diff --git a/browser/fuel/src/fuelApplication.js b/browser/fuel/src/fuelApplication.js
index c7b0c9a067cd..623694bb7660 100644
--- a/browser/fuel/src/fuelApplication.js
+++ b/browser/fuel/src/fuelApplication.js
@@ -20,6 +20,12 @@ var Utilities = {
     return this.bookmarks;
   },
 
+  get bookmarksObserver() {
+    let bookmarksObserver = new BookmarksObserver();
+    this.__defineGetter__("bookmarksObserver", function() bookmarksObserver);
+    return this.bookmarksObserver;
+  },
+
   get livemarks() {
     let livemarks = Cc["@mozilla.org/browser/livemark-service;2"].
                     getService[Ci.mozIAsyncLivemarks].
@@ -49,15 +55,16 @@ var Utilities = {
     return this.windowMediator;
   },
 
-  makeURI : function(aSpec) {
+  makeURI: function fuelutil_makeURI(aSpec) {
     if (!aSpec)
       return null;
     var ios = Cc["@mozilla.org/network/io-service;1"].getService(Ci.nsIIOService);
     return ios.newURI(aSpec, null, null);
   },
 
-  free : function() {
+  free: function fuelutil_free() {
     delete this.bookmarks;
+    delete this.bookmarksObserver;
     delete this.livemarks
     delete this.annotations;
     delete this.history;
@@ -68,19 +75,26 @@ var Utilities = {
 
 //=================================================
 // Window implementation
+
+var fuelWindowMap = new WeakMap();
+function getWindow(aWindow) {
+  let fuelWindow = fuelWindowMap.get(aWindow);
+  if (!fuelWindow) {
+    fuelWindow = new Window(aWindow);
+    fuelWindowMap.set(aWindow, fuelWindow);
+  }
+  return fuelWindow;
+}
+
+// Don't call new Window() directly; use getWindow instead.
 function Window(aWindow) {
   this._window = aWindow;
-  this._tabbrowser = aWindow.getBrowser();
   this._events = new Events();
-  this._cleanup = {};
 
   this._watch("TabOpen");
   this._watch("TabMove");
   this._watch("TabClose");
   this._watch("TabSelect");
-
-  var self = this;
-  gShutdown.push(function() { self._shutdown(); });
 }
 
 Window.prototype = {
@@ -88,65 +102,75 @@ Window.prototype = {
     return this._events;
   },
 
+  get _tabbrowser() {
+    return this._window.getBrowser();
+  },
+
   /*
    * Helper used to setup event handlers on the XBL element. Note that the events
    * are actually dispatched to tabs, so we capture them.
    */
-  _watch : function win_watch(aType) {
-    var self = this;
-    this._tabbrowser.tabContainer.addEventListener(aType,
-      this._cleanup[aType] = function(e){ self._event(e); },
-      true);
+  _watch: function win_watch(aType) {
+    this._tabbrowser.tabContainer.addEventListener(aType, this,
+                                                   /* useCapture = */ true);
   },
 
-  /*
-   * Helper event callback used to redirect events made on the XBL element
-   */
-  _event : function win_event(aEvent) {
-    this._events.dispatch(aEvent.type, new BrowserTab(this, aEvent.originalTarget.linkedBrowser));
+  handleEvent: function win_handleEvent(aEvent) {
+    this._events.dispatch(aEvent.type, getBrowserTab(this, aEvent.originalTarget.linkedBrowser));
   },
+
   get tabs() {
     var tabs = [];
     var browsers = this._tabbrowser.browsers;
     for (var i=0; i<browsers.length; i++)
-      tabs.push(new BrowserTab(this, browsers[i]));
+      tabs.push(getBrowserTab(this, browsers[i]));
     return tabs;
   },
+
   get activeTab() {
-    return new BrowserTab(this, this._tabbrowser.selectedBrowser);
-  },
-  open : function win_open(aURI) {
-    return new BrowserTab(this, this._tabbrowser.addTab(aURI.spec).linkedBrowser);
-  },
-  _shutdown : function win_shutdown() {
-    for (var type in this._cleanup)
-      this._tabbrowser.removeEventListener(type, this._cleanup[type], true);
-    this._cleanup = null;
-
-    this._window = null;
-    this._tabbrowser = null;
-    this._events = null;
+    return getBrowserTab(this, this._tabbrowser.selectedBrowser);
   },
 
-  QueryInterface : XPCOMUtils.generateQI([Ci.fuelIWindow])
+  open: function win_open(aURI) {
+    return getBrowserTab(this, this._tabbrowser.addTab(aURI.spec).linkedBrowser);
+  },
+
+  QueryInterface: XPCOMUtils.generateQI([Ci.fuelIWindow])
 };
 
 //=================================================
 // BrowserTab implementation
+
+var fuelBrowserTabMap = new WeakMap();
+function getBrowserTab(aFUELWindow, aBrowser) {
+  let fuelBrowserTab = fuelBrowserTabMap.get(aBrowser);
+  if (!fuelBrowserTab) {
+    fuelBrowserTab = new BrowserTab(aFUELWindow, aBrowser);
+    fuelBrowserTabMap.set(aBrowser, fuelBrowserTab);
+  }
+  else {
+    // This tab may have moved to another window, so make sure its cached
+    // window is up-to-date.
+    fuelBrowserTab._window = aFUELWindow;
+  }
+
+  return fuelBrowserTab;
+}
+
+// Don't call new BrowserTab() directly; call getBrowserTab instead.
 function BrowserTab(aFUELWindow, aBrowser) {
   this._window = aFUELWindow;
-  this._tabbrowser = aFUELWindow._tabbrowser;
   this._browser = aBrowser;
   this._events = new Events();
-  this._cleanup = {};
 
   this._watch("load");
-
-  var self = this;
-  gShutdown.push(function() { self._shutdown(); });
 }
 
 BrowserTab.prototype = {
+  get _tabbrowser() {
+    return this._window._tabbrowser;
+  },
+
   get uri() {
     return this._browser.currentURI;
   },
@@ -175,17 +199,12 @@ BrowserTab.prototype = {
   /*
    * Helper used to setup event handlers on the XBL element
    */
-  _watch : function bt_watch(aType) {
-    var self = this;
-    this._browser.addEventListener(aType,
-      this._cleanup[aType] = function(e){ self._event(e); },
-      true);
+  _watch: function bt_watch(aType) {
+    this._browser.addEventListener(aType, this,
+                                   /* useCapture = */ true);
   },
 
-  /*
-   * Helper event callback used to redirect events made on the XBL element
-   */
-  _event : function bt_event(aEvent) {
+  handleEvent: function bt_handleEvent(aEvent) {
     if (aEvent.type == "load") {
       if (!(aEvent.originalTarget instanceof Ci.nsIDOMDocument))
         return;
@@ -199,44 +218,33 @@ BrowserTab.prototype = {
   /*
    * Helper used to determine the index offset of the browsertab
    */
-  _getTab : function bt_gettab() {
+  _getTab: function bt_gettab() {
     var tabs = this._tabbrowser.tabs;
     return tabs[this.index] || null;
   },
 
-  load : function bt_load(aURI) {
+  load: function bt_load(aURI) {
     this._browser.loadURI(aURI.spec, null, null);
   },
 
-  focus : function bt_focus() {
+  focus: function bt_focus() {
     this._tabbrowser.selectedTab = this._getTab();
     this._tabbrowser.focus();
   },
 
-  close : function bt_close() {
+  close: function bt_close() {
     this._tabbrowser.removeTab(this._getTab());
   },
 
-  moveBefore : function bt_movebefore(aBefore) {
+  moveBefore: function bt_movebefore(aBefore) {
     this._tabbrowser.moveTabTo(this._getTab(), aBefore.index);
   },
 
-  moveToEnd : function bt_moveend() {
+  moveToEnd: function bt_moveend() {
     this._tabbrowser.moveTabTo(this._getTab(), this._tabbrowser.browsers.length);
   },
 
-  _shutdown : function bt_shutdown() {
-    for (var type in this._cleanup)
-      this._browser.removeEventListener(type, this._cleanup[type], true);
-    this._cleanup = null;
-
-    this._window = null;
-    this._tabbrowser = null;
-    this._browser = null;
-    this._events = null;
-  },
-
-  QueryInterface : XPCOMUtils.generateQI([Ci.fuelIBrowserTab])
+  QueryInterface: XPCOMUtils.generateQI([Ci.fuelIBrowserTab])
 };
 
 
@@ -251,52 +259,177 @@ Annotations.prototype = {
     return Utilities.annotations.getItemAnnotationNames(this._id);
   },
 
-  has : function ann_has(aName) {
+  has: function ann_has(aName) {
     return Utilities.annotations.itemHasAnnotation(this._id, aName);
   },
 
-  get : function(aName) {
+  get: function ann_get(aName) {
     if (this.has(aName))
       return Utilities.annotations.getItemAnnotation(this._id, aName);
     return null;
   },
 
-  set : function(aName, aValue, aExpiration) {
+  set: function ann_set(aName, aValue, aExpiration) {
     Utilities.annotations.setItemAnnotation(this._id, aName, aValue, 0, aExpiration);
   },
 
-  remove : function ann_remove(aName) {
+  remove: function ann_remove(aName) {
     if (aName)
       Utilities.annotations.removeItemAnnotation(this._id, aName);
   },
 
-  QueryInterface : XPCOMUtils.generateQI([Ci.fuelIAnnotations])
+  QueryInterface: XPCOMUtils.generateQI([Ci.fuelIAnnotations])
 };
 
 
+//=================================================
+// BookmarksObserver implementation (internal class)
+//
+// BookmarksObserver is a global singleton which watches the browser's
+// bookmarks and sends you events when things change.
+//
+// You can register three different kinds of event listeners on
+// BookmarksObserver, using addListener, addFolderListener, and
+// addRootlistener.
+//
+//  - addListener(aId, aEvent, aListener) lets you listen to a specific
+//    bookmark.  You can listen to the "change", "move", and "remove" events.
+//
+//  - addFolderListener(aId, aEvent, aListener) lets you listen to a specific
+//    bookmark folder.  You can listen to "addchild" and "removechild".
+//
+//  - addRootListener(aEvent, aListener) lets you listen to the root bookmark
+//    node.  This lets you hear "add", "remove", and "change" events on all
+//    bookmarks.
+//
+
+function BookmarksObserver() {
+  this._eventsDict = {};
+  this._folderEventsDict = {};
+  this._rootEvents = new Events();
+  Utilities.bookmarks.addObserver(this, /* ownsWeak = */ true);
+}
+
+BookmarksObserver.prototype = {
+  onBeginUpdateBatch: function () {},
+  onEndUpdateBatch: function () {},
+  onBeforeItemRemoved: function () {},
+  onItemVisited: function () {},
+
+  onItemAdded: function bo_onItemAdded(aId, aFolder, aIndex, aItemType, aURI) {
+    this._rootEvents.dispatch("add", aId);
+    this._dispatchToEvents("addchild", aId, this._folderEventsDict[aFolder]);
+  },
+
+  onItemRemoved: function bo_onItemRemoved(aId, aFolder, aIndex) {
+    this._rootEvents.dispatch("remove", aId);
+    this._dispatchToEvents("remove", aId, this._eventsDict[aId]);
+    this._dispatchToEvents("removechild", aId, this._folderEventsDict[aFolder]);
+  },
+
+  onItemChanged: function bo_onItemChanged(aId, aProperty, aIsAnnotationProperty, aValue) {
+    this._rootEvents.dispatch("change", aProperty);
+    this._dispatchToEvents("change", aProperty, this._eventsDict[aId]);
+  },
+
+  onItemMoved: function bo_onItemMoved(aId, aOldParent, aOldIndex, aNewParent, aNewIndex) {
+    this._dispatchToEvents("move", aId, this._eventsDict[aId]);
+  },
+
+  _dispatchToEvents: function bo_dispatchToEvents(aEvent, aData, aEvents) {
+    if (aEvents) {
+      aEvents.dispatch(aEvent, aData);
+    }
+  },
+
+  _addListenerToDict: function bo_addListenerToDict(aId, aEvent, aListener, aDict) {
+    var events = aDict[aId];
+    if (!events) {
+      events = new Events();
+      aDict[aId] = events;
+    }
+    events.addListener(aEvent, aListener);
+  },
+
+  _removeListenerFromDict: function bo_removeListenerFromDict(aId, aEvent, aListener, aDict) {
+    var events = aDict[aId];
+    if (!events) {
+      return;
+    }
+    events.removeListener(aEvent, aListener);
+    if (events._listeners.length == 0) {
+      delete aDict[aId];
+    }
+  },
+
+  addListener: function bo_addListener(aId, aEvent, aListener) {
+    this._addListenerToDict(aId, aEvent, aListener, this._eventsDict);
+  },
+
+  removeListener: function bo_removeListener(aId, aEvent, aListener) {
+    this._removeListenerFromDict(aId, aEvent, aListener, this._eventsDict);
+  },
+
+  addFolderListener: function addFolderListener(aId, aEvent, aListener) {
+    this._addListenerToDict(aId, aEvent, aListener, this._folderEventsDict);
+  },
+
+  removeFolderListener: function removeFolderListener(aId, aEvent, aListener) {
+    this._removeListenerFromDict(aId, aEvent, aListener, this._folderEventsDict);
+  },
+
+  addRootListener: function addRootListener(aEvent, aListener) {
+    this._rootEvents.addListener(aEvent, aListener);
+  },
+
+  removeRootListener: function removeRootListener(aEvent, aListener) {
+    this._rootEvents.removeListener(aEvent, aListener);
+  },
+
+  QueryInterface: XPCOMUtils.generateQI([Ci.nsINavBookmarksObserver,
+                                         Ci.nsISupportsWeakReference])
+};
+
 //=================================================
 // Bookmark implementation
+//
+// Bookmark event listeners are stored in BookmarksObserver, not in the
+// Bookmark objects themselves.  Thus, you don't have to hold on to a Bookmark
+// object in order for your event listener to stay valid, and Bookmark objects
+// not kept alive by the extension can be GC'ed.
+//
+// A consequence of this is that if you have two different Bookmark objects x
+// and y for the same bookmark (i.e., x != y but x.id == y.id), and you do
+//
+//   x.addListener("foo", fun);
+//   y.removeListener("foo", fun);
+//
+// the second line will in fact remove the listener added in the first line.
+//
+
 function Bookmark(aId, aParent, aType) {
   this._id = aId;
   this._parent = aParent;
   this._type = aType || "bookmark";
   this._annotations = new Annotations(this._id);
-  this._events = new Events();
-
-  Utilities.bookmarks.addObserver(this, false);
 
+  // Our _events object forwards to bookmarksObserver.
   var self = this;
-  gShutdown.push(function() { self._shutdown(); });
+  this._events = {
+    addListener: function bookmarkevents_al(aEvent, aListener) {
+      Utilities.bookmarksObserver.addListener(self._id, aEvent, aListener);
+    },
+    removeListener: function bookmarkevents_rl(aEvent, aListener) {
+      Utilities.bookmarksObserver.removeListener(self._id, aEvent, aListener);
+    },
+    QueryInterface: XPCOMUtils.generateQI([Ci.extIEvents])
+  };
+
+  // For our onItemMoved listener, which updates this._parent.
+  Utilities.bookmarks.addObserver(this, /* ownsWeak = */ true);
 }
 
 Bookmark.prototype = {
-  _shutdown : function bm_shutdown() {
-    this._annotations = null;
-    this._events = null;
-
-    Utilities.bookmarks.removeObserver(this);
-  },
-
   get id() {
     return this._id;
   },
@@ -358,66 +491,86 @@ Bookmark.prototype = {
     Utilities.bookmarks.removeItem(this._id);
   },
 
-  // observer
-  onBeginUpdateBatch : function bm_obub() {
-  },
+  onBeginUpdateBatch: function () {},
+  onEndUpdateBatch: function () {},
+  onItemAdded: function () {},
+  onBeforeItemRemoved: function () {},
+  onItemVisited: function () {},
+  onItemRemoved: function () {},
+  onItemChanged: function () {},
 
-  onEndUpdateBatch : function bm_oeub() {
-  },
-
-  onItemAdded : function bm_oia(aId, aFolder, aIndex, aItemType, aURI) {
-    // bookmark object doesn't exist at this point
-  },
-
-  onBeforeItemRemoved : function bm_obir(aId) {
-  },
-
-  onItemRemoved : function bm_oir(aId, aFolder, aIndex) {
-    if (this._id == aId)
-      this._events.dispatch("remove", aId);
-  },
-
-  onItemChanged : function bm_oic(aId, aProperty, aIsAnnotationProperty, aValue) {
-    if (this._id == aId)
-      this._events.dispatch("change", aProperty);
-  },
-
-  onItemVisited: function bm_oiv(aId, aVisitID, aTime) {
-  },
-
-  onItemMoved: function bm_oim(aId, aOldParent, aOldIndex, aNewParent, aNewIndex) {
-    if (this._id == aId) {
+  onItemMoved: function(aId, aOldParent, aOldIndex, aNewParent, aNewIndex) {
+    if (aId == this._id) {
       this._parent = new BookmarkFolder(aNewParent, Utilities.bookmarks.getFolderIdForItem(aNewParent));
-      this._events.dispatch("move", aId);
     }
   },
 
-  QueryInterface : XPCOMUtils.generateQI([Ci.fuelIBookmark, Ci.nsINavBookmarkObserver])
+  QueryInterface: XPCOMUtils.generateQI([Ci.fuelIBookmark,
+                                         Ci.nsINavBookmarksObserver,
+                                         Ci.nsISupportsWeakReference])
 };
 
 
 //=================================================
 // BookmarkFolder implementation
+//
+// As with Bookmark, events on BookmarkFolder are handled by the
+// BookmarksObserver singleton.
+//
+
 function BookmarkFolder(aId, aParent) {
   this._id = aId;
   this._parent = aParent;
   this._annotations = new Annotations(this._id);
-  this._events = new Events();
 
-  Utilities.bookmarks.addObserver(this, false);
+  // Our event listeners are handled by the BookmarksObserver singleton.  This
+  // is a bit complicated because there are three different kinds of events we
+  // might want to listen to here:
+  //
+  //  - If this._parent is null, we're the root bookmark folder, and all our
+  //    listeners should be root listeners.
+  //
+  //  - Otherwise, events ending with "child" (addchild, removechild) are
+  //    handled by a folder listener.
+  //
+  //  - Other events are handled by a vanilla bookmark listener.
 
   var self = this;
-  gShutdown.push(function() { self._shutdown(); });
+  this._events = {
+    addListener: function bmfevents_al(aEvent, aListener) {
+      if (self._parent) {
+        if (/child$/.test(aEvent)) {
+          Utilities.bookmarksObserver.addFolderListener(self._id, aEvent, aListener);
+        }
+        else {
+          Utilities.bookmarksObserver.addListener(self._id, aEvent, aListener);
+        }
+      }
+      else {
+        Utilities.bookmarksObserver.addRootListener(aEvent, aListener);
+      }
+    },
+    removeListener: function bmfevents_rl(aEvent, aListener) {
+      if (self._parent) {
+        if (/child$/.test(aEvent)) {
+          Utilities.bookmarksObserver.removeFolderListener(self._id, aEvent, aListener);
+        }
+        else {
+          Utilities.bookmarksObserver.removeListener(self._id, aEvent, aListener);
+        }
+      }
+      else {
+        Utilities.bookmarksObserver.removeRootListener(aEvent, aListener);
+      }
+    },
+    QueryInterface: XPCOMUtils.generateQI([Ci.extIEvents])
+  };
+
+  // For our onItemMoved listener, which updates this._parent.
+  Utilities.bookmarks.addObserver(this, /* ownsWeak = */ true);
 }
 
 BookmarkFolder.prototype = {
-  _shutdown : function bmf_shutdown() {
-    this._annotations = null;
-    this._events = null;
-
-    Utilities.bookmarks.removeObserver(this);
-  },
-
   get id() {
     return this._id;
   },
@@ -489,93 +642,53 @@ BookmarkFolder.prototype = {
     return items;
   },
 
-  addBookmark : function bmf_addbm(aTitle, aUri) {
+  addBookmark: function bmf_addbm(aTitle, aUri) {
     var newBookmarkID = Utilities.bookmarks.insertBookmark(this._id, aUri, Utilities.bookmarks.DEFAULT_INDEX, aTitle);
     var newBookmark = new Bookmark(newBookmarkID, this, "bookmark");
     return newBookmark;
   },
 
-  addSeparator : function bmf_addsep() {
+  addSeparator: function bmf_addsep() {
     var newBookmarkID = Utilities.bookmarks.insertSeparator(this._id, Utilities.bookmarks.DEFAULT_INDEX);
     var newBookmark = new Bookmark(newBookmarkID, this, "separator");
     return newBookmark;
   },
 
-  addFolder : function bmf_addfolder(aTitle) {
+  addFolder: function bmf_addfolder(aTitle) {
     var newFolderID = Utilities.bookmarks.createFolder(this._id, aTitle, Utilities.bookmarks.DEFAULT_INDEX);
     var newFolder = new BookmarkFolder(newFolderID, this);
     return newFolder;
   },
 
-  remove : function bmf_remove() {
+  remove: function bmf_remove() {
     Utilities.bookmarks.removeItem(this._id);
   },
 
   // observer
-  onBeginUpdateBatch : function bmf_obub() {
-  },
+  onBeginUpdateBatch: function () {},
+  onEndUpdateBatch : function () {},
+  onItemAdded : function () {},
+  onBeforeItemRemoved : function () {},
+  onItemRemoved : function () {},
+  onItemChanged : function () {},
 
-  onEndUpdateBatch : function bmf_oeub() {
-  },
-
-  onItemAdded : function bmf_oia(aId, aFolder, aIndex, aItemType, aURI) {
-    // handle root folder events
-    if (!this._parent)
-      this._events.dispatch("add", aId);
-
-    // handle this folder events
-    if (this._id == aFolder)
-      this._events.dispatch("addchild", aId);
-  },
-
-  onBeforeItemRemoved : function bmf_oir(aId) {
-  },
-
-  onItemRemoved : function bmf_oir(aId, aFolder, aIndex) {
-    // handle root folder events
-    if (!this._parent || this._id == aId)
-      this._events.dispatch("remove", aId);
-
-    // handle this folder events
-    if (this._id == aFolder)
-      this._events.dispatch("removechild", aId);
-  },
-
-  onItemChanged : function bmf_oic(aId, aProperty, aIsAnnotationProperty, aValue) {
-    // handle root folder and this folder events
-    if (!this._parent || this._id == aId)
-      this._events.dispatch("change", aProperty);
-  },
-
-  onItemVisited: function bmf_oiv(aId, aVisitID, aTime) {
-  },
-
-  onItemMoved: function bmf_oim(aId, aOldParent, aOldIndex, aNewParent, aNewIndex) {
-    // handle this folder event, root folder cannot be moved
+  onItemMoved: function bf_onItemMoved(aId, aOldParent, aOldIndex, aNewParent, aNewIndex) {
     if (this._id == aId) {
       this._parent = new BookmarkFolder(aNewParent, Utilities.bookmarks.getFolderIdForItem(aNewParent));
-      this._events.dispatch("move", aId);
     }
   },
 
