheck.cpp
+++ b/security/pkix/lib/pkixcheck.cpp
@@ -830,6 +830,65 @@ CheckExtendedKeyUsage(EndEntityOrCA endEntityOrCA,
   return Success;
 }
 
+Result
+CheckTLSFeatures(const BackCert& subject, BackCert& potentialIssuer)
+{
+  const Input* issuerTLSFeatures = potentialIssuer.GetRequiredTLSFeatures();
+  if (!issuerTLSFeatures) {
+    return Success;
+  }
+
+  const Input* subjectTLSFeatures = subject.GetRequiredTLSFeatures();
+  if (issuerTLSFeatures->GetLength() == 0 ||
+      !subjectTLSFeatures ||
+      !InputsAreEqual(*issuerTLSFeatures, *subjectTLSFeatures)) {
+    return Result::ERROR_REQUIRED_TLS_FEATURE_MISSING;
+  }
+
+  return Success;
+}
+
+Result
+TLSFeaturesSatisfiedInternal(const Input* requiredTLSFeatures,
+                             const Input* stapledOCSPResponse)
+{
+  if (!requiredTLSFeatures) {
+    return Success;
+  }
+
+  // RFC 6066 10.2: ExtensionType status_request
+  const static uint8_t status_request = 5;
+  const static uint8_t status_request_bytes[] = { status_request };
+
+  Reader input(*requiredTLSFeatures);
+  return der::NestedOf(input, der::SEQUENCE, der::INTEGER,
+                       der::EmptyAllowed::No, [&](Reader& r) {
+    if (!r.MatchRest(status_request_bytes)) {
+      return Result::ERROR_REQUIRED_TLS_FEATURE_MISSING;
+    }
+
+    if (!stapledOCSPResponse) {
+      return Result::ERROR_REQUIRED_TLS_FEATURE_MISSING;
+    }
+
+    return Result::Success;
+  });
+}
+
+Result
+CheckTLSFeaturesAreSatisfied(Input& cert,
+                             const Input* stapledOCSPResponse)
+{
+  BackCert backCert(cert, EndEntityOrCA::MustBeEndEntity, nullptr);
+  Result rv = backCert.Init();
+  if (rv != Success) {
+    return rv;
+  }
+
+  return TLSFeaturesSatisfiedInternal(backCert.GetRequiredTLSFeatures(),
+                                      stapledOCSPResponse);
+}
+
 Result
 CheckIssuerIndependentProperties(TrustDomain& trustDomain,
                                  const BackCert& cert,
diff --git a/security/pkix/lib/pkixcheck.h b/security/pkix/lib/pkixcheck.h
index 72b463d2795d..c5a31c8ea6e5 100644
--- a/security/pkix/lib/pkixcheck.h
+++ b/security/pkix/lib/pkixcheck.h
@@ -55,6 +55,10 @@ Result ParseValidity(Input encodedValidity,
                      /*optional out*/ Time* notAfterOut = nullptr);
 Result CheckValidity(Time time, Time notBefore, Time notAfter);
 
+// Check that a subject has TLS Feature (rfc7633) requirements that match its
+// potential issuer
+Result CheckTLSFeatures(const BackCert& subject, BackCert& potentialIssuer);
+
 } } // namespace mozilla::pkix
 
 #endif // mozilla_pkix_pkixcheck_h
diff --git a/security/pkix/lib/pkixnss.cpp b/security/pkix/lib/pkixnss.cpp
index 19d69323c761..c1228624873c 100644
--- a/security/pkix/lib/pkixnss.cpp
+++ b/security/pkix/lib/pkixnss.cpp
@@ -202,6 +202,8 @@ RegisterErrorTable()
       "verified." },
     { "MOZILLA_PKIX_ERROR_VALIDITY_TOO_LONG",
       "The server presented a certificate that is valid for too long." },
+    { "MOZILLA_PKIX_ERROR_REQUIRED_TLS_FEATURE_MISSING",
+      "A required TLS feature is missing." },
   };
   // Note that these error strings are not localizable.
   // When these strings change, update the localization information too.
diff --git a/security/pkix/lib/pkixutil.h b/security/pkix/lib/pkixutil.h
index 9179cedc2df4..996ffe9b8a2a 100644
--- a/security/pkix/lib/pkixutil.h
+++ b/security/pkix/lib/pkixutil.h
@@ -102,6 +102,10 @@ public:
   {
     return MaybeInput(subjectAltName);
   }
+  const Input* GetRequiredTLSFeatures() const
+  {
+    return MaybeInput(requiredTLSFeatures);
+  }
 
 private:
   const Input der;
@@ -144,6 +148,7 @@ private:
   Input nameConstraints;
   Input subjectAltName;
   Input criticalNetscapeCertificateType;
+  Input requiredTLSFeatures;
 
   Result RememberExtension(Reader& extnID, Input extnValue, bool critical,
                            /*out*/ bool& understood);
diff --git a/security/pkix/test/gtest/moz.build b/security/pkix/test/gtest/moz.build
index 41fc5507486a..560c1e1db5c3 100644
--- a/security/pkix/test/gtest/moz.build
+++ b/security/pkix/test/gtest/moz.build
@@ -12,6 +12,7 @@ SOURCES += [
     'pkixcheck_CheckSignatureAlgorithm_tests.cpp',
     'pkixcheck_CheckValidity_tests.cpp',
     'pkixcheck_ParseValidity_tests.cpp',
+    'pkixcheck_TLSFeaturesSatisfiedInternal_tests.cpp',
 
     # The naming conventions are described in ./README.txt.
 
diff --git a/security/pkix/test/gtest/pkixcheck_TLSFeaturesSatisfiedInternal_tests.cpp b/security/pkix/test/gtest/pkixcheck_TLSFeaturesSatisfiedInternal_tests.cpp
new file mode 100644
index 000000000000..28db4d15080a
--- /dev/null
+++ b/security/pkix/test/gtest/pkixcheck_TLSFeaturesSatisfiedInternal_tests.cpp
@@ -0,0 +1,114 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This code is made available to you under your choice of the following sets
+ * of licensing terms:
+ */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+/* Copyright 2015 Mozilla Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "pkixder.h"
+#include "pkixgtest.h"
+
+using namespace mozilla::pkix;
+using namespace mozilla::pkix::test;
+
+namespace mozilla { namespace pkix {
+  extern Result TLSFeaturesSatisfiedInternal(const Input* requiredTLSFeatures,
+                                             const Input* stapledOCSPResponse);
+} } // namespace mozilla::pkix
+
+struct TLSFeaturesTestParams
+{
+  ByteString requiredTLSFeatures;
+  Result expectedResultWithResponse;
+  Result expectedResultWithoutResponse;
+};
+
+#define BS(s) ByteString(s, MOZILLA_PKIX_ARRAY_LENGTH(s))
+static const uint8_t statusRequest[] = {
+  0x30, 0x03, 0x02, 0x01, 0x05
+};
+
+static const uint8_t unknown[] = {
+  0x30, 0x03, 0x02, 0x01, 0x06
+};
+
+static const uint8_t statusRequestAndUnknown[] = {
+  0x30, 0x06, 0x02, 0x01, 0x05, 0x02, 0x01, 0x06
+};
+
+static const uint8_t duplicateStatusRequest[] = {
+  0x30, 0x06, 0x02, 0x01, 0x05, 0x02, 0x01, 0x05
+};
+
+static const uint8_t twoByteUnknown[] = {
+  0x30, 0x04, 0x02, 0x02, 0x05, 0x05
+};
+
+static const uint8_t zeroByteInteger[] = {
+  0x30, 0x02, 0x02, 0x00
+};
+
+static const TLSFeaturesTestParams
+  TLSFEATURESSATISFIED_TEST_PARAMS[] =
+{
+  // some tests with checks enforced
+  { ByteString(), Result::ERROR_BAD_DER, Result::ERROR_BAD_DER },
+  { BS(statusRequest), Success, Result::ERROR_REQUIRED_TLS_FEATURE_MISSING },
+  { BS(unknown), Result::ERROR_REQUIRED_TLS_FEATURE_MISSING,
+    Result::ERROR_REQUIRED_TLS_FEATURE_MISSING },
+  { BS(statusRequestAndUnknown), Result::ERROR_REQUIRED_TLS_FEATURE_MISSING,
+    Result::ERROR_REQUIRED_TLS_FEATURE_MISSING },
+  { BS(duplicateStatusRequest), Success,
+    Result::ERROR_REQUIRED_TLS_FEATURE_MISSING },
+  { BS(twoByteUnknown), Result::ERROR_REQUIRED_TLS_FEATURE_MISSING,
+    Result::ERROR_REQUIRED_TLS_FEATURE_MISSING },
+  { BS(zeroByteInteger), Result::ERROR_REQUIRED_TLS_FEATURE_MISSING,
+    Result::ERROR_REQUIRED_TLS_FEATURE_MISSING },
+};
+
+class pkixcheck_TLSFeaturesSatisfiedInternal
+  : public ::testing::Test
+  , public ::testing::WithParamInterface<TLSFeaturesTestParams>
+{
+};
+
+TEST_P(pkixcheck_TLSFeaturesSatisfiedInternal, TLSFeaturesSatisfiedInternal) {
+  const TLSFeaturesTestParams& params(GetParam());
+
+  Input featuresInput;
+  ASSERT_EQ(Success, featuresInput.Init(params.requiredTLSFeatures.data(),
+                                        params.requiredTLSFeatures.length()));
+  Input responseInput;
+  // just create an input with any data in it
+  ByteString stapledOCSPResponse = BS(statusRequest);
+  ASSERT_EQ(Success, responseInput.Init(stapledOCSPResponse.data(),
+                                        stapledOCSPResponse.length()));
+  // first we omit the response
+  ASSERT_EQ(params.expectedResultWithoutResponse,
+            TLSFeaturesSatisfiedInternal(&featuresInput, nullptr));
+  // then we try again with the response
+  ASSERT_EQ(params.expectedResultWithResponse,
+            TLSFeaturesSatisfiedInternal(&featuresInput, &responseInput));
+}
+
+INSTANTIATE_TEST_CASE_P(
+  pkixcheck_TLSFeaturesSatisfiedInternal,
+  pkixcheck_TLSFeaturesSatisfiedInternal,
+  testing::ValuesIn(TLSFEATURESSATISFIED_TEST_PARAMS));
diff --git a/testing/marionette/client/marionette/__init__.py b/testing/marionette/client/marionette/__init__.py
index 9fd3fdb2616d..cda1e0d5550b 100644
--- a/testing/marionette/client/marionette/__init__.py
+++ b/testing/marionette/client/marionette/__init__.py
@@ -2,7 +2,7 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-__version__ = '1.1.0'
+__version__ = '2.0.0'
 
 from .marionette_test import (
     CommonTestCase,
diff --git a/testing/marionette/client/marionette/runtests.py b/testing/marionette/client/marionette/runtests.py
index 4fbe6b7c8eeb..db959a757491 100644
--- a/testing/marionette/client/marionette/runtests.py
+++ b/testing/marionette/client/marionette/runtests.py
@@ -69,14 +69,30 @@ class MarionetteHarness(object):
             tests = args_dict.pop('tests')
             runner = self._runner_class(**args_dict)
             runner.run_tests(tests)
-            return runner
+            return runner.failed
         except Exception:
             self.args.logger.error('Failure during test execution.',
                                    exc_info=True)
-            sys.exit(1)
+            raise
 
-def cli(runner_class=MarionetteTestRunner, parser_class=MarionetteArguments):
-    MarionetteHarness(runner_class, parser_class).run()
+
+def cli(runner_class=MarionetteTestRunner, parser_class=MarionetteArguments,
+        harness_class=MarionetteHarness):
+    """
+    Call the harness to parse args and run tests.
+
+    The following exit codes are expected:
+    - Test failures: 10
+    - Harness/other failures: 1
+    - Success: 0
+    """
+    try:
+        failed = harness_class(runner_class, parser_class).run()
+        if failed > 0:
+            sys.exit(10)
+    except Exception:
+        sys.exit(1)
+    sys.exit(0)
 
 if __name__ == "__main__":
     cli()
diff --git a/testing/marionette/client/marionette/tests/unit/test_about_pages.py b/testing/marionette/client/marionette/tests/unit/test_about_pages.py
index 729dd9884df7..23dcb0221358 100644
--- a/testing/marionette/client/marionette/tests/unit/test_about_pages.py
+++ b/testing/marionette/client/marionette/tests/unit/test_about_pages.py
@@ -11,8 +11,7 @@ class TestAboutPages(MarionetteTestCase):
 
     def setUp(self):
         MarionetteTestCase.setUp(self)
-
-        if self.marionette.session_capabilities['platformName'] == 'DARWIN':
+        if self.marionette.session_capabilities['platformName'] == 'Darwin':
             self.mod_key = Keys.META
         else:
             self.mod_key = Keys.CONTROL
diff --git a/testing/marionette/client/marionette/tests/unit/test_capabilities.py b/testing/marionette/client/marionette/tests/unit/test_capabilities.py
index 2e4fb10c9276..e873d3b26554 100644
--- a/testing/marionette/client/marionette/tests/unit/test_capabilities.py
+++ b/testing/marionette/client/marionette/tests/unit/test_capabilities.py
@@ -5,13 +5,23 @@
 from marionette import MarionetteTestCase
 from marionette_driver.errors import SessionNotCreatedException
 
+
 class TestCapabilities(MarionetteTestCase):
+
     def setUp(self):
         super(TestCapabilities, self).setUp()
         self.caps = self.marionette.session_capabilities
-        self.marionette.set_context("chrome")
-        self.appinfo = self.marionette.execute_script(
-            "return Services.appinfo")
+        with self.marionette.using_context("chrome"):
+            self.appinfo = self.marionette.execute_script(
+                "return Services.appinfo")
+            self.os_name = self.marionette.execute_script(
+                "return Services.sysinfo.getProperty('name')")
+            self.os_version = self.marionette.execute_script(
+                "return Services.sysinfo.getProperty('version')")
+
+    @property
+    def is_b2g(self):
+        return self.appinfo["name"] == "B2G"
 
     def test_mandates_capabilities(self):
         self.assertIn("browserName", self.caps)
@@ -22,9 +32,8 @@ class TestCapabilities(MarionetteTestCase):
 
         self.assertEqual(self.caps["browserName"], self.appinfo["name"])
         self.assertEqual(self.caps["browserVersion"], self.appinfo["version"])
-        self.assertEqual(self.caps["platformName"], self.appinfo["OS"].upper())
-        self.assertEqual(self.caps["platformVersion"],
-                         self.appinfo["platformVersion"])
+        self.assertEqual(self.caps["platformName"], self.os_name)
+        self.assertEqual(self.caps["platformVersion"], self.os_version)
 
     def test_supported_features(self):
         self.assertIn("rotatable", self.caps)
@@ -32,14 +41,14 @@ class TestCapabilities(MarionetteTestCase):
         self.assertIn("takesElementScreenshot", self.caps)
         self.assertIn("takesScreenshot", self.caps)
 
-        self.assertEqual(self.caps["rotatable"], self.appinfo["name"] == "B2G")
+        self.assertEqual(self.caps["rotatable"], self.is_b2g)
         self.assertFalse(self.caps["acceptSslCerts"])
         self.assertTrue(self.caps["takesElementScreenshot"])
         self.assertTrue(self.caps["takesScreenshot"])
 
     def test_selenium2_compat(self):
         self.assertIn("platform", self.caps)
-        self.assertEqual(self.caps["platform"], self.caps["platformName"])
+        self.assertEqual(self.caps["platform"], self.caps["platformName"].upper())
 
     def test_extensions(self):
         self.assertIn("XULappId", self.caps)
@@ -53,14 +62,14 @@ class TestCapabilities(MarionetteTestCase):
 
     def test_we_can_pass_in_capabilities_on_session_start(self):
         self.marionette.delete_session()
-        capabilities = { "desiredCapabilities": {"somethingAwesome": "cake"}}
+        capabilities = {"desiredCapabilities": {"somethingAwesome": "cake"}}
         self.marionette.start_session(capabilities)
         caps = self.marionette.session_capabilities
         self.assertIn("somethingAwesome", caps)
 
     def test_we_dont_overwrite_server_capabilities(self):
         self.marionette.delete_session()
-        capabilities = { "desiredCapabilities": {"browserName": "ChocolateCake"}}
+        capabilities = {"desiredCapabilities": {"browserName": "ChocolateCake"}}
         self.marionette.start_session(capabilities)
         caps = self.marionette.session_capabilities
         self.assertEqual(caps["browserName"], self.appinfo["name"],
@@ -68,14 +77,14 @@ class TestCapabilities(MarionetteTestCase):
 
     def test_we_can_pass_in_required_capabilities_on_session_start(self):
         self.marionette.delete_session()
-        capabilities = { "requiredCapabilities": {"browserName": self.appinfo["name"]}}
+        capabilities = {"requiredCapabilities": {"browserName": self.appinfo["name"]}}
         self.marionette.start_session(capabilities)
         caps = self.marionette.session_capabilities
         self.assertIn("browserName", caps)
 
     def test_we_pass_in_required_capability_we_cant_fulfil_raises_exception(self):
         self.marionette.delete_session()
-        capabilities = { "requiredCapabilities": {"browserName": "CookiesAndCream"}}
+        capabilities = {"requiredCapabilities": {"browserName": "CookiesAndCream"}}
         try:
             self.marionette.start_session(capabilities)
             self.fail("Marionette Should have throw an exception")
@@ -87,6 +96,6 @@ class TestCapabilities(MarionetteTestCase):
         # same state it was before it started the test
         self.marionette.start_session()
 
-    def test_we_get_valid_uuid_4_when_creating_a_session(self):
-        self.assertNotIn("{", self.marionette.session_id, 'Session ID has {} in it. %s ' \
-                         % self.marionette.session_id)
+    def test_we_get_valid_uuid4_when_creating_a_session(self):
+        self.assertNotIn("{", self.marionette.session_id,
+                         "Session ID has {} in it: %s" % self.marionette.session_id)
diff --git a/testing/marionette/client/marionette/tests/unit/test_key_actions.py b/testing/marionette/client/marionette/tests/unit/test_key_actions.py
index 13a231d6a653..a7d5c5badbd3 100644
--- a/testing/marionette/client/marionette/tests/unit/test_key_actions.py
+++ b/testing/marionette/client/marionette/tests/unit/test_key_actions.py
@@ -10,7 +10,7 @@ class TestKeyActions(MarionetteTestCase):
 
     def setUp(self):
         MarionetteTestCase.setUp(self)
-        if self.marionette.session_capabilities['platformName'] == 'DARWIN':
+        if self.marionette.session_capabilities['platformName'] == 'Darwin':
             self.mod_key = Keys.META
         else:
             self.mod_key = Keys.CONTROL
diff --git a/testing/marionette/client/marionette/tests/unit/test_mouse_action.py b/testing/marionette/client/marionette/tests/unit/test_mouse_action.py
index a0b6c9c2d773..611adbaf7dce 100644
--- a/testing/marionette/client/marionette/tests/unit/test_mouse_action.py
+++ b/testing/marionette/client/marionette/tests/unit/test_mouse_action.py
@@ -11,7 +11,7 @@ class TestMouseAction(MarionetteTestCase):
 
     def setUp(self):
         MarionetteTestCase.setUp(self)
-        if self.marionette.session_capabilities['platformName'] == 'DARWIN':
+        if self.marionette.session_capabilities['platformName'] == 'Darwin':
             self.mod_key = Keys.META
         else:
             self.mod_key = Keys.CONTROL
diff --git a/testing/marionette/client/marionette/tests/unit/test_typing.py b/testing/marionette/client/marionette/tests/unit/test_typing.py
index 081c84fa2ce9..2f3474cfc9d5 100644
--- a/testing/marionette/client/marionette/tests/unit/test_typing.py
+++ b/testing/marionette/client/marionette/tests/unit/test_typing.py
@@ -58,7 +58,7 @@ class TestTyping(MarionetteTestCase):
     @skip_if_b2g
     def testCutAndPasteShortcuts(self):
         # Test that modifier keys work via copy/paste shortcuts.
-        if self.marionette.session_capabilities['platformName'] == 'DARWIN':
+        if self.marionette.session_capabilities['platformName'] == 'Darwin':
             mod_key = Keys.META
         else:
             mod_key = Keys.CONTROL
diff --git a/testing/marionette/client/marionette/tests/unit/test_window_handles.py b/testing/marionette/client/marionette/tests/unit/test_window_handles.py
index c0fba8025115..4aca3f7239b5 100644
--- a/testing/marionette/client/marionette/tests/unit/test_window_handles.py
+++ b/testing/marionette/client/marionette/tests/unit/test_window_handles.py
@@ -11,7 +11,7 @@ class TestWindowHandles(MarionetteTestCase):
     def test_new_tab_window_handles(self):
 
         keys = []
-        if self.marionette.session_capabilities['platformName'] == 'DARWIN':
+        if self.marionette.session_capabilities['platformName'] == 'Darwin':
             keys.append(Keys.META)
         else:
             keys.append(Keys.CONTROL)
diff --git a/testing/marionette/client/requirements.txt b/testing/marionette/client/requirements.txt
index 542fa990da7a..6ca53f2002cd 100644
--- a/testing/marionette/client/requirements.txt
+++ b/testing/marionette/client/requirements.txt
@@ -1,4 +1,4 @@
-marionette-driver >= 1.1.0
+marionette-driver >= 1.1.1
 browsermob-proxy >= 0.6.0
 manifestparser >= 1.1
 mozhttpd >= 0.7
diff --git a/testing/marionette/driver.js b/testing/marionette/driver.js
index f591bf58e2bd..71ee581e0ff4 100644
--- a/testing/marionette/driver.js
+++ b/testing/marionette/driver.js
@@ -136,14 +136,14 @@ this.GeckoDriver = function(appName, device, emulator) {
   this.actions = new ActionChain(utils);
 
   this.sessionCapabilities = {
-    // Mandated capabilities
-    "browserName": this.appName,
+    // mandated capabilities
+    "browserName": Services.appinfo.name,
     "browserVersion": Services.appinfo.version,
-    "platformName": Services.appinfo.OS.toUpperCase(),
-    "platformVersion": Services.appinfo.platformVersion,
+    "platformName": Services.sysinfo.getProperty("name"),
+    "platformVersion": Services.sysinfo.getProperty("version"),
     "specificationLevel": "1",
 
-    // Supported features
+    // supported features
     "raisesAccessibilityExceptions": false,
     "rotatable": this.appName == "B2G",
     "acceptSslCerts": false,
@@ -152,13 +152,13 @@ this.GeckoDriver = function(appName, device, emulator) {
     "proxy": {},
 
     // Selenium 2 compat
-    "platform": Services.appinfo.OS.toUpperCase(),
+    "platform": Services.sysinfo.getProperty("name").toUpperCase(),
 
-    // Proprietary extensions
+    // proprietary extensions
     "XULappId" : Services.appinfo.ID,
     "appBuildId" : Services.appinfo.appBuildID,
     "device": device,
-    "version": Services.appinfo.version
+    "version": Services.appinfo.version,
   };
 
   this.mm = globalMessageManager;
diff --git a/testing/marionette/driver/marionette_driver/__init__.py b/testing/marionette/driver/marionette_driver/__init__.py
index f276af27de4b..f3a03679b9f0 100644
--- a/testing/marionette/driver/marionette_driver/__init__.py
+++ b/testing/marionette/driver/marionette_driver/__init__.py
@@ -2,7 +2,7 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-__version__ = '1.1.0'
+__version__ = '1.1.1'
 
 from marionette_driver import (
     addons,
diff --git a/testing/marionette/elements.js b/testing/marionette/elements.js
index 04ff08b45dcd..dcdb4c9b8f2f 100644
--- a/testing/marionette/elements.js
+++ b/testing/marionette/elements.js
@@ -5,6 +5,12 @@
 var {utils: Cu} = Components;
 
 Cu.import("chrome://marionette/content/error.js");
+Cu.import("resource://gre/modules/XPCOMUtils.jsm");
+
+XPCOMUtils.defineLazyModuleGetter(this, 'setInterval',
+  'resource://gre/modules/Timer.jsm');
+XPCOMUtils.defineLazyModuleGetter(this, 'clearInterval',
+  'resource://gre/modules/Timer.jsm');
 
 /**
  * The ElementManager manages DOM references and interactions with elements.
@@ -64,6 +70,22 @@ this.Accessibility = function Accessibility() {
 };
 
 Accessibility.prototype = {
+
+  /**
+   * Number of attempts to get an accessible object for an element. We attempt
+   * more than once because accessible tree can be out of sync with the DOM tree
+   * for a short period of time.
+   * @type {Number}
+   */
+  GET_ACCESSIBLE_ATTEMPTS: 100,
+
+  /**
+   * An interval between attempts to retrieve an accessible object for an
+   * element.
+   * @type {Number} ms
+   */
+  GET_ACCESSIBLE_ATTEMPT_INTERVAL: 10,
+
   /**
    * Accessible object roles that support some action
    * @type Object
@@ -100,12 +122,28 @@ Accessibility.prototype = {
    * @return nsIAccessible object for the element
    */
   getAccessibleObject(element, mustHaveAccessible = false) {
-    let acc = this.accessibleRetrieval.getAccessibleFor(element);
-    if (!acc && mustHaveAccessible) {
-      this.handleErrorMessage('Element does not have an accessible object',
-        element);
-    }
-    return acc;
+    return new Promise((resolve, reject) => {
+      let acc = this.accessibleRetrieval.getAccessibleFor(element);
+
+      if (acc || !mustHaveAccessible) {
+        // If accessible object is found, return it. If it is not required,
+        // also resolve.
+        resolve(acc);
+      } else {
+        // If we require an accessible object, we need to poll for it because
+        // accessible tree might be out of sync with DOM tree for a short time.
+        let attempts = this.GET_ACCESSIBLE_ATTEMPTS;
+        let intervalId = setInterval(() => {
+          let acc = this.accessibleRetrieval.getAccessibleFor(element);
+          if (acc || --attempts <= 0) {
+            clearInterval(intervalId);
+            if (acc) { resolve(acc); }
+            else { reject(); }
+          }
+        }, this.GET_ACCESSIBLE_ATTEMPT_INTERVAL);
+      }
+    }).catch(() => this.handleErrorMessage(
+      'Element does not have an accessible object', element));
   },
 
   /**
diff --git a/testing/marionette/listener.js b/testing/marionette/listener.js
index 69dc31c78fc1..809239102434 100644
--- a/testing/marionette/listener.js
+++ b/testing/marionette/listener.js
@@ -162,7 +162,6 @@ function dispatch(fn) {
     let id = msg.json.command_id;
 
     let req = Task.spawn(function*() {
-      let rv;
       if (typeof msg.json == "undefined" || msg.json instanceof Array) {
         return yield fn.apply(null, msg.json);
       } else {
@@ -928,20 +927,21 @@ function singleTap(id, corx, cory) {
   if (!visible) {
     throw new ElementNotVisibleError("Element is not currently visible and may not be manipulated");
   }
-  let acc = accessibility.getAccessibleObject(el, true);
-  checkVisibleAccessibility(acc, el, visible);
-  checkActionableAccessibility(acc, el);
-  if (!curContainer.frame.document.createTouch) {
-    actions.mouseEventsOnly = true;
-  }
-  let c = coordinates(el, corx, cory);
-  if (!actions.mouseEventsOnly) {
-    let touchId = actions.nextTouchId++;
-    let touch = createATouch(el, c.x, c.y, touchId);
-    emitTouchEvent('touchstart', touch);
-    emitTouchEvent('touchend', touch);
-  }
-  actions.mouseTap(el.ownerDocument, c.x, c.y);
+  return accessibility.getAccessibleObject(el, true).then(acc => {
+    checkVisibleAccessibility(acc, el, visible);
+    checkActionableAccessibility(acc, el);
+    if (!curContainer.frame.document.createTouch) {
+      actions.mouseEventsOnly = true;
+    }
+    let c = coordinates(el, corx, cory);
+    if (!actions.mouseEventsOnly) {
+      let touchId = actions.nextTouchId++;
+      let touch = createATouch(el, c.x, c.y, touchId);
+      emitTouchEvent('touchstart', touch);
+      emitTouchEvent('touchend', touch);
+    }
+    actions.mouseTap(el.ownerDocument, c.x, c.y);
+  });
 }
 
 /**
@@ -1463,16 +1463,16 @@ function clickElement(id) {
   if (!visible) {
     throw new ElementNotVisibleError("Element is not visible");
   }
-  let acc = accessibility.getAccessibleObject(el, true);
-  checkVisibleAccessibility(acc, el, visible);
-
-  if (utils.isElementEnabled(el)) {
-    checkEnabledAccessibility(acc, el, true);
-    checkActionableAccessibility(acc, el);
-    utils.synthesizeMouseAtCenter(el, {}, el.ownerDocument.defaultView);
-  } else {
-    throw new InvalidElementStateError("Element is not Enabled");
-  }
+  return accessibility.getAccessibleObject(el, true).then(acc => {
+    checkVisibleAccessibility(acc, el, visible);
+    if (utils.isElementEnabled(el)) {
+      checkEnabledAccessibility(acc, el, true);
+      checkActionableAccessibility(acc, el);
+      utils.synthesizeMouseAtCenter(el, {}, el.ownerDocument.defaultView);
+    } else {
+      throw new InvalidElementStateError("Element is not Enabled");
+    }
+  });
 }
 
 /**
@@ -1528,9 +1528,10 @@ function getElementTagName(id) {
 function isElementDisplayed(id) {
   let el = elementManager.getKnownElement(id, curContainer);
   let displayed = utils.isElementDisplayed(el);
-  checkVisibleAccessibility(
-    accessibility.getAccessibleObject(el), el, displayed);
-  return displayed;
+  return accessibility.getAccessibleObject(el).then(acc => {
+    checkVisibleAccessibility(acc, el, displayed);
+    return displayed;
+  });
 }
 
 /**
@@ -1583,9 +1584,10 @@ function getElementRect(id) {
 function isElementEnabled(id) {
   let el = elementManager.getKnownElement(id, curContainer);
   let enabled = utils.isElementEnabled(el);
-  checkEnabledAccessibility(
-    accessibility.getAccessibleObject(el), el, enabled);
-  return enabled;
+  return accessibility.getAccessibleObject(el).then(acc => {
+    checkEnabledAccessibility(acc, el, enabled);
+    return enabled;
+  });
 }
 
 /**
@@ -1596,10 +1598,11 @@ function isElementEnabled(id) {
  */
 function isElementSelected(id) {
   let el = elementManager.getKnownElement(id, curContainer);
-    let selected = utils.isElementSelected(el);
-    checkSelectedAccessibility(
-      accessibility.getAccessibleObject(el), el, selected);
-  return selected;
+  let selected = utils.isElementSelected(el);
+  return accessibility.getAccessibleObject(el).then(acc => {
+    checkSelectedAccessibility(acc, el, selected);
+    return selected;
+  });
 }
 
 /**
@@ -1608,27 +1611,28 @@ function isElementSelected(id) {
 function sendKeysToElement(msg) {
   let command_id = msg.json.command_id;
   let val = msg.json.value;
+  let el;
 
-  try {
-    let el = elementManager.getKnownElement(msg.json.id, curContainer);
-    // Element should be actionable from the accessibility standpoint to be able
-    // to send keys to it.
-    checkActionableAccessibility(
-      accessibility.getAccessibleObject(el, true), el);
-    if (el.type == "file") {
-      let p = val.join("");
-      fileInputElement = el;
-      // In e10s, we can only construct File objects in the parent process,
-      // so pass the filename to driver.js, which in turn passes them back
-      // to this frame script in receiveFiles.
-      sendSyncMessage("Marionette:getFiles",
-                      {value: p, command_id: command_id});
-    } else {
-      utils.sendKeysToElement(curContainer.frame, el, val, sendOk, sendError, command_id);
-    }
-  } catch (e) {
-    sendError(e, command_id);
-  }
+  return Promise.resolve(elementManager.getKnownElement(msg.json.id, curContainer))
+    .then(knownEl => {
+      el = knownEl;
+      // Element should be actionable from the accessibility standpoint to be able
+      // to send keys to it.
+      return accessibility.getAccessibleObject(el, true)
+    }).then(acc => {
+      checkActionableAccessibility(acc, el);
+      if (el.type == "file") {
+        let p = val.join("");
+        fileInputElement = el;
+        // In e10s, we can only construct File objects in the parent process,
+        // so pass the filename to driver.js, which in turn passes them back
+        // to this frame script in receiveFiles.
+        sendSyncMessage("Marionette:getFiles",
+                        {value: p, command_id: command_id});
+      } else {
+        utils.sendKeysToElement(curContainer.frame, el, val, sendOk, sendError, command_id);
+      }
+    }).catch(e => sendError(e, command_id));
 }
 
 /**
diff --git a/testing/marionette/mach_commands.py b/testing/marionette/mach_commands.py
index 955e61b92454..e9a1b64a6e79 100644
--- a/testing/marionette/mach_commands.py
+++ b/testing/marionette/mach_commands.py
@@ -67,10 +67,8 @@ def run_marionette(tests, b2g_path=None, emulator=None, testtype=None,
     args.logger = commandline.setup_logging("Marionette Unit Tests",
                                             args,
                                             {"mach": sys.stdout})
-
-    results = MarionetteHarness(MarionetteTestRunner, args=args).run()
-
-    if results.failed > 0:
+    failed = MarionetteHarness(MarionetteTestRunner, args=args).run()
+    if failed > 0:
         return 1
     else:
         return 0
diff --git a/testing/mochitest/BrowserTestUtils/BrowserTestUtils.jsm b/testing/mochitest/BrowserTestUtils/BrowserTestUtils.jsm
index 871224c42a06..771a62ad6608 100644
--- a/testing/mochitest/BrowserTestUtils/BrowserTestUtils.jsm
+++ b/testing/mochitest/BrowserTestUtils/BrowserTestUtils.jsm
@@ -337,7 +337,7 @@ this.BrowserTestUtils = {
    * Waits for an event to be fired on a specified element.
    *
    * Usage:
-   *    let promiseEvent = BrowserTestUtil.waitForEvent(element, "eventName");
+   *    let promiseEvent = BrowserTestUtils.waitForEvent(element, "eventName");
    *    // Do some processing here that will cause the event to be fired
    *    // ...
    *    // Now yield until the Promise is fulfilled
diff --git a/testing/mochitest/mochitest_options.py b/testing/mochitest/mochitest_options.py
index 1212b8834b45..52ec3355e5d6 100644
--- a/testing/mochitest/mochitest_options.py
+++ b/testing/mochitest/mochitest_options.py
@@ -394,6 +394,13 @@ class MochitestArguments(ArgumentContainer):
           "default": False,
           "help": "Run tests with electrolysis preferences and test filtering enabled.",
           }],
+        [["--store-chrome-manifest"],
+         {"action": "store",
+          "help": "Destination path to write a copy of any chrome manifest "
+                  "written by the harness.",
+          "default": None,
+          "suppress": True,
+          }],
         [["--strict-content-sandbox"],
          {"action": "store_true",
           "default": False,
@@ -669,6 +676,13 @@ class MochitestArguments(ArgumentContainer):
             parser.error(
                 "--debugger-args requires --debugger.")
 