-  QueryInterface : XPCOMUtils.generateQI([Ci.fuelIBookmarkFolder, Ci.nsINavBookmarkObserver])
+  QueryInterface: XPCOMUtils.generateQI([Ci.fuelIBookmarkFolder,
+                                         Ci.nsINavBookmarksObserver,
+                                         Ci.nsISupportsWeakReference])
 };
 
 //=================================================
 // BookmarkRoots implementation
 function BookmarkRoots() {
-  var self = this;
-  gShutdown.push(function() { self._shutdown(); });
 }
 
 BookmarkRoots.prototype = {
-  _shutdown : function bmr_shutdown() {
-    this._menu = null;
-    this._toolbar = null;
-    this._tags = null;
-    this._unfiled = null;
-  },
-
   get menu() {
     if (!this._menu)
       this._menu = new BookmarkFolder(Utilities.bookmarks.bookmarksMenuFolder, null);
@@ -604,7 +717,7 @@ BookmarkRoots.prototype = {
     return this._unfiled;
   },
 
-  QueryInterface : XPCOMUtils.generateQI([Ci.fuelIBookmarkRoots])
+  QueryInterface: XPCOMUtils.generateQI([Ci.fuelIBookmarkRoots])
 };
 
 
@@ -632,21 +745,20 @@ var ApplicationFactory = {
 // Application constructor
 function Application() {
   this.initToolkitHelpers();
-  this._bookmarks = null;
 }
 
 //=================================================
 // Application implementation
 Application.prototype = {
   // for nsIClassInfo + XPCOMUtils
-  classID:          APPLICATION_CID,
+  classID: APPLICATION_CID,
 
   // redefine the default factory for XPCOMUtils
   _xpcom_factory: ApplicationFactory,
 
   // for nsISupports
-  QueryInterface : XPCOMUtils.generateQI([Ci.fuelIApplication, Ci.extIApplication,
-                                          Ci.nsIObserver]),
+  QueryInterface: XPCOMUtils.generateQI([Ci.fuelIApplication, Ci.extIApplication,
+                                         Ci.nsIObserver, Ci.nsISupportsWeakReference]),
 
   // for nsIClassInfo
   classInfo: XPCOMUtils.generateCI({classID: APPLICATION_CID,
@@ -662,7 +774,6 @@ Application.prototype = {
     this.__proto__.__proto__.observe.call(this, aSubject, aTopic, aData);
     if (aTopic == "xpcom-shutdown") {
       this._obs.removeObserver(this, "xpcom-shutdown");
-      this._bookmarks = null;
       Utilities.free();
     }
   },
@@ -678,13 +789,13 @@ Application.prototype = {
     var browserEnum = Utilities.windowMediator.getEnumerator("navigator:browser");
 
     while (browserEnum.hasMoreElements())
-      win.push(new Window(browserEnum.getNext()));
+      win.push(getWindow(browserEnum.getNext()));
 
     return win;
   },
 
   get activeWindow() {
-    return new Window(Utilities.windowMediator.getMostRecentWindow("navigator:browser"));
+    return getWindow(Utilities.windowMediator.getMostRecentWindow("navigator:browser"));
   }
 };
 
diff --git a/browser/fuel/test/browser_ApplicationPrefs.js b/browser/fuel/test/browser_ApplicationPrefs.js
index e88bc22828df..6e100a98364d 100644
--- a/browser/fuel/test/browser_ApplicationPrefs.js
+++ b/browser/fuel/test/browser_ApplicationPrefs.js
@@ -148,9 +148,6 @@ function test() {
   pref.locked = false;
   ok(!pref.locked, "A single preference is unlocked.");
 
-  // Preference events tests disabled until bug 533290 is fixed
-  return;
-
   // check for change event when setting a value
   waitForExplicitFinish();
   Application.prefs.events.addListener("change", onPrefChange);
@@ -177,4 +174,6 @@ function onPrefChange2(evt) {
   finish();
 }
 
-function onPrefChangeDummy(evt) { }
+function onPrefChangeDummy(evt) {
+  ok(false, "onPrefChangeDummy shouldn't be invoked!");
+}
diff --git a/browser/fuel/test/browser_Bookmarks.js b/browser/fuel/test/browser_Bookmarks.js
index 0aa0ab28d928..d096f7b19dc5 100644
--- a/browser/fuel/test/browser_Bookmarks.js
+++ b/browser/fuel/test/browser_Bookmarks.js
@@ -1,5 +1,6 @@
 var gLastFolderAction = "";
 var gLastBookmarkAction = "";
+var gLastRootAction = "";
 
 function url(spec) {
   return Services.io.newURI(spec, null, null);
@@ -187,6 +188,24 @@ function test() {
   testFolderA.parent = testFolderB;
   is(testFolderA.parent.title, "folder-b", "Checking for new parent after moving folder");
   is(gLastFolderAction, "move", "Checking for event handler after moving folder");
+
+  // test events on the root
+  root.events.addListener("add", onRootAdd);
+  root.events.addListener("remove", onRootRemove);
+  root.events.addListener("change", onRootChange);
+  var testFolderC = root.addFolder("folder-c");
+  is(gLastRootAction, "add");
+
+  root.events.removeListener("add", onRootAdd);
+  gLastRootAction = "";
+  var testFolderD = root.addFolder("folder-d");
+  is(gLastRootAction, "");
+
+  testFolderC.remove();
+  is(gLastRootAction, "remove");
+
+  testFolderD.description = "Foo";
+  is(gLastRootAction, "bookmarkProperties/description");
 }
 
 function onFolderChange(evt) {
@@ -220,3 +239,15 @@ function onBookmarkRemove(evt) {
 function onBookmarkMove(evt) {
   gLastBookmarkAction = evt.type;
 }
+
+function onRootAdd(evt) {
+  gLastRootAction = evt.type;
+}
+
+function onRootRemove(evt) {
+  gLastRootAction = evt.type;
+}
+
+function onRootChange(evt) {
+  gLastRootAction = evt.data;
+}
diff --git a/build/mobile/sutagent/android/DoCommand.java b/build/mobile/sutagent/android/DoCommand.java
index a5e9a7dade1d..205182ed9b7e 100755
--- a/build/mobile/sutagent/android/DoCommand.java
+++ b/build/mobile/sutagent/android/DoCommand.java
@@ -2380,45 +2380,32 @@ private void CancelNotification()
 
     public String KillProcess(String sProcName, OutputStream out)
         {
-        String sTmp = "";
-        String sCmd = "kill";
-
         String sRet = sErrorPrefix + "Unable to kill " + sProcName + "\n";
         ActivityManager aMgr = (ActivityManager) contextWrapper.getSystemService(Activity.ACTIVITY_SERVICE);
         List <ActivityManager.RunningAppProcessInfo> lProcesses = aMgr.getRunningAppProcesses();
         int lcv = 0;
-        String strProcName = "";
-        int    nPID = 0;
+        String sFoundProcName = "";
         int nProcs = 0;
+        boolean bFoundAppProcess = false;
 
-        if (lProcesses != null) 
+        if (lProcesses != null)
             nProcs = lProcesses.size();
 
         for (lcv = 0; lcv < nProcs; lcv++)
             {
             if (lProcesses.get(lcv).processName.contains(sProcName))
                 {
-                strProcName = lProcesses.get(lcv).processName;
-                nPID = lProcesses.get(lcv).pid;
-                sRet = sErrorPrefix + "Failed to kill " + nPID + " " + strProcName + "\n";
-
-                sCmd += " " + nPID;
+                sFoundProcName = lProcesses.get(lcv).processName;
+                bFoundAppProcess = true;
 
                 try
                     {
-                    pProc = Runtime.getRuntime().exec(this.getSuArgs(sCmd));
+                    pProc = Runtime.getRuntime().exec(this.getSuArgs("kill " + lProcesses.get(lcv).pid));
                     RedirOutputThread outThrd = new RedirOutputThread(pProc, null);
                     outThrd.start();
                     outThrd.join(15000);
-                    sTmp = outThrd.strOutput;
+                    String sTmp = outThrd.strOutput;
                     Log.e("KILLPROCESS", sTmp);
-                    if (outThrd.nExitCode == 0) {
-                        sRet = "Successfully killed " + nPID + " " + strProcName + "\n";
-                        nPID = 0;
-                        break;
-                    } else {
-                        sRet = sErrorPrefix + "Failed to kill " + nPID + " " + strProcName + "\n";
-                    }
                     }
                 catch (IOException e)
                     {
@@ -2429,31 +2416,30 @@ private void CancelNotification()
                     {
                     e.printStackTrace();
                     }
-
-                // Give the messages a chance to be processed
-                try {
-                    Thread.sleep(2000);
-                    }
-                catch (InterruptedException e)
-                    {
-                    e.printStackTrace();
-                    }
-                break;
                 }
             }
 
-        if (nPID > 0)
+        if (bFoundAppProcess)
             {
-            sRet = "Successfully killed " + nPID + " " + strProcName + "\n";
+            // Give the messages a chance to be processed
+            try {
+                Thread.sleep(2000);
+                }
+            catch (InterruptedException e)
+                {
+                e.printStackTrace();
+                }
+
+            sRet = "Successfully killed " + sProcName + "\n";
             lProcesses = aMgr.getRunningAppProcesses();
             nProcs = 0;
-            if (lProcesses != null) 
+            if (lProcesses != null)
                 nProcs = lProcesses.size();
             for (lcv = 0; lcv < nProcs; lcv++)
                 {
                 if (lProcesses.get(lcv).processName.contains(sProcName))
                     {
-                    sRet = sErrorPrefix + "Unable to kill " + nPID + " " + strProcName + "\n";
+                    sRet = sErrorPrefix + "Unable to kill " + sProcName + " (couldn't kill " + sFoundProcName +")\n";
                     break;
                     }
                 }
@@ -2469,7 +2455,7 @@ private void CancelNotification()
                 RedirOutputThread outThrd = new RedirOutputThread(pProc, null);
                 outThrd.start();
                 outThrd.join(10000);
-                sTmp = outThrd.strOutput;
+                String sTmp = outThrd.strOutput;
                 StringTokenizer stokLines = new StringTokenizer(sTmp, "\n");
                 while(stokLines.hasMoreTokens())
                     {
@@ -2490,7 +2476,7 @@ private void CancelNotification()
                         if (sName.contains(sProcName))
                             {
                             NewKillProc(sPid, out);
-                            sRet = "Successfully killed " + sPid + " " + sName + "\n";
+                            sRet = "Successfully killed " + sName + "\n";
                             }
                         }
                     }
diff --git a/content/base/src/FileIOObject.cpp b/content/base/src/FileIOObject.cpp
index 51f9f6c54fd1..10386c9541ca 100644
--- a/content/base/src/FileIOObject.cpp
+++ b/content/base/src/FileIOObject.cpp
@@ -38,6 +38,7 @@ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(FileIOObject,
   NS_CYCLE_COLLECTION_TRAVERSE_EVENT_HANDLER(abort)
   NS_CYCLE_COLLECTION_TRAVERSE_EVENT_HANDLER(error)
   NS_CYCLE_COLLECTION_TRAVERSE_EVENT_HANDLER(progress)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mError)
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(FileIOObject,
@@ -46,6 +47,7 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(FileIOObject,
   NS_CYCLE_COLLECTION_UNLINK_EVENT_HANDLER(abort)
   NS_CYCLE_COLLECTION_UNLINK_EVENT_HANDLER(error)
   NS_CYCLE_COLLECTION_UNLINK_EVENT_HANDLER(progress)
+  NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mError)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 FileIOObject::FileIOObject()
diff --git a/content/html/content/src/nsGenericHTMLElement.h b/content/html/content/src/nsGenericHTMLElement.h
index 3d829c265919..18ce572f3681 100644
--- a/content/html/content/src/nsGenericHTMLElement.h
+++ b/content/html/content/src/nsGenericHTMLElement.h
@@ -1160,31 +1160,6 @@ PR_STATIC_ASSERT(ELEMENT_TYPE_SPECIFIC_BITS_OFFSET + 1 < 32);
     return SetAttrHelper(nsGkAtoms::_atom, aValue);                       \
   }
 
-/**
- * A macro to implement the getter and setter for a given content
- * property that needs to set a positive integer. The method uses
- * the generic GetAttr and SetAttr methods. This macro is much like
- * the NS_IMPL_NON_NEGATIVE_INT_ATTR macro except the exception is
- * thrown also when the value is equal to 0.
- */
-#define NS_IMPL_POSITIVE_INT_ATTR(_class, _method, _atom)                 \
-  NS_IMPL_POSITIVE_INT_ATTR_DEFAULT_VALUE(_class, _method, _atom, 1)
-
-#define NS_IMPL_POSITIVE_INT_ATTR_DEFAULT_VALUE(_class, _method, _atom, _default)  \
-  NS_IMETHODIMP                                                           \
-  _class::Get##_method(PRInt32* aValue)                                   \
-  {                                                                       \
-    return GetIntAttr(nsGkAtoms::_atom, _default, aValue);                \
-  }                                                                       \
-  NS_IMETHODIMP                                                           \
-  _class::Set##_method(PRInt32 aValue)                                    \
-  {                                                                       \
-    if (aValue <= 0) {                                                    \
-      return NS_ERROR_DOM_INDEX_SIZE_ERR;                                 \
-    }                                                                     \
-    return SetIntAttr(nsGkAtoms::_atom, aValue);                          \
-  }
-
 /**
  * QueryInterface() implementation helper macros
  */
diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
index 39b6caa790e1..58e685e78fe3 100644
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -8046,6 +8046,23 @@ private:
     bool mFirstParty;
 };
 
+/**
+ * Returns true if we started an asynchronous load (i.e., from the network), but
+ * the document we're loading there hasn't yet become this docshell's active
+ * document.
+ *
+ * When JustStartedNetworkLoad is true, you should be careful about modifying
+ * mLoadType and mLSHE.  These are both set when the asynchronous load first
+ * starts, and the load expects that, when it eventually runs InternalLoad,
+ * mLoadType and mLSHE will have their original values.
+ */
+bool
+nsDocShell::JustStartedNetworkLoad()
+{
+    return mDocumentRequest &&
+           mDocumentRequest != GetCurrentDocChannel();
+}
+
 NS_IMETHODIMP
 nsDocShell::InternalLoad(nsIURI * aURI,
                          nsIURI * aReferrer,
@@ -8462,7 +8479,16 @@ nsDocShell::InternalLoad(nsIURI * aURI,
             // See bug 737307.
             AutoRestore<PRUint32> loadTypeResetter(mLoadType);
 
-            mLoadType = aLoadType;
+            // If a non-short-circuit load (i.e., a network load) is pending,
+            // make this a replacement load, so that we don't add a SHEntry here
+            // and the network load goes into the SHEntry it expects to.
+            if (JustStartedNetworkLoad() && (aLoadType & LOAD_CMD_NORMAL)) {
+                mLoadType = LOAD_NORMAL_REPLACE;
+            }
+            else {
+                mLoadType = aLoadType;
+            }
+
             mURIResultedInDocument = true;
 
             /* we need to assign mLSHE to aSHEntry right here, so that on History loads,
@@ -9662,6 +9688,16 @@ nsDocShell::AddState(nsIVariant *aData, const nsAString& aTitle,
 
     nsresult rv;
 
+    // Don't clobber the load type of an existing network load.
+    AutoRestore<PRUint32> loadTypeResetter(mLoadType);
+
+    // pushState effectively becomes replaceState when we've started a network
+    // load but haven't adopted its document yet.  This mirrors what we do with
+    // changes to the hash at this stage of the game.
+    if (JustStartedNetworkLoad()) {
+        aReplace = true;
+    }
+
     nsCOMPtr<nsIDocument> document = do_GetInterface(GetAsSupports(this));
     NS_ENSURE_TRUE(document, NS_ERROR_FAILURE);
 
diff --git a/docshell/base/nsDocShell.h b/docshell/base/nsDocShell.h
index ca7992e4309e..83e7b0533499 100644
--- a/docshell/base/nsDocShell.h
+++ b/docshell/base/nsDocShell.h
@@ -660,6 +660,8 @@ protected:
         nsRefPtr<nsDocShell> mDocShell;
     };
 
+    bool JustStartedNetworkLoad();
+
     // hash of session storages, keyed by domain
     nsInterfaceHashtable<nsCStringHashKey, nsIDOMStorage> mStorages;
 
diff --git a/dom/base/nsDOMClassInfo.cpp b/dom/base/nsDOMClassInfo.cpp
index a850522eb8fd..a65b82125f43 100644
--- a/dom/base/nsDOMClassInfo.cpp
+++ b/dom/base/nsDOMClassInfo.cpp
@@ -7455,7 +7455,7 @@ nsWindowSH::NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
   // binding a name) a new undefined property that's not already
   // defined on our prototype chain. This way we can access this
   // expando w/o ever getting back into XPConnect.
-  if ((flags & JSRESOLVE_ASSIGNING) && !(flags & JSRESOLVE_WITH)) {
+  if (flags & JSRESOLVE_ASSIGNING) {
     JSObject *realObj;
     wrapper->GetJSObject(&realObj);
 
diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
index 47eb001e19c3..7496cda91ef0 100644
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -8992,7 +8992,175 @@ nsGlobalWindow::SetTimeoutOrInterval(bool aIsInterval, PRInt32 *aReturn)
   return SetTimeoutOrInterval(handler, interval, isInterval, aReturn);
 }
 
-// static
+bool
+nsGlobalWindow::RunTimeoutHandler(nsTimeout* aTimeout,
+                                  nsIScriptContext* aScx)
+{
+  // Hold on to the timeout in case mExpr or mFunObj releases its
+  // doc.
+  nsRefPtr<nsTimeout> timeout = aTimeout;
+  nsTimeout* last_running_timeout = mRunningTimeout;
+  mRunningTimeout = timeout;
+  timeout->mRunning = true;
+
+  // Push this timeout's popup control state, which should only be
+  // eabled the first time a timeout fires that was created while
+  // popups were enabled and with a delay less than
+  // "dom.disable_open_click_delay".
+  nsAutoPopupStatePusher popupStatePusher(timeout->mPopupState);
+
+  // Clear the timeout's popup state, if any, to prevent interval
+  // timeouts from repeatedly opening poups.
+  timeout->mPopupState = openAbused;
+
+  ++gRunningTimeoutDepth;
+  ++mTimeoutFiringDepth;
+
+  bool trackNestingLevel = !timeout->mIsInterval;
+  PRUint32 nestingLevel;
+  if (trackNestingLevel) {
+    nestingLevel = sNestingLevel;
+    sNestingLevel = timeout->mNestingLevel;
+  }
+
+  nsCOMPtr<nsIScriptTimeoutHandler> handler(timeout->mScriptHandler);
+  JSObject* scriptObject = handler->GetScriptObject();
+  if (!scriptObject) {
+    // Evaluate the timeout expression.
+    const PRUnichar* script = handler->GetHandlerText();
+    NS_ASSERTION(script, "timeout has no script nor handler text!");
+
+    const char* filename = nsnull;
+    PRUint32 lineNo = 0;
+    handler->GetLocation(&filename, &lineNo);
+
+    NS_TIME_FUNCTION_MARK("(file: %s, line: %d)", filename, lineNo);
+
+    bool is_undefined;
+    aScx->EvaluateString(nsDependentString(script), FastGetGlobalJSObject(),
+                         timeout->mPrincipal, timeout->mPrincipal,
+                         filename, lineNo, JSVERSION_DEFAULT, nsnull,
+                         &is_undefined);
+  } else {
+    nsCOMPtr<nsIVariant> dummy;
+    nsCOMPtr<nsISupports> me(static_cast<nsIDOMWindow *>(this));
+    aScx->CallEventHandler(me, FastGetGlobalJSObject(),
+                           scriptObject, handler->GetArgv(),
+                           // XXXmarkh - consider allowing CallEventHandler to
+                           // accept nsnull?
+                           getter_AddRefs(dummy));
+
+  }
+
+  // We ignore any failures from calling EvaluateString() or
+  // CallEventHandler() on the context here since we're in a loop
+  // where we're likely to be running timeouts whose OS timers
+  // didn't fire in time and we don't want to not fire those timers
+  // now just because execution of one timer failed. We can't
+  // propagate the error to anyone who cares about it from this
+  // point anyway, and the script context should have already reported
+  // the script error in the usual way - so we just drop it.
+
+  if (trackNestingLevel) {
+    sNestingLevel = nestingLevel;
+  }
+
+  --mTimeoutFiringDepth;
+  --gRunningTimeoutDepth;
+
+  mRunningTimeout = last_running_timeout;
+  timeout->mRunning = false;
+  return timeout->mCleared;
+}
+
+bool
+nsGlobalWindow::RescheduleTimeout(nsTimeout* aTimeout, const TimeStamp& now,
+                                  bool aRunningPendingTimeouts)
+{
+  if (!aTimeout->mIsInterval) {
+    if (aTimeout->mTimer) {
+      // The timeout still has an OS timer, and it's not an interval,
+      // that means that the OS timer could still fire; cancel the OS
+      // timer and release its reference to the timeout.
+      aTimeout->mTimer->Cancel();
+      aTimeout->mTimer = nsnull;
+      aTimeout->Release();
+    }
+    return false;
+  }
+
+  // Compute time to next timeout for interval timer.
+  // Make sure nextInterval is at least DOMMinTimeoutValue().
+  TimeDuration nextInterval =
+    TimeDuration::FromMilliseconds(NS_MAX(aTimeout->mInterval,
+                                          PRUint32(DOMMinTimeoutValue())));
+
+  // If we're running pending timeouts, set the next interval to be
+  // relative to "now", and not to when the timeout that was pending
+  // should have fired.
+  TimeStamp firingTime;
+  if (aRunningPendingTimeouts) {
+    firingTime = now + nextInterval;
+  } else {
+    firingTime = aTimeout->mWhen + nextInterval;
+  }
+
+  TimeStamp currentNow = TimeStamp::Now();
+  TimeDuration delay = firingTime - currentNow;
+
+  // And make sure delay is nonnegative; that might happen if the timer
+  // thread is firing our timers somewhat early or if they're taking a long
+  // time to run the callback.
+  if (delay < TimeDuration(0)) {
+    delay = TimeDuration(0);
+  }
+
+  if (!aTimeout->mTimer) {
+    NS_ASSERTION(IsFrozen() || mTimeoutsSuspendDepth,
+                 "How'd our timer end up null if we're not frozen or "
+                 "suspended?");
+
+    aTimeout->mTimeRemaining = delay;
+    return true;
+  }
+
+  aTimeout->mWhen = currentNow + delay;
+
+  // Reschedule the OS timer. Don't bother returning any error codes if
+  // this fails since the callers of this method don't care about them.
+
+  // Make sure to cast the unsigned PR_USEC_PER_MSEC to signed
+  // PRTime to make the division do the right thing on 64-bit
+  // platforms whether delay is positive or negative (which we
+  // know is always positive here, but cast anyways for
+  // consistency).
+  nsresult rv = aTimeout->mTimer->
+    InitWithFuncCallback(TimerCallback, aTimeout,
+                         delay.ToMilliseconds(),
+                         nsITimer::TYPE_ONE_SHOT);
+
+  if (NS_FAILED(rv)) {
+    NS_ERROR("Error initializing timer for DOM timeout!");
+
+    // We failed to initialize the new OS timer, this timer does
+    // us no good here so we just cancel it (just in case) and
+    // null out the pointer to the OS timer, this will release the
+    // OS timer. As we continue executing the code below we'll end
+    // up deleting the timeout since it's not an interval timeout
+    // any more (since timeout->mTimer == nsnull).
+    aTimeout->mTimer->Cancel();
+    aTimeout->mTimer = nsnull;
+
+    // Now that the OS timer no longer has a reference to the
+    // timeout we need to drop that reference.
+    aTimeout->Release();
+
+    return false;
+  }
+
+  return true;
+}
+
 void
 nsGlobalWindow::RunTimeout(nsTimeout *aTimeout)
 {
@@ -9133,90 +9301,8 @@ nsGlobalWindow::RunTimeout(nsTimeout *aTimeout)
     }
 