+        if options.store_chrome_manifest:
+            options.store_chrome_manifest = os.path.abspath(options.store_chrome_manifest)
+            if not os.path.isdir(os.path.dirname(options.store_chrome_manifest)):
+                parser.error(
+                    "directory for %s does not exist as a destination to copy a "
+                    "chrome manifest." % options.store_chrome_manifest)
+
         if options.testingModulesDir is None:
             if build_obj:
                 options.testingModulesDir = os.path.join(
diff --git a/testing/mochitest/runtests.py b/testing/mochitest/runtests.py
index e0e3e27a1f3a..293cd4167946 100644
--- a/testing/mochitest/runtests.py
+++ b/testing/mochitest/runtests.py
@@ -905,6 +905,8 @@ class MochitestUtilsMixin(object):
             if options.testingModulesDir is not None:
                 manifestFile.write("resource testing-common file:///%s\n" %
                                    options.testingModulesDir)
+        if options.store_chrome_manifest:
+            shutil.copyfile(manifest, options.store_chrome_manifest)
         return manifest
 
     def addChromeToProfile(self, options):
diff --git a/testing/mochitest/tests/Harness_sanity/mochitest.ini b/testing/mochitest/tests/Harness_sanity/mochitest.ini
index 3395221529ef..c570cb404be1 100644
--- a/testing/mochitest/tests/Harness_sanity/mochitest.ini
+++ b/testing/mochitest/tests/Harness_sanity/mochitest.ini
@@ -3,6 +3,7 @@ skip-if = buildapp == 'mulet' || buildapp == 'b2g'
 [test_TestsRunningAfterSimpleTestFinish.html]
 skip-if = true #depends on fix for bug 1048446
 [test_add_task.html]
+[test_createFiles.html]
 [test_sanity.html]
 [test_sanityException.html]
 [test_sanityException2.html]
diff --git a/testing/mochitest/tests/Harness_sanity/test_createFiles.html b/testing/mochitest/tests/Harness_sanity/test_createFiles.html
new file mode 100644
index 000000000000..f3a7a53175ef
--- /dev/null
+++ b/testing/mochitest/tests/Harness_sanity/test_createFiles.html
@@ -0,0 +1,70 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>Test for SpecialPowers.createFiles</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+
+<div id="content" class="testbody">
+  <script type="text/javascript">
+    // Creating one file, followed by failing to create a file.
+    function test1() {
+      let fdata = "this is same data for a file";
+      SpecialPowers.createFiles([{name: "test1.txt", data:fdata}],
+        function (files) {
+          is(files.length, 1, "Created 1 file");
+          let f = files[0];
+          is("[object File]", f.toString(), "first thing in array is a file");
+          is(f.size, fdata.length, "test1 size of first file should be length of its data");
+          is("test1.txt", f.name, "test1 test file should have the right name");
+          test2();
+        },
+        function (msg) { ok(false, "Should be able to create a file without an error"); test2(); }
+      );
+    }
+
+    // Failing to create a file, followed by creating a file.
+    function test2() {
+      function test3Check(passed) {
+        ok(passed, "Should trigger the error handler for a bad file name.");
+        test3();
+      };
+
+      SpecialPowers.createFiles([{name: "/\/\/\/\/\/\/\/\/\/\/\invalidname",}],
+        function () { test3Check(false); },
+        function (msg) { test3Check(true); }
+      );
+    }
+
+    // Creating two files at the same time.
+    function test3() {
+      let f1data = "hello";
+      SpecialPowers.createFiles([{name: "test3_file.txt", data:f1data}, {name: "emptyfile.txt"}],
+        function (files) {
+          is(files.length, 2, "Expected two files to be created");
+          let f1 = files[0];
+          let f2 = files[1];
+          is("[object File]", f1.toString(), "first thing in array is a file");
+          is("[object File]", f2.toString(), "second thing in array is a file");
+          is("test3_file.txt", f1.name, "first test3 test file should have the right name");
+          is("emptyfile.txt", f2.name, "second test3 test file should have the right name");
+          is(f1.size, f1data.length, "size of first file should be length of its data");
+          is(f2.size, 0, "size of second file should be 0");
+          SimpleTest.finish();
+        },
+        function (msg) {
+          ok(false, "Failed to create files: " + msg);
+          SimpleTest.finish();
+        }
+      );
+    };
+
+    SimpleTest.waitForExplicitFinish();
+    test1();
+
+  </script>
+</div>
+</body>
+</html>
diff --git a/testing/mochitest/tests/SimpleTest/SimpleTest.js b/testing/mochitest/tests/SimpleTest/SimpleTest.js
index 6c2090a2ecfc..4e276f337c6f 100644
--- a/testing/mochitest/tests/SimpleTest/SimpleTest.js
+++ b/testing/mochitest/tests/SimpleTest/SimpleTest.js
@@ -1025,6 +1025,8 @@ SimpleTest.finish = function() {
     }
 
     var afterCleanup = function() {
+        SpecialPowers.removeFiles();
+
         if (SpecialPowers.DOMWindowUtils.isTestControllingRefreshes) {
             SimpleTest.ok(false, "test left refresh driver under test control");
             SpecialPowers.DOMWindowUtils.restoreNormalRefresh();
diff --git a/testing/mozharness/configs/firefox_ui_tests/qa_jenkins.py b/testing/mozharness/configs/firefox_ui_tests/qa_jenkins.py
index cd10677c0148..078b5f407206 100644
--- a/testing/mozharness/configs/firefox_ui_tests/qa_jenkins.py
+++ b/testing/mozharness/configs/firefox_ui_tests/qa_jenkins.py
@@ -2,6 +2,13 @@
 
 import os
 
+import mozharness
+
+
+external_tools_path = os.path.join(
+    os.path.abspath(os.path.dirname(os.path.dirname(mozharness.__file__))),
+    'external_tools',
+)
 
 config = {
     'env': {
@@ -10,8 +17,8 @@ config = {
 
     # General local variable overwrite
     'exes': {
-        'gittool.py': os.path.join(os.getcwd(), 'external_tools', 'gittool.py'),
-        'hgtool.py': os.path.join(os.getcwd(), 'external_tools', 'hgtool.py'),
+        'gittool.py': os.path.join(external_tools_path, 'gittool.py'),
+        'hgtool.py': os.path.join(external_tools_path, 'hgtool.py'),
     },
 
     # PIP
diff --git a/testing/mozharness/configs/firefox_ui_tests/releng_release.py b/testing/mozharness/configs/firefox_ui_tests/releng_release.py
index 77e1e2ecee93..6f85052b40b6 100644
--- a/testing/mozharness/configs/firefox_ui_tests/releng_release.py
+++ b/testing/mozharness/configs/firefox_ui_tests/releng_release.py
@@ -2,6 +2,14 @@
 
 import os
 
+import mozharness
+
+
+external_tools_path = os.path.join(
+    os.path.abspath(os.path.dirname(os.path.dirname(mozharness.__file__))),
+    'external_tools',
+)
+
 
 config = {
     'env': {
@@ -10,8 +18,8 @@ config = {
 
     # General local variable overwrite
     'exes': {
-        'gittool.py': os.path.join(os.getcwd(), 'external_tools', 'gittool.py'),
-        'hgtool.py': os.path.join(os.getcwd(), 'external_tools', 'hgtool.py'),
+        'gittool.py': os.path.join(external_tools_path, 'gittool.py'),
+        'hgtool.py': os.path.join(external_tools_path, 'hgtool.py'),
     },
 
     # PIP
diff --git a/testing/specialpowers/components/SpecialPowersObserver.js b/testing/specialpowers/components/SpecialPowersObserver.js
index 37c2fcbbea51..22442271f40c 100644
--- a/testing/specialpowers/components/SpecialPowersObserver.js
+++ b/testing/specialpowers/components/SpecialPowersObserver.js
@@ -11,6 +11,7 @@
 
 Components.utils.import("resource://gre/modules/XPCOMUtils.jsm");
 Components.utils.import("resource://gre/modules/Services.jsm");
+Components.utils.importGlobalProperties(['File']);
 
 if (typeof(Cc) == "undefined") {
   const Cc = Components.classes;
@@ -81,6 +82,8 @@ SpecialPowersObserver.prototype = new SpecialPowersObserverAPI();
       this._messageManager.addMessageListener("SPPingService", this);
       this._messageManager.addMessageListener("SpecialPowers.Quit", this);
       this._messageManager.addMessageListener("SpecialPowers.Focus", this);
+      this._messageManager.addMessageListener("SpecialPowers.CreateFiles", this);
+      this._messageManager.addMessageListener("SpecialPowers.RemoveFiles", this);
       this._messageManager.addMessageListener("SPPermissionManager", this);
       this._messageManager.addMessageListener("SPWebAppService", this);
       this._messageManager.addMessageListener("SPObserverService", this);
@@ -98,6 +101,7 @@ SpecialPowersObserver.prototype = new SpecialPowersObserverAPI();
       this._messageManager.loadFrameScript(CHILD_SCRIPT_API, true);
       this._messageManager.loadFrameScript(CHILD_SCRIPT, true);
       this._isFrameScriptLoaded = true;
+      this._createdFiles = null;
     }
   };
 
@@ -161,6 +165,8 @@ SpecialPowersObserver.prototype = new SpecialPowersObserverAPI();
       this._messageManager.removeMessageListener("SPPingService", this);
       this._messageManager.removeMessageListener("SpecialPowers.Quit", this);
       this._messageManager.removeMessageListener("SpecialPowers.Focus", this);
+      this._messageManager.removeMessageListener("SpecialPowers.CreateFiles", this);
+      this._messageManager.removeMessageListener("SpecialPowers.RemoveFiles", this);
       this._messageManager.removeMessageListener("SPPermissionManager", this);
       this._messageManager.removeMessageListener("SPWebAppService", this);
       this._messageManager.removeMessageListener("SPObserverService", this);
@@ -265,6 +271,50 @@ SpecialPowersObserver.prototype = new SpecialPowersObserverAPI();
       case "SpecialPowers.Focus":
         aMessage.target.focus();
         break;
+      case "SpecialPowers.CreateFiles":
+        let filePaths = new Array;
+        if (!this.createdFiles) {
+          this._createdFiles = new Array;
+        }
+        let createdFiles = this._createdFiles;
+        try {
+          aMessage.data.forEach(function(request) {
+            let testFile = Services.dirsvc.get("ProfD", Ci.nsIFile);
+            testFile.append(request.name);
+            let outStream = Cc["@mozilla.org/network/file-output-stream;1"].createInstance(Ci.nsIFileOutputStream);
+            outStream.init(testFile, 0x02 | 0x08 | 0x20, // PR_WRONLY | PR_CREATE_FILE | PR_TRUNCATE
+                           0666, 0);
+            if (request.data) {
+              outStream.write(request.data, request.data.length);
+              outStream.close();
+            }
+            filePaths.push(new File(testFile.path));
+            createdFiles.push(testFile);
+          });
+          aMessage.target
+                  .QueryInterface(Ci.nsIFrameLoaderOwner)
+                  .frameLoader
+                  .messageManager
+                  .sendAsyncMessage("SpecialPowers.FilesCreated", filePaths);
+        } catch (e) {
+          aMessage.target
+                  .QueryInterface(Ci.nsIFrameLoaderOwner)
+                  .frameLoader
+                  .messageManager
+                  .sendAsyncMessage("SpecialPowers.FilesError", e.toString());
+        }
+
+        break;
+      case "SpecialPowers.RemoveFiles":
+        if (this._createdFiles) {
+          this._createdFiles.forEach(function (testFile) {
+            try {
+              testFile.remove(false);
+            } catch (e) {}
+          });
+          this._createdFiles = null;
+        }
+        break;
       default:
         return this._receiveMessage(aMessage);
     }
diff --git a/testing/specialpowers/content/specialpowers.js b/testing/specialpowers/content/specialpowers.js
index 9342916ae402..1208616fcb1c 100644
--- a/testing/specialpowers/content/specialpowers.js
+++ b/testing/specialpowers/content/specialpowers.js
@@ -24,6 +24,8 @@ function SpecialPowers(window) {
   this._pongHandlers = [];
   this._messageListener = this._messageReceived.bind(this);
   this._grandChildFrameMM = null;
+  this._createFilesOnError = null;
+  this._createFilesOnSuccess = null;
   this.SP_SYNC_MESSAGES = ["SPChromeScriptMessage",
                            "SPLoadChromeScript",
                            "SPObserverService",
@@ -36,6 +38,8 @@ function SpecialPowers(window) {
 
   this.SP_ASYNC_MESSAGES = ["SpecialPowers.Focus",
                             "SpecialPowers.Quit",
+                            "SpecialPowers.CreateFiles",
+                            "SpecialPowers.RemoveFiles",
                             "SPPingService",
                             "SPQuotaManager",
                             "SPLoadExtension",
@@ -43,6 +47,8 @@ function SpecialPowers(window) {
                             "SPUnloadExtension",
                             "SPExtensionMessage"];
   addMessageListener("SPPingService", this._messageListener);
+  addMessageListener("SpecialPowers.FilesCreated", this._messageListener);
+  addMessageListener("SpecialPowers.FilesError", this._messageListener);
   let self = this;
   Services.obs.addObserver(function onInnerWindowDestroyed(subject, topic, data) {
     var id = subject.QueryInterface(Components.interfaces.nsISupportsPRUint64).data;
@@ -50,6 +56,8 @@ function SpecialPowers(window) {
       Services.obs.removeObserver(onInnerWindowDestroyed, "inner-window-destroyed");
       try {
         removeMessageListener("SPPingService", self._messageListener);
+        removeMessageListener("SpecialPowers.FilesCreated", self._messageListener);
+        removeMessageListener("SpecialPowers.FilesError", self._messageListener);
       } catch (e if e.result == Components.results.NS_ERROR_ILLEGAL_VALUE) {
         // Ignore the exception which the message manager has been destroyed.
         ;
@@ -122,7 +130,26 @@ SpecialPowers.prototype._messageReceived = function(aMessage) {
         }
       }
       break;
+
+    case "SpecialPowers.FilesCreated":
+      var handler = this._createFilesOnSuccess;
+      this._createFilesOnSuccess = null;
+      this._createFilesOnError = null;
+      if (handler) {
+        handler(aMessage.data);
+      }
+      break;
+
+    case "SpecialPowers.FilesError":
+      var handler = this._createFilesOnError;
+      this._createFilesOnSuccess = null;
+      this._createFilesOnError = null;
+      if (handler) {
+        handler(aMessage.data);
+      }
+      break;
   }
+
   return true;
 };
 
@@ -130,6 +157,27 @@ SpecialPowers.prototype.quit = function() {
   sendAsyncMessage("SpecialPowers.Quit", {});
 };
 
+// fileRequests is an array of file requests. Each file request is an object.
+// A request must have a field |name|, which gives the base of the name of the
+// file to be created in the profile directory. If the request has a |data| field
+// then that data will be written to the file.
+SpecialPowers.prototype.createFiles = function(fileRequests, onCreation, onError) {
+  if (this._createFilesOnSuccess || this._createFilesOnError) {
+    onError("Already waiting for SpecialPowers.createFiles() to finish.");
+    return;
+  }
+
+  this._createFilesOnSuccess = onCreation;
+  this._createFilesOnError = onError;
+  sendAsyncMessage("SpecialPowers.CreateFiles", fileRequests);
+};
+
+// Remove the files that were created using |SpecialPowers.createFiles()|.
+// This will be automatically called by |SimpleTest.finish()|.
+SpecialPowers.prototype.removeFiles = function() {
+  sendAsyncMessage("SpecialPowers.RemoveFiles", {});
+};
+
 SpecialPowers.prototype.executeAfterFlushingMessageQueue = function(aCallback) {
   this._pongHandlers.push(aCallback);
   sendAsyncMessage("SPPingService", { op: "ping" });
diff --git a/testing/web-platform/tests/dom/nodes/Document-Element-getElementsByTagName.js b/testing/web-platform/tests/dom/nodes/Document-Element-getElementsByTagName.js
index 7402bbe2cd29..cc2b73646ef7 100644
--- a/testing/web-platform/tests/dom/nodes/Document-Element-getElementsByTagName.js
+++ b/testing/web-platform/tests/dom/nodes/Document-Element-getElementsByTagName.js
@@ -50,19 +50,44 @@ function test_getElementsByTagName(context, element) {
   }, "Should be able to set expando shadowing a proto prop (namedItem)")
 
   test(function() {
-    var t = element.appendChild(document.createElement("pre"));
-    t.id = "x";
-    this.add_cleanup(function() {element.removeChild(t)});
+    var t1 = element.appendChild(document.createElement("pre"));
+    t1.id = "x";
+    var t2 = element.appendChild(document.createElement("pre"));
+    t2.setAttribute("name", "y");
+    var t3 = element.appendChild(document.createElementNS("", "pre"));
+    t3.setAttribute("id", "z");
+    var t4 = element.appendChild(document.createElementNS("", "pre"));
+    t4.setAttribute("name", "w");
+    this.add_cleanup(function() {
+      element.removeChild(t1)
+      element.removeChild(t2)
+      element.removeChild(t3)
+      element.removeChild(t4)
+    });
 
     var list = context.getElementsByTagName('pre');
     var pre = list[0];
     assert_equals(pre.id, "x");
-    assert_equals(list['x'], pre);
 
-    assert_true('x' in list, "'x' in list");
-    assert_true(list.hasOwnProperty('x'), "list.hasOwnProperty('x')");
+    var exposedNames = { 'x': 0, 'y': 1, 'z': 2 };
+    for (var exposedName in exposedNames) {
+      assert_equals(list[exposedName], list[exposedNames[exposedName]]);
+      assert_equals(list[exposedName], list.namedItem(exposedName));
+      assert_true(exposedName in list, "'" + exposedName + "' in list");
+      assert_true(list.hasOwnProperty(exposedName),
+                  "list.hasOwnProperty('" + exposedName + "')");
+    }
 
-    assert_array_equals(Object.getOwnPropertyNames(list).sort(), ["0", "x"]);
+    var unexposedNames = ["w"];
+    for (var unexposedName of unexposedNames) {
+      assert_false(unexposedName in list);
+      assert_false(list.hasOwnProperty(unexposedName));
+      assert_equals(list[unexposedName], undefined);
+      assert_equals(list.namedItem(unexposedName), null);
+    }
+
+    assert_array_equals(Object.getOwnPropertyNames(list).sort(),
+                        ["0", "1", "2", "3", "x", "y", "z"]);
 
     var desc = Object.getOwnPropertyDescriptor(list, '0');
     assert_equals(typeof desc, "object", "descriptor should be an object");
diff --git a/testing/web-platform/tests/dom/nodes/Element-children.html b/testing/web-platform/tests/dom/nodes/Element-children.html
index b3ce08ceefe5..c0210f9667af 100644
--- a/testing/web-platform/tests/dom/nodes/Element-children.html
+++ b/testing/web-platform/tests/dom/nodes/Element-children.html
@@ -3,14 +3,27 @@
 <script src="/resources/testharness.js"></script>
 <script src="/resources/testharnessreport.js"></script>
 <div id="log"></div>
-<div id="test"><img><img id=foo><img id=foo></div>
+<div id="test"><img><img id=foo><img id=foo><img name="bar"></div>
 <script>
+setup(function() {
+  // Add some non-HTML elements in there to test what happens with those.
+  var container = document.getElementById("test");
+  var child = document.createElementNS("", "img");
+  child.setAttribute("id", "baz");
+  container.appendChild(child);
+
+  child = document.createElementNS("", "img");
+  child.setAttribute("name", "qux");
+  container.appendChild(child);
+});
+
 test(function() {
   var container = document.getElementById("test");
   var result = container.children.item("foo");
   assert_true(result instanceof Element, "Expected an Element.");
   assert_false(result.hasAttribute("id"), "Expected the IDless Element.")
 })
+
 test(function() {
   var container = document.getElementById("test");
   var list = container.children;
@@ -20,8 +33,26 @@ test(function() {
       result.push(p);
     }
   }
-  assert_array_equals(result, ['0', '1', '2']);
+  assert_array_equals(result, ['0', '1', '2', '3', '4', '5']);
   result = Object.getOwnPropertyNames(list);
-  assert_array_equals(result, ['0', '1', '2', 'foo']);
+  assert_array_equals(result, ['0', '1', '2', '3', '4', '5', 'foo', 'bar', 'baz']);
+
+  // Mapping of exposed names to their indices in the list.
+  var exposedNames = { 'foo': 1, 'bar': 3, 'baz': 4 };
+  for (var exposedName in exposedNames) {
+    assert_true(exposedName in list);
+    assert_true(list.hasOwnProperty(exposedName));
+    assert_equals(list[exposedName], list.namedItem(exposedName));
+    assert_equals(list[exposedName], list.item(exposedNames[exposedName]));
+    assert_true(list[exposedName] instanceof Element);
+  }
+
+  var unexposedNames = ['qux'];
+  for (var unexposedName of unexposedNames) {
+    assert_false(unexposedName in list);
+    assert_false(list.hasOwnProperty(unexposedName));
+    assert_equals(list[unexposedName], undefined);
+    assert_equals(list.namedItem(unexposedName), null);
+  }
 });
 </script>
diff --git a/toolkit/components/ctypes/tests/unit/head.js b/toolkit/components/ctypes/tests/unit/head.js
index 9ba033a13076..67d4c70818dd 100644
--- a/toolkit/components/ctypes/tests/unit/head.js
+++ b/toolkit/components/ctypes/tests/unit/head.js
@@ -23,7 +23,7 @@ ResourceCleaner.prototype = {
     return v;
   },
   cleanup: function ResourceCleaner_cleanup() {
-    let keys = Components.utils.nondeterministicGetWeakMapKeys(this._map);
+    let keys = ThreadSafeChromeUtils.nondeterministicGetWeakMapKeys(this._map);
     keys.forEach((function cleaner(k) {
       try {
         k.dispose();
diff --git a/toolkit/components/mediasniffer/nsMediaSniffer.cpp b/toolkit/components/mediasniffer/nsMediaSniffer.cpp
index eb67bae85fa4..cd1e585b5aa5 100644
--- a/toolkit/components/mediasniffer/nsMediaSniffer.cpp
+++ b/toolkit/components/mediasniffer/nsMediaSniffer.cpp
@@ -41,6 +41,7 @@ nsMediaSnifferEntry nsMediaSniffer::sSnifferEntries[] = {
 // For a complete list of file types, see http://www.ftyps.com/index.html
 nsMediaSnifferEntry sFtypEntries[] = {
   PATTERN_ENTRY("\xFF\xFF\xFF", "mp4", VIDEO_MP4), // Could be mp41 or mp42.
+  PATTERN_ENTRY("\xFF\xFF\xFF", "avc", VIDEO_MP4), // Could be avc1, avc2, ...
   PATTERN_ENTRY("\xFF\xFF\xFF", "3gp", VIDEO_3GPP), // Could be 3gp4, 3gp5, ...
   PATTERN_ENTRY("\xFF\xFF\xFF\xFF", "M4A ", AUDIO_MP4),
   PATTERN_ENTRY("\xFF\xFF\xFF\xFF", "M4P ", AUDIO_MP4)
diff --git a/toolkit/locales/l10n.mk b/toolkit/locales/l10n.mk
index 9203fb710b51..a8e3ce652c50 100644
--- a/toolkit/locales/l10n.mk
+++ b/toolkit/locales/l10n.mk
@@ -49,7 +49,7 @@ WIN32_INSTALLER_IN ?= $(_ABS_DIST)/$(PKG_INST_PATH)$(PKG_INST_BASENAME).exe
 # Allows overriding the final destination of the repackaged file
 ZIP_OUT ?= $(_ABS_DIST)/$(PACKAGE)
 
-DEFINES += \
+ACDEFINES += \
 	-DAB_CD=$(AB_CD) \
 	-DMOZ_LANGPACK_EID=$(MOZ_LANGPACK_EID) \
 	-DMOZ_APP_VERSION=$(MOZ_APP_VERSION) \
diff --git a/toolkit/mozapps/installer/packager.mk b/toolkit/mozapps/installer/packager.mk
index d8a9c849dc23..8f51bb5faffa 100644
--- a/toolkit/mozapps/installer/packager.mk
+++ b/toolkit/mozapps/installer/packager.mk
@@ -40,7 +40,7 @@ export USE_ELF_HACK ELF_HACK_FLAGS
 stage-package: $(MOZ_PKG_MANIFEST) $(MOZ_PKG_MANIFEST_DEPS)
 	OMNIJAR_NAME=$(OMNIJAR_NAME) \
 	NO_PKG_FILES="$(NO_PKG_FILES)" \
-	$(PYTHON) $(MOZILLA_DIR)/toolkit/mozapps/installer/packager.py $(DEFINES) \
+	$(PYTHON) $(MOZILLA_DIR)/toolkit/mozapps/installer/packager.py $(DEFINES) $(ACDEFINES) \
 		--format $(MOZ_PACKAGER_FORMAT) \
 		$(addprefix --removals ,$(MOZ_PKG_REMOVALS)) \
 		$(if $(filter-out 0,$(MOZ_PKG_FATAL_WARNINGS)),,--ignore-errors) \
diff --git a/toolkit/themes/osx/mozapps/jar.mn b/toolkit/themes/osx/mozapps/jar.mn
index 7e618b17e6a4..d374f446b3ed 100644
--- a/toolkit/themes/osx/mozapps/jar.mn
+++ b/toolkit/themes/osx/mozapps/jar.mn
@@ -41,10 +41,6 @@ toolkit.jar:
   skin/classic/mozapps/passwordmgr/key-16.png                     (passwordmgr/key-16.png)
   skin/classic/mozapps/passwordmgr/key-16@2x.png                  (passwordmgr/key-16@2x.png)
   skin/classic/mozapps/passwordmgr/key-64.png                     (passwordmgr/key-64.png)
-  skin/classic/mozapps/formautofill/requestAutocomplete.css       (../../shared/formautofill/requestAutocomplete.css)
-  skin/classic/mozapps/plugins/pluginProblem.css                  (../../shared/plugins/pluginProblem.css)
-  skin/classic/mozapps/aboutNetworking.css                        (../../shared/aboutNetworking.css)
-  skin/classic/mozapps/aboutServiceWorkers.css                    (../../shared/aboutServiceWorkers.css)
   skin/classic/mozapps/plugins/notifyPluginGeneric.png            (plugins/notifyPluginGeneric.png)
   skin/classic/mozapps/plugins/pluginGeneric.png                  (plugins/pluginGeneric.png)
   skin/classic/mozapps/plugins/pluginBlocked.png                  (plugins/pluginBlocked.png)
diff --git a/toolkit/themes/shared/non-mac.jar.inc.mn b/toolkit/themes/shared/non-mac.jar.inc.mn
index 1a9af34daf0f..7e74b4b9694f 100644
--- a/toolkit/themes/shared/non-mac.jar.inc.mn
+++ b/toolkit/themes/shared/non-mac.jar.inc.mn
@@ -23,7 +23,9 @@
   skin/classic/global/resizer.css                          (../../windows/global/resizer.css)
   skin/classic/global/richlistbox.css                      (../../windows/global/richlistbox.css)
   skin/classic/global/scale.css                            (../../windows/global/scale.css)
+#ifndef MOZ_THEME_FASTSTRIPE
   skin/classic/global/scrollbars.css                       (../../windows/global/xulscrollbars.css)
+#endif
   skin/classic/global/spinbuttons.css                      (../../windows/global/spinbuttons.css)
   skin/classic/global/tabprompts.css                       (../../windows/global/tabprompts.css)
   skin/classic/global/wizard.css                           (../../windows/global/wizard.css)
diff --git a/toolkit/themes/windows/global/jar.mn b/toolkit/themes/windows/global/jar.mn
index ca257fd1b23b..a6e6bd920981 100644
--- a/toolkit/themes/windows/global/jar.mn
+++ b/toolkit/themes/windows/global/jar.mn
@@ -6,31 +6,33 @@
 
 toolkit.jar:
 * skin/classic/global/autocomplete.css
+#ifndef MOZ_THEME_FASTSTRIPE
   skin/classic/global/button.css
   skin/classic/global/checkbox.css
+  skin/classic/global/dropmarker.css
+  skin/classic/global/groupbox.css
+* skin/classic/global/menu.css
+  skin/classic/global/menulist.css
+* skin/classic/global/popup.css
+  skin/classic/global/radio.css
+  skin/classic/global/tabbox.css
+  skin/classic/global/textbox.css
+#endif
   skin/classic/global/colorpicker.css
   skin/classic/global/commonDialog.css
-  skin/classic/global/dropmarker.css
   skin/classic/global/filepicker.css
   skin/classic/global/Filepicker.png                       (filepicker/Filepicker.png)
   skin/classic/global/findBar.css
 * skin/classic/global/global.css
-  skin/classic/global/groupbox.css
   skin/classic/global/listbox.css
-* skin/classic/global/menu.css
-  skin/classic/global/menulist.css
   skin/classic/global/netError.css
   skin/classic/global/numberbox.css
 * skin/classic/global/notification.css
-* skin/classic/global/popup.css
   skin/classic/global/preferences.css
   skin/classic/global/printPageSetup.css
   skin/classic/global/printPreview.css
-  skin/classic/global/radio.css
   skin/classic/global/scrollbox.css
   skin/classic/global/splitter.css
-  skin/classic/global/tabbox.css
-  skin/classic/global/textbox.css
   skin/classic/global/toolbar.css
   skin/classic/global/toolbarbutton.css
 * skin/classic/global/tree.css
diff --git a/toolkit/themes/windows/global/moz.build b/toolkit/themes/windows/global/moz.build
index c97072bba2df..db0e41491839 100644
--- a/toolkit/themes/windows/global/moz.build
+++ b/toolkit/themes/windows/global/moz.build
@@ -4,4 +4,7 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-JAR_MANIFESTS += ['jar.mn']
\ No newline at end of file
+JAR_MANIFESTS += ['jar.mn']
+
+if CONFIG['MOZ_THEME_FASTSTRIPE']:
+    DEFINES['MOZ_THEME_FASTSTRIPE'] = True
diff --git a/toolkit/themes/windows/mozapps/jar.mn b/toolkit/themes/windows/mozapps/jar.mn
index 05704c94be6d..dc45774da368 100644
--- a/toolkit/themes/windows/mozapps/jar.mn
+++ b/toolkit/themes/windows/mozapps/jar.mn
@@ -6,7 +6,6 @@ toolkit.jar:
 #include ../../shared/mozapps.inc.mn
   skin/classic/mozapps/downloads/downloadIcon.png            (downloads/downloadIcon.png)
   skin/classic/mozapps/downloads/downloads.css               (downloads/downloads.css)
-  skin/classic/mozapps/extensions/about.css                  (extensions/about.css)
 * skin/classic/mozapps/extensions/extensions.css             (extensions/extensions.css)
 * skin/classic/mozapps/extensions/selectAddons.css           (extensions/selectAddons.css)
   skin/classic/mozapps/extensions/category-search.png        (extensions/category-search.png)
diff --git a/tools/profiler/core/GeckoSampler.cpp b/tools/profiler/core/GeckoSampler.cpp
index cf6230580fbd..24514a33fbf7 100644
--- a/tools/profiler/core/GeckoSampler.cpp
+++ b/tools/profiler/core/GeckoSampler.cpp
@@ -929,10 +929,6 @@ void StackWalkCallback(uint32_t aFrameNumber, void* aPC, void* aSP,
 
 void GeckoSampler::doNativeBacktrace(ThreadProfile &aProfile, TickSample* aSample)
 {
-#ifndef XP_MACOSX
-  uintptr_t thread = GetThreadHandle(aSample->threadProfile->GetPlatformData());
-  MOZ_ASSERT(thread);
-#endif
   void* pc_array[1000];
   void* sp_array[1000];
   NativeStack nativeStack = {
@@ -949,7 +945,7 @@ void GeckoSampler::doNativeBacktrace(ThreadProfile &aProfile, TickSample* aSampl
   StackWalkCallback(/* frameNumber */ 0, aSample->pc, aSample->sp, &nativeStack);
 
   uint32_t maxFrames = uint32_t(nativeStack.size - nativeStack.count);
-#ifdef XP_MACOSX
+#if defined(XP_MACOSX) || defined(XP_WIN)
   void *stackEnd = aSample->threadProfile->GetStackTop();
   bool rv = true;
   if (aSample->fp >= aSample->sp && aSample->fp <= stackEnd)
@@ -958,15 +954,9 @@ void GeckoSampler::doNativeBacktrace(ThreadProfile &aProfile, TickSample* aSampl
                                reinterpret_cast<void**>(aSample->fp), stackEnd);
 #else
   void *platformData = nullptr;
-#ifdef XP_WIN
-  if (aSample->isSamplingCurrentThread) {
-    // In this case we want MozStackWalk to know that it's walking the
-    // current thread's stack, so we pass 0 as the thread handle.
-    thread = 0;
-  }
-  platformData = aSample->context;
-#endif // XP_WIN
 