     // This timeout is good to run
-    nsTimeout *last_running_timeout = mRunningTimeout;
-    mRunningTimeout = timeout;
-    timeout->mRunning = true;
     ++timeoutsRan;
-
-    // Push this timeout's popup control state, which should only be
-    // eabled the first time a timeout fires that was created while
-    // popups were enabled and with a delay less than
-    // "dom.disable_open_click_delay".
-    nsAutoPopupStatePusher popupStatePusher(timeout->mPopupState);
-
-    // Clear the timeout's popup state, if any, to prevent interval
-    // timeouts from repeatedly opening poups.
-    timeout->mPopupState = openAbused;
-
-    // Hold on to the timeout in case mExpr or mFunObj releases its
-    // doc.
-    timeout->AddRef();
-
-    ++gRunningTimeoutDepth;
-    ++mTimeoutFiringDepth;
-
-    bool trackNestingLevel = !timeout->mIsInterval;
-    PRUint32 nestingLevel;
-    if (trackNestingLevel) {
-      nestingLevel = sNestingLevel;
-      sNestingLevel = timeout->mNestingLevel;
-    }
-
-    nsCOMPtr<nsIScriptTimeoutHandler> handler(timeout->mScriptHandler);
-    JSObject* scriptObject = handler->GetScriptObject();
-    if (!scriptObject) {
-      // Evaluate the timeout expression.
-      const PRUnichar *script = handler->GetHandlerText();
-      NS_ASSERTION(script, "timeout has no script nor handler text!");
-
-      const char *filename = nsnull;
-      PRUint32 lineNo = 0;
-      handler->GetLocation(&filename, &lineNo);
-
-      NS_TIME_FUNCTION_MARK("(file: %s, line: %d)", filename, lineNo);
-
-      bool is_undefined;
-      scx->EvaluateString(nsDependentString(script), FastGetGlobalJSObject(),
-                          timeout->mPrincipal, timeout->mPrincipal,
-                          filename, lineNo, JSVERSION_DEFAULT, nsnull,
-                          &is_undefined);
-    } else {
-      nsCOMPtr<nsIVariant> dummy;
-      nsCOMPtr<nsISupports> me(static_cast<nsIDOMWindow *>(this));
-      scx->CallEventHandler(me, FastGetGlobalJSObject(),
-                            scriptObject, handler->GetArgv(),
-                            // XXXmarkh - consider allowing CallEventHandler to
-                            // accept nsnull?
-                            getter_AddRefs(dummy));
-
-    }
-    handler = nsnull; // drop reference before dropping timeout refs.
-
-    if (trackNestingLevel) {
-      sNestingLevel = nestingLevel;
-    }
-
-    --mTimeoutFiringDepth;
-    --gRunningTimeoutDepth;
-
-    mRunningTimeout = last_running_timeout;
-    timeout->mRunning = false;
-
-    // We ignore any failures from calling EvaluateString() or
-    // CallEventHandler() on the context here since we're in a loop
-    // where we're likely to be running timeouts whose OS timers
-    // didn't fire in time and we don't want to not fire those timers
-    // now just because execution of one timer failed. We can't
-    // propagate the error to anyone who cares about it from this
-    // point anyway, and the script context should have already reported
-    // the script error in the usual way - so we just drop it.
-
-    // If all timeouts were cleared and |timeout != aTimeout| then
-    // |timeout| may be the last reference to the timeout so check if
-    // it was cleared before releasing it.
-    bool timeout_was_cleared = timeout->mCleared;
-
-    timeout->Release();
+    bool timeout_was_cleared = RunTimeoutHandler(timeout, scx);
 
     if (timeout_was_cleared) {
       // The running timeout's window was cleared, this means that
@@ -9229,96 +9315,9 @@ nsGlobalWindow::RunTimeout(nsTimeout *aTimeout)
       return;
     }
 
-    bool isInterval = false;
-
     // If we have a regular interval timer, we re-schedule the
     // timeout, accounting for clock drift.
-    if (timeout->mIsInterval) {
-      // Compute time to next timeout for interval timer.
-      // Make sure nextInterval is at least DOMMinTimeoutValue().
-      TimeDuration nextInterval =
-        TimeDuration::FromMilliseconds(NS_MAX(timeout->mInterval,
-                                              PRUint32(DOMMinTimeoutValue())));
-
-      // If we're running pending timeouts because they've been temporarily
-      // disabled (!aTimeout), set the next interval to be relative to "now",
-      // and not to when the timeout that was pending should have fired.
-      TimeStamp firingTime;
-      if (!aTimeout)
-        firingTime = now + nextInterval;
-      else
-        firingTime = timeout->mWhen + nextInterval;
-
-      TimeStamp currentNow = TimeStamp::Now();
-      TimeDuration delay = firingTime - currentNow;
-
-      // And make sure delay is nonnegative; that might happen if the timer
-      // thread is firing our timers somewhat early or if they're taking a long
-      // time to run the callback.
-      if (delay < TimeDuration(0)) {
-        delay = TimeDuration(0);
-      }
-
-      if (timeout->mTimer) {
-        timeout->mWhen = currentNow + delay; // firingTime unless delay got
-                                             // clamped, in which case it's
-                                             // currentNow.
-
-        // Reschedule the OS timer. Don't bother returning any error
-        // codes if this fails since the callers of this method
-        // doesn't care about them nobody who cares about them
-        // anyways.
-
-        // Make sure to cast the unsigned PR_USEC_PER_MSEC to signed
-        // PRTime to make the division do the right thing on 64-bit
-        // platforms whether delay is positive or negative (which we
-        // know is always positive here, but cast anyways for
-        // consistency).
-        nsresult rv = timeout->mTimer->
-          InitWithFuncCallback(TimerCallback, timeout,
-                               delay.ToMilliseconds(),
-                               nsITimer::TYPE_ONE_SHOT);
-
-        if (NS_FAILED(rv)) {
-          NS_ERROR("Error initializing timer for DOM timeout!");
-
-          // We failed to initialize the new OS timer, this timer does
-          // us no good here so we just cancel it (just in case) and
-          // null out the pointer to the OS timer, this will release the
-          // OS timer. As we continue executing the code below we'll end
-          // up deleting the timeout since it's not an interval timeout
-          // any more (since timeout->mTimer == nsnull).
-          timeout->mTimer->Cancel();
-          timeout->mTimer = nsnull;
-
-          // Now that the OS timer no longer has a reference to the
-          // timeout we need to drop that reference.
-          timeout->Release();
-        }
-      } else {
-        NS_ASSERTION(IsFrozen() || mTimeoutsSuspendDepth,
-                     "How'd our timer end up null if we're not frozen or "
-                     "suspended?");
-
-        timeout->mTimeRemaining = delay;
-        isInterval = true;
-      }
-    }
-
-    if (timeout->mTimer) {
-      if (timeout->mIsInterval) {
-        isInterval = true;
-      } else {
-        // The timeout still has an OS timer, and it's not an
-        // interval, that means that the OS timer could still fire (if
-        // it didn't already, i.e. aTimeout == timeout), cancel the OS
-        // timer and release its reference to the timeout.
-        timeout->mTimer->Cancel();
-        timeout->mTimer = nsnull;
-
-        timeout->Release();
-      }
-    }
+    bool needsReinsertion = RescheduleTimeout(timeout, now, !aTimeout);
 
     // Running a timeout can cause another timeout to be deleted, so
     // we need to reset the pointer to the following timeout.
@@ -9326,9 +9325,10 @@ nsGlobalWindow::RunTimeout(nsTimeout *aTimeout)
 
     PR_REMOVE_LINK(timeout);
 
-    if (isInterval) {
-      // Reschedule an interval timeout. Insert interval timeout
-      // onto list sorted in deadline order.
+    if (needsReinsertion) {
+      NS_ASSERTION(timeout->mTimer,
+                   "rescheduling interval timeout without a timer!");
+      // Insert interval timeout onto list sorted in deadline order.
       // AddRefs timeout.
       InsertTimeoutIntoList(timeout);
     }
diff --git a/dom/base/nsGlobalWindow.h b/dom/base/nsGlobalWindow.h
index 788986c4d8fc..ca5379c61b1e 100644
--- a/dom/base/nsGlobalWindow.h
+++ b/dom/base/nsGlobalWindow.h
@@ -659,6 +659,11 @@ protected:
   // The timeout implementation functions.
   void RunTimeout(nsTimeout *aTimeout);
   void RunTimeout() { RunTimeout(nsnull); }
+  // Return true if |aTimeout| was cleared while its handler ran.
+  bool RunTimeoutHandler(nsTimeout* aTimeout, nsIScriptContext* aScx);
+  // Return true if |aTimeout| needs to be reinserted into the timeout list.
+  bool RescheduleTimeout(nsTimeout* aTimeout, const TimeStamp& now,
+                         bool aRunningPendingTimeouts);
 
   void ClearAllTimeouts();
   // Insert aTimeout into the list, before all timeouts that would
diff --git a/dom/base/nsJSUtils.h b/dom/base/nsJSUtils.h
index b068440c3bbf..ffa7d6ae2425 100644
--- a/dom/base/nsJSUtils.h
+++ b/dom/base/nsJSUtils.h
@@ -13,6 +13,8 @@
  * the generated code itself.
  */
 
+#include "mozilla/Assertions.h"
+
 #include "nsISupports.h"
 #include "jsapi.h"
 #include "nsString.h"
@@ -63,10 +65,19 @@ public:
   {
   }
 
+  /**
+   * Ditto for flat strings.
+   */
+  explicit nsDependentJSString(JSFlatString* fstr)
+    : nsDependentString(JS_GetFlatStringChars(fstr),
+                        JS_GetStringLength(JS_FORGET_STRING_FLATNESS(fstr)))
+  {
+  }
+
   /**
    * For all other strings, the nsDependentJSString object should be default
    * constructed, which leaves it empty (this->IsEmpty()), and initialized with
-   * one of the fallible init() methods below.
+   * one of the init() methods below.
    */
 
   nsDependentJSString()
@@ -91,6 +102,12 @@ public:
       return init(aContext, JSVAL_TO_STRING(v));
   }
 
+  void init(JSFlatString* fstr)
+  {
+      MOZ_ASSERT(IsEmpty(), "init() on initialized string");
+      new(this) nsDependentJSString(fstr);
+  }
+
   ~nsDependentJSString()
   {
   }
diff --git a/dom/plugins/base/Makefile.in b/dom/plugins/base/Makefile.in
index dafe2adbd045..0f9e0ff23078 100644
--- a/dom/plugins/base/Makefile.in
+++ b/dom/plugins/base/Makefile.in
@@ -26,7 +26,6 @@ XPIDLSRCS = \
   nsIPluginHost.idl \
   nsIPluginInputStream.idl \
   nsIPluginInstanceOwner.idl \
-  nsIPluginStreamInfo.idl \
   nsIPluginTag.idl \
   nsIPluginTagInfo.idl \
   nspluginroot.idl \
diff --git a/dom/plugins/base/nsIPluginStreamInfo.idl b/dom/plugins/base/nsIPluginStreamInfo.idl
deleted file mode 100644
index b6b512974e79..000000000000
--- a/dom/plugins/base/nsIPluginStreamInfo.idl
+++ /dev/null
@@ -1,39 +0,0 @@
-/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-/**
- * nsIPluginStreamInfo
- *
- * @status DEPRECATED
- *
- * Originally published XPCOM Plugin API is now deprecated
- * Developers are welcome to use NPAPI, please refer to:
- * http://mozilla.org/projects/plugins/
- */
-
-#include "nsISupports.idl"
-#include "nspluginroot.idl"
-
-%{C++
-#include "npapi.h"
-%}
-
-[uuid(A700845F-0E26-44EA-84F5-3BE5381F98D5)]
-interface nsIPluginStreamInfo : nsISupports
-{
-  readonly attribute string contentType;
-
-  void isSeekable(out boolean aSeekable);
-
-    readonly attribute unsigned long length;
-
-    readonly attribute unsigned long lastModified;
-
-  void getURL(out constCharPtr aURL);
-
-  void requestRead(in NPByteRangePtr aRangeList);
-
-  attribute long streamOffset;
-};
diff --git a/dom/plugins/base/nsNPAPIPlugin.cpp b/dom/plugins/base/nsNPAPIPlugin.cpp
index 9cce533c2a2e..e703161b51f4 100644
--- a/dom/plugins/base/nsNPAPIPlugin.cpp
+++ b/dom/plugins/base/nsNPAPIPlugin.cpp
@@ -19,6 +19,7 @@
 #include "nsNPAPIPlugin.h"
 #include "nsNPAPIPluginInstance.h"
 #include "nsNPAPIPluginStreamListener.h"
+#include "nsPluginStreamListenerPeer.h"
 #include "nsIServiceManager.h"
 #include "nsThreadUtils.h"
 #include "mozilla/Preferences.h"
@@ -533,11 +534,12 @@ nsNPAPIPlugin::RetainStream(NPStream *pstream, nsISupports **aRetainedPeer)
     return NPERR_GENERIC_ERROR;
   }
 
-  nsPluginStreamListenerPeer* peer = listener->GetStreamListenerPeer();
-  if (!peer)
+  nsIStreamListener* streamListener = listener->GetStreamListenerPeer();
+  if (!streamListener) {
     return NPERR_GENERIC_ERROR;
+  }
 
-  *aRetainedPeer = (nsISupports*) peer;
+  *aRetainedPeer = streamListener;
   NS_ADDREF(*aRetainedPeer);
   return NS_OK;
 }
@@ -2510,10 +2512,10 @@ _requestread(NPStream *pstream, NPByteRange *rangeList)
   if (streamtype != NP_SEEK)
     return NPERR_STREAM_NOT_SEEKABLE;
 
-  if (!streamlistener->mStreamInfo)
+  if (!streamlistener->mStreamListenerPeer)
     return NPERR_GENERIC_ERROR;
 
-  nsresult rv = streamlistener->mStreamInfo->RequestRead((NPByteRange *)rangeList);
+  nsresult rv = streamlistener->mStreamListenerPeer->RequestRead((NPByteRange *)rangeList);
   if (NS_FAILED(rv))
     return NPERR_GENERIC_ERROR;
 
diff --git a/dom/plugins/base/nsNPAPIPluginStreamListener.cpp b/dom/plugins/base/nsNPAPIPluginStreamListener.cpp
index 286b64e1503d..3a110a00af7d 100644
--- a/dom/plugins/base/nsNPAPIPluginStreamListener.cpp
+++ b/dom/plugins/base/nsNPAPIPluginStreamListener.cpp
@@ -137,7 +137,6 @@ nsNPAPIPluginStreamListener::nsNPAPIPluginStreamListener(nsNPAPIPluginInstance*
 : mStreamBuffer(nsnull),
 mNotifyURL(aURL ? PL_strdup(aURL) : nsnull),
 mInst(inst),
-mStreamListenerPeer(nsnull),
 mStreamBufferSize(0),
 mStreamBufferByteCount(0),
 mStreamType(NP_NORMAL),
@@ -215,7 +214,7 @@ nsNPAPIPluginStreamListener::CleanUpStream(NPReason reason)
   if (!mInst || !mInst->CanFireNotifications())
     return rv;
   
-  mStreamInfo = NULL;
+  mStreamListenerPeer = nsnull;
   
   PluginDestructionGuard guard(mInst);
 
@@ -279,7 +278,7 @@ nsNPAPIPluginStreamListener::CallURLNotify(NPReason reason)
 }
 
 nsresult
-nsNPAPIPluginStreamListener::OnStartBinding(nsIPluginStreamInfo* pluginInfo)
+nsNPAPIPluginStreamListener::OnStartBinding(nsPluginStreamListenerPeer* streamPeer)
 {
   if (!mInst || !mInst->CanFireNotifications())
     return NS_ERROR_FAILURE;
@@ -303,18 +302,18 @@ nsNPAPIPluginStreamListener::OnStartBinding(nsIPluginStreamInfo* pluginInfo)
   PRUint16 streamType = NP_NORMAL;
   NPError error;
 
-  pluginInfo->GetURL(&mNPStreamWrapper->mNPStream.url);
-  pluginInfo->GetLength((PRUint32*)&(mNPStreamWrapper->mNPStream.end));
-  pluginInfo->GetLastModified((PRUint32*)&(mNPStreamWrapper->mNPStream.lastmodified));
-  pluginInfo->IsSeekable(&seekable);
-  pluginInfo->GetContentType(&contentType);
+  streamPeer->GetURL(&mNPStreamWrapper->mNPStream.url);
+  streamPeer->GetLength((PRUint32*)&(mNPStreamWrapper->mNPStream.end));
+  streamPeer->GetLastModified((PRUint32*)&(mNPStreamWrapper->mNPStream.lastmodified));
+  streamPeer->IsSeekable(&seekable);
+  streamPeer->GetContentType(&contentType);
   
   if (!mResponseHeaders.IsEmpty()) {
     mResponseHeaderBuf = PL_strdup(mResponseHeaders.get());
     mNPStreamWrapper->mNPStream.headers = mResponseHeaderBuf;
   }
   
-  mStreamInfo = pluginInfo;
+  mStreamListenerPeer = streamPeer;
   
   NPPAutoPusher nppPusher(npp);
   
@@ -360,31 +359,22 @@ nsNPAPIPluginStreamListener::SuspendRequest()
 {
   NS_ASSERTION(!mIsSuspended,
                "Suspending a request that's already suspended!");
-  
-  nsCOMPtr<nsINPAPIPluginStreamInfo> pluginInfoNPAPI =
-  do_QueryInterface(mStreamInfo);
-  
-  if (!pluginInfoNPAPI) {
-    return;
-  }
-  
+
   nsresult rv = StartDataPump();
   if (NS_FAILED(rv))
     return;
   
   mIsSuspended = true;
-  
-  pluginInfoNPAPI->SuspendRequests();
+
+  if (mStreamListenerPeer) {
+   mStreamListenerPeer->SuspendRequests();
+  }
 }
 
 void
 nsNPAPIPluginStreamListener::ResumeRequest()
 {
-  nsCOMPtr<nsINPAPIPluginStreamInfo> pluginInfoNPAPI =
-  do_QueryInterface(mStreamInfo);
-  
-  pluginInfoNPAPI->ResumeRequests();
-  
+  mStreamListenerPeer->ResumeRequests();
   mIsSuspended = false;
 }
 
@@ -436,7 +426,7 @@ nsNPAPIPluginStreamListener::PluginInitJSLoadInProgress()
 // and the length will be the number of bytes available in our
 // internal buffer.
 nsresult
-nsNPAPIPluginStreamListener::OnDataAvailable(nsIPluginStreamInfo* pluginInfo,
+nsNPAPIPluginStreamListener::OnDataAvailable(nsPluginStreamListenerPeer* streamPeer,
                                              nsIInputStream* input,
                                              PRUint32 length)
 {
@@ -446,7 +436,7 @@ nsNPAPIPluginStreamListener::OnDataAvailable(nsIPluginStreamInfo* pluginInfo,
   PluginDestructionGuard guard(mInst);
   
   // Just in case the caller switches plugin info on us.
-  mStreamInfo = pluginInfo;
+  mStreamListenerPeer = streamPeer;
 
   nsNPAPIPlugin* plugin = mInst->GetPlugin();
   if (!plugin || !plugin->GetLibrary())
@@ -466,7 +456,7 @@ nsNPAPIPluginStreamListener::OnDataAvailable(nsIPluginStreamInfo* pluginInfo,
     // consecutive Read() calls form input stream into our buff.
     
     PRUint32 contentLength;
-    pluginInfo->GetLength(&contentLength);
+    streamPeer->GetLength(&contentLength);
     
     mStreamBufferSize = NS_MAX(length, contentLength);
     
@@ -486,7 +476,7 @@ nsNPAPIPluginStreamListener::OnDataAvailable(nsIPluginStreamInfo* pluginInfo,
   mInst->GetNPP(&npp);
   
   PRInt32 streamPosition;
-  pluginInfo->GetStreamOffset(&streamPosition);
+  streamPeer->GetStreamOffset(&streamPosition);
   PRInt32 streamOffset = streamPosition;
   
   if (input) {
@@ -501,7 +491,7 @@ nsNPAPIPluginStreamListener::OnDataAvailable(nsIPluginStreamInfo* pluginInfo,
     //
     // Note: there is a special case when data flow should be
     // temporarily stopped if NPP_WriteReady returns 0 (bug #89270)
-    pluginInfo->SetStreamOffset(streamOffset);
+    streamPeer->SetStreamOffset(streamOffset);
     
     // set new end in case the content is compressed
     // initial end is less than end of decompressed stream
@@ -695,10 +685,10 @@ nsNPAPIPluginStreamListener::OnDataAvailable(nsIPluginStreamInfo* pluginInfo,
     // NPN_RequestRead() call.
     