+  uintptr_t thread = GetThreadHandle(aSample->threadProfile->GetPlatformData());
+  MOZ_ASSERT(thread);
   bool rv = MozStackWalk(StackWalkCallback, /* skipFrames */ 0, maxFrames,
                              &nativeStack, thread, platformData);
 #endif
diff --git a/tools/profiler/core/StackTop.cpp b/tools/profiler/core/StackTop.cpp
new file mode 100644
index 000000000000..1f7944e5e96a
--- /dev/null
+++ b/tools/profiler/core/StackTop.cpp
@@ -0,0 +1,48 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifdef XP_MACOSX
+#include <mach/task.h>
+#include <mach/thread_act.h>
+#include <pthread.h>
+#elif XP_WIN
+#include <windows.h>
+#endif
+
+#include "StackTop.h"
+
+void *GetStackTop(void *guess) {
+#if defined(XP_MACOSX)
+  pthread_t thread = pthread_self();
+  return pthread_get_stackaddr_np(thread);
+#elif defined(XP_WIN)
+#if defined(_MSC_VER) && defined(_M_IX86)
+  // offset 0x18 from the FS segment register gives a pointer to
+  // the thread information block for the current thread
+  NT_TIB* pTib;
+  __asm {
+    MOV EAX, FS:[18h]
+      MOV pTib, EAX
+  }
+  return static_cast<void*>(pTib->StackBase);
+#elif defined(__GNUC__) && defined(i386)
+  // offset 0x18 from the FS segment register gives a pointer to
+  // the thread information block for the current thread
+  NT_TIB* pTib;
+  asm ( "movl %%fs:0x18, %0\n"
+       : "=r" (pTib)
+      );
+  return static_cast<void*>(pTib->StackBase);
+#elif defined(_M_X64) || defined(__x86_64)
+  PNT_TIB64 pTib = reinterpret_cast<PNT_TIB64>(NtCurrentTeb());
+  return reinterpret_cast<void*>(pTib->StackBase);
+#else
+#error Need a way to get the stack bounds on this platform (Windows)
+#endif
+#else
+  return guess;
+#endif
+}
diff --git a/tools/profiler/core/StackTop.h b/tools/profiler/core/StackTop.h
new file mode 100644
index 000000000000..a933d10b4e6e
--- /dev/null
+++ b/tools/profiler/core/StackTop.h
@@ -0,0 +1,10 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef MOZ_STACK_TOP_H
+#define MOZ_STACK_TOP_H
+void *GetStackTop(void *guess);
+#endif
diff --git a/tools/profiler/core/platform.cpp b/tools/profiler/core/platform.cpp
index 0a4b83cf0355..56c417517416 100644
--- a/tools/profiler/core/platform.cpp
+++ b/tools/profiler/core/platform.cpp
@@ -950,7 +950,7 @@ void mozilla_sampler_unlock()
 #endif
 }
 
-bool mozilla_sampler_register_thread(const char* aName, void* stackTop)
+bool mozilla_sampler_register_thread(const char* aName, void* aGuessStackTop)
 {
   if (sInitCount == 0) {
     return false;
@@ -969,6 +969,7 @@ bool mozilla_sampler_register_thread(const char* aName, void* stackTop)
   PseudoStack* stack = PseudoStack::create();
   tlsPseudoStack.set(stack);
   bool isMainThread = is_main_thread_name(aName);
+  void* stackTop = GetStackTop(aGuessStackTop);
   return Sampler::RegisterCurrentThread(aName, stack, isMainThread, stackTop);
 }
 
diff --git a/tools/profiler/core/platform.h b/tools/profiler/core/platform.h
index b77b216f76db..5d2e25c8e32b 100644
--- a/tools/profiler/core/platform.h
+++ b/tools/profiler/core/platform.h
@@ -57,6 +57,7 @@
 #include "PlatformMacros.h"
 #include "v8-support.h"
 #include <vector>
+#include "StackTop.h"
 
 // We need a definition of gettid(), but glibc doesn't provide a
 // wrapper for it.
diff --git a/tools/profiler/gecko/ThreadResponsiveness.cpp b/tools/profiler/gecko/ThreadResponsiveness.cpp
index e54a8b560085..f0c009ba478b 100644
--- a/tools/profiler/gecko/ThreadResponsiveness.cpp
+++ b/tools/profiler/gecko/ThreadResponsiveness.cpp
@@ -10,6 +10,7 @@
 #include "nsITimer.h"
 #include "mozilla/Monitor.h"
 #include "ProfileEntry.h"
+#include "ThreadProfile.h"
 
 using mozilla::Monitor;
 using mozilla::MonitorAutoLock;
diff --git a/tools/profiler/moz.build b/tools/profiler/moz.build
index 2e744c88dc14..576fe3505e0c 100644
--- a/tools/profiler/moz.build
+++ b/tools/profiler/moz.build
@@ -32,6 +32,7 @@ if CONFIG['MOZ_ENABLE_PROFILER_SPS']:
         'core/ProfileJSONWriter.cpp',
         'core/ProfilerBacktrace.cpp',
         'core/ProfilerMarkers.cpp',
+        'core/StackTop.cpp',
         'core/SyncProfile.cpp',
         'core/ThreadInfo.cpp',
         'core/ThreadProfile.cpp',
diff --git a/tools/profiler/public/GeckoProfiler.h b/tools/profiler/public/GeckoProfiler.h
index f8ec8c736927..eeb163ae3609 100644
--- a/tools/profiler/public/GeckoProfiler.h
+++ b/tools/profiler/public/GeckoProfiler.h
@@ -215,7 +215,7 @@ static inline void profiler_lock() {}
 // Re-enable the profiler and notify 'profiler-unlocked'.
 static inline void profiler_unlock() {}
 
-static inline void profiler_register_thread(const char* name, void* stackTop) {}
+static inline void profiler_register_thread(const char* name, void* guessStackTop) {}
 static inline void profiler_unregister_thread() {}
 
 // These functions tell the profiler that a thread went to sleep so that we can avoid
diff --git a/tools/profiler/public/GeckoProfilerImpl.h b/tools/profiler/public/GeckoProfilerImpl.h
index 011a0941c9ec..daf4848a59d5 100644
--- a/tools/profiler/public/GeckoProfilerImpl.h
+++ b/tools/profiler/public/GeckoProfilerImpl.h
@@ -204,9 +204,9 @@ void profiler_unlock()
 }
 
 static inline
-void profiler_register_thread(const char* name, void* stackTop)
+void profiler_register_thread(const char* name, void* guessStackTop)
 {
-  mozilla_sampler_register_thread(name, stackTop);
+  mozilla_sampler_register_thread(name, guessStackTop);
 }
 
 static inline
diff --git a/widget/PuppetWidget.cpp b/widget/PuppetWidget.cpp
index 034ff22d6387..b012bf168dd1 100644
--- a/widget/PuppetWidget.cpp
+++ b/widget/PuppetWidget.cpp
@@ -240,8 +240,8 @@ PuppetWidget::ConfigureChildren(const nsTArray<Configuration>& aConfigurations)
     NS_ASSERTION(w->GetParent() == this,
                  "Configured widget is not a child");
     w->SetWindowClipRegion(configuration.mClipRegion, true);
-    nsIntRect bounds;
-    w->GetBoundsUntyped(bounds);
+    LayoutDeviceIntRect bounds;
+    w->GetBounds(bounds);
     if (bounds.Size() != configuration.mBounds.Size()) {
       w->Resize(configuration.mBounds.x, configuration.mBounds.y,
                 configuration.mBounds.width, configuration.mBounds.height,
@@ -1172,7 +1172,7 @@ PuppetWidget::GetWindowPosition()
 
 NS_METHOD
 PuppetWidget::GetScreenBoundsUntyped(nsIntRect &aRect) {
-  aRect.MoveTo(WidgetToScreenOffsetUntyped());
+  aRect.MoveTo(WidgetToScreenOffset().ToUnknownPoint());
   aRect.SizeTo(mBounds.Size());
   return NS_OK;
 }
diff --git a/widget/android/AndroidContentController.cpp b/widget/android/AndroidContentController.cpp
index 151368f22b81..6840091567b1 100644
--- a/widget/android/AndroidContentController.cpp
+++ b/widget/android/AndroidContentController.cpp
@@ -4,10 +4,13 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "AndroidContentController.h"
-#include "mozilla/layers/APZCTreeManager.h"
-#include "base/message_loop.h"
-#include "nsWindow.h"
+
 #include "AndroidBridge.h"
+#include "base/message_loop.h"
+#include "mozilla/layers/APZCCallbackHelper.h"
+#include "mozilla/layers/APZCTreeManager.h"
+#include "nsLayoutUtils.h"
+#include "nsWindow.h"
 
 using mozilla::layers::APZCTreeManager;
 
@@ -46,6 +49,41 @@ AndroidContentController::NotifyDefaultPrevented(uint64_t aInputBlockId,
     }
 }
 
+void
+AndroidContentController::HandleSingleTap(const CSSPoint& aPoint,
+                                          Modifiers aModifiers,
+                                          const ScrollableLayerGuid& aGuid)
+{
+    // This function will get invoked first on the Java UI thread, and then
+    // again on the main thread (because of the code in ChromeProcessController::
+    // HandleSingleTap). We want to post the SingleTap message once; it can be
+    // done from either thread but we need access to the callback transform
+    // so we do it from the main thread.
+    if (NS_IsMainThread()) {
+        CSSPoint point = mozilla::layers::APZCCallbackHelper::ApplyCallbackTransform(aPoint, aGuid);
+
+        nsIContent* content = nsLayoutUtils::FindContentFor(aGuid.mScrollId);
+        nsIPresShell* shell = content
+            ? mozilla::layers::APZCCallbackHelper::GetRootContentDocumentPresShellForContent(content)
+            : nullptr;
+
+        if (shell && shell->ScaleToResolution()) {
+            // We need to convert from the root document to the root content document,
+            // by unapplying the resolution that's on the content document.
+            const float resolution = shell->GetResolution();
+            point.x /= resolution;
+            point.y /= resolution;
+        }
+
+        CSSIntPoint rounded = RoundedToInt(point);
+        nsCString data = nsPrintfCString("{ \"x\": %d, \"y\": %d }", rounded.x, rounded.y);
+        nsAppShell::gAppShell->PostEvent(AndroidGeckoEvent::MakeBroadcastEvent(
+                NS_LITERAL_CSTRING("Gesture:SingleTap"), data));
+    }
+
+    ChromeProcessController::HandleSingleTap(aPoint, aModifiers, aGuid);
+}
+
 void
 AndroidContentController::PostDelayedTask(Task* aTask, int aDelayMs)
 {
diff --git a/widget/android/AndroidContentController.h b/widget/android/AndroidContentController.h
index fa5b02a41287..d5bdec80b4d0 100644
--- a/widget/android/AndroidContentController.h
+++ b/widget/android/AndroidContentController.h
@@ -32,6 +32,9 @@ public:
     {}
 
     // ChromeProcessController methods
+    void HandleSingleTap(const CSSPoint& aPoint,
+                         Modifiers aModifiers,
+                         const ScrollableLayerGuid& aGuid) override;
     void PostDelayedTask(Task* aTask, int aDelayMs) override;
 
 public:
diff --git a/widget/android/AndroidJavaWrappers.cpp b/widget/android/AndroidJavaWrappers.cpp
index b023319b76a1..9df6ebbfa272 100644
--- a/widget/android/AndroidJavaWrappers.cpp
+++ b/widget/android/AndroidJavaWrappers.cpp
@@ -717,7 +717,7 @@ AndroidGeckoEvent::MakeMultiTouchInput(nsIWidget* widget)
         return event;
     }
 
-    const nsIntPoint& offset = widget->WidgetToScreenOffsetUntyped();
+    const nsIntPoint& offset = widget->WidgetToScreenOffset().ToUnknownPoint();
     event.mTouches.SetCapacity(endIndex - startIndex);
     for (int i = startIndex; i < endIndex; i++) {
         nsIntPoint point = Points()[i] - offset;
diff --git a/widget/android/nsWindow.cpp b/widget/android/nsWindow.cpp
index b0ee1cfc161b..6b248feceb67 100644
--- a/widget/android/nsWindow.cpp
+++ b/widget/android/nsWindow.cpp
@@ -58,6 +58,7 @@ using mozilla::Unused;
 #include "mozilla/layers/LayerManagerComposite.h"
 #include "mozilla/layers/AsyncCompositionManager.h"
 #include "mozilla/layers/APZCTreeManager.h"
+#include "mozilla/layers/APZEventState.h"
 #include "mozilla/layers/APZThreadUtils.h"
 #include "GLContext.h"
 #include "GLContextProvider.h"
@@ -1151,6 +1152,7 @@ nsWindow::OnGlobalAndroidEvent(AndroidGeckoEvent *ae)
 
             WidgetTouchEvent touchEvent = ae->MakeTouchEvent(win);
             win->ProcessUntransformedAPZEvent(&touchEvent, ae->ApzGuid(), ae->ApzInputBlockId(), ae->ApzEventStatus());
+            win->DispatchHitTest(touchEvent);
             break;
         }
         case AndroidGeckoEvent::MOTION_EVENT: {
@@ -1338,6 +1340,28 @@ nsWindow::OnLongTapEvent(AndroidGeckoEvent *ae)
     DispatchEvent(&event);
 }
 
+void
+nsWindow::DispatchHitTest(const WidgetTouchEvent& aEvent)
+{
+    if (aEvent.mMessage == eTouchStart && aEvent.touches.Length() == 1) {
+        // Since touch events don't get retargeted by PositionedEventTargeting.cpp
+        // code on Fennec, we dispatch a dummy mouse event that *does* get
+        // retargeted. The Fennec browser.js code can use this to activate the
+        // highlight element in case the this touchstart is the start of a tap.
+        WidgetMouseEvent hittest(true, eMouseHitTest, this,
+                                 WidgetMouseEvent::eReal);
+        hittest.refPoint = aEvent.touches[0]->mRefPoint;
+        hittest.ignoreRootScrollFrame = true;
+        hittest.inputSource = nsIDOMMouseEvent::MOZ_SOURCE_TOUCH;
+        nsEventStatus status;
+        DispatchEvent(&hittest, status);
+
+        if (mAPZEventState && hittest.hitCluster) {
+            mAPZEventState->ProcessClusterHit();
+        }
+    }
+}
+
 bool nsWindow::OnMultitouchEvent(AndroidGeckoEvent *ae)
 {
     RefPtr<nsWindow> kungFuDeathGrip(this);
@@ -1368,19 +1392,7 @@ bool nsWindow::OnMultitouchEvent(AndroidGeckoEvent *ae)
         isDownEvent = (event.mMessage == eTouchStart);
     }
 
-    if (isDownEvent && event.touches.Length() == 1) {
-        // Since touch events don't get retargeted by PositionedEventTargeting.cpp
-        // code on Fennec, we dispatch a dummy mouse event that *does* get
-        // retargeted. The Fennec browser.js code can use this to activate the
-        // highlight element in case the this touchstart is the start of a tap.
-        WidgetMouseEvent hittest(true, eMouseHitTest, this,
-                                 WidgetMouseEvent::eReal);
-        hittest.refPoint = event.touches[0]->mRefPoint;
-        hittest.ignoreRootScrollFrame = true;
-        hittest.inputSource = nsIDOMMouseEvent::MOZ_SOURCE_TOUCH;
-        nsEventStatus status;
-        DispatchEvent(&hittest, status);
-    }
+    DispatchHitTest(event);
 