     PRInt32 postWriteStreamPosition;
-    pluginInfo->GetStreamOffset(&postWriteStreamPosition);
+    streamPeer->GetStreamOffset(&postWriteStreamPosition);
     
     if (postWriteStreamPosition == streamOffset) {
-      pluginInfo->SetStreamOffset(streamPosition);
+      streamPeer->SetStreamOffset(streamPosition);
     }
   }
   
@@ -706,7 +696,7 @@ nsNPAPIPluginStreamListener::OnDataAvailable(nsIPluginStreamInfo* pluginInfo,
 }
 
 nsresult
-nsNPAPIPluginStreamListener::OnFileAvailable(nsIPluginStreamInfo* pluginInfo, 
+nsNPAPIPluginStreamListener::OnFileAvailable(nsPluginStreamListenerPeer* streamPeer, 
                                              const char* fileName)
 {
   if (!mInst || !mInst->CanFireNotifications())
@@ -736,7 +726,7 @@ nsNPAPIPluginStreamListener::OnFileAvailable(nsIPluginStreamInfo* pluginInfo,
 }
 
 nsresult
-nsNPAPIPluginStreamListener::OnStopBinding(nsIPluginStreamInfo* pluginInfo, 
+nsNPAPIPluginStreamListener::OnStopBinding(nsPluginStreamListenerPeer* streamPeer, 
                                            nsresult status)
 {
   StopDataPump();
@@ -744,9 +734,8 @@ nsNPAPIPluginStreamListener::OnStopBinding(nsIPluginStreamInfo* pluginInfo,
   if (NS_FAILED(status)) {
     // The stream was destroyed, or died for some reason. Make sure we
     // cancel the underlying request.
-    nsCOMPtr<nsINPAPIPluginStreamInfo> pluginInfoNPAPI = do_QueryInterface(mStreamInfo);
-    if (pluginInfoNPAPI) {
-      pluginInfoNPAPI->CancelRequests(status);
+    if (mStreamListenerPeer) {
+      mStreamListenerPeer->CancelRequests(status);
     }
   }
   
@@ -788,7 +777,7 @@ nsNPAPIPluginStreamListener::Notify(nsITimer *aTimer)
   
   PRInt32 oldStreamBufferByteCount = mStreamBufferByteCount;
   
-  nsresult rv = OnDataAvailable(mStreamInfo, nsnull, mStreamBufferByteCount);
+  nsresult rv = OnDataAvailable(mStreamListenerPeer, nsnull, mStreamBufferByteCount);
   
   if (NS_FAILED(rv)) {
     // We ran into an error, no need to keep firing this timer then.
diff --git a/dom/plugins/base/nsNPAPIPluginStreamListener.h b/dom/plugins/base/nsNPAPIPluginStreamListener.h
index 577aa2d28e47..dfa4ff5758df 100644
--- a/dom/plugins/base/nsNPAPIPluginStreamListener.h
+++ b/dom/plugins/base/nsNPAPIPluginStreamListener.h
@@ -7,7 +7,6 @@
 #define nsNPAPIPluginStreamListener_h_
 
 #include "nscore.h"
-#include "nsIPluginStreamInfo.h"
 #include "nsIHTTPHeaderListener.h"
 #include "nsIRequest.h"
 #include "nsITimer.h"
@@ -22,7 +21,6 @@
 
 #define MAX_PLUGIN_NECKO_BUFFER 16384
 
-class nsINPAPIPluginStreamInfo;
 class nsPluginStreamListenerPeer;
 class nsNPAPIPluginStreamListener;
 
@@ -42,64 +40,6 @@ protected:
   nsNPAPIPluginStreamListener*          mStreamListener; // only valid if browser initiated
 };
 
-// nsINPAPIPluginStreamInfo is an internal helper interface that exposes
-// the underlying necko request to consumers of nsIPluginStreamInfo's.
-#define NS_INPAPIPLUGINSTREAMINFO_IID       \
-{ 0x097fdaaa, 0xa2a3, 0x49c2, \
-{0x91, 0xee, 0xeb, 0xc5, 0x7d, 0x6c, 0x9c, 0x97} }
-
-class nsINPAPIPluginStreamInfo : public nsIPluginStreamInfo
-{
-public:
-  NS_DECLARE_STATIC_IID_ACCESSOR(NS_INPAPIPLUGINSTREAMINFO_IID)
-
-  void TrackRequest(nsIRequest* request)
-  {
-    mRequests.AppendObject(request);
-  }
-
-  void ReplaceRequest(nsIRequest* oldRequest, nsIRequest* newRequest)
-  {
-    PRInt32 i = mRequests.IndexOfObject(oldRequest);
-    if (i == -1) {
-      NS_ASSERTION(mRequests.Count() == 0,
-                   "Only our initial stream should be unknown!");
-      mRequests.AppendObject(oldRequest);
-    }
-    else {
-      mRequests.ReplaceObjectAt(newRequest, i);
-    }
-  }
-  
-  void CancelRequests(nsresult status)
-  {
-    // Copy the array to avoid modification during the loop.
-    nsCOMArray<nsIRequest> requestsCopy(mRequests);
-    for (PRInt32 i = 0; i < requestsCopy.Count(); ++i)
-      requestsCopy[i]->Cancel(status);
-  }
-
-  void SuspendRequests() {
-    nsCOMArray<nsIRequest> requestsCopy(mRequests);
-    for (PRInt32 i = 0; i < requestsCopy.Count(); ++i)
-      requestsCopy[i]->Suspend();
-  }
-
-  void ResumeRequests() {
-    nsCOMArray<nsIRequest> requestsCopy(mRequests);
-    for (PRInt32 i = 0; i < requestsCopy.Count(); ++i)
-      requestsCopy[i]->Resume();
-  }
-
-protected:
-  friend class nsPluginByteRangeStreamListener;
-  
-  nsCOMArray<nsIRequest> mRequests;
-};
-
-NS_DEFINE_STATIC_IID_ACCESSOR(nsINPAPIPluginStreamInfo,
-                              NS_INPAPIPLUGINSTREAMINFO_IID)
-
 // Used to handle NPN_NewStream() - writes the stream as received by the plugin
 // to a file and at completion (NPN_DestroyStream), tells the browser to load it into
 // a plugin-specified target
@@ -134,13 +74,13 @@ public:
                               const char* aURL);
   virtual ~nsNPAPIPluginStreamListener();
 
-  nsresult OnStartBinding(nsIPluginStreamInfo* pluginInfo);
-  nsresult OnDataAvailable(nsIPluginStreamInfo* pluginInfo,
+  nsresult OnStartBinding(nsPluginStreamListenerPeer* streamPeer);
+  nsresult OnDataAvailable(nsPluginStreamListenerPeer* streamPeer,
                            nsIInputStream* input,
                            PRUint32 length);
-  nsresult OnFileAvailable(nsIPluginStreamInfo* pluginInfo, 
+  nsresult OnFileAvailable(nsPluginStreamListenerPeer* streamPeer, 
                            const char* fileName);
-  nsresult OnStopBinding(nsIPluginStreamInfo* pluginInfo, 
+  nsresult OnStopBinding(nsPluginStreamListenerPeer* streamPeer, 
                          nsresult status);
   nsresult GetStreamType(PRInt32 *result);
 
@@ -167,7 +107,6 @@ protected:
   char* mStreamBuffer;
   char* mNotifyURL;
   nsRefPtr<nsNPAPIPluginInstance> mInst;
-  nsPluginStreamListenerPeer* mStreamListenerPeer;
   nsNPAPIStreamWrapper *mNPStreamWrapper;
   PRUint32 mStreamBufferSize;
   PRInt32 mStreamBufferByteCount;
@@ -184,7 +123,7 @@ protected:
   nsCOMPtr<nsIAsyncVerifyRedirectCallback> mHTTPRedirectCallback;
 
 public:
-  nsCOMPtr<nsIPluginStreamInfo> mStreamInfo;
+  nsRefPtr<nsPluginStreamListenerPeer> mStreamListenerPeer;
 };
 
 #endif // nsNPAPIPluginStreamListener_h_
diff --git a/dom/plugins/base/nsPluginHost.cpp b/dom/plugins/base/nsPluginHost.cpp
index 8c76ca0e706d..d8397cd4e9cb 100644
--- a/dom/plugins/base/nsPluginHost.cpp
+++ b/dom/plugins/base/nsPluginHost.cpp
@@ -15,6 +15,8 @@
 #include "nsNPAPIPlugin.h"
 #include "nsNPAPIPluginStreamListener.h"
 #include "nsNPAPIPluginInstance.h"
+#include "nsPluginInstanceOwner.h"
+#include "nsObjectLoadingContent.h"
 #include "nsIHTTPHeaderListener.h"
 #include "nsIHttpHeaderVisitor.h"
 #include "nsIObserverService.h"
diff --git a/dom/plugins/base/nsPluginStreamListenerPeer.cpp b/dom/plugins/base/nsPluginStreamListenerPeer.cpp
index ab4ebdc6ab4c..a0856462b597 100644
--- a/dom/plugins/base/nsPluginStreamListenerPeer.cpp
+++ b/dom/plugins/base/nsPluginStreamListenerPeer.cpp
@@ -27,6 +27,7 @@
 #include "nsNetUtil.h"
 #include "nsPluginNativeWindow.h"
 #include "sampler.h"
+#include "nsObjectLoadingContent.h"
 
 #define MAGIC_REQUEST_CONTEXT 0x01020304
 
@@ -264,13 +265,11 @@ public:
 
 // nsPluginStreamListenerPeer
 
-NS_IMPL_ISUPPORTS8(nsPluginStreamListenerPeer,
+NS_IMPL_ISUPPORTS6(nsPluginStreamListenerPeer,
                    nsIStreamListener,
                    nsIRequestObserver,
                    nsIHttpHeaderVisitor,
                    nsISupportsWeakReference,
-                   nsIPluginStreamInfo,
-                   nsINPAPIPluginStreamInfo,
                    nsIInterfaceRequestor,
                    nsIChannelEventSink)
 
@@ -635,7 +634,7 @@ NS_IMETHODIMP nsPluginStreamListenerPeer::OnStatus(nsIRequest *request,
   return NS_OK;
 }
 
-NS_IMETHODIMP
+nsresult
 nsPluginStreamListenerPeer::GetContentType(char** result)
 {
   *result = const_cast<char*>(mContentType.get());
@@ -643,28 +642,28 @@ nsPluginStreamListenerPeer::GetContentType(char** result)
 }
 
 
-NS_IMETHODIMP
+nsresult
 nsPluginStreamListenerPeer::IsSeekable(bool* result)
 {
   *result = mSeekable;
   return NS_OK;
 }
 
-NS_IMETHODIMP
+nsresult
 nsPluginStreamListenerPeer::GetLength(PRUint32* result)
 {
   *result = mLength;
   return NS_OK;
 }
 
-NS_IMETHODIMP
+nsresult
 nsPluginStreamListenerPeer::GetLastModified(PRUint32* result)
 {
   *result = mModified;
   return NS_OK;
 }
 
-NS_IMETHODIMP
+nsresult
 nsPluginStreamListenerPeer::GetURL(const char** result)
 {
   *result = mURLSpec.get();
@@ -707,7 +706,7 @@ nsPluginStreamListenerPeer::MakeByteRangeString(NPByteRange* aRangeList, nsACStr
   return;
 }
 
-NS_IMETHODIMP
+nsresult
 nsPluginStreamListenerPeer::RequestRead(NPByteRange* rangeList)
 {
   nsCAutoString rangeString;
@@ -770,14 +769,14 @@ nsPluginStreamListenerPeer::RequestRead(NPByteRange* rangeList)
   return rv;
 }
 
-NS_IMETHODIMP
+nsresult
 nsPluginStreamListenerPeer::GetStreamOffset(PRInt32* result)
 {
   *result = mStreamOffset;
   return NS_OK;
 }
 
-NS_IMETHODIMP
+nsresult
 nsPluginStreamListenerPeer::SetStreamOffset(PRInt32 value)
 {
   mStreamOffset = value;
@@ -1289,11 +1288,11 @@ nsPluginStreamListenerPeer::GetInterface(const nsIID& aIID, void** result)
 class ChannelRedirectProxyCallback : public nsIAsyncVerifyRedirectCallback
 {
 public:
-  ChannelRedirectProxyCallback(nsINPAPIPluginStreamInfo* listener,
+  ChannelRedirectProxyCallback(nsPluginStreamListenerPeer* listener,
                                nsIAsyncVerifyRedirectCallback* parent,
                                nsIChannel* oldChannel,
                                nsIChannel* newChannel)
-    : mWeakListener(do_GetWeakReference(listener))
+    : mWeakListener(do_GetWeakReference(static_cast<nsIStreamListener*>(listener)))
     , mParent(parent)
     , mOldChannel(oldChannel)
     , mNewChannel(newChannel)
@@ -1308,9 +1307,9 @@ public:
   NS_IMETHODIMP OnRedirectVerifyCallback(nsresult result)
   {
     if (NS_SUCCEEDED(result)) {
-      nsCOMPtr<nsINPAPIPluginStreamInfo> listener = do_QueryReferent(mWeakListener);
+      nsCOMPtr<nsIStreamListener> listener = do_QueryReferent(mWeakListener);
       if (listener)
-        listener->ReplaceRequest(mOldChannel, mNewChannel);
+        static_cast<nsPluginStreamListenerPeer*>(listener.get())->ReplaceRequest(mOldChannel, mNewChannel);
     }
     return mParent->OnRedirectVerifyCallback(result);
   }
diff --git a/dom/plugins/base/nsPluginStreamListenerPeer.h b/dom/plugins/base/nsPluginStreamListenerPeer.h
index 67bcdae82369..49281964eecc 100644
--- a/dom/plugins/base/nsPluginStreamListenerPeer.h
+++ b/dom/plugins/base/nsPluginStreamListenerPeer.h
@@ -17,9 +17,10 @@
 #include "nsNPAPIPluginInstance.h"
 #include "nsIInterfaceRequestor.h"
 #include "nsIChannelEventSink.h"
-#include "nsObjectLoadingContent.h"
+#include "nsIObjectLoadingContent.h"
 
 class nsIChannel;
+class nsObjectLoadingContent;
 
 /**
  * When a plugin requests opens multiple requests to the same URL and
@@ -47,7 +48,6 @@ class nsPluginStreamListenerPeer : public nsIStreamListener,
 public nsIProgressEventSink,
 public nsIHttpHeaderVisitor,
 public nsSupportsWeakReference,
-public nsINPAPIPluginStreamInfo,
 public nsIInterfaceRequestor,
 public nsIChannelEventSink
 {
@@ -63,9 +63,6 @@ public:
   NS_DECL_NSIINTERFACEREQUESTOR
   NS_DECL_NSICHANNELEVENTSINK
 
-  // nsINPAPIPluginStreamInfo interface
-  NS_DECL_NSIPLUGINSTREAMINFO
-  
   // Called by RequestRead
   void
   MakeByteRangeString(NPByteRange* aRangeList, nsACString &string, PRInt32 *numRequests);
@@ -89,6 +86,53 @@ public:
   
   nsNPAPIPluginInstance *GetPluginInstance() { return mPluginInstance; }
   
+  nsresult RequestRead(NPByteRange* rangeList);
+  nsresult GetLength(PRUint32* result);
+  nsresult GetURL(const char** result);
+  nsresult GetLastModified(PRUint32* result);
+  nsresult IsSeekable(bool* result);
+  nsresult GetContentType(char** result);
+  nsresult GetStreamOffset(PRInt32* result);
+  nsresult SetStreamOffset(PRInt32 value);
+
+  void TrackRequest(nsIRequest* request)
+  {
+    mRequests.AppendObject(request);
+  }
+
+  void ReplaceRequest(nsIRequest* oldRequest, nsIRequest* newRequest)
+  {
+    PRInt32 i = mRequests.IndexOfObject(oldRequest);
+    if (i == -1) {
+      NS_ASSERTION(mRequests.Count() == 0,
+                   "Only our initial stream should be unknown!");
+      mRequests.AppendObject(oldRequest);
+    }
+    else {
+      mRequests.ReplaceObjectAt(newRequest, i);
+    }
+  }
+  
+  void CancelRequests(nsresult status)
+  {
+    // Copy the array to avoid modification during the loop.
+    nsCOMArray<nsIRequest> requestsCopy(mRequests);
+    for (PRInt32 i = 0; i < requestsCopy.Count(); ++i)
+      requestsCopy[i]->Cancel(status);
+  }
+
+  void SuspendRequests() {
+    nsCOMArray<nsIRequest> requestsCopy(mRequests);
+    for (PRInt32 i = 0; i < requestsCopy.Count(); ++i)
+      requestsCopy[i]->Suspend();
+  }
+
+  void ResumeRequests() {
+    nsCOMArray<nsIRequest> requestsCopy(mRequests);
+    for (PRInt32 i = 0; i < requestsCopy.Count(); ++i)
+      requestsCopy[i]->Resume();
+  }
+
 private:
   nsresult SetUpStreamListener(nsIRequest* request, nsIURI* aURL);
   nsresult SetupPluginCacheFile(nsIChannel* channel);
@@ -132,6 +176,7 @@ public:
   PRInt32                 mPendingRequests;
   nsWeakPtr               mWeakPtrChannelCallbacks;
   nsWeakPtr               mWeakPtrChannelLoadGroup;
+  nsCOMArray<nsIRequest> mRequests;
 };
 
 #endif // nsPluginStreamListenerPeer_h_
diff --git a/dom/system/gonk/systemlibs.js b/dom/system/gonk/systemlibs.js
index 6c88eccb6efc..0a0f268b356d 100644
--- a/dom/system/gonk/systemlibs.js
+++ b/dom/system/gonk/systemlibs.js
@@ -192,6 +192,10 @@ let libnetutils = (function () {
                                   serverbuf,
                                   lease.address());
 
+      if (ret && DEBUG) {
+        let error = iface.dhcp_get_errmsg();
+        dump("dhcp_do_request failed - " + error.readString());
+      }
       let obj = {
         ret: ret | 0,
         ipaddr_str: ipaddrbuf.readString(),
@@ -246,6 +250,10 @@ let libnetutils = (function () {
                        ints.addressOfElement(4),
                        ints.addressOfElement(5),
                        ints.addressOfElement(6));
+        if (ret && DEBUG) {
+          let error = iface.dhcp_get_errmsg();
+          dump("dhcp_do_request_* failed - " + error.readString());
+        }
         return {ret: ret | 0,
                 ipaddr: ints[0] | 0,
                 gateway: ints[1] | 0,
diff --git a/dom/system/nsDeviceSensors.cpp b/dom/system/nsDeviceSensors.cpp
index 8722c0b29a72..139517f6f235 100644
--- a/dom/system/nsDeviceSensors.cpp
+++ b/dom/system/nsDeviceSensors.cpp
@@ -160,9 +160,11 @@ nsDeviceSensors::Notify(const mozilla::hal::SensorData& aSensorData)
 {
   PRUint32 type = aSensorData.sensor();
 
-  double x = aSensorData.values()[0];
-  double y = aSensorData.values()[1];
-  double z = aSensorData.values()[2];
+  const InfallibleTArray<float>& values = aSensorData.values();
+  size_t len = values.Length();
+  double x = len > 0 ? values[0] : 0.0;
+  double y = len > 1 ? values[1] : 0.0;
+  double z = len > 2 ? values[2] : 0.0;
 
   nsCOMArray<nsIDOMWindow> windowListeners;
   for (PRUint32 i = 0; i < mWindowListeners[type]->Length(); i++) {
diff --git a/dom/wifi/libnetutils.js b/dom/wifi/libnetutils.js
deleted file mode 100644
index db36f4e07f84..000000000000
--- a/dom/wifi/libnetutils.js
+++ /dev/null
@@ -1,150 +0,0 @@
-/* -*- Mode: Java; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-/* vim: set shiftwidth=2 tabstop=2 autoindent cindent expandtab: */
-
-"use strict";
-
-let libnetutils = (function () {
-  let library = ctypes.open("libnetutils.so");
-  let cutils = ctypes.open("libcutils.so");
-
-  let cbuf = ctypes.char.array(4096)();
-  let c_property_get = cutils.declare("property_get", ctypes.default_abi,
-                                      ctypes.int,       // return value: length
-                                      ctypes.char.ptr,  // key
-                                      ctypes.char.ptr,  // value
-                                      ctypes.char.ptr); // default
-  let property_get = function (key, defaultValue) {
-    if (defaultValue === undefined) {
-      defaultValue = null;
-    }
-    c_property_get(key, cbuf, defaultValue);
-    return cbuf.readString();
-  }
-
-  let sdkVersion = parseInt(property_get("ro.build.version.sdk"));
-
-  let iface = {
-    ifc_enable: library.declare("ifc_enable", ctypes.default_abi, ctypes.int, ctypes.char.ptr),
-    ifc_disable: library.declare("ifc_disable", ctypes.default_abi, ctypes.int, ctypes.char.ptr),
-    ifc_add_host_route: library.declare("ifc_add_host_route", ctypes.default_abi, ctypes.int, ctypes.char.ptr, ctypes.int),
-    ifc_remove_host_routes: library.declare("ifc_remove_host_routes", ctypes.default_abi, ctypes.int, ctypes.char.ptr),
-    ifc_set_default_route: library.declare("ifc_set_default_route", ctypes.default_abi, ctypes.int, ctypes.char.ptr, ctypes.int),
-    ifc_get_default_route: library.declare("ifc_get_default_route", ctypes.default_abi, ctypes.int, ctypes.char.ptr),
-    ifc_remove_default_route: library.declare("ifc_remove_default_route", ctypes.default_abi, ctypes.int, ctypes.char.ptr),
-    ifc_reset_connections: library.declare("ifc_reset_connections", ctypes.default_abi, ctypes.int, ctypes.char.ptr),
-    ifc_configure: library.declare("ifc_configure", ctypes.default_abi, ctypes.int, ctypes.char.ptr,
-                                   ctypes.int, ctypes.int, ctypes.int, ctypes.int, ctypes.int),
-    dhcp_stop: library.declare("dhcp_stop", ctypes.default_abi, ctypes.int, ctypes.char.ptr),
-    dhcp_release_lease: library.declare("dhcp_release_lease", ctypes.default_abi, ctypes.int, ctypes.char.ptr),
-    dhcp_get_errmsg: library.declare("dhcp_get_errmsg", ctypes.default_abi, ctypes.char.ptr),
-  };
-
-  if (sdkVersion >= 15) {
-    let ipaddrbuf = ctypes.char.array(4096)();
-    let gatewaybuf = ctypes.char.array(4096)();
-    let prefixLen = ctypes.int();
-    let dns1buf = ctypes.char.array(4096)();
-    let dns2buf = ctypes.char.array(4096)();
-    let serverbuf = ctypes.char.array(4096)();
-    let lease = ctypes.int();
-    let c_dhcp_do_request =
-      library.declare("dhcp_do_request", ctypes.default_abi,
-                      ctypes.int,      // [return]
-                      ctypes.char.ptr, // ifname
-                      ctypes.char.ptr, // ipaddr
-                      ctypes.char.ptr, // gateway
-                      ctypes.int.ptr,  // prefixlen
-                      ctypes.char.ptr, // dns1
-                      ctypes.char.ptr, // dns2
-                      ctypes.char.ptr, // server
-                      ctypes.int.ptr); // lease
-
-    let stringToIp = function (s) {
-      if (!s) return 0;
-      let comps = s.split(".");
-      return ((parseInt(comps[0]) & 0xff) <<  0 |
-              (parseInt(comps[1]) & 0xff) <<  8 |
-              (parseInt(comps[2]) & 0xff) << 16 |
-              (parseInt(comps[3]) & 0xff) << 24);
-    }
-
-    let makeMask = function (len) {
-      let mask = 0;
-      for (let i = 0; i < len; ++i)
-        mask |= (1 << i);
-      return mask;
-    }
-
-    iface.dhcp_do_request = function (ifname) {
-      let ret = c_dhcp_do_request(ifname,
-                                  ipaddrbuf,
-                                  gatewaybuf,
-                                  prefixLen.address(),
-                                  dns1buf,
-                                  dns2buf,
-                                  serverbuf,
-                                  lease.address());
-      return {
-          ret: ret |0,
-          ipaddr: stringToIp(ipaddrbuf.readString()),
-          gateway: stringToIp(gatewaybuf.readString()),
-          mask: makeMask(prefixLen),
-          dns1: stringToIp(dns1buf.readString()),
-          dns2: stringToIp(dns2buf.readString()),
-          server: stringToIp(serverbuf.readString()),
-          lease: lease |0
-      };
-    };
-    // dhcp_do_request_renew() went away in newer libnetutils.
-    iface.dhcp_do_request_renew = iface.dhcp_do_request;
-  } else {
-    let ints = ctypes.int.array(8)();
-    let c_dhcp_do_request =
-      library.declare("dhcp_do_request", ctypes.default_abi,
-                      ctypes.int,      // [return]
-                      ctypes.char.ptr, // ifname
-                      ctypes.int.ptr,  // ipaddr
-                      ctypes.int.ptr,  // gateway
-                      ctypes.int.ptr,  // mask
-                      ctypes.int.ptr,  // dns1
-                      ctypes.int.ptr,  // dns2
-                      ctypes.int.ptr,  // server
-                      ctypes.int.ptr); // lease
-    let c_dhcp_do_request_renew =
-      library.declare("dhcp_do_request_renew", ctypes.default_abi,
-                      ctypes.int, // [return]
-                      ctypes.char.ptr, // ifname
-                      ctypes.int.ptr,  // ipaddr
-                      ctypes.int.ptr,  // gateway
-                      ctypes.int.ptr,  // mask
-                      ctypes.int.ptr,  // dns1
-                      ctypes.int.ptr,  // dns2
-                      ctypes.int.ptr,  // server
-                      ctypes.int.ptr); // lease
-
-    let makeRequestWrapper = function (c_fn) {
-      return function (ifname) {
-        let ret = c_fn(ifname,
-                       ints.addressOfElement(0),
-                       ints.addressOfElement(1),
-                       ints.addressOfElement(2),
-                       ints.addressOfElement(3),
-                       ints.addressOfElement(4),
-                       ints.addressOfElement(5),
-                       ints.addressOfElement(6));
-        return { ret: ret |0, ipaddr: ints[0] |0, gateway: ints[1] |0,
-                 mask: ints[2] |0, dns1: ints[3] |0, dns2: ints[4] |0,
-                 server: ints[5] |0, lease: ints[6] |0 };
-      };
-    }
-
-    iface.dhcp_do_request = makeRequestWrapper(c_dhcp_do_request);
-    iface.dhcp_do_request_renew = makeRequestWrapper(c_dhcp_do_request_renew);
-  }
-
-  return iface;
-})();
diff --git a/embedding/examples/Makefile.in b/embedding/examples/Makefile.in
deleted file mode 100644
index be26e62b74c0..000000000000
--- a/embedding/examples/Makefile.in
+++ /dev/null
@@ -1,15 +0,0 @@
-# 
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-DEPTH		= ../..
-topsrcdir	= @top_srcdir@
-srcdir		= @srcdir@
-VPATH		= @srcdir@
-
-include $(DEPTH)/config/autoconf.mk
-
-DIRS=
-
-include $(topsrcdir)/config/rules.mk
diff --git a/embedding/examples/readme.txt b/embedding/examples/readme.txt
deleted file mode 100644
index 8422b34bc822..000000000000
--- a/embedding/examples/readme.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-This folder contains sample applications developed using the Gecko embedding
-APIs.
-
diff --git a/js/src/builtin/RegExp.cpp b/js/src/builtin/RegExp.cpp
index 9d896d72980d..dfb078f7e2e0 100644
--- a/js/src/builtin/RegExp.cpp
+++ b/js/src/builtin/RegExp.cpp
@@ -295,12 +295,13 @@ regexp_compile(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, regexp_compile, &RegExpClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, regexp_compile, &RegExpClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
-    RegExpObjectBuilder builder(cx, &obj->asRegExp());
+    RegExpObjectBuilder builder(cx, &thisObj->asRegExp());
     return CompileRegExpObject(cx, builder, args);
 }
 
@@ -333,12 +334,13 @@ regexp_toString(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, regexp_toString, &RegExpClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, regexp_toString, &RegExpClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
-    JSString *str = obj->asRegExp().toString(cx);
+    JSString *str = thisObj->asRegExp().toString(cx);
     if (!str)
         return false;
 
@@ -540,12 +542,13 @@ ExecuteRegExp(JSContext *cx, Native native, unsigned argc, Value *vp)
     CallArgs args = CallArgsFromVp(argc, vp);
 
     /* Step 1. */
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, native, &RegExpClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, native, &RegExpClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
-    Rooted<RegExpObject*> reobj(cx, &obj->asRegExp());
+    Rooted<RegExpObject*> reobj(cx, &thisObj->asRegExp());
 
     RegExpGuard re;
     if (StartsWithGreedyStar(reobj->getSource())) {
diff --git a/js/src/gc/Root.h b/js/src/gc/Root.h
index 9d5aeb811731..729271c62885 100644
--- a/js/src/gc/Root.h
+++ b/js/src/gc/Root.h
@@ -122,6 +122,7 @@ class Handle
 
 typedef Handle<JSObject*>    HandleObject;
 typedef Handle<JSFunction*>  HandleFunction;
+typedef Handle<JSScript*>    HandleScript;
 typedef Handle<JSString*>    HandleString;
 typedef Handle<jsid>         HandleId;
 typedef Handle<Value>        HandleValue;
@@ -224,6 +225,7 @@ Handle<T>::Handle(const Rooted<S> &root)
 
 typedef Rooted<JSObject*>    RootedObject;
 typedef Rooted<JSFunction*>  RootedFunction;
+typedef Rooted<JSScript*>    RootedScript;
 typedef Rooted<JSString*>    RootedString;
 typedef Rooted<jsid>         RootedId;
 typedef Rooted<Value>        RootedValue;
diff --git a/js/src/jit-test/tests/basic/testBug761439.js b/js/src/jit-test/tests/basic/testBug761439.js
new file mode 100644
index 000000000000..cda3a45f4909
--- /dev/null
+++ b/js/src/jit-test/tests/basic/testBug761439.js
@@ -0,0 +1,5 @@
+var b = new ArrayBuffer(4);
+var dv = new DataView(b);
+dv.setInt32(0, 42);
+var w = wrap(dv);
+assertEq(DataView.prototype.getInt32.call(w, 0), 42);
diff --git a/js/src/jsapi-tests/Makefile.in b/js/src/jsapi-tests/Makefile.in
index 605153bc43bd..0ceee042f695 100644
--- a/js/src/jsapi-tests/Makefile.in
+++ b/js/src/jsapi-tests/Makefile.in
@@ -18,7 +18,9 @@ CPPSRCS = \
   selfTest.cpp \
   testAddPropertyPropcache.cpp \
   testArgumentsObject.cpp \
+  testBindCallable.cpp \
   testBug604087.cpp \
+  testCallNonGenericMethodOnProxy.cpp \
   testChromeBuffer.cpp \
   testClassGetter.cpp \
   testCloneScript.cpp \
@@ -61,7 +63,6 @@ CPPSRCS = \
   testValueABI.cpp \
   testVersion.cpp \
   testXDR.cpp \
-  testBindCallable.cpp \
   $(NULL)
 
 CSRCS = \
diff --git a/js/src/jsapi-tests/testCallNonGenericMethodOnProxy.cpp b/js/src/jsapi-tests/testCallNonGenericMethodOnProxy.cpp
new file mode 100644
index 000000000000..ac9142b998b4
--- /dev/null
+++ b/js/src/jsapi-tests/testCallNonGenericMethodOnProxy.cpp
@@ -0,0 +1,82 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "tests.h"
+
+using namespace JS;
+
+static JSClass CustomClass = {
+  "CustomClass",
+  JSCLASS_HAS_RESERVED_SLOTS(1),
+  JS_PropertyStub,
+  JS_PropertyStub,
+  JS_PropertyStub,
+  JS_StrictPropertyStub,
+  JS_EnumerateStub,
+  JS_ResolveStub,
+  JS_ConvertStub
+};
+
+static const uint32_t CUSTOM_SLOT = 0;
+
+static JSBool
+CustomMethod(JSContext *cx, unsigned argc, Value *vp)
+{
+  const Value &thisv = JS_THIS_VALUE(cx, vp);
+  JSObject *thisObj;
+  if (!thisv.isObject() || JS_GetClass((thisObj = &thisv.toObject())) != &CustomClass)
+    return JS_CallNonGenericMethodOnProxy(cx, argc, vp, CustomMethod, &CustomClass);
+
+  JS_SET_RVAL(cx, vp, JS_GetReservedSlot(thisObj, CUSTOM_SLOT));
+  return true;
+}
+
+BEGIN_TEST(test_CallNonGenericMethodOnProxy)
+{
+  // Create the first global object and compartment
+  JSObject *globalA = JS_NewCompartmentAndGlobalObject(cx, getGlobalClass(), NULL);
+  CHECK(globalA);
+
+  JSObject *customA = JS_NewObject(cx, &CustomClass, NULL, NULL);
+  CHECK(customA);
+  JS_SetReservedSlot(customA, CUSTOM_SLOT, Int32Value(17));
+
+  JSFunction *customMethodA = JS_NewFunction(cx, CustomMethod, 0, 0, customA, "customMethodA");
+  CHECK(customMethodA);
+
+  jsval rval;
+  CHECK(JS_CallFunction(cx, customA, customMethodA, 0, NULL, &rval));
+  CHECK_SAME(rval, Int32Value(17));
+
+  // Now create the second global object and compartment...
+  {
+    JSObject *globalB = JS_NewCompartmentAndGlobalObject(cx, getGlobalClass(), NULL);
+    CHECK(globalB);
+
+    // ...and enter it.
+    JSAutoEnterCompartment enter;
+    CHECK(enter.enter(cx, globalB));
+
+    JSObject *customB = JS_NewObject(cx, &CustomClass, NULL, NULL);
+    CHECK(customB);
+    JS_SetReservedSlot(customB, CUSTOM_SLOT, Int32Value(42));
+
+    JSFunction *customMethodB = JS_NewFunction(cx, CustomMethod, 0, 0, customB, "customMethodB");
+    CHECK(customMethodB);
+
+    jsval rval;
+    CHECK(JS_CallFunction(cx, customB, customMethodB, 0, NULL, &rval));
+    CHECK_SAME(rval, Int32Value(42));
+
+    JSObject *wrappedCustomA = customA;
+    CHECK(JS_WrapObject(cx, &wrappedCustomA));
+
+    jsval rval2;
+    CHECK(JS_CallFunction(cx, wrappedCustomA, customMethodB, 0, NULL, &rval2));
+    CHECK_SAME(rval, Int32Value(42));
+  }
+
+  return true;
+}
+END_TEST(test_CallNonGenericMethodOnProxy)
diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index acf260ece541..e37f349da2cd 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -3440,49 +3440,6 @@ JS_DeepFreezeObject(JSContext *cx, JSObject *obj)
     return true;
 }
 
-JS_PUBLIC_API(JSObject *)
-JS_ConstructObject(JSContext *cx, JSClass *jsclasp, JSObject *parent)
-{
-    return JS_ConstructObjectWithArguments(cx, jsclasp, parent, 0, NULL);
-}
-
-JS_PUBLIC_API(JSObject *)
-JS_ConstructObjectWithArguments(JSContext *cx, JSClass *jsclasp, JSObject *parent,
-                                unsigned argc, jsval *argv)
-{
-    AssertNoGC(cx);
-    CHECK_REQUEST(cx);
-    assertSameCompartment(cx, parent, JSValueArray(argv, argc));
-
-    AutoArrayRooter argtvr(cx, argc, argv);
-
-    Class *clasp = Valueify(jsclasp);
-    if (!clasp)
-        clasp = &ObjectClass;    /* default class is Object */
-
-    JSProtoKey protoKey = GetClassProtoKey(clasp);
-
-    /* Protect constructor in case a crazy getter for .prototype uproots it. */
-    RootedValue value(cx);
-    if (!js_FindClassObject(cx, parent, protoKey, value.address(), clasp))
-        return NULL;
-
-    Value rval;
-    if (!InvokeConstructor(cx, value, argc, argv, &rval))
-        return NULL;
-
-    /*
-     * If the instance's class differs from what was requested, throw a type
-     * error.
-     */
-    if (!rval.isObject() || rval.toObject().getClass() != clasp) {
-        JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
-                             JSMSG_WRONG_CONSTRUCTOR, clasp->name);
-        return NULL;
-    }
-    return &rval.toObject();
-}
-
 static JSBool
 LookupPropertyById(JSContext *cx, JSObject *obj, HandleId id, unsigned flags,
                    JSObject **objp, JSProperty **propp)
@@ -4845,6 +4802,14 @@ JS_DefineFunctionById(JSContext *cx, JSObject *obj_, jsid id_, JSNative call,
     return js_DefineFunction(cx, obj, id, call, nargs, attrs);
 }
 
+extern JS_PUBLIC_API(JSBool)
+JS_CallNonGenericMethodOnProxy(JSContext *cx, unsigned argc, jsval *vp, JSNative native,
+                               JSClass *clasp)
+{
+    CallArgs args = CallArgsFromVp(argc, vp);
+    return HandleNonGenericMethodClassMismatch(cx, args, native, Valueify(clasp));
+}
+
 struct AutoLastFrameCheck {
     AutoLastFrameCheck(JSContext *cx JS_GUARD_OBJECT_NOTIFIER_PARAM)
       : cx(cx) {
@@ -5344,7 +5309,8 @@ JS_ExecuteScript(JSContext *cx, JSObject *obj, JSScript *scriptArg, jsval *rval)
      * mozilla, but there doesn't seem to be one, so we handle it here.
      */
     if (scriptArg->compartment() != obj->compartment()) {
-        script = CloneScript(cx, scriptArg);
+        RootedScript scriptArgRoot(cx, scriptArg);
+        script = CloneScript(cx, scriptArgRoot);
         if (!script.get())
             return false;
     } else {
diff --git a/js/src/jsapi.h b/js/src/jsapi.h
index f27df2712ee6..f6dfa03fe0cc 100644
--- a/js/src/jsapi.h
+++ b/js/src/jsapi.h
@@ -3811,7 +3811,6 @@ JS_IdToValue(JSContext *cx, jsid id, jsval *vp);
 #define JSRESOLVE_ASSIGNING     0x02    /* resolve on the left of assignment */
 #define JSRESOLVE_DETECTING     0x04    /* 'if (o.p)...' or '(o.p) ?...:...' */
 #define JSRESOLVE_DECLARING     0x08    /* var, const, or function prolog op */
-#define JSRESOLVE_WITH          0x10    /* resolve inside a with statement */
 
 /*
  * Invoke the [[DefaultValue]] hook (see ES5 8.6.2) with the provided hint on
@@ -3976,13 +3975,6 @@ JS_DeepFreezeObject(JSContext *cx, JSObject *obj);
 extern JS_PUBLIC_API(JSBool)
 JS_FreezeObject(JSContext *cx, JSObject *obj);
 
-extern JS_PUBLIC_API(JSObject *)
-JS_ConstructObject(JSContext *cx, JSClass *clasp, JSObject *parent);
-
-extern JS_PUBLIC_API(JSObject *)
-JS_ConstructObjectWithArguments(JSContext *cx, JSClass *clasp, JSObject *parent,
-                                unsigned argc, jsval *argv);
-
 extern JS_PUBLIC_API(JSObject *)
 JS_New(JSContext *cx, JSObject *ctor, unsigned argc, jsval *argv);
 
@@ -4473,6 +4465,66 @@ JS_DefineFunctionById(JSContext *cx, JSObject *obj, jsid id, JSNative call,
 extern JS_PUBLIC_API(JSObject *)
 JS_CloneFunctionObject(JSContext *cx, JSObject *funobj, JSObject *parent);
 
+/*
+ * Methods usually act upon |this| objects only from a single global object and
+ * compartment.  Sometimes, however, a method must act upon |this| values from
+ * multiple global objects or compartments.  In such cases the |this| value a
+ * method might see will be wrapped, such that various access to the object --
+ * to its class, its private data, its reserved slots, and so on -- will not
+ * work properly without entering that object's compartment.  This method
+ * implements a solution to this problem.
+ *
+ * When called, this method attempts to unwrap |this| and call |native| on the
+ * underlying object with the provided arguments, entering |this|'s compartment
+ * in the process.  It is critical that |this|-checking occur right at the
+ * start of |native| so that reentrant invocation is idempotent!  If the call
+ * fails because |this| isn't a proxy to another object, a TypeError is thrown.
+ *
+ * The following example demonstrates the most common way this method might be
+ * used, to accept objects having only a particular class but which might be
+ * found in another compartment/global object or might be a proxy of some sort:
+ *
+ *     static JSClass MyClass = { "MyClass", JSCLASS_HAS_PRIVATE, ... };
+ *
+ *     inline bool
+ *     RequireMyClassThis(JSContext *cx, unsigned argc, JSObject **thisObj)
+ *     {
+ *         const Value &thisv = JS_THIS_VALUE(cx, vp);
+ *         if (!thisv.isObject()) {
+ *             JS_ReportError(cx, "this must be an object");
+ *             return false;
+ *         }
+ *
+ *         JSObject *obj = &thisv.toObject();
+ *         if (JS_GetClass(obj) == &MyClass) {
+ *             *thisObj = obj;
+ *             return true;
+ *         }
+ *
+ *         *thisObj = NULL; // prevent infinite recursion into calling method
+ *         return JS_CallNonGenericMethodOnProxy(cx, argc, vp, method, &MyClass);
+ *     }
+ *
+ *     static JSBool
+ *     Method(JSContext *cx, unsigned argc, jsval *vp)
+ *     {
+ *         if (!RequireMyClassThis(cx, argc, vp, &thisObj))
+ *             return false;
+ *         if (!thisObj)
+ *             return true; // method invocation was performed by nested call
+ *
+ *         // thisObj definitely has MyClass: implement the guts of the method.
+ *         void *priv = JS_GetPrivate(thisObj);
+ *         ...
+ *     }
+ *
+ * This method doesn't do any checking of its own, except to throw a TypeError
+ * if the |this| in the arguments isn't a proxy that can be unwrapped for the
+ * recursive call.  The client is responsible for performing all type-checks!
+ */
+extern JS_PUBLIC_API(JSBool)
+JS_CallNonGenericMethodOnProxy(JSContext *cx, unsigned argc, jsval *vp, JSNative native, JSClass *clasp);
+
 /*
  * Given a buffer, return JS_FALSE if the buffer might become a valid
  * javascript statement with the addition of more lines.  Otherwise return
diff --git a/js/src/jsdate.cpp b/js/src/jsdate.cpp
index 702d513a632a..245832729e32 100644
--- a/js/src/jsdate.cpp
+++ b/js/src/jsdate.cpp
@@ -1385,12 +1385,13 @@ date_getTime(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, date_getTime, &DateClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, date_getTime, &DateClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
-    args.rval() = obj->getDateUTCTime();
+    args.rval() = thisObj->getDateUTCTime();
     return true;
 }
 
@@ -1399,15 +1400,16 @@ date_getYear(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, date_getYear, &DateClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, date_getYear, &DateClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
-    if (!GetAndCacheLocalTime(cx, obj))
+    if (!GetAndCacheLocalTime(cx, thisObj))
         return false;
 
-    Value yearVal = obj->getSlot(JSObject::JSSLOT_DATE_LOCAL_YEAR);
+    Value yearVal = thisObj->getSlot(JSObject::JSSLOT_DATE_LOCAL_YEAR);
     if (yearVal.isInt32()) {
         /* Follow ECMA-262 to the letter, contrary to IE JScript. */
         int year = yearVal.toInt32() - 1900;
@@ -1424,15 +1426,16 @@ date_getFullYear(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, date_getFullYear, &DateClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, date_getFullYear, &DateClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
-    if (!GetAndCacheLocalTime(cx, obj))
+    if (!GetAndCacheLocalTime(cx, thisObj))
         return false;
 
-    args.rval() = obj->getSlot(JSObject::JSSLOT_DATE_LOCAL_YEAR);
+    args.rval() = thisObj->getSlot(JSObject::JSSLOT_DATE_LOCAL_YEAR);
     return true;
 }
 
@@ -1441,12 +1444,13 @@ date_getUTCFullYear(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, date_getUTCFullYear, &DateClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, date_getUTCFullYear, &DateClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
-    double result = obj->getDateUTCTime().toNumber();
+    double result = thisObj->getDateUTCTime().toNumber();
     if (MOZ_DOUBLE_IS_FINITE(result))
         result = YearFromTime(result);
 
@@ -1459,15 +1463,16 @@ date_getMonth(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, date_getMonth, &DateClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, date_getMonth, &DateClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
-    if (!GetAndCacheLocalTime(cx, obj))
+    if (!GetAndCacheLocalTime(cx, thisObj))
         return false;
 
-    args.rval() = obj->getSlot(JSObject::JSSLOT_DATE_LOCAL_MONTH);
+    args.rval() = thisObj->getSlot(JSObject::JSSLOT_DATE_LOCAL_MONTH);
     return true;
 }
 
@@ -1476,12 +1481,13 @@ date_getUTCMonth(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, date_getUTCMonth, &DateClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, date_getUTCMonth, &DateClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
-    double result = obj->getDateUTCTime().toNumber();
+    double result = thisObj->getDateUTCTime().toNumber();
     if (MOZ_DOUBLE_IS_FINITE(result))
         result = MonthFromTime(result);
 
@@ -1494,15 +1500,16 @@ date_getDate(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, date_getDate, &DateClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, date_getDate, &DateClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
-    if (!GetAndCacheLocalTime(cx, obj))
+    if (!GetAndCacheLocalTime(cx, thisObj))
         return false;
 
-    args.rval() = obj->getSlot(JSObject::JSSLOT_DATE_LOCAL_DATE);
+    args.rval() = thisObj->getSlot(JSObject::JSSLOT_DATE_LOCAL_DATE);
     return true;
 }
 
@@ -1511,12 +1518,13 @@ date_getUTCDate(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, date_getUTCDate, &DateClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, date_getUTCDate, &DateClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
-    double result = obj->getDateUTCTime().toNumber();
+    double result = thisObj->getDateUTCTime().toNumber();
     if (MOZ_DOUBLE_IS_FINITE(result))
         result = DateFromTime(result);
 
@@ -1529,15 +1537,16 @@ date_getDay(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, date_getDay, &DateClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, date_getDay, &DateClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
-    if (!GetAndCacheLocalTime(cx, obj))
+    if (!GetAndCacheLocalTime(cx, thisObj))
         return false;
 
-    args.rval() = obj->getSlot(JSObject::JSSLOT_DATE_LOCAL_DAY);
+    args.rval() = thisObj->getSlot(JSObject::JSSLOT_DATE_LOCAL_DAY);
     return true;
 }
 
@@ -1546,12 +1555,13 @@ date_getUTCDay(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, date_getUTCDay, &DateClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, date_getUTCDay, &DateClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
-    double result = obj->getDateUTCTime().toNumber();
+    double result = thisObj->getDateUTCTime().toNumber();
     if (MOZ_DOUBLE_IS_FINITE(result))
         result = WeekDay(result);
 
@@ -1564,15 +1574,16 @@ date_getHours(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, date_getHours, &DateClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, date_getHours, &DateClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
-    if (!GetAndCacheLocalTime(cx, obj))
+    if (!GetAndCacheLocalTime(cx, thisObj))
         return false;
 
-    args.rval() = obj->getSlot(JSObject::JSSLOT_DATE_LOCAL_HOURS);
+    args.rval() = thisObj->getSlot(JSObject::JSSLOT_DATE_LOCAL_HOURS);
     return true;
 }
 