     // if the last event we got was a down event, then by now we know for sure whether
     // this block has been default-prevented or not. if we haven't already sent the
diff --git a/widget/android/nsWindow.h b/widget/android/nsWindow.h
index b65b1316a8d7..7f7313446c1a 100644
--- a/widget/android/nsWindow.h
+++ b/widget/android/nsWindow.h
@@ -22,6 +22,7 @@ struct ANPEvent;
 namespace mozilla {
     class AndroidGeckoEvent;
     class TextComposition;
+    class WidgetTouchEvent;
 
     namespace layers {
         class CompositorParent;
@@ -187,6 +188,7 @@ protected:
 
     void ConfigureAPZCTreeManager() override;
     void ConfigureAPZControllerThread() override;
+    void DispatchHitTest(const mozilla::WidgetTouchEvent& aEvent);
 
     already_AddRefed<GeckoContentController> CreateRootContentController() override;
 
diff --git a/widget/cocoa/nsChildView.h b/widget/cocoa/nsChildView.h
index 5bc10980c3dc..b582a37adcb1 100644
--- a/widget/cocoa/nsChildView.h
+++ b/widget/cocoa/nsChildView.h
@@ -167,7 +167,7 @@ typedef NSInteger NSEventGestureAxis;
 #ifdef ACCESSIBILITY
                               mozAccessible,
 #endif
-                              mozView, NSTextInput, NSTextInputClient>
+                              mozView, NSTextInputClient>
 {
 @private
   // the nsChildView that created the view. It retains this NSView, so
@@ -551,7 +551,7 @@ public:
 
   bool IsPluginFocused() { return mPluginFocused; }
 
-  virtual nsIntPoint GetClientOffset() override;
+  virtual nsIntPoint GetClientOffsetUntyped() override;
 
   void DispatchAPZWheelInputEvent(mozilla::InputData& aEvent, bool aCanTriggerSwipe);
 
diff --git a/widget/cocoa/nsChildView.mm b/widget/cocoa/nsChildView.mm
index 3214c55c4701..33d99924091e 100644
--- a/widget/cocoa/nsChildView.mm
+++ b/widget/cocoa/nsChildView.mm
@@ -922,7 +922,7 @@ NS_IMETHODIMP nsChildView::GetClientBoundsUntyped(nsIntRect &aRect)
   if (!mParentWidget) {
     // For top level widgets we want the position on screen, not the position
     // of this view inside the window.
-    aRect.MoveTo(WidgetToScreenOffsetUntyped());
+    aRect.MoveTo(WidgetToScreenOffset().ToUnknownPoint());
   }
   return NS_OK;
 }
@@ -930,7 +930,7 @@ NS_IMETHODIMP nsChildView::GetClientBoundsUntyped(nsIntRect &aRect)
 NS_IMETHODIMP nsChildView::GetScreenBoundsUntyped(nsIntRect &aRect)
 {
   GetBoundsUntyped(aRect);
-  aRect.MoveTo(WidgetToScreenOffsetUntyped());
+  aRect.MoveTo(WidgetToScreenOffset().ToUnknownPoint());
   return NS_OK;
 }
 
@@ -1520,7 +1520,7 @@ void nsChildView::ReportSizeEvent()
 
 #pragma mark -
 
-nsIntPoint nsChildView::GetClientOffset()
+nsIntPoint nsChildView::GetClientOffsetUntyped()
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_RETURN;
 
diff --git a/widget/cocoa/nsCocoaWindow.h b/widget/cocoa/nsCocoaWindow.h
index 957dc46cbc5c..145e9c7e0040 100644
--- a/widget/cocoa/nsCocoaWindow.h
+++ b/widget/cocoa/nsCocoaWindow.h
@@ -271,7 +271,7 @@ public:
     virtual bool            IsVisible() const override;
     NS_IMETHOD              SetFocus(bool aState=false) override;
     virtual mozilla::LayoutDeviceIntPoint WidgetToScreenOffset() override;
-    virtual nsIntPoint GetClientOffset() override;
+    virtual nsIntPoint GetClientOffsetUntyped() override;
     virtual mozilla::LayoutDeviceIntSize
     ClientToWindowSize(const mozilla::LayoutDeviceIntSize& aClientSize) override;
 
@@ -340,7 +340,7 @@ public:
     virtual void SetWindowAnimationType(WindowAnimationType aType) override;
     virtual void SetDrawsTitle(bool aDrawTitle) override;
     virtual void SetUseBrightTitlebarForeground(bool aBrightForeground) override;
-    NS_IMETHOD SetNonClientMargins(nsIntMargin &margins) override;
+    NS_IMETHOD SetNonClientMargins(mozilla::LayoutDeviceIntMargin &margins) override;
     NS_IMETHOD SetWindowTitlebarColor(nscolor aColor, bool aActive) override;
     virtual void SetDrawsInTitlebar(bool aState) override;
     virtual void UpdateThemeGeometries(const nsTArray<ThemeGeometry>& aThemeGeometries) override;
diff --git a/widget/cocoa/nsCocoaWindow.mm b/widget/cocoa/nsCocoaWindow.mm
index 63e449d7c354..03ed44e7c57a 100644
--- a/widget/cocoa/nsCocoaWindow.mm
+++ b/widget/cocoa/nsCocoaWindow.mm
@@ -1978,7 +1978,7 @@ LayoutDeviceIntPoint nsCocoaWindow::WidgetToScreenOffset()
   NS_OBJC_END_TRY_ABORT_BLOCK_RETURN(LayoutDeviceIntPoint(0,0));
 }
 
-nsIntPoint nsCocoaWindow::GetClientOffset()
+nsIntPoint nsCocoaWindow::GetClientOffsetUntyped()
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_RETURN;
 
@@ -2167,7 +2167,7 @@ nsCocoaWindow::SetUseBrightTitlebarForeground(bool aBrightForeground)
   NS_OBJC_END_TRY_ABORT_BLOCK;
 }
 
-NS_IMETHODIMP nsCocoaWindow::SetNonClientMargins(nsIntMargin &margins)
+NS_IMETHODIMP nsCocoaWindow::SetNonClientMargins(LayoutDeviceIntMargin &margins)
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NSRESULT;
 
diff --git a/widget/gonk/HwcComposer2D.cpp b/widget/gonk/HwcComposer2D.cpp
index 29ce362bb415..842189fa4642 100644
--- a/widget/gonk/HwcComposer2D.cpp
+++ b/widget/gonk/HwcComposer2D.cpp
@@ -769,7 +769,7 @@ HwcComposer2D::Render(nsIWidget* aWidget)
         mList->hwLayers[mList->numHwLayers - 1].acquireFenceFd = dispSurface->GetPrevDispAcquireFd();
     } else {
         // Update screen rect to handle a case that TryRenderWithHwc() is not called.
-        mScreenRect = screen->GetNaturalBoundsUntyped();
+        mScreenRect = screen->GetNaturalBounds().ToUnknownRect();
 
         mList->flags = HWC_GEOMETRY_CHANGED;
         mList->numHwLayers = 2;
@@ -891,7 +891,7 @@ HwcComposer2D::TryRenderWithHwc(Layer* aRoot,
     // reallocated. We may want to avoid this if possible
     mVisibleRegions.clear();
 
-    mScreenRect = screen->GetNaturalBoundsUntyped();
+    mScreenRect = screen->GetNaturalBounds().ToUnknownRect();
     MOZ_ASSERT(mHwcLayerMap.IsEmpty());
     if (!PrepareLayerList(aRoot,
                           mScreenRect,
diff --git a/widget/gonk/nsAppShell.cpp b/widget/gonk/nsAppShell.cpp
index 410a7990bf5b..9eb740c63bc3 100644
--- a/widget/gonk/nsAppShell.cpp
+++ b/widget/gonk/nsAppShell.cpp
@@ -580,7 +580,7 @@ GeckoInputReaderPolicy::setDisplayInfo()
     uint32_t rotation = nsIScreen::ROTATION_0_DEG;
     DebugOnly<nsresult> rv = screen->GetRotation(&rotation);
     MOZ_ASSERT(NS_SUCCEEDED(rv));
-    nsIntRect screenBounds = screen->GetNaturalBoundsUntyped();
+    LayoutDeviceIntRect screenBounds = screen->GetNaturalBounds();
 
     DisplayViewport viewport;
     viewport.displayId = 0;
diff --git a/widget/gonk/nsScreenManagerGonk.cpp b/widget/gonk/nsScreenManagerGonk.cpp
index bd91eaaa89b1..c43c12f073df 100644
--- a/widget/gonk/nsScreenManagerGonk.cpp
+++ b/widget/gonk/nsScreenManagerGonk.cpp
@@ -289,10 +289,10 @@ nsScreenGonk::SetRotation(uint32_t aRotation)
     return NS_OK;
 }
 
-nsIntRect
-nsScreenGonk::GetNaturalBoundsUntyped()
+LayoutDeviceIntRect
+nsScreenGonk::GetNaturalBounds()
 {
-    return mNaturalBounds;
+    return LayoutDeviceIntRect::FromUnknownRect(mNaturalBounds);
 }
 
 uint32_t
@@ -444,9 +444,18 @@ nsScreenGonk::GetEGLDisplay()
 hwc_surface_t
 nsScreenGonk::GetEGLSurface()
 {
+    MOZ_ASSERT(CompositorParent::IsInCompositorThread());
     return mEGLSurface;
 }
 
+already_AddRefed<mozilla::gl::GLContext>
+nsScreenGonk::GetGLContext()
+{
+    MOZ_ASSERT(CompositorParent::IsInCompositorThread());
+    RefPtr<mozilla::gl::GLContext>glContext = mGLContext;
+    return glContext.forget();
+}
+
 static void
 UpdateMirroringWidgetSync(RefPtr<nsScreenGonk>&& aScreen, nsWindow* aWindow)
 {
diff --git a/widget/gonk/nsScreenManagerGonk.h b/widget/gonk/nsScreenManagerGonk.h
index 4b910e45ef94..c7d60e8365dc 100644
--- a/widget/gonk/nsScreenManagerGonk.h
+++ b/widget/gonk/nsScreenManagerGonk.h
@@ -76,7 +76,7 @@ public:
     float GetDpi();
     int32_t GetSurfaceFormat();
     ANativeWindow* GetNativeWindow();
-    nsIntRect GetNaturalBoundsUntyped();
+    mozilla::LayoutDeviceIntRect GetNaturalBounds();
     uint32_t EffectiveScreenRotation();
     ScreenConfiguration GetConfiguration();
     bool IsPrimaryScreen();
@@ -116,6 +116,7 @@ public:
                     mozilla::gl::GLContext* aGLContext);
     hwc_display_t GetEGLDisplay();
     hwc_surface_t GetEGLSurface();
+    already_AddRefed<mozilla::gl::GLContext> GetGLContext();
     void UpdateMirroringWidget(already_AddRefed<nsWindow>& aWindow); // Primary screen only
     nsWindow* GetMirroringWidget(); // Primary screen only
 
diff --git a/widget/gonk/nsWindow.cpp b/widget/gonk/nsWindow.cpp
index e91dbf92aa24..ab8f5aac4cf6 100644
--- a/widget/gonk/nsWindow.cpp
+++ b/widget/gonk/nsWindow.cpp
@@ -537,7 +537,10 @@ nsWindow::GetNativeData(uint32_t aDataType)
     case NS_NATIVE_WINDOW:
         // Called before primary display's EGLSurface creation.
         return mScreen->GetNativeWindow();
+    case NS_NATIVE_OPENGL_CONTEXT:
+        return mScreen->GetGLContext().take();
     }
+
     return nullptr;
 }
 
@@ -854,7 +857,7 @@ nsWindow::GetGLFrameBufferFormat()
 nsIntRect
 nsWindow::GetNaturalBoundsUntyped()
 {
-    return mScreen->GetNaturalBoundsUntyped();
+    return mScreen->GetNaturalBounds().ToUnknownRect();
 }
 
 nsScreenGonk*
diff --git a/widget/gtk/nsWindow.cpp b/widget/gtk/nsWindow.cpp
index a2a1af87ff2f..8ad8ddf4ee78 100644
--- a/widget/gtk/nsWindow.cpp
+++ b/widget/gtk/nsWindow.cpp
@@ -1488,9 +1488,8 @@ nsWindow::GetScreenBoundsUntyped(nsIntRect &aRect)
         gint x, y;
         gdk_window_get_root_origin(gtk_widget_get_window(GTK_WIDGET(mContainer)), &x, &y);
         aRect.MoveTo(GdkPointToDevicePixels({ x, y }).ToUnknownPoint());
-    }
-    else {
-        aRect.MoveTo(WidgetToScreenOffsetUntyped());
+    } else {
+        aRect.MoveTo(WidgetToScreenOffset().ToUnknownPoint());
     }
     // mBounds.Size() is the window bounds, not the window-manager frame
     // bounds (bug 581863).  gdk_window_get_frame_extents would give the
@@ -1515,7 +1514,7 @@ nsWindow::GetClientBoundsUntyped(nsIntRect &aRect)
     // outer bounds, but whose width/height represent the size of the inner
     // bounds (which is messed up).
     GetBoundsUntyped(aRect);
-    aRect.MoveBy(GetClientOffset());
+    aRect.MoveBy(GetClientOffsetUntyped());
 
     return NS_OK;
 }
@@ -1563,7 +1562,7 @@ nsWindow::UpdateClientOffset()
 }
 
 nsIntPoint
-nsWindow::GetClientOffset()
+nsWindow::GetClientOffsetUntyped()
 {
     return mClientOffset;
 }
@@ -4300,14 +4299,16 @@ nsWindow::ConfigureChildren(const nsTArray<Configuration>& aConfigurations)
         nsWindow* w = static_cast<nsWindow*>(configuration.mChild.get());
         NS_ASSERTION(w->GetParent() == this,
                      "Configured widget is not a child");
+        LayoutDeviceIntRect wBounds =
+            LayoutDeviceIntRect::FromUnknownRect(w->mBounds);
         w->SetWindowClipRegion(configuration.mClipRegion, true);
-        if (w->mBounds.Size() != configuration.mBounds.Size()) {
+        if (wBounds.Size() != configuration.mBounds.Size()) {
             w->Resize(configuration.mBounds.x, configuration.mBounds.y,
                       configuration.mBounds.width, configuration.mBounds.height,
                       true);
-        } else if (w->mBounds.TopLeft() != configuration.mBounds.TopLeft()) {
+        } else if (wBounds.TopLeft() != configuration.mBounds.TopLeft()) {
             w->Move(configuration.mBounds.x, configuration.mBounds.y);
-        } 
+        }
         w->SetWindowClipRegion(configuration.mClipRegion, false);
     }
     return NS_OK;
diff --git a/widget/gtk/nsWindow.h b/widget/gtk/nsWindow.h
index 771437199d02..4a6aaa467384 100644
--- a/widget/gtk/nsWindow.h
+++ b/widget/gtk/nsWindow.h
@@ -134,7 +134,7 @@ public:
     NS_IMETHOD         GetScreenBoundsUntyped(nsIntRect &aRect) override;
     NS_IMETHOD         GetClientBoundsUntyped(nsIntRect &aRect) override;
     virtual mozilla::gfx::IntSize GetClientSize() override;
-    virtual nsIntPoint GetClientOffset() override;
+    virtual nsIntPoint GetClientOffsetUntyped() override;
     NS_IMETHOD         SetCursor(nsCursor aCursor) override;
     NS_IMETHOD         SetCursor(imgIContainer* aCursor,
                                  uint32_t aHotspotX, uint32_t aHotspotY) override;
diff --git a/widget/nsBaseWidget.cpp b/widget/nsBaseWidget.cpp
index 8fae27d84398..88009edbd6b4 100644
--- a/widget/nsBaseWidget.cpp
+++ b/widget/nsBaseWidget.cpp
@@ -1239,7 +1239,7 @@ NS_METHOD nsBaseWidget::SetWindowClass(const nsAString& xulWinType)
 
 NS_METHOD nsBaseWidget::MoveClient(double aX, double aY)
 {
-  nsIntPoint clientOffset(GetClientOffset());
+  LayoutDeviceIntPoint clientOffset(GetClientOffset());
 
   // GetClientOffset returns device pixels; scale back to display pixels
   // if that's what this widget uses for the Move/Resize APIs
@@ -1290,7 +1290,7 @@ NS_METHOD nsBaseWidget::ResizeClient(double aX,
   aWidth = mBounds.width * scale + (aWidth - clientBounds.width * scale);
   aHeight = mBounds.height * scale + (aHeight - clientBounds.height * scale);
 