@@ -1581,12 +1592,13 @@ date_getUTCHours(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, date_getUTCHours, &DateClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, date_getUTCHours, &DateClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
-    double result = obj->getDateUTCTime().toNumber();
+    double result = thisObj->getDateUTCTime().toNumber();
     if (MOZ_DOUBLE_IS_FINITE(result))
         result = HourFromTime(result);
 
@@ -1599,15 +1611,16 @@ date_getMinutes(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, date_getMinutes, &DateClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, date_getMinutes, &DateClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
-    if (!GetAndCacheLocalTime(cx, obj))
+    if (!GetAndCacheLocalTime(cx, thisObj))
         return false;
 
-    args.rval() = obj->getSlot(JSObject::JSSLOT_DATE_LOCAL_MINUTES);
+    args.rval() = thisObj->getSlot(JSObject::JSSLOT_DATE_LOCAL_MINUTES);
     return true;
 }
 
@@ -1616,12 +1629,13 @@ date_getUTCMinutes(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, date_getUTCMinutes, &DateClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, date_getUTCMinutes, &DateClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
-    double result = obj->getDateUTCTime().toNumber();
+    double result = thisObj->getDateUTCTime().toNumber();
     if (MOZ_DOUBLE_IS_FINITE(result))
         result = MinFromTime(result);
 
@@ -1636,15 +1650,16 @@ date_getUTCSeconds(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, date_getUTCSeconds, &DateClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, date_getUTCSeconds, &DateClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
-    if (!GetAndCacheLocalTime(cx, obj))
+    if (!GetAndCacheLocalTime(cx, thisObj))
         return false;
 
-    args.rval() = obj->getSlot(JSObject::JSSLOT_DATE_LOCAL_SECONDS);
+    args.rval() = thisObj->getSlot(JSObject::JSSLOT_DATE_LOCAL_SECONDS);
     return true;
 }
 
@@ -1655,12 +1670,13 @@ date_getUTCMilliseconds(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, date_getUTCMilliseconds, &DateClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, date_getUTCMilliseconds, &DateClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
-    double result = obj->getDateUTCTime().toNumber();
+    double result = thisObj->getDateUTCTime().toNumber();
     if (MOZ_DOUBLE_IS_FINITE(result))
         result = msFromTime(result);
 
@@ -1673,15 +1689,16 @@ date_getTimezoneOffset(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, date_getTimezoneOffset, &DateClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, date_getTimezoneOffset, &DateClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
-    double utctime = obj->getDateUTCTime().toNumber();
+    double utctime = thisObj->getDateUTCTime().toNumber();
 
     double localtime;
-    if (!GetAndCacheLocalTime(cx, obj, &localtime))
+    if (!GetAndCacheLocalTime(cx, thisObj, &localtime))
         return false;
 
     /*
@@ -1699,13 +1716,14 @@ date_setTime(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    RootedObject obj(cx, NonGenericMethodGuard(cx, args, date_setTime, &DateClass, &ok));
-    if (!obj)
-        return ok;
+    RootedObject thisObj(cx);
+    if (!NonGenericMethodGuard(cx, args, date_setTime, &DateClass, thisObj.address()))
+        return false;
+    if (!thisObj)
+        return true;
 
     if (args.length() == 0) {
-        SetDateToNaN(cx, obj, &args.rval());
+        SetDateToNaN(cx, thisObj, &args.rval());
         return true;
     }
 
@@ -1713,7 +1731,7 @@ date_setTime(JSContext *cx, unsigned argc, Value *vp)
     if (!ToNumber(cx, args[0], &result))
         return false;
 
-    return SetUTCTime(cx, obj, TimeClip(result), &args.rval());
+    return SetUTCTime(cx, thisObj, TimeClip(result), &args.rval());
 }
 
 static JSBool
@@ -1721,12 +1739,13 @@ date_makeTime(JSContext *cx, Native native, unsigned maxargs, JSBool local, unsi
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    RootedObject obj(cx, NonGenericMethodGuard(cx, args, native, &DateClass, &ok));
-    if (!obj)
-        return ok;
+    RootedObject thisObj(cx);
+    if (!NonGenericMethodGuard(cx, args, native, &DateClass, thisObj.address()))
+        return false;
+    if (!thisObj)
+        return true;
 
-    double result = obj->getDateUTCTime().toNumber();
+    double result = thisObj->getDateUTCTime().toNumber();
 
     /*
      * Satisfy the ECMA rule that if a function is called with
@@ -1738,7 +1757,7 @@ date_makeTime(JSContext *cx, Native native, unsigned maxargs, JSBool local, unsi
      * d.setMilliseconds()" returns NaN.  Blech.
      */
     if (args.length() == 0) {
-        SetDateToNaN(cx, obj, &args.rval());
+        SetDateToNaN(cx, thisObj, &args.rval());
         return true;
     }
 
@@ -1767,7 +1786,7 @@ date_makeTime(JSContext *cx, Native native, unsigned maxargs, JSBool local, unsi
 
     /* set Date to NaN, after argument evaluation. */
     if (argIsNotFinite) {
-        SetDateToNaN(cx, obj, &args.rval());
+        SetDateToNaN(cx, thisObj, &args.rval());
         return true;
     }
 
@@ -1809,7 +1828,7 @@ date_makeTime(JSContext *cx, Native native, unsigned maxargs, JSBool local, unsi
     if (local)
         result = UTC(result, cx);
 
-    return SetUTCTime(cx, obj, TimeClip(result), &args.rval());
+    return SetUTCTime(cx, thisObj, TimeClip(result), &args.rval());
 }
 
 static JSBool
@@ -1865,16 +1884,17 @@ date_makeDate(JSContext *cx, Native native, unsigned maxargs, JSBool local, unsi
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    RootedObject obj(cx, NonGenericMethodGuard(cx, args, native, &DateClass, &ok));
-    if (!obj)
-        return ok;
+    RootedObject thisObj(cx);
+    if (!NonGenericMethodGuard(cx, args, native, &DateClass, thisObj.address()))
+        return false;
+    if (!thisObj)
+        return true;
 
-    double result = obj->getDateUTCTime().toNumber();
+    double result = thisObj->getDateUTCTime().toNumber();
 
     /* See complaint about ECMA in date_makeTime. */
     if (args.length() == 0) {
-        SetDateToNaN(cx, obj, &args.rval());
+        SetDateToNaN(cx, thisObj, &args.rval());
         return true;
     }
 
@@ -1894,7 +1914,7 @@ date_makeDate(JSContext *cx, Native native, unsigned maxargs, JSBool local, unsi
 
     /* If we found a non-finite argument, set the date to NaN and return. */
     if (argIsNotFinite) {
-        SetDateToNaN(cx, obj, &args.rval());
+        SetDateToNaN(cx, thisObj, &args.rval());
         return true;
     }
 
@@ -1939,7 +1959,7 @@ date_makeDate(JSContext *cx, Native native, unsigned maxargs, JSBool local, unsi
     if (local)
         result = UTC(result, cx);
 
-    return SetUTCTime(cx, obj, TimeClip(result), &args.rval());
+    return SetUTCTime(cx, thisObj, TimeClip(result), &args.rval());
 }
 
 static JSBool
@@ -1983,24 +2003,25 @@ date_setYear(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    RootedObject obj(cx, NonGenericMethodGuard(cx, args, date_setYear, &DateClass, &ok));
-    if (!obj)
-        return ok;
+    RootedObject thisObj(cx);
+    if (!NonGenericMethodGuard(cx, args, date_setYear, &DateClass, thisObj.address()))
+        return false;
+    if (!thisObj)
+        return true;
 
     if (args.length() == 0) {
         /* Call this only after verifying that obj.[[Class]] = "Date". */
-        SetDateToNaN(cx, obj, &args.rval());
+        SetDateToNaN(cx, thisObj, &args.rval());
         return true;
     }
 
-    double result = obj->getDateUTCTime().toNumber();
+    double result = thisObj->getDateUTCTime().toNumber();
 
     double year;
     if (!ToNumber(cx, args[0], &year))
         return false;
     if (!MOZ_DOUBLE_IS_FINITE(year)) {
-        SetDateToNaN(cx, obj, &args.rval());
+        SetDateToNaN(cx, thisObj, &args.rval());
         return true;
     }
     year = ToInteger(year);
@@ -2012,7 +2033,7 @@ date_setYear(JSContext *cx, unsigned argc, Value *vp)
     result = MakeDate(day, TimeWithinDay(t));
     result = UTC(result, cx);
 
-    return SetUTCTime(cx, obj, TimeClip(result), &args.rval());
+    return SetUTCTime(cx, thisObj, TimeClip(result), &args.rval());
 }
 
 /* constants for toString, toUTCString */
@@ -2059,12 +2080,13 @@ static JSBool
 date_utc_format(JSContext *cx, Native native, CallArgs args,
                 void (*printFunc)(char*, size_t, double))
 {
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, native, &DateClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, native, &DateClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
-    double utctime = obj->getDateUTCTime().toNumber();
+    double utctime = thisObj->getDateUTCTime().toNumber();
 
     char buf[100];
     if (!MOZ_DOUBLE_IS_FINITE(utctime)) {
@@ -2338,12 +2360,13 @@ date_toLocaleHelper(JSContext *cx, unsigned argc, Value *vp, Native native, cons
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, native, &DateClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, native, &DateClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
-    return ToLocaleHelper(cx, args, obj, format);
+    return ToLocaleHelper(cx, args, thisObj, format);
 }
 
 static JSBool
@@ -2398,10 +2421,11 @@ date_toLocaleFormat(JSContext *cx, unsigned argc, Value *vp)
 
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, date_toLocaleFormat, &DateClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, date_toLocaleFormat, &DateClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
     JSString *fmt = ToString(cx, args[0]);
     if (!fmt)
@@ -2412,7 +2436,7 @@ date_toLocaleFormat(JSContext *cx, unsigned argc, Value *vp)
     if (!fmtbytes)
         return false;
 
-    return ToLocaleHelper(cx, args, obj, fmtbytes.ptr());
+    return ToLocaleHelper(cx, args, thisObj, fmtbytes.ptr());
 }
 
 static JSBool
@@ -2420,12 +2444,13 @@ date_toTimeString(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, date_toTimeString, &DateClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, date_toTimeString, &DateClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
-    return date_format(cx, obj->getDateUTCTime().toNumber(), FORMATSPEC_TIME, args);
+    return date_format(cx, thisObj->getDateUTCTime().toNumber(), FORMATSPEC_TIME, args);
 }
 
 static JSBool
@@ -2433,12 +2458,13 @@ date_toDateString(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, date_toDateString, &DateClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, date_toDateString, &DateClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
-    return date_format(cx, obj->getDateUTCTime().toNumber(), FORMATSPEC_DATE, args);
+    return date_format(cx, thisObj->getDateUTCTime().toNumber(), FORMATSPEC_DATE, args);
 }
 
 #if JS_HAS_TOSOURCE
@@ -2447,13 +2473,15 @@ date_toSource(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, date_toSource, &DateClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, date_toSource, &DateClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
     StringBuffer sb(cx);
-    if (!sb.append("(new Date(") || !NumberValueToStringBuffer(cx, obj->getDateUTCTime(), sb) ||
+    if (!sb.append("(new Date(") ||
+        !NumberValueToStringBuffer(cx, thisObj->getDateUTCTime(), sb) ||
         !sb.append("))"))
     {
         return false;
@@ -2472,12 +2500,13 @@ date_toString(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, date_toString, &DateClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, date_toString, &DateClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
-    return date_format(cx, obj->getDateUTCTime().toNumber(), FORMATSPEC_FULL, args);
+    return date_format(cx, thisObj->getDateUTCTime().toNumber(), FORMATSPEC_FULL, args);
 }
 
 static JSBool
@@ -2485,14 +2514,15 @@ date_valueOf(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, date_valueOf, &DateClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, date_valueOf, &DateClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
     /* If called directly with no arguments, convert to a time number. */
     if (argc == 0) {
-        args.rval() = obj->getDateUTCTime();
+        args.rval() = thisObj->getDateUTCTime();
         return true;
     }
 
@@ -2505,10 +2535,10 @@ date_valueOf(JSContext *cx, unsigned argc, Value *vp)
         return false;
     JSAtom *number_str = cx->runtime->atomState.typeAtoms[JSTYPE_NUMBER];
     if (EqualStrings(linear_str, number_str)) {
-        args.rval() = obj->getDateUTCTime();
+        args.rval() = thisObj->getDateUTCTime();
         return true;
     }
-    return date_format(cx, obj->getDateUTCTime().toNumber(), FORMATSPEC_FULL, args);
+    return date_format(cx, thisObj->getDateUTCTime().toNumber(), FORMATSPEC_FULL, args);
 }
 
 static JSFunctionSpec date_static_methods[] = {
diff --git a/js/src/jsfriendapi.cpp b/js/src/jsfriendapi.cpp
index 52a76992b256..ab4876e5a2a4 100644
--- a/js/src/jsfriendapi.cpp
+++ b/js/src/jsfriendapi.cpp
@@ -167,6 +167,12 @@ JS_WrapPropertyDescriptor(JSContext *cx, js::PropertyDescriptor *desc)
     return cx->compartment->wrap(cx, desc);
 }
 
+JS_FRIEND_API(JSBool)
+JS_WrapAutoIdVector(JSContext *cx, js::AutoIdVector &props)
+{
+    return cx->compartment->wrap(cx, props);
+}
+
 JS_FRIEND_API(void)
 JS_TraceShapeCycleCollectorChildren(JSTracer *trc, void *shape)
 {
diff --git a/js/src/jsfriendapi.h b/js/src/jsfriendapi.h
index 852db6f5718b..07f7d9a3f132 100644
--- a/js/src/jsfriendapi.h
+++ b/js/src/jsfriendapi.h
@@ -130,6 +130,9 @@ JS_CopyPropertiesFrom(JSContext *cx, JSObject *target, JSObject *obj);
 extern JS_FRIEND_API(JSBool)
 JS_WrapPropertyDescriptor(JSContext *cx, js::PropertyDescriptor *desc);
 
+extern JS_FRIEND_API(JSBool)
+JS_WrapAutoIdVector(JSContext *cx, JS::AutoIdVector &props);
+
 extern JS_FRIEND_API(JSBool)
 JS_EnumerateState(JSContext *cx, JSHandleObject obj, JSIterateOp enum_op, js::Value *statep, jsid *idp);
 
diff --git a/js/src/jsfun.cpp b/js/src/jsfun.cpp
index b9e09bb44ae6..339b538598f8 100644
--- a/js/src/jsfun.cpp
+++ b/js/src/jsfun.cpp
@@ -426,7 +426,7 @@ js::CloneInterpretedFunction(JSContext *cx, JSFunction *srcFun)
     if (!clone->clearType(cx))
         return NULL;
 
-    JSScript *clonedScript = CloneScript(cx, srcFun->script());
+    JSScript *clonedScript = CloneScript(cx, RootedScript(cx, srcFun->script()));
     if (!clonedScript)
         return NULL;
 
@@ -1295,7 +1295,7 @@ js_CloneFunctionObject(JSContext *cx, HandleFunction fun, HandleObject parent,
          * functions.
          */
         if (clone->isInterpreted()) {
-            JSScript *script = clone->script();
+            RootedScript script(cx, clone->script());
             JS_ASSERT(script);
             JS_ASSERT(script->compartment() == fun->compartment());
             JS_ASSERT(script->compartment() != cx->compartment);
diff --git a/js/src/jsinfer.cpp b/js/src/jsinfer.cpp
index 17d4dabdf784..8c3a26ec1405 100644
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -5508,15 +5508,18 @@ JSObject::shouldSplicePrototype(JSContext *cx)
 }
 
 bool
-JSObject::splicePrototype(JSContext *cx, JSObject *proto)
+JSObject::splicePrototype(JSContext *cx, JSObject *proto_)
 {
+    RootedObject proto(cx, proto_);
+    RootedObject self(cx, this);
+
     /*
      * For singleton types representing only a single JSObject, the proto
      * can be rearranged as needed without destroying type information for
      * the old or new types. Note that type constraints propagating properties
      * from the old prototype are not removed.
      */
-    JS_ASSERT_IF(cx->typeInferenceEnabled(), hasSingletonType());
+    JS_ASSERT_IF(cx->typeInferenceEnabled(), self->hasSingletonType());
 
     /* Inner objects may not appear on prototype chains. */
     JS_ASSERT_IF(proto, !proto->getClass()->ext.outerObject);
@@ -5525,7 +5528,7 @@ JSObject::splicePrototype(JSContext *cx, JSObject *proto)
      * Force type instantiation when splicing lazy types. This may fail,
      * in which case inference will be disabled for the compartment.
      */
-    TypeObject *type = getType(cx);
+    TypeObject *type = self->getType(cx);
     TypeObject *protoType = NULL;
     if (proto) {
         protoType = proto->getType(cx);
@@ -5537,7 +5540,7 @@ JSObject::splicePrototype(JSContext *cx, JSObject *proto)
         TypeObject *type = proto ? proto->getNewType(cx) : cx->compartment->getEmptyType(cx);
         if (!type)
             return false;
-        type_ = type;
+        self->type_ = type;
         return true;
     }
 
diff --git a/js/src/jsinterp.cpp b/js/src/jsinterp.cpp
index 4e8e1e6227c8..ea894439eb71 100644
--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -2329,11 +2329,11 @@ BEGIN_CASE(JSOP_GETXPROP)
 BEGIN_CASE(JSOP_LENGTH)
 BEGIN_CASE(JSOP_CALLPROP)
 {
-    Value rval;
-    if (!GetPropertyOperation(cx, regs.pc, regs.sp[-1], &rval))
+    RootedValue rval(cx);
+    if (!GetPropertyOperation(cx, regs.pc, regs.sp[-1], rval.address()))
         goto error;
 
-    TypeScript::Monitor(cx, script, regs.pc, rval);
+    TypeScript::Monitor(cx, script, regs.pc, rval.reference());
 
     regs.sp[-1] = rval;
     assertSameCompartment(cx, regs.sp[-1]);
diff --git a/js/src/jsinterpinlines.h b/js/src/jsinterpinlines.h
index 49028c90285b..1805f3a9adae 100644
--- a/js/src/jsinterpinlines.h
+++ b/js/src/jsinterpinlines.h
@@ -287,9 +287,9 @@ SetPropertyOperation(JSContext *cx, jsbytecode *pc, const Value &lval, const Val
                 /* Fast path for, e.g., plain Object instance properties. */
                 obj->nativeSetSlotWithType(cx, shape, rval);
             } else {
-                Value rref = rval;
+                RootedValue rref(cx, rval);
                 bool strict = cx->stack.currentScript()->strictModeCode;
-                if (!js_NativeSet(cx, obj, shape, false, strict, &rref))
+                if (!js_NativeSet(cx, obj, shape, false, strict, rref.address()))
                     return false;
             }
             return true;
diff --git a/js/src/jsiter.cpp b/js/src/jsiter.cpp
index bce911da94f0..58c7543da3ec 100644
--- a/js/src/jsiter.cpp
+++ b/js/src/jsiter.cpp
@@ -828,12 +828,13 @@ iterator_next(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    RootedObject obj(cx, NonGenericMethodGuard(cx, args, iterator_next, &IteratorClass, &ok));
-    if (!obj)
-        return ok;
+    RootedObject thisObj(cx);
+    if (!NonGenericMethodGuard(cx, args, iterator_next, &IteratorClass, thisObj.address()))
+        return false;
+    if (!thisObj)
+        return true;
 
-    if (!js_IteratorMore(cx, obj, &args.rval()))
+    if (!js_IteratorMore(cx, thisObj, &args.rval()))
         return false;
 
     if (!args.rval().toBoolean()) {
@@ -841,7 +842,7 @@ iterator_next(JSContext *cx, unsigned argc, Value *vp)
         return false;
     }
 
-    return js_IteratorNext(cx, obj, &args.rval());
+    return js_IteratorNext(cx, thisObj, &args.rval());
 }
 
 #define JSPROP_ROPERM   (JSPROP_READONLY | JSPROP_PERMANENT)
@@ -1582,12 +1583,13 @@ generator_op(JSContext *cx, Native native, JSGeneratorOp op, Value *vp, unsigned
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, native, &GeneratorClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, native, &GeneratorClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
-    JSGenerator *gen = (JSGenerator *) obj->getPrivate();
+    JSGenerator *gen = (JSGenerator *) thisObj->getPrivate();
     if (!gen) {
         /* This happens when obj is the generator prototype. See bug 352885. */
         goto closed_generator;
@@ -1630,7 +1632,7 @@ generator_op(JSContext *cx, Native native, JSGeneratorOp op, Value *vp, unsigned
     }
 
     bool undef = ((op == JSGENOP_SEND || op == JSGENOP_THROW) && args.length() != 0);
-    if (!SendToGenerator(cx, op, obj, gen, undef ? args[0] : UndefinedValue()))
+    if (!SendToGenerator(cx, op, thisObj, gen, undef ? args[0] : UndefinedValue()))
         return false;
 
     args.rval() = gen->fp->returnValue();
diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index f3adca88a830..46ef1fb4ef20 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -1930,7 +1930,7 @@ DefinePropertyOnObject(JSContext *cx, HandleObject obj, HandleId id, const PropD
 
     JS_ASSERT(obj == obj2);
 
-    const Shape *shape = reinterpret_cast<Shape *>(current);
+    Rooted<const Shape *> shape(cx, reinterpret_cast<Shape *>(current));
     do {
         if (desc.isAccessorDescriptor()) {
             if (!shape->isAccessorDescriptor())
@@ -3040,10 +3040,8 @@ Detecting(JSContext *cx, jsbytecode *pc)
 }
 
 /*
- * Infer lookup flags from the currently executing bytecode. This does
- * not attempt to infer JSRESOLVE_WITH, because the current bytecode
- * does not indicate whether we are in a with statement. Return defaultFlags
- * if a currently executing bytecode cannot be determined.
+ * Infer lookup flags from the currently executing bytecode, returning
+ * defaultFlags if a currently executing bytecode cannot be determined.
  */
 unsigned
 js_InferFlags(JSContext *cx, unsigned defaultFlags)
@@ -4974,7 +4972,7 @@ js_NativeSet(JSContext *cx, JSObject *obj, const Shape *shape, bool added, bool
     Rooted<const Shape *> shapeRoot(cx, shape);
 
     int32_t sample = cx->runtime->propertyRemovals;
-    if (!shape->set(cx, RootedObject(cx, obj), strict, vp))
+    if (!shapeRoot->set(cx, RootedObject(cx, obj), strict, vp))
         return false;
 