-  nsIntPoint clientOffset(GetClientOffset());
+  LayoutDeviceIntPoint clientOffset(GetClientOffset());
   aX -= clientOffset.x * scale;
   aY -= clientOffset.y * scale;
 
@@ -1332,27 +1332,28 @@ NS_METHOD nsBaseWidget::GetScreenBoundsUntyped(nsIntRect &aRect)
   return GetBoundsUntyped(aRect);
 }
 
-NS_METHOD nsBaseWidget::GetRestoredBoundsUntyped(nsIntRect &aRect)
+NS_METHOD nsBaseWidget::GetRestoredBounds(LayoutDeviceIntRect &aRect)
 {
   if (SizeMode() != nsSizeMode_Normal) {
     return NS_ERROR_FAILURE;
   }
-  return GetScreenBoundsUntyped(aRect);
+  return GetScreenBounds(aRect);
 }
 
-nsIntPoint nsBaseWidget::GetClientOffset()
+nsIntPoint
+nsBaseWidget::GetClientOffsetUntyped()
 {
   return nsIntPoint(0, 0);
 }
 
 NS_IMETHODIMP
-nsBaseWidget::GetNonClientMargins(nsIntMargin &margins)
+nsBaseWidget::GetNonClientMargins(LayoutDeviceIntMargin &margins)
 {
   return NS_ERROR_NOT_IMPLEMENTED;
 }
 
 NS_IMETHODIMP
-nsBaseWidget::SetNonClientMargins(nsIntMargin &margins)
+nsBaseWidget::SetNonClientMargins(LayoutDeviceIntMargin &margins)
 {
   return NS_ERROR_NOT_IMPLEMENTED;
 }
diff --git a/widget/nsBaseWidget.h b/widget/nsBaseWidget.h
index d4b21da7929c..372293d6c349 100644
--- a/widget/nsBaseWidget.h
+++ b/widget/nsBaseWidget.h
@@ -190,10 +190,12 @@ public:
   NS_IMETHOD              GetBoundsUntyped(nsIntRect &aRect) override;
   NS_IMETHOD              GetClientBoundsUntyped(nsIntRect &aRect) override;
   NS_IMETHOD              GetScreenBoundsUntyped(nsIntRect &aRect) override;
-  NS_IMETHOD              GetRestoredBoundsUntyped(nsIntRect &aRect) override;
-  NS_IMETHOD              GetNonClientMargins(nsIntMargin &margins) override;
-  NS_IMETHOD              SetNonClientMargins(nsIntMargin &margins) override;
-  virtual nsIntPoint      GetClientOffset() override;
+  NS_IMETHOD              GetRestoredBounds(mozilla::LayoutDeviceIntRect &aRect) override;
+  NS_IMETHOD              GetNonClientMargins(
+                            mozilla::LayoutDeviceIntMargin &margins) override;
+  NS_IMETHOD              SetNonClientMargins(
+                            mozilla::LayoutDeviceIntMargin &margins) override;
+  virtual nsIntPoint      GetClientOffsetUntyped() override;
   NS_IMETHOD              EnableDragDrop(bool aEnable) override;
   NS_IMETHOD              GetAttention(int32_t aCycleCount) override;
   virtual bool            HasPendingInputEvent() override;
@@ -224,7 +226,7 @@ public:
   virtual bool            ComputeShouldAccelerate();
   NS_IMETHOD              GetToggledKeyState(uint32_t aKeyCode, bool* aLEDState) override { return NS_ERROR_NOT_IMPLEMENTED; }
   virtual nsIMEUpdatePreference GetIMEUpdatePreference() override { return nsIMEUpdatePreference(); }
-  NS_IMETHOD              OnDefaultButtonLoaded(const nsIntRect &aButtonRect) override { return NS_ERROR_NOT_IMPLEMENTED; }
+  NS_IMETHOD              OnDefaultButtonLoaded(const mozilla::LayoutDeviceIntRect& aButtonRect) override { return NS_ERROR_NOT_IMPLEMENTED; }
   NS_IMETHOD              OverrideSystemMouseScrollSpeed(double aOriginalDeltaX,
                                                          double aOriginalDeltaY,
                                                          double& aOverriddenDeltaX,
diff --git a/widget/nsIWidget.h b/widget/nsIWidget.h
index a9fd000ecb34..2257ebbf07eb 100644
--- a/widget/nsIWidget.h
+++ b/widget/nsIWidget.h
@@ -843,19 +843,10 @@ class nsIWidget : public nsISupports {
      * This method will always succeed if the current size mode is
      * nsSizeMode_Normal.
      *
-     * The untyped version exists temporarily to ease conversion to typed
-     * coordinates.
-     *
      * @param aRect   On return it holds the  x, y, width and height of
      *                this widget.
      */
-    NS_IMETHOD GetRestoredBounds(mozilla::LayoutDeviceIntRect &aRect) {
-      nsIntRect tmp;
-      nsresult rv = GetRestoredBoundsUntyped(tmp);
-      aRect = mozilla::LayoutDeviceIntRect::FromUnknownRect(tmp);
-      return rv;
-    }
-    NS_IMETHOD GetRestoredBoundsUntyped(nsIntRect &aRect) = 0;
+    NS_IMETHOD GetRestoredBounds(mozilla::LayoutDeviceIntRect &aRect) = 0;
 
     /**
      * Get this widget's client area bounds, if the window has a 3D border
@@ -879,9 +870,8 @@ class nsIWidget : public nsISupports {
 
     /**
      * Get the non-client area dimensions of the window.
-     * 
      */
-    NS_IMETHOD GetNonClientMargins(nsIntMargin &margins) = 0;
+    NS_IMETHOD GetNonClientMargins(mozilla::LayoutDeviceIntMargin &margins) = 0;
 
     /**
      * Sets the non-client area dimensions of the window. Pass -1 to restore
@@ -895,16 +885,22 @@ class nsIWidget : public nsISupports {
      *  dimensions between zero and size < system default.
      *
      */
-    NS_IMETHOD SetNonClientMargins(nsIntMargin &margins) = 0;
+    NS_IMETHOD SetNonClientMargins(mozilla::LayoutDeviceIntMargin &margins) = 0;
 
     /**
      * Get the client offset from the window origin.
      *
+     * The untyped version exists temporarily to ease conversion to typed
+     * coordinates.
+     *
      * @return the x and y of the offset.
      *
      */
-    virtual nsIntPoint GetClientOffset() = 0;
-
+    virtual mozilla::LayoutDeviceIntPoint GetClientOffset() {
+      nsIntPoint tmp = GetClientOffsetUntyped();
+      return mozilla::LayoutDeviceIntPoint::FromUnknownPoint(tmp);
+    }
+    virtual nsIntPoint GetClientOffsetUntyped() = 0;
 
     /**
      * Equivalent to GetClientBounds but only returns the size.
@@ -1008,7 +1004,7 @@ class nsIWidget : public nsISupports {
         nsCOMPtr<nsIWidget> mChild;
         uintptr_t mWindowID; // e10s specific, the unique plugin port id
         bool mVisible; // e10s specific, widget visibility
-        nsIntRect mBounds;
+        mozilla::LayoutDeviceIntRect mBounds;
         nsTArray<nsIntRect> mClipRegion;
     };
 
@@ -1366,16 +1362,11 @@ class nsIWidget : public nsISupports {
     NS_IMETHOD SetIcon(const nsAString& anIconSpec) = 0;
 
     /**
-     * Return this widget's origin in screen coordinates. The untyped version
-     * exists temporarily to ease conversion to typed coordinates.
+     * Return this widget's origin in screen coordinates.
      *
      * @return screen coordinates stored in the x,y members
      */
-
     virtual mozilla::LayoutDeviceIntPoint WidgetToScreenOffset() = 0;
-    virtual nsIntPoint WidgetToScreenOffsetUntyped() {
-      return WidgetToScreenOffset().ToUnknownPoint();
-    }
 
     /**
      * Given the specified client size, return the corresponding window size,
@@ -1860,8 +1851,8 @@ public:
     /*
      * Call this method when a dialog is opened which has a default button.
      * The button's rectangle should be supplied in aButtonRect.
-     */ 
-    NS_IMETHOD OnDefaultButtonLoaded(const nsIntRect &aButtonRect) = 0;
+     */
+    NS_IMETHOD OnDefaultButtonLoaded(const mozilla::LayoutDeviceIntRect& aButtonRect) = 0;
 
     /**
      * Compute the overridden system mouse scroll speed on the root content of
diff --git a/widget/qt/nsWindow.cpp b/widget/qt/nsWindow.cpp
index bfd9a6d0f96f..12734fc66fc4 100644
--- a/widget/qt/nsWindow.cpp
+++ b/widget/qt/nsWindow.cpp
@@ -466,7 +466,8 @@ nsWindow::Resize(double aWidth, double aHeight, bool aRepaint)
     // synthesize a resize event if this isn't a toplevel
     if (mIsTopLevel || mListenForResizes) {
         nsEventStatus status;
-        DispatchResizeEvent(mBounds, status);
+        DispatchResizeEvent(LayoutDeviceIntRect::FromUnknownRect(mBounds),
+                            status);
     }
 
     NotifyRollupGeometryChange();
@@ -529,7 +530,8 @@ nsWindow::Resize(double aX, double aY, double aWidth, double aHeight,
     if (mIsTopLevel || mListenForResizes) {
         // synthesize a resize event
         nsEventStatus status;
-        DispatchResizeEvent(mBounds, status);
+        DispatchResizeEvent(LayoutDeviceIntRect::FromUnknownRect(mBounds),
+                            status);
     }
 
     if (aRepaint) {
@@ -601,11 +603,13 @@ nsWindow::ConfigureChildren(const nsTArray<nsIWidget::Configuration>& aConfigura
         NS_ASSERTION(w->GetParent() == this,
                      "Configured widget is not a child");
 
-        if (w->mBounds.Size() != configuration.mBounds.Size()) {
+        LayoutDeviceIntRect wBounds =
+            LayoutDeviceIntRect::FromUnknownRect(w->mBounds);
+        if (wBounds.Size() != configuration.mBounds.Size()) {
             w->Resize(configuration.mBounds.x, configuration.mBounds.y,
                       configuration.mBounds.width, configuration.mBounds.height,
                       true);
-        } else if (w->mBounds.TopLeft() != configuration.mBounds.TopLeft()) {
+        } else if (wBounds.TopLeft() != configuration.mBounds.TopLeft()) {
             w->Move(configuration.mBounds.x, configuration.mBounds.y);
         }
     }
@@ -905,10 +909,10 @@ nsWindow::moveEvent(QMoveEvent* aEvent)
 nsEventStatus
 nsWindow::resizeEvent(QResizeEvent* aEvent)
 {
-    nsIntRect rect;
+    LayoutDeviceIntRect rect;
 
     // Generate XPFE resize event
-    GetBoundsUntyped(rect);
+    GetBounds(rect);
 
     rect.width = aEvent->size().width();
     rect.height = aEvent->size().height();
@@ -1366,7 +1370,8 @@ nsWindow::DispatchDeactivateEventOnTopLevelWindow(void)
 }
 
 void
-nsWindow::DispatchResizeEvent(nsIntRect &aRect, nsEventStatus &aStatus)
+nsWindow::DispatchResizeEvent(LayoutDeviceIntRect& aRect,
+                              nsEventStatus& aStatus)
 {
     aStatus = nsEventStatus_eIgnore;
     if (mWidgetListener &&
@@ -1501,9 +1506,8 @@ nsWindow::GetScreenBoundsUntyped(nsIntRect &aRect)
     if (mIsTopLevel) {
         QPoint pos = mWidget->position();
         aRect.MoveTo(pos.x(), pos.y());
-    }
-    else {
-        aRect.MoveTo(WidgetToScreenOffsetUntyped());
+    } else {
+        aRect.MoveTo(WidgetToScreenOffset().ToUnknownPoint());
     }
     LOG(("GetScreenBounds %d %d | %d %d | %d %d\n",
          aRect.x, aRect.y,
diff --git a/widget/qt/nsWindow.h b/widget/qt/nsWindow.h
index 9f7a7ebf3f41..bf193869fd59 100644
--- a/widget/qt/nsWindow.h
+++ b/widget/qt/nsWindow.h
@@ -178,7 +178,8 @@ private:
     void DispatchDeactivateEvent(void);
     void DispatchActivateEventOnTopLevelWindow(void);
     void DispatchDeactivateEventOnTopLevelWindow(void);
-    void DispatchResizeEvent(nsIntRect &aRect, nsEventStatus &aStatus);
+    void DispatchResizeEvent(mozilla::LayoutDeviceIntRect &aRect,
+                             nsEventStatus &aStatus);
 
     // Remember the last sizemode so that we can restore it when
     // leaving fullscreen
diff --git a/widget/windows/IMMHandler.cpp b/widget/windows/IMMHandler.cpp
index ae1afb55dc28..ccde46494004 100644
--- a/widget/windows/IMMHandler.cpp
+++ b/widget/windows/IMMHandler.cpp
@@ -1632,12 +1632,12 @@ IMMHandler::HandleQueryCharPosition(nsWindow* aWindow,
     return false;
   }
 
-  nsIntRect r;
+  LayoutDeviceIntRect r;
   bool ret =
     GetCharacterRectOfSelectedTextAt(aWindow, pCharPosition->dwCharPos, r);
   NS_ENSURE_TRUE(ret, false);
 
-  nsIntRect screenRect;
+  LayoutDeviceIntRect screenRect;
   // We always need top level window that is owner window of the popup window
   // even if the content of the popup window has focus.
   ResolveIMECaretPos(aWindow->GetTopLevelWindow(false),
@@ -1662,10 +1662,10 @@ IMMHandler::HandleQueryCharPosition(nsWindow* aWindow,
       ("IMM: HandleQueryCharPosition, eQueryEditorRect failed"));
     ::GetWindowRect(aWindow->GetWindowHandle(), &pCharPosition->rcDocument);
   } else {
-    nsIntRect editorRectInWindow = editorRect.mReply.mRect.ToUnknownRect();
+    LayoutDeviceIntRect editorRectInWindow = editorRect.mReply.mRect;
     nsWindow* window = editorRect.mReply.mFocusedWidget ?
       static_cast<nsWindow*>(editorRect.mReply.mFocusedWidget) : aWindow;
-    nsIntRect editorRectInScreen;
+    LayoutDeviceIntRect editorRectInScreen;
     ResolveIMECaretPos(window, editorRectInWindow, nullptr, editorRectInScreen);
     ::SetRect(&pCharPosition->rcDocument,
               editorRectInScreen.x, editorRectInScreen.y,
@@ -2094,7 +2094,7 @@ IMMHandler::ConvertToANSIString(const nsAFlatString& aStr,
 bool
 IMMHandler::GetCharacterRectOfSelectedTextAt(nsWindow* aWindow,
                                              uint32_t aOffset,
-                                             nsIntRect& aCharRect,
+                                             LayoutDeviceIntRect& aCharRect,
                                              WritingMode* aWritingMode)
 {
   LayoutDeviceIntPoint point(0, 0);
@@ -2169,7 +2169,7 @@ IMMHandler::GetCharacterRectOfSelectedTextAt(nsWindow* aWindow,
     aWindow->InitEvent(charRect, &point);
     aWindow->DispatchWindowEvent(&charRect);
     if (charRect.mSucceeded) {
-      aCharRect = charRect.mReply.mRect.ToUnknownRect();
+      aCharRect = charRect.mReply.mRect;
       if (aWritingMode) {
         *aWritingMode = charRect.GetWritingMode();
       }
@@ -2188,7 +2188,7 @@ IMMHandler::GetCharacterRectOfSelectedTextAt(nsWindow* aWindow,
 
 bool
 IMMHandler::GetCaretRect(nsWindow* aWindow,
-                         nsIntRect& aCaretRect,
+                         LayoutDeviceIntRect& aCaretRect,
                          WritingMode* aWritingMode)
 {
   LayoutDeviceIntPoint point(0, 0);
@@ -2210,7 +2210,7 @@ IMMHandler::GetCaretRect(nsWindow* aWindow,
       ("IMM: GetCaretRect, FAILED, due to eQueryCaretRect failure"));
     return false;
   }
-  aCaretRect = caretRect.mReply.mRect.ToUnknownRect();
+  aCaretRect = caretRect.mReply.mRect;
   if (aWritingMode) {
     *aWritingMode = caretRect.GetWritingMode();
   }
@@ -2227,20 +2227,20 @@ bool
 IMMHandler::SetIMERelatedWindowsPos(nsWindow* aWindow,
                                     const IMEContext& aContext)
 {
-  nsIntRect r;
+  LayoutDeviceIntRect r;
   // Get first character rect of current a normal selected text or a composing
   // string.
   WritingMode writingMode;
   bool ret = GetCharacterRectOfSelectedTextAt(aWindow, 0, r, &writingMode);
   NS_ENSURE_TRUE(ret, false);
   nsWindow* toplevelWindow = aWindow->GetTopLevelWindow(false);
-  nsIntRect firstSelectedCharRect;
+  LayoutDeviceIntRect firstSelectedCharRect;
   ResolveIMECaretPos(toplevelWindow, r, aWindow, firstSelectedCharRect);
 