     /*
diff --git a/js/src/jsproxy.cpp b/js/src/jsproxy.cpp
index dfbc93d52f26..79e01b1c14f8 100644
--- a/js/src/jsproxy.cpp
+++ b/js/src/jsproxy.cpp
@@ -459,6 +459,7 @@ bool
 IndirectProxyHandler::nativeCall(JSContext *cx, JSObject *proxy, Class *clasp,
                                  Native native, CallArgs args)
 {
+    args.thisv() = ObjectValue(*GetProxyTargetObject(proxy));
     return CallJSNative(cx, native, args);
 }
 
diff --git a/js/src/jsscope.cpp b/js/src/jsscope.cpp
index b4722bdf7cfd..eafc1f66039b 100644
--- a/js/src/jsscope.cpp
+++ b/js/src/jsscope.cpp
@@ -965,7 +965,7 @@ JSObject::replaceWithNewEquivalentShape(JSContext *cx, Shape *oldShape, Shape *n
         RootedShape newRoot(cx, newShape);
         if (!toDictionaryMode(cx))
             return NULL;
-        oldShape = self->lastProperty();
+        oldShape = selfRoot->lastProperty();
         self = selfRoot;
         newShape = newRoot;
     }
@@ -976,7 +976,7 @@ JSObject::replaceWithNewEquivalentShape(JSContext *cx, Shape *oldShape, Shape *n
         newShape = js_NewGCShape(cx);
         if (!newShape)
             return NULL;
-        new (newShape) Shape(oldShape->base()->unowned(), 0);
+        new (newShape) Shape(oldRoot->base()->unowned(), 0);
         self = selfRoot;
         oldShape = oldRoot;
     }
@@ -1315,7 +1315,7 @@ EmptyShape::getInitialShape(JSContext *cx, Class *clasp, JSObject *proto, JSObje
 }
 
 void
-NewObjectCache::invalidateEntriesForShape(JSContext *cx, Shape *shape, JSObject *proto)
+NewObjectCache::invalidateEntriesForShape(JSContext *cx, Shape *shape, JSObject *proto_)
 {
     Class *clasp = shape->getObjectClass();
 
@@ -1323,7 +1323,8 @@ NewObjectCache::invalidateEntriesForShape(JSContext *cx, Shape *shape, JSObject
     if (CanBeFinalizedInBackground(kind, clasp))
         kind = GetBackgroundAllocKind(kind);
 
-    GlobalObject *global = &shape->getObjectParent()->global();
+    Rooted<GlobalObject *> global(cx, &shape->getObjectParent()->global());
+    RootedObject proto(cx, proto_);
     types::TypeObject *type = proto->getNewType(cx);
 
     EntryIndex entry;
diff --git a/js/src/jsscope.h b/js/src/jsscope.h
index 70d8117715f4..73edef007dc5 100644
--- a/js/src/jsscope.h
+++ b/js/src/jsscope.h
@@ -1110,8 +1110,8 @@ Shape::search(JSContext *cx, Shape *start, jsid id, Shape ***pspp, bool adding)
         if (start->isBigEnoughForAShapeTable()) {
             RootedShape startRoot(cx, start);
             RootedId idRoot(cx, id);
-            if (start->hashify(cx)) {
-                Shape **spp = start->table().search(id, adding);
+            if (startRoot->hashify(cx)) {
+                Shape **spp = startRoot->table().search(id, adding);
                 return SHAPE_FETCH(spp);
             }
             start = startRoot;
diff --git a/js/src/jsscopeinlines.h b/js/src/jsscopeinlines.h
index 1ddec3a97975..dc96897a9516 100644
--- a/js/src/jsscopeinlines.h
+++ b/js/src/jsscopeinlines.h
@@ -259,7 +259,7 @@ Shape::getUserId(JSContext *cx, jsid *idp) const
             return ValueToId(cx, Int32Value(id), idp);
         *idp = INT_TO_JSID(id);
     } else {
-        *idp = propid();
+        *idp = self->propid();
     }
     return true;
 }
@@ -274,11 +274,12 @@ Shape::get(JSContext* cx, HandleObject receiver, JSObject* obj, JSObject *pobj,
         return InvokeGetterOrSetter(cx, receiver, fval, 0, 0, vp);
     }
 
+    Rooted<const Shape *> self(cx, this);
     RootedId id(cx);
-    if (!getUserId(cx, id.address()))
+    if (!self->getUserId(cx, id.address()))
         return false;
 
-    return CallJSPropertyOp(cx, getterOp(), receiver, id, vp);
+    return CallJSPropertyOp(cx, self->getterOp(), receiver, id, vp);
 }
 
 inline bool
@@ -294,8 +295,9 @@ Shape::set(JSContext* cx, HandleObject obj, bool strict, Value* vp) const
     if (attrs & JSPROP_GETTER)
         return js_ReportGetterOnlyAssignment(cx);
 
+    Rooted<const Shape *> self(cx, this);
     RootedId id(cx);
-    if (!getUserId(cx, id.address()))
+    if (!self->getUserId(cx, id.address()))
         return false;
 
     /*
@@ -304,10 +306,10 @@ Shape::set(JSContext* cx, HandleObject obj, bool strict, Value* vp) const
      */
     if (obj->isWith()) {
         RootedObject nobj(cx, &obj->asWith().object());
-        return CallJSPropertyOpSetter(cx, setterOp(), nobj, id, strict, vp);
+        return CallJSPropertyOpSetter(cx, self->setterOp(), nobj, id, strict, vp);
     }
 
-    return CallJSPropertyOpSetter(cx, setterOp(), obj, id, strict, vp);
+    return CallJSPropertyOpSetter(cx, self->setterOp(), obj, id, strict, vp);
 }
 
 inline void
diff --git a/js/src/jsscript.cpp b/js/src/jsscript.cpp
index bc8a598c4adc..0636203ce4b7 100644
--- a/js/src/jsscript.cpp
+++ b/js/src/jsscript.cpp
@@ -1684,7 +1684,7 @@ Rebase(JSScript *dst, JSScript *src, T *srcp)
 }
 
 JSScript *
-js::CloneScript(JSContext *cx, JSScript *src)
+js::CloneScript(JSContext *cx, HandleScript src)
 {
     /* NB: Keep this in sync with XDRScript. */
 
@@ -1707,6 +1707,7 @@ js::CloneScript(JSContext *cx, JSScript *src)
     /* Bindings */
 
     Bindings bindings(cx);
+    Bindings::AutoRooter bindingsRoot(cx, &bindings);
     BindingNames names(cx);
     if (!src->bindings.getLocalNameArray(cx, &names))
         return NULL;
diff --git a/js/src/jsscript.h b/js/src/jsscript.h
index 6f1b7569b46b..c5873129090a 100644
--- a/js/src/jsscript.h
+++ b/js/src/jsscript.h
@@ -1050,7 +1050,7 @@ inline void
 CurrentScriptFileLineOrigin(JSContext *cx, unsigned *linenop, LineOption = NOT_CALLED_FROM_JSOP_EVAL);
 
 extern JSScript *
-CloneScript(JSContext *cx, JSScript *script);
+CloneScript(JSContext *cx, HandleScript script);
 
 /*
  * NB: after a successful XDR_DECODE, XDRScript callers must do any required
diff --git a/js/src/jstypedarray.cpp b/js/src/jstypedarray.cpp
index ee7aa5d7f696..826b5bbb4925 100644
--- a/js/src/jstypedarray.cpp
+++ b/js/src/jstypedarray.cpp
@@ -134,12 +134,13 @@ ArrayBufferObject::fun_slice(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, fun_slice, &ArrayBufferClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, fun_slice, &ArrayBufferClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
-    ArrayBufferObject &arrayBuffer = obj->asArrayBuffer();
+    ArrayBufferObject &arrayBuffer = thisObj->asArrayBuffer();
 
     // these are the default values
     int32_t length = int32_t(arrayBuffer.byteLength());
@@ -485,7 +486,8 @@ JSBool
 ArrayBufferObject::obj_getElement(JSContext *cx, HandleObject obj,
                                   HandleObject receiver, uint32_t index, Value *vp)
 {
-    RootedObject delegate(cx, DelegateObject(cx, RootedObject(cx, getArrayBuffer(obj))));
+    RootedObject buffer(cx, getArrayBuffer(obj));
+    RootedObject delegate(cx, DelegateObject(cx, buffer));
     if (!delegate)
         return false;
     return baseops::GetElement(cx, delegate, receiver, index, vp);
@@ -495,7 +497,8 @@ JSBool
 ArrayBufferObject::obj_getElementIfPresent(JSContext *cx, HandleObject obj, HandleObject receiver,
                                            uint32_t index, Value *vp, bool *present)
 {
-    JSObject *delegate = DelegateObject(cx, RootedObject(cx, getArrayBuffer(obj)));
+    RootedObject buffer(cx, getArrayBuffer(obj));
+    RootedObject delegate(cx, DelegateObject(cx, buffer));
     if (!delegate)
         return false;
     return delegate->getElementIfPresent(cx, receiver, index, vp, present);
@@ -1419,14 +1422,14 @@ class TypedArrayTemplate
         obj->setSlot(FIELD_BUFFER, ObjectValue(*bufobj));
 
         JS_ASSERT(bufobj->isArrayBuffer());
-        ArrayBufferObject &buffer = bufobj->asArrayBuffer();
+        Rooted<ArrayBufferObject *> buffer(cx, &bufobj->asArrayBuffer());
 
         /*
          * N.B. The base of the array's data is stored in the object's
          * private data rather than a slot, to avoid alignment restrictions
          * on private Values.
          */
-        obj->setPrivate(buffer.dataPointer() + byteOffset);
+        obj->setPrivate(buffer->dataPointer() + byteOffset);
 
         obj->setSlot(FIELD_LENGTH, Int32Value(len));
         obj->setSlot(FIELD_BYTEOFFSET, Int32Value(byteOffset));
@@ -1442,10 +1445,10 @@ class TypedArrayTemplate
             return NULL;
         obj->setLastPropertyInfallible(empty);
 
-        DebugOnly<uint32_t> bufferByteLength = buffer.byteLength();
+        DebugOnly<uint32_t> bufferByteLength = buffer->byteLength();
         JS_ASSERT(bufferByteLength - getByteOffset(obj) >= getByteLength(obj));
         JS_ASSERT(getByteOffset(obj) <= bufferByteLength);
-        JS_ASSERT(buffer.dataPointer() <= getDataOffset(obj));
+        JS_ASSERT(buffer->dataPointer() <= getDataOffset(obj));
         JS_ASSERT(getDataOffset(obj) <= offsetData(obj, bufferByteLength));
 
         JS_ASSERT(obj->numFixedSlots() == NUM_FIXED_SLOTS);
@@ -1453,6 +1456,13 @@ class TypedArrayTemplate
         return obj;
     }
 
+    static JSObject *
+    makeInstance(JSContext *cx, HandleObject bufobj, uint32_t byteOffset, uint32_t len)
+    {
+        RootedObject nullproto(cx, NULL);
+        return makeInstance(cx, bufobj, byteOffset, len, nullproto);
+    }
+
     /*
      * new [Type]Array(length)
      * new [Type]Array(otherTypedArray)
@@ -1474,8 +1484,9 @@ class TypedArrayTemplate
     fromBuffer(JSContext *cx, unsigned argc, Value *vp)
     {
         CallArgs args = CallArgsFromVp(argc, vp);
-        JSObject *obj = fromBuffer(cx, RootedObject(cx, &args[0].toObject()),
-                                   args[1].toInt32(), args[2].toInt32(), RootedObject(cx, &args[3].toObject()));
+        RootedObject buffer(cx, &args[0].toObject());
+        RootedObject proto(cx, &args[3].toObject());
+        JSObject *obj = fromBuffer(cx, buffer, args[1].toInt32(), args[2].toInt32(), proto);
         if (!obj)
             return false;
         vp->setObject(*obj);
@@ -1544,12 +1555,13 @@ class TypedArrayTemplate
     {
         CallArgs args = CallArgsFromVp(argc, vp);
 
-        bool ok;
-        JSObject *obj = NonGenericMethodGuard(cx, args, fun_subarray, fastClass(), &ok);
-        if (!obj)
-            return ok;
+        JSObject *thisObj;
+        if (!NonGenericMethodGuard(cx, args, fun_subarray, fastClass(), &thisObj))
+            return false;
+        if (!thisObj)
+            return true;
 
-        JSObject *tarray = getTypedArray(obj);
+        JSObject *tarray = getTypedArray(thisObj);
         if (!tarray)
             return true;
 
@@ -1583,12 +1595,13 @@ class TypedArrayTemplate
     {
         CallArgs args = CallArgsFromVp(argc, vp);
 
-        bool ok;
-        RootedObject obj(cx, NonGenericMethodGuard(cx, args, fun_set, fastClass(), &ok));
-        if (!obj)
-            return ok;
+        RootedObject thisObj(cx);
+        if (!NonGenericMethodGuard(cx, args, fun_set, fastClass(), thisObj.address()))
+            return false;
+        if (!thisObj)
+            return true;
 
-        RootedObject tarray(cx, getTypedArray(obj));
+        RootedObject tarray(cx, getTypedArray(thisObj));
         if (!tarray)
             return true;
 
@@ -1623,7 +1636,7 @@ class TypedArrayTemplate
                 return false;
             }
 
-            if (!copyFromTypedArray(cx, obj, src, offset))
+            if (!copyFromTypedArray(cx, thisObj, src, offset))
                 return false;
         } else {
             src = arg0;
@@ -1637,7 +1650,7 @@ class TypedArrayTemplate
                 return false;
             }
 
-            if (!copyFromArray(cx, obj, src, len, offset))
+            if (!copyFromArray(cx, thisObj, src, len, offset))
                 return false;
         }
 
@@ -1743,7 +1756,7 @@ class TypedArrayTemplate
         RootedObject buffer(cx, createBufferWithSizeAndCount(cx, nelements));
         if (!buffer)
             return NULL;
-        return makeInstance(cx, buffer, 0, nelements, RootedObject(cx, NULL));
+        return makeInstance(cx, buffer, 0, nelements);
     }
 
     static JSObject *
@@ -1757,7 +1770,7 @@ class TypedArrayTemplate
         if (!bufobj)
             return NULL;
 
-        RootedObject obj(cx, makeInstance(cx, bufobj, 0, len, RootedObject(cx)));
+        RootedObject obj(cx, makeInstance(cx, bufobj, 0, len));
         if (!obj || !copyFromArray(cx, obj, other, len))
             return NULL;
         return obj;
@@ -1795,7 +1808,7 @@ class TypedArrayTemplate
         JS_ASSERT(UINT32_MAX - begin * sizeof(NativeType) >= getByteOffset(tarray));
         uint32_t byteOffset = getByteOffset(tarray) + begin * sizeof(NativeType);
 
-        return makeInstance(cx, bufobj, byteOffset, length, RootedObject(cx));
+        return makeInstance(cx, bufobj, byteOffset, length);
     }
 
   protected:
@@ -2287,6 +2300,9 @@ DataViewObject::class_constructor(JSContext *cx, unsigned argc, Value *vp)
         argv[argc + 2].setObject(*proto);
         argv[0].setUndefined(); // We want to use a different callee (avoid an assertion)
 
+        // Appease 'thisv' assertion in CrossCompartmentWrapper::nativeCall
+        argv[1].setMagic(JS_IS_CONSTRUCTING);
+
         CallArgs proxyArgs = CallArgsFromVp(argc + 1, argv.begin());
         if (!Proxy::nativeCall(cx, bufobj, &DataViewClass, constructWithProto, proxyArgs))
             return false;
@@ -2481,13 +2497,14 @@ DataViewObject::fun_getInt8(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, fun_getInt8, &DataViewClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, fun_getInt8, &DataViewClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
     int8_t val;
-    if (!obj->asDataView().read(cx, args, &val, "getInt8"))
+    if (!thisObj->asDataView().read(cx, args, &val, "getInt8"))
         return false;
     args.rval().setInt32(val);
     return true;
@@ -2498,13 +2515,14 @@ DataViewObject::fun_getUint8(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, fun_getUint8, &DataViewClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, fun_getUint8, &DataViewClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
     uint8_t val;
-    if (!obj->asDataView().read(cx, args, &val, "getUint8"))
+    if (!thisObj->asDataView().read(cx, args, &val, "getUint8"))
         return false;
     args.rval().setInt32(val);
     return true;
@@ -2515,13 +2533,14 @@ DataViewObject::fun_getInt16(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, fun_getInt16, &DataViewClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, fun_getInt16, &DataViewClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
     int16_t val;
-    if (!obj->asDataView().read(cx, args, &val, "getInt16"))
+    if (!thisObj->asDataView().read(cx, args, &val, "getInt16"))
         return false;
     args.rval().setInt32(val);
     return true;
@@ -2532,13 +2551,14 @@ DataViewObject::fun_getUint16(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, fun_getUint16, &DataViewClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, fun_getUint16, &DataViewClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
     uint16_t val;
-    if (!obj->asDataView().read(cx, args, &val, "getUint16"))
+    if (!thisObj->asDataView().read(cx, args, &val, "getUint16"))
         return false;
     args.rval().setInt32(val);
     return true;
@@ -2549,13 +2569,14 @@ DataViewObject::fun_getInt32(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, fun_getInt32, &DataViewClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, fun_getInt32, &DataViewClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
     int32_t val;
-    if (!obj->asDataView().read(cx, args, &val, "getInt32"))
+    if (!thisObj->asDataView().read(cx, args, &val, "getInt32"))
         return false;
     args.rval().setInt32(val);
     return true;
@@ -2566,13 +2587,14 @@ DataViewObject::fun_getUint32(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, fun_getUint32, &DataViewClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, fun_getUint32, &DataViewClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
     uint32_t val;
-    if (!obj->asDataView().read(cx, args, &val, "getUint32"))
+    if (!thisObj->asDataView().read(cx, args, &val, "getUint32"))
         return false;
     args.rval().setNumber(val);
     return true;
@@ -2583,13 +2605,14 @@ DataViewObject::fun_getFloat32(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, fun_getFloat32, &DataViewClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, fun_getFloat32, &DataViewClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
     float val;
-    if (!obj->asDataView().read(cx, args, &val, "getFloat32"))
+    if (!thisObj->asDataView().read(cx, args, &val, "getFloat32"))
         return false;
 
     args.rval().setDouble(JS_CANONICALIZE_NAN(val));
@@ -2601,13 +2624,14 @@ DataViewObject::fun_getFloat64(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, fun_getFloat64, &DataViewClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, fun_getFloat64, &DataViewClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
     double val;
-    if (!obj->asDataView().read(cx, args, &val, "getFloat64"))
+    if (!thisObj->asDataView().read(cx, args, &val, "getFloat64"))
         return false;
 
     args.rval().setDouble(JS_CANONICALIZE_NAN(val));
@@ -2619,12 +2643,13 @@ DataViewObject::fun_setInt8(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, fun_setInt8, &DataViewClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, fun_setInt8, &DataViewClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
-    if (!obj->asDataView().write<int8_t>(cx, args, "setInt8"))
+    if (!thisObj->asDataView().write<int8_t>(cx, args, "setInt8"))
         return false;
     args.rval().setUndefined();
     return true;
@@ -2635,12 +2660,13 @@ DataViewObject::fun_setUint8(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, fun_setUint8, &DataViewClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, fun_setUint8, &DataViewClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
-    if (!obj->asDataView().write<uint8_t>(cx, args, "setUint8"))
+    if (!thisObj->asDataView().write<uint8_t>(cx, args, "setUint8"))
         return false;
     args.rval().setUndefined();
     return true;
@@ -2651,12 +2677,13 @@ DataViewObject::fun_setInt16(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, fun_setInt16, &DataViewClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, fun_setInt16, &DataViewClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
-    if (!obj->asDataView().write<int16_t>(cx, args, "setInt16"))
+    if (!thisObj->asDataView().write<int16_t>(cx, args, "setInt16"))
         return false;
     args.rval().setUndefined();
     return true;
@@ -2667,12 +2694,13 @@ DataViewObject::fun_setUint16(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, fun_setUint16, &DataViewClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, fun_setUint16, &DataViewClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
-    if (!obj->asDataView().write<uint16_t>(cx, args, "setUint16"))
+    if (!thisObj->asDataView().write<uint16_t>(cx, args, "setUint16"))
         return false;
     args.rval().setUndefined();
     return true;
@@ -2683,12 +2711,13 @@ DataViewObject::fun_setInt32(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, fun_setInt32, &DataViewClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, fun_setInt32, &DataViewClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
-    if (!obj->asDataView().write<int32_t>(cx, args, "setInt32"))
+    if (!thisObj->asDataView().write<int32_t>(cx, args, "setInt32"))
         return false;
     args.rval().setUndefined();
     return true;
@@ -2699,12 +2728,13 @@ DataViewObject::fun_setUint32(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, fun_setUint32, &DataViewClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, fun_setUint32, &DataViewClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
-    if (!obj->asDataView().write<uint32_t>(cx, args, "setUint32"))
+    if (!thisObj->asDataView().write<uint32_t>(cx, args, "setUint32"))
         return false;
     args.rval().setUndefined();
     return true;
@@ -2715,12 +2745,13 @@ DataViewObject::fun_setFloat32(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, fun_setFloat32, &DataViewClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, fun_setFloat32, &DataViewClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
-    if (!obj->asDataView().write<float>(cx, args, "setFloat32"))
+    if (!thisObj->asDataView().write<float>(cx, args, "setFloat32"))
         return false;
     args.rval().setUndefined();
     return true;
@@ -2731,12 +2762,13 @@ DataViewObject::fun_setFloat64(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, fun_setFloat64, &DataViewClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, fun_setFloat64, &DataViewClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
-    if (!obj->asDataView().write<double>(cx, args, "setFloat64"))
+    if (!thisObj->asDataView().write<double>(cx, args, "setFloat64"))
         return false;
     args.rval().setUndefined();
     return true;
@@ -2918,6 +2950,7 @@ IMPL_TYPED_ARRAY_JSAPI_CONSTRUCTORS(Float64, double)
     #_typedArray,                                                              \
     JSCLASS_HAS_RESERVED_SLOTS(TypedArray::FIELD_MAX) |                        \
     JSCLASS_HAS_PRIVATE | JSCLASS_IMPLEMENTS_BARRIERS |                        \
+    JSCLASS_HAS_CACHED_PROTO(JSProto_##_typedArray) |                          \
     JSCLASS_FOR_OF_ITERATION |                                                 \
     Class::NON_NATIVE,                                                         \
     JS_PropertyStub,         /* addProperty */                                 \
diff --git a/js/src/jsval.h b/js/src/jsval.h
index 9fcf07980737..2ee90a8e4fa8 100644
--- a/js/src/jsval.h
+++ b/js/src/jsval.h
@@ -12,8 +12,6 @@
  * Implementation details for js::Value in jsapi.h.
  */
 
-#include "mozilla/FloatingPoint.h"
-
 #include "js/Utility.h"
 
 JS_BEGIN_EXTERN_C
diff --git a/js/src/jsweakmap.cpp b/js/src/jsweakmap.cpp
index 97e106c2d1cd..e56ecb937f59 100644
--- a/js/src/jsweakmap.cpp
+++ b/js/src/jsweakmap.cpp
@@ -125,10 +125,11 @@ WeakMap_has(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, WeakMap_has, &WeakMapClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, WeakMap_has, &WeakMapClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
     if (args.length() < 1) {
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_MORE_ARGS_NEEDED,
@@ -139,7 +140,7 @@ WeakMap_has(JSContext *cx, unsigned argc, Value *vp)
     if (!key)
         return false;
 