   // Set native caret size/position to our caret. Some IMEs honor it. E.g.,
   // "Intelligent ABC" (Simplified Chinese) and "MS PinYin 3.0" (Simplified
   // Chinese) on XP.
-  nsIntRect caretRect(firstSelectedCharRect);
+  LayoutDeviceIntRect caretRect(firstSelectedCharRect);
   if (GetCaretRect(aWindow, r)) {
     ResolveIMECaretPos(toplevelWindow, r, aWindow, caretRect);
   } else {
@@ -2262,7 +2262,7 @@ IMMHandler::SetIMERelatedWindowsPos(nsWindow* aWindow,
       ("IMM: SetIMERelatedWindowsPos, Set candidate window"));
 
     // Get a rect of first character in current target in composition string.
-    nsIntRect firstTargetCharRect, lastTargetCharRect;
+    LayoutDeviceIntRect firstTargetCharRect, lastTargetCharRect;
     if (mIsComposing && !mCompositionString.IsEmpty()) {
       // If there are no targetted selection, we should use it's first character
       // rect instead.
@@ -2296,7 +2296,7 @@ IMMHandler::SetIMERelatedWindowsPos(nsWindow* aWindow,
                        aWindow, firstTargetCharRect);
     ResolveIMECaretPos(toplevelWindow, lastTargetCharRect,
                        aWindow, lastTargetCharRect);
-    nsIntRect targetClauseRect;
+    LayoutDeviceIntRect targetClauseRect;
     targetClauseRect.UnionRect(firstTargetCharRect, lastTargetCharRect);
 
     // Move the candidate window to proper position from the target clause as
@@ -2395,7 +2395,7 @@ IMMHandler::SetIMERelatedWindowsPosOnPlugin(nsWindow* aWindow,
   // composition window cannot be positioned on the edge of client area.
   winRectInScreen.width--;
   winRectInScreen.height--;
-  nsIntRect clippedPluginRect;
+  LayoutDeviceIntRect clippedPluginRect;
   clippedPluginRect.x =
     std::min(std::max(pluginRectInScreen.x, winRectInScreen.x),
              winRectInScreen.XMost());
@@ -2406,7 +2406,7 @@ IMMHandler::SetIMERelatedWindowsPosOnPlugin(nsWindow* aWindow,
   int32_t yMost = std::min(pluginRectInScreen.YMost(), winRectInScreen.YMost());
   clippedPluginRect.width = std::max(0, xMost - clippedPluginRect.x);
   clippedPluginRect.height = std::max(0, yMost - clippedPluginRect.y);
-  clippedPluginRect -= aWindow->WidgetToScreenOffsetUntyped();
+  clippedPluginRect -= aWindow->WidgetToScreenOffset();
 
   // Cover the plugin with native caret.  This prevents IME's window and plugin
   // overlap.
@@ -2435,9 +2435,9 @@ IMMHandler::SetIMERelatedWindowsPosOnPlugin(nsWindow* aWindow,
 
 void
 IMMHandler::ResolveIMECaretPos(nsIWidget* aReferenceWidget,
-                               nsIntRect& aCursorRect,
+                               LayoutDeviceIntRect& aCursorRect,
                                nsIWidget* aNewOriginWidget,
-                               nsIntRect& aOutRect)
+                               LayoutDeviceIntRect& aOutRect)
 {
   aOutRect = aCursorRect;
 
@@ -2445,10 +2445,10 @@ IMMHandler::ResolveIMECaretPos(nsIWidget* aReferenceWidget,
     return;
 
   if (aReferenceWidget)
-    aOutRect.MoveBy(aReferenceWidget->WidgetToScreenOffsetUntyped());
+    aOutRect.MoveBy(aReferenceWidget->WidgetToScreenOffset());
 
   if (aNewOriginWidget)
-    aOutRect.MoveBy(-aNewOriginWidget->WidgetToScreenOffsetUntyped());
+    aOutRect.MoveBy(-aNewOriginWidget->WidgetToScreenOffset());
 }
 
 static void
diff --git a/widget/windows/IMMHandler.h b/widget/windows/IMMHandler.h
index a37a6ebdd72d..1066cf8edc4f 100644
--- a/widget/windows/IMMHandler.h
+++ b/widget/windows/IMMHandler.h
@@ -267,9 +267,9 @@ protected:
    *  @param aOutRect         The converted cursor rect.
    */
   void ResolveIMECaretPos(nsIWidget* aReferenceWidget,
-                          nsIntRect& aCursorRect,
+                          mozilla::LayoutDeviceIntRect& aCursorRect,
                           nsIWidget* aNewOriginWidget,
-                          nsIntRect& aOutRect);
+                          mozilla::LayoutDeviceIntRect& aOutRect);
 
   bool ConvertToANSIString(const nsAFlatString& aStr,
                              UINT aCodePage,
@@ -299,7 +299,7 @@ protected:
   bool GetCharacterRectOfSelectedTextAt(
          nsWindow* aWindow,
          uint32_t aOffset,
-         nsIntRect& aCharRect,
+         mozilla::LayoutDeviceIntRect& aCharRect,
          mozilla::WritingMode* aWritingMode = nullptr);
   /**
    * GetCaretRect() returns caret rect at current selection start.
@@ -313,7 +313,7 @@ protected:
    *                        Otherwise, false.
    */
   bool GetCaretRect(nsWindow* aWindow,
-                    nsIntRect& aCaretRect,
+                    mozilla::LayoutDeviceIntRect& aCaretRect,
                     mozilla::WritingMode* aWritingMode = nullptr);
   void GetCompositionString(const IMEContext& aContext,
                             DWORD aIndex,
diff --git a/widget/windows/nsWindow.cpp b/widget/windows/nsWindow.cpp
index 7c29872c3550..978101f0bd3a 100644
--- a/widget/windows/nsWindow.cpp
+++ b/widget/windows/nsWindow.cpp
@@ -1918,7 +1918,7 @@ NS_METHOD nsWindow::GetBoundsUntyped(nsIntRect &aRect)
       // adjust for chrome
       nsWindow* pWidget = static_cast<nsWindow*>(GetParent());
       if (pWidget && pWidget->IsTopLevelWidget()) {
-        nsIntPoint clientOffset = pWidget->GetClientOffset();
+        LayoutDeviceIntPoint clientOffset = pWidget->GetClientOffset();
         r.left -= clientOffset.x;
         r.top  -= clientOffset.y;
       }
@@ -1940,7 +1940,7 @@ NS_METHOD nsWindow::GetClientBoundsUntyped(nsIntRect &aRect)
 
     nsIntRect bounds;
     GetBoundsUntyped(bounds);
-    aRect.MoveTo(bounds.TopLeft() + GetClientOffset());
+    aRect.MoveTo(bounds.TopLeft() + GetClientOffsetUntyped());
     aRect.width  = r.right - r.left;
     aRect.height = r.bottom - r.top;
 
@@ -1967,10 +1967,10 @@ NS_METHOD nsWindow::GetScreenBoundsUntyped(nsIntRect &aRect)
   return NS_OK;
 }
 
-NS_METHOD nsWindow::GetRestoredBoundsUntyped(nsIntRect &aRect)
+NS_METHOD nsWindow::GetRestoredBounds(LayoutDeviceIntRect &aRect)
 {
   if (SizeMode() == nsSizeMode_Normal) {
-    return GetScreenBoundsUntyped(aRect);
+    return GetScreenBounds(aRect);
   }
   if (!mWnd) {
     return NS_ERROR_FAILURE;
@@ -1995,7 +1995,8 @@ NS_METHOD nsWindow::GetRestoredBoundsUntyped(nsIntRect &aRect)
 
 // return the x,y offset of the client area from the origin
 // of the window. If the window is borderless returns (0,0).
-nsIntPoint nsWindow::GetClientOffset()
+nsIntPoint
+nsWindow::GetClientOffsetUntyped()
 {
   if (!mWnd) {
     return nsIntPoint(0, 0);
@@ -2017,17 +2018,17 @@ nsWindow::SetDrawsInTitlebar(bool aState)
 
   if (aState) {
     // top, right, bottom, left for nsIntMargin
-    nsIntMargin margins(0, -1, -1, -1);
+    LayoutDeviceIntMargin margins(0, -1, -1, -1);
     SetNonClientMargins(margins);
   }
   else {
-    nsIntMargin margins(-1, -1, -1, -1);
+    LayoutDeviceIntMargin margins(-1, -1, -1, -1);
     SetNonClientMargins(margins);
   }
 }
 
 NS_IMETHODIMP
-nsWindow::GetNonClientMargins(nsIntMargin &margins)
+nsWindow::GetNonClientMargins(LayoutDeviceIntMargin &margins)
 {
   nsWindow * window = GetTopLevelWindow(true);
   if (window && window != this) {
@@ -2302,7 +2303,7 @@ nsWindow::UpdateNonClientMargins(int32_t aSizeMode, bool aReflowWindow)
 }
 
 NS_IMETHODIMP
-nsWindow::SetNonClientMargins(nsIntMargin &margins)
+nsWindow::SetNonClientMargins(LayoutDeviceIntMargin &margins)
 {
   if (!mIsTopWidgetWindow ||
       mBorderStyle == eBorderStyle_none)
@@ -3548,7 +3549,7 @@ nsWindow::GetLayerManager(PLayerTransactionChild* aShadowManager,
  **************************************************************/
  
 NS_IMETHODIMP
-nsWindow::OnDefaultButtonLoaded(const nsIntRect &aButtonRect)
+nsWindow::OnDefaultButtonLoaded(const LayoutDeviceIntRect& aButtonRect)
 {
   if (aButtonRect.IsEmpty())
     return NS_OK;
@@ -3571,13 +3572,13 @@ nsWindow::OnDefaultButtonLoaded(const nsIntRect &aButtonRect)
       return NS_OK;
   }
 
-  nsIntRect widgetRect;
-  nsresult rv = GetScreenBoundsUntyped(widgetRect);
+  LayoutDeviceIntRect widgetRect;
+  nsresult rv = GetScreenBounds(widgetRect);
   NS_ENSURE_SUCCESS(rv, rv);
-  nsIntRect buttonRect(aButtonRect + widgetRect.TopLeft());
+  LayoutDeviceIntRect buttonRect(aButtonRect + widgetRect.TopLeft());
 
-  nsIntPoint centerOfButton(buttonRect.x + buttonRect.width / 2,
-                            buttonRect.y + buttonRect.height / 2);
+  LayoutDeviceIntPoint centerOfButton(buttonRect.x + buttonRect.width / 2,
+                                      buttonRect.y + buttonRect.height / 2);
   // The center of the button can be outside of the widget.
   // E.g., it could be hidden by scrolling.
   if (!widgetRect.Contains(centerOfButton)) {
@@ -6530,8 +6531,8 @@ nsWindow::ConfigureChildren(const nsTArray<Configuration>& aConfigurations)
                  "Configured widget is not a child");
     nsresult rv = w->SetWindowClipRegion(configuration.mClipRegion, true);
     NS_ENSURE_SUCCESS(rv, rv);
-    nsIntRect bounds;
-    w->GetBoundsUntyped(bounds);
+    LayoutDeviceIntRect bounds;
+    w->GetBounds(bounds);
     if (bounds.Size() != configuration.mBounds.Size()) {
       w->Resize(configuration.mBounds.x, configuration.mBounds.y,
                 configuration.mBounds.width, configuration.mBounds.height,
@@ -6547,7 +6548,7 @@ nsWindow::ConfigureChildren(const nsTArray<Configuration>& aConfigurations)
         // plugin window that might be touched by moving content somehow. The
         // underlying problem should be found and fixed!
         nsIntRegion r;
-        r.Sub(bounds, configuration.mBounds);
+        r.Sub(bounds.ToUnknownRect(), configuration.mBounds.ToUnknownRect());
         r.MoveBy(-bounds.x,
                  -bounds.y);
         nsIntRect toInvalidate = r.GetBounds();
diff --git a/widget/windows/nsWindow.h b/widget/windows/nsWindow.h
index 457a41bb9f20..122735eea1ab 100644
--- a/widget/windows/nsWindow.h
+++ b/widget/windows/nsWindow.h
@@ -118,9 +118,9 @@ public:
   NS_IMETHOD              SetFocus(bool aRaise);
   NS_IMETHOD              GetBoundsUntyped(nsIntRect &aRect);
   NS_IMETHOD              GetScreenBoundsUntyped(nsIntRect &aRect);
-  NS_IMETHOD              GetRestoredBoundsUntyped(nsIntRect &aRect) override;
+  NS_IMETHOD              GetRestoredBounds(mozilla::LayoutDeviceIntRect &aRect) override;
   NS_IMETHOD              GetClientBoundsUntyped(nsIntRect &aRect);
-  virtual nsIntPoint      GetClientOffset();
+  virtual nsIntPoint      GetClientOffsetUntyped() override;
   void                    SetBackgroundColor(const nscolor &aColor);
   NS_IMETHOD              SetCursor(imgIContainer* aCursor,
                                     uint32_t aHotspotX, uint32_t aHotspotY);
@@ -156,7 +156,7 @@ public:
                                           LayersBackend aBackendHint = mozilla::layers::LayersBackend::LAYERS_NONE,
                                           LayerManagerPersistence aPersistence = LAYER_MANAGER_CURRENT,
                                           bool* aAllowRetaining = nullptr);
-  NS_IMETHOD              OnDefaultButtonLoaded(const nsIntRect &aButtonRect);
+  NS_IMETHOD              OnDefaultButtonLoaded(const mozilla::LayoutDeviceIntRect& aButtonRect) override;
   NS_IMETHOD              OverrideSystemMouseScrollSpeed(double aOriginalDeltaX,
                                                          double aOriginalDeltaY,
                                                          double& aOverriddenDeltaX,
@@ -195,8 +195,10 @@ public:
   virtual void            UpdateOpaqueRegion(const nsIntRegion& aOpaqueRegion);
 #endif // MOZ_XUL
   virtual nsIMEUpdatePreference GetIMEUpdatePreference();
-  NS_IMETHOD              GetNonClientMargins(nsIntMargin &margins);
-  NS_IMETHOD              SetNonClientMargins(nsIntMargin &margins);
+  NS_IMETHOD              GetNonClientMargins(
+                            mozilla::LayoutDeviceIntMargin &margins) override;
+  NS_IMETHOD              SetNonClientMargins(
+                            mozilla::LayoutDeviceIntMargin &margins) override;
   void                    SetDrawsInTitlebar(bool aState);
   already_AddRefed<mozilla::gfx::DrawTarget> StartRemoteDrawing() override;
   virtual void            EndRemoteDrawing() override;
@@ -515,11 +517,11 @@ protected:
 
   // Non-client margin settings
   // Pre-calculated outward offset applied to default frames
-  nsIntMargin           mNonClientOffset;
+  mozilla::LayoutDeviceIntMargin mNonClientOffset;
   // Margins set by the owner
-  nsIntMargin           mNonClientMargins;
+  mozilla::LayoutDeviceIntMargin mNonClientMargins;
   // Margins we'd like to set once chrome is reshown:
-  nsIntMargin           mFutureMarginsOnceChromeShows;
+  mozilla::LayoutDeviceIntMargin mFutureMarginsOnceChromeShows;
   // Indicates we need to apply margins once toggling chrome into showing:
   bool                  mFutureMarginsToUse;
 
diff --git a/xpfe/appshell/nsXULWindow.cpp b/xpfe/appshell/nsXULWindow.cpp
index 1925f937c1f8..f236b710ac94 100644
--- a/xpfe/appshell/nsXULWindow.cpp
+++ b/xpfe/appshell/nsXULWindow.cpp
@@ -1428,7 +1428,8 @@ void nsXULWindow::SyncAttributesToWidget()
   nsIntMargin margins;
   windowElement->GetAttribute(NS_LITERAL_STRING("chromemargin"), attr);
   if (nsContentUtils::ParseIntMarginValue(attr, margins)) {
-    mWindow->SetNonClientMargins(margins);
+    LayoutDeviceIntMargin tmp = LayoutDeviceIntMargin::FromUnknownMargin(margins);
+    mWindow->SetNonClientMargins(tmp);
   }
 
   // "windowtype" attribute