-    ObjectValueMap *map = GetObjectMap(obj);
+    ObjectValueMap *map = GetObjectMap(thisObj);
     if (map) {
         ObjectValueMap::Ptr ptr = map->lookup(key);
         if (ptr) {
@@ -157,10 +158,11 @@ WeakMap_get(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, WeakMap_get, &WeakMapClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, WeakMap_get, &WeakMapClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
     if (args.length() < 1) {
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_MORE_ARGS_NEEDED,
@@ -171,7 +173,7 @@ WeakMap_get(JSContext *cx, unsigned argc, Value *vp)
     if (!key)
         return false;
 
-    ObjectValueMap *map = GetObjectMap(obj);
+    ObjectValueMap *map = GetObjectMap(thisObj);
     if (map) {
         ObjectValueMap::Ptr ptr = map->lookup(key);
         if (ptr) {
@@ -189,10 +191,11 @@ WeakMap_delete(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, WeakMap_delete, &WeakMapClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, WeakMap_delete, &WeakMapClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
     if (args.length() < 1) {
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_MORE_ARGS_NEEDED,
@@ -203,7 +206,7 @@ WeakMap_delete(JSContext *cx, unsigned argc, Value *vp)
     if (!key)
         return false;
 
-    ObjectValueMap *map = GetObjectMap(obj);
+    ObjectValueMap *map = GetObjectMap(thisObj);
     if (map) {
         ObjectValueMap::Ptr ptr = map->lookup(key);
         if (ptr) {
@@ -222,10 +225,11 @@ WeakMap_set(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    bool ok;
-    JSObject *obj = NonGenericMethodGuard(cx, args, WeakMap_set, &WeakMapClass, &ok);
-    if (!obj)
-        return ok;
+    JSObject *thisObj;
+    if (!NonGenericMethodGuard(cx, args, WeakMap_set, &WeakMapClass, &thisObj))
+        return false;
+    if (!thisObj)
+        return true;
 
     if (args.length() < 1) {
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_MORE_ARGS_NEEDED,
@@ -238,14 +242,14 @@ WeakMap_set(JSContext *cx, unsigned argc, Value *vp)
 
     Value value = (args.length() > 1) ? args[1] : UndefinedValue();
 
-    ObjectValueMap *map = GetObjectMap(obj);
+    ObjectValueMap *map = GetObjectMap(thisObj);
     if (!map) {
-        map = cx->new_<ObjectValueMap>(cx, obj);
+        map = cx->new_<ObjectValueMap>(cx, thisObj);
         if (!map->init()) {
             cx->delete_(map);
             goto out_of_memory;
         }
-        obj->setPrivate(map);
+        thisObj->setPrivate(map);
     }
 
     if (!map->put(key, value))
diff --git a/js/src/jswrapper.cpp b/js/src/jswrapper.cpp
index d4ea544b8f0a..41749af14183 100644
--- a/js/src/jswrapper.cpp
+++ b/js/src/jswrapper.cpp
@@ -706,7 +706,7 @@ CrossCompartmentWrapper::nativeCall(JSContext *cx, JSObject *wrapper, Class *cla
             return false;
     }
 
-    if (!DirectWrapper::nativeCall(cx, wrapper, clasp, native, dstArgs))
+    if (!CallJSNative(cx, native, dstArgs))
         return false;
 
     srcArgs.rval() = dstArgs.rval();
diff --git a/js/src/jsxml.cpp b/js/src/jsxml.cpp
index 4ab549e0089d..6fcfdc01754e 100644
--- a/js/src/jsxml.cpp
+++ b/js/src/jsxml.cpp
@@ -491,6 +491,37 @@ NewXMLAttributeName(JSContext *cx, JSLinearString *uri, JSLinearString *prefix,
     return obj;
 }
 
+static JSObject *
+ConstructObjectWithArguments(JSContext *cx, Class *clasp, JSObject *parent,
+                             unsigned argc, jsval *argv)
+{
+    assertSameCompartment(cx, parent, JSValueArray(argv, argc));
+
+    AutoArrayRooter argtvr(cx, argc, argv);
+
+    JSProtoKey protoKey = GetClassProtoKey(clasp);
+
+    /* Protect constructor in case a crazy getter for .prototype uproots it. */
+    RootedValue value(cx);
+    if (!js_FindClassObject(cx, parent, protoKey, value.address(), clasp))
+        return NULL;
+
+    Value rval;
+    if (!InvokeConstructor(cx, value, argc, argv, &rval))
+        return NULL;
+
+    /*
+     * If the instance's class differs from what was requested, throw a type
+     * error.
+     */
+    if (!rval.isObject() || rval.toObject().getClass() != clasp) {
+        JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
+                             JSMSG_WRONG_CONSTRUCTOR, clasp->name);
+        return NULL;
+    }
+    return &rval.toObject();
+}
+
 JSObject *
 js_ConstructXMLQNameObject(JSContext *cx, const Value &nsval, const Value &lnval)
 {
@@ -508,7 +539,7 @@ js_ConstructXMLQNameObject(JSContext *cx, const Value &nsval, const Value &lnval
         argv[0] = nsval;
     }
     argv[1] = lnval;
-    return JS_ConstructObjectWithArguments(cx, Jsvalify(&QNameClass), NULL, 2, argv);
+    return ConstructObjectWithArguments(cx, &QNameClass, NULL, 2, argv);
 }
 
 static JSBool
@@ -2250,7 +2281,7 @@ GetNamespace(JSContext *cx, JSObject *qn, const JSXMLArray<JSObject> *inScopeNSe
     if (!match) {
         argv[0] = prefix ? STRING_TO_JSVAL(prefix) : JSVAL_VOID;
         argv[1] = STRING_TO_JSVAL(uri);
-        ns = JS_ConstructObjectWithArguments(cx, Jsvalify(&NamespaceClass), NULL, 2, argv);
+        ns = ConstructObjectWithArguments(cx, &NamespaceClass, NULL, 2, argv);
         if (!ns)
             return NULL;
         match = ns;
@@ -2929,7 +2960,7 @@ ToXMLName(JSContext *cx, jsval v, jsid *funidp)
 
 construct:
     v = STRING_TO_JSVAL(name);
-    obj = JS_ConstructObjectWithArguments(cx, Jsvalify(&QNameClass), NULL, 1, &v);
+    obj = ConstructObjectWithArguments(cx, &QNameClass, NULL, 1, &v);
     if (!obj)
         return NULL;
 
@@ -6713,7 +6744,7 @@ xml_setName(JSContext *cx, unsigned argc, jsval *vp)
         }
     }
 
-    nameqn = JS_ConstructObjectWithArguments(cx, Jsvalify(&QNameClass), NULL, 1, &name);
+    nameqn = ConstructObjectWithArguments(cx, &QNameClass, NULL, 1, &name);
     if (!nameqn)
         return JS_FALSE;
 
@@ -6818,8 +6849,7 @@ xml_setNamespace(JSContext *cx, unsigned argc, jsval *vp)
     if (!JSXML_HAS_NAME(xml))
         return JS_TRUE;
 
-    ns = JS_ConstructObjectWithArguments(cx, Jsvalify(&NamespaceClass), NULL,
-                                         argc == 0 ? 0 : 1, vp + 2);
+    ns = ConstructObjectWithArguments(cx, &NamespaceClass, NULL, argc == 0 ? 0 : 1, vp + 2);
     if (!ns)
         return JS_FALSE;
     vp[0] = OBJECT_TO_JSVAL(ns);
@@ -6827,7 +6857,7 @@ xml_setNamespace(JSContext *cx, unsigned argc, jsval *vp)
 
     qnargv[0] = OBJECT_TO_JSVAL(ns);
     qnargv[1] = OBJECT_TO_JSVAL(xml->name);
-    qn = JS_ConstructObjectWithArguments(cx, Jsvalify(&QNameClass), NULL, 2, qnargv);
+    qn = ConstructObjectWithArguments(cx, &QNameClass, NULL, 2, qnargv);
     if (!qn)
         return JS_FALSE;
 
@@ -7569,7 +7599,7 @@ js_GetDefaultXMLNamespace(JSContext *cx, jsval *vp)
         obj = tmp;
     }
 
-    ns = JS_ConstructObjectWithArguments(cx, Jsvalify(&NamespaceClass), NULL, 0, NULL);
+    ns = ConstructObjectWithArguments(cx, &NamespaceClass, NULL, 0, NULL);
     if (!ns)
         return JS_FALSE;
     v = OBJECT_TO_JSVAL(ns);
@@ -7587,7 +7617,7 @@ js_SetDefaultXMLNamespace(JSContext *cx, const Value &v)
     Value argv[2];
     argv[0].setString(cx->runtime->emptyString);
     argv[1] = v;
-    JSObject *ns = JS_ConstructObjectWithArguments(cx, Jsvalify(&NamespaceClass), NULL, 2, argv);
+    JSObject *ns = ConstructObjectWithArguments(cx, &NamespaceClass, NULL, 2, argv);
     if (!ns)
         return JS_FALSE;
 
@@ -7705,7 +7735,7 @@ js_FindXMLProperty(JSContext *cx, const Value &nameval, JSObject **objp, jsid *i
     nameobj = &nameval.toObject();
     if (nameobj->getClass() == &AnyNameClass) {
         v = STRING_TO_JSVAL(cx->runtime->atomState.starAtom);
-        nameobj = JS_ConstructObjectWithArguments(cx, Jsvalify(&QNameClass), NULL, 1, &v);
+        nameobj = ConstructObjectWithArguments(cx, &QNameClass, NULL, 1, &v);
         if (!nameobj)
             return JS_FALSE;
     } else {
diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
index 03e467484e1e..56fba44e4444 100644
--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -2143,7 +2143,7 @@ DumpStack(JSContext *cx, unsigned argc, Value *vp)
 
     uint32_t index = 0;
     for (; !iter.done(); ++index, ++iter) {
-        Value v;
+        RootedValue v(cx);
         if (iter.isNonEvalFunctionFrame() || iter.isNativeCall()) {
             v = iter.calleev();
         } else if (iter.isEvalFrame()) {
@@ -2151,9 +2151,9 @@ DumpStack(JSContext *cx, unsigned argc, Value *vp)
         } else {
             v = StringValue(globalStr);
         }
-        if (!JS_WrapValue(cx, &v))
+        if (!JS_WrapValue(cx, v.address()))
             return false;
-        if (!JS_SetElement(cx, arr, index, &v))
+        if (!JS_SetElement(cx, arr, index, v.address()))
             return false;
     }
 
diff --git a/js/src/tests/js1_8_5/extensions/dataview.js b/js/src/tests/js1_8_5/extensions/dataview.js
index bc4dc42a4f80..56cd93c6ec33 100644
--- a/js/src/tests/js1_8_5/extensions/dataview.js
+++ b/js/src/tests/js1_8_5/extensions/dataview.js
@@ -1631,6 +1631,14 @@ function test() {
     assertEq(av.getUint8(4), 100);
     assertEq(Object.getPrototypeOf(av), DataView.prototype);
 
+    // Bug 760904: call another compartment's constructor with an ArrayBuffer
+    // from this compartment, both as a constructor and as a regular call. (The
+    // latter is what was broken in that bug.)
+    var alien_constructor = alien.DataView;
+    var local_buffer = (new Int8Array(3)).buffer;
+    var foreign_exchange_student_1 = alien_constructor(local_buffer);
+    var foreign_exchange_student_2 = new alien_constructor(local_buffer);
+
     reportCompare(0, 0, 'done.');
     exitFunc ('test');
 }
diff --git a/js/src/vm/Debugger.cpp b/js/src/vm/Debugger.cpp
index c766b4646770..6e1210193e08 100644
--- a/js/src/vm/Debugger.cpp
+++ b/js/src/vm/Debugger.cpp
@@ -941,7 +941,7 @@ Debugger::fireEnterFrame(JSContext *cx, Value *vp)
 }
 
 void
-Debugger::fireNewScript(JSContext *cx, Handle<JSScript*> script)
+Debugger::fireNewScript(JSContext *cx, HandleScript script)
 {
     RootedObject hook(cx, getHook(OnNewScript));
     JS_ASSERT(hook);
@@ -2376,7 +2376,7 @@ Class DebuggerScript_class = {
 };
 
 JSObject *
-Debugger::newDebuggerScript(JSContext *cx, Handle<JSScript*> script)
+Debugger::newDebuggerScript(JSContext *cx, HandleScript script)
 {
     assertSameCompartment(cx, object.get());
 
@@ -2392,7 +2392,7 @@ Debugger::newDebuggerScript(JSContext *cx, Handle<JSScript*> script)
 }
 
 JSObject *
-Debugger::wrapScript(JSContext *cx, Handle<JSScript*> script)
+Debugger::wrapScript(JSContext *cx, HandleScript script)
 {
     assertSameCompartment(cx, object.get());
     JS_ASSERT(cx->compartment != script->compartment());
@@ -4396,7 +4396,7 @@ DebuggerEnv_getVariable(JSContext *cx, unsigned argc, Value *vp)
     if (!ValueToIdentifier(cx, args[0], id.address()))
         return false;
 
-    Value v;
+    RootedValue v(cx);
     {
         AutoCompartment ac(cx, env);
         if (!ac.enter() || !cx->compartment->wrapId(cx, id.address()))
@@ -4404,11 +4404,11 @@ DebuggerEnv_getVariable(JSContext *cx, unsigned argc, Value *vp)
 
         /* This can trigger getters. */
         ErrorCopier ec(ac, dbg->toJSObject());
-        if (!env->getGeneric(cx, id, &v))
+        if (!env->getGeneric(cx, id, v.address()))
             return false;
     }
 
-    if (!dbg->wrapDebuggeeValue(cx, &v))
+    if (!dbg->wrapDebuggeeValue(cx, v.address()))
         return false;
     args.rval() = v;
     return true;
diff --git a/js/src/vm/Debugger.h b/js/src/vm/Debugger.h
index 392e013be8b1..89c634f1ef89 100644
--- a/js/src/vm/Debugger.h
+++ b/js/src/vm/Debugger.h
@@ -190,13 +190,13 @@ class Debugger {
      * Allocate and initialize a Debugger.Script instance whose referent is
      * |script|.
      */
-    JSObject *newDebuggerScript(JSContext *cx, Handle<JSScript*> script);
+    JSObject *newDebuggerScript(JSContext *cx, HandleScript script);
 
     /*
      * Receive a "new script" event from the engine. A new script was compiled
      * or deserialized.
      */
-    void fireNewScript(JSContext *cx, Handle<JSScript*> script);
+    void fireNewScript(JSContext *cx, HandleScript script);
 
     static inline Debugger *fromLinks(JSCList *links);
     inline Breakpoint *firstBreakpoint() const;
@@ -337,7 +337,7 @@ class Debugger {
      * needed. The context |cx| must be in the debugger compartment; |script|
      * must be a script in a debuggee compartment.
      */
-    JSObject *wrapScript(JSContext *cx, Handle<JSScript*> script);
+    JSObject *wrapScript(JSContext *cx, HandleScript script);
 
   private:
     Debugger(const Debugger &) MOZ_DELETE;
diff --git a/js/src/vm/MethodGuard-inl.h b/js/src/vm/MethodGuard-inl.h
index 334bf569f52e..d69cd0a39013 100644
--- a/js/src/vm/MethodGuard-inl.h
+++ b/js/src/vm/MethodGuard-inl.h
@@ -53,20 +53,20 @@ class PrimitiveBehavior<JSString *> {
 
 } /* namespace detail */
 
-inline JSObject *
-NonGenericMethodGuard(JSContext *cx, CallArgs args, Native native, Class *clasp, bool *ok)
+inline bool
+NonGenericMethodGuard(JSContext *cx, CallArgs args, Native native, Class *clasp, JSObject **thisObj)
 {
     const Value &thisv = args.thisv();
     if (thisv.isObject()) {
         JSObject &obj = thisv.toObject();
         if (obj.getClass() == clasp) {
-            *ok = true;  /* quell gcc overwarning */
-            return &obj;
+            *thisObj = &obj;
+            return true;
         }
     }
 
-    *ok = HandleNonGenericMethodClassMismatch(cx, args, native, clasp);
-    return NULL;
+    *thisObj = NULL;
+    return HandleNonGenericMethodClassMismatch(cx, args, native, clasp);
 }
 
 template <typename T>
@@ -81,10 +81,11 @@ BoxedPrimitiveMethodGuard(JSContext *cx, CallArgs args, Native native, T *v, boo
         return true;
     }
 
-    if (!NonGenericMethodGuard(cx, args, native, Behavior::getClass(), ok))
+    JSObject *thisObj;
+    *ok = NonGenericMethodGuard(cx, args, native, Behavior::getClass(), &thisObj);
+    if (!*ok || !thisObj)
         return false;
-
-    *v = Behavior::extract(thisv.toObject());
+    *v = Behavior::extract(*thisObj);
     return true;
 }
 
diff --git a/js/src/vm/MethodGuard.h b/js/src/vm/MethodGuard.h
index 125240a1922a..c0eb04034ede 100644
--- a/js/src/vm/MethodGuard.h
+++ b/js/src/vm/MethodGuard.h
@@ -32,31 +32,36 @@ ReportIncompatibleMethod(JSContext *cx, CallReceiver call, Class *clasp);
  * NonGenericMethodGuard performs this checking. Canonical usage is:
  *
  *   CallArgs args = ...
- *   bool ok;
- *   JSObject *thisObj = NonGenericMethodGuard(cx, args, clasp, &ok);
+ *   JSObject *thisObj;
+ *   if (!NonGenericMethodGuard(cx, args, clasp, &thisObj))
+ *     return false;
  *   if (!thisObj)
- *     return ok;
+ *     return true;
  *
- * Specifically: if obj is a proxy, NonGenericMethodGuard will call the
- * object's ProxyHandler's nativeCall hook (which may recursively call
- * args.callee in args.thisv's compartment). Thus, there are three possible
- * post-conditions:
+ * Specifically: if args.thisv is a proxy, NonGenericMethodGuard will call its
+ * ProxyHandler's nativeCall hook (which may recursively call args.callee in
+ * args.thisv's compartment). These are the possible post-conditions:
  *
- *   1. thisv is an object of the given clasp: the caller may proceed;
+ *   1. NonGenericMethodGuard returned false because it encountered an error:
+ *      args.thisv wasn't an object, was an object of the wrong class, was a
+ *      proxy to an object of the wrong class, or was a proxy to an object of
+ *      the right class but the recursive call to args.callee failed. This case
+ *      should be handled like any other failure: propagate it, or catch it and
+ *      continue.
+ *   2. NonGenericMethodGuard returned true, and thisObj was nulled out.  In
+ *      this case args.thisv was a proxy to an object with the desired class,
+ *      and recursive invocation of args.callee succeeded. This completes the
+ *      invocation of args.callee, so return true.
+ *   3. NonGenericMethodGuard returned true, and thisObj was set to a non-null
+ *      pointer. In this case args.thisv was exactly an object of the desired
+ *      class, and not a proxy to one. Finish up the call using thisObj as the
+ *      this object provided to the call, which will have clasp as its class.
  *
- *   2. there was an error: the caller must return 'false';
- *
- *   3. thisv wrapped an object of the given clasp and the native was reentered
- *      and completed succesfully: the caller must return 'true'.
- *
- * Case 1 is indicated by a non-NULL return value; case 2 by a NULL return
- * value with *ok == false; and case 3 by a NULL return value with *ok == true.
- *
- * NB: since this guard may reenter the native, the guard must be placed before
- * any effectful operations are performed.
+ * Be careful! This guard may reenter the native, so the guard must be placed
+ * before any effectful operations are performed.
  */
-inline JSObject *
-NonGenericMethodGuard(JSContext *cx, CallArgs args, Native native, Class *clasp, bool *ok);
+inline bool
+NonGenericMethodGuard(JSContext *cx, CallArgs args, Native native, Class *clasp, JSObject **thisObj);
 
 /*
  * NonGenericMethodGuard tests args.thisv's class using 'clasp'. If more than
diff --git a/js/src/vm/ScopeObject.cpp b/js/src/vm/ScopeObject.cpp
index 72142bd011da..c5d443717475 100644
--- a/js/src/vm/ScopeObject.cpp
+++ b/js/src/vm/ScopeObject.cpp
@@ -332,12 +332,6 @@ WithObject::create(JSContext *cx, HandleObject proto, HandleObject enclosing, ui
 static JSBool
 with_LookupGeneric(JSContext *cx, HandleObject obj, HandleId id, JSObject **objp, JSProperty **propp)
 {
-    /* Fixes bug 463997 */
-    unsigned flags = cx->resolveFlags;
-    if (flags == RESOLVE_INFER)
-        flags = js_InferFlags(cx, flags);
-    flags |= JSRESOLVE_WITH;
-    JSAutoResolveFlags rf(cx, flags);
     return obj->asWith().object().lookupGeneric(cx, id, objp, propp);
 }
 
@@ -1375,7 +1369,7 @@ int DebugScopeProxy::family = 0;
 DebugScopeProxy DebugScopeProxy::singleton;
 
 /* static */ DebugScopeObject *
-DebugScopeObject::create(JSContext *cx, ScopeObject &scope, JSObject &enclosing)
+DebugScopeObject::create(JSContext *cx, ScopeObject &scope, HandleObject enclosing)
 {
     JSObject *obj = NewProxyObject(cx, &DebugScopeProxy::singleton, ObjectValue(scope),
                                    NULL /* proto */, &scope.global(),
@@ -1383,8 +1377,8 @@ DebugScopeObject::create(JSContext *cx, ScopeObject &scope, JSObject &enclosing)
     if (!obj)
         return NULL;
 
-    JS_ASSERT(!enclosing.isScope());
-    SetProxyExtra(obj, ENCLOSING_EXTRA, ObjectValue(enclosing));
+    JS_ASSERT(!enclosing->isScope());
+    SetProxyExtra(obj, ENCLOSING_EXTRA, ObjectValue(*enclosing.value()));
 
     return &obj->asDebugScope();
 }
@@ -1735,19 +1729,19 @@ GetDebugScopeForScope(JSContext *cx, ScopeObject &scope, ScopeIter enclosing)
     if (DebugScopeObject *debugScope = debugScopes.hasDebugScope(cx, scope))
         return debugScope;
 
-    JSObject *enclosingDebug = GetDebugScope(cx, enclosing);
+    RootedObject enclosingDebug(cx, GetDebugScope(cx, enclosing));
     if (!enclosingDebug)
         return NULL;
 
     JSObject &maybeDecl = scope.enclosingScope();
     if (maybeDecl.isDeclEnv()) {
         JS_ASSERT(CallObjectLambdaName(scope.asCall().getCalleeFunction()));
-        enclosingDebug = DebugScopeObject::create(cx, maybeDecl.asDeclEnv(), *enclosingDebug);
+        enclosingDebug = DebugScopeObject::create(cx, maybeDecl.asDeclEnv(), enclosingDebug);
         if (!enclosingDebug)
             return NULL;
     }
 
-    DebugScopeObject *debugScope = DebugScopeObject::create(cx, scope, *enclosingDebug);
+    DebugScopeObject *debugScope = DebugScopeObject::create(cx, scope, enclosingDebug);
     if (!debugScope)
         return NULL;
 
@@ -1760,11 +1754,13 @@ GetDebugScopeForScope(JSContext *cx, ScopeObject &scope, ScopeIter enclosing)
 static DebugScopeObject *
 GetDebugScopeForMissing(JSContext *cx, ScopeIter si)
 {
+    SkipRoot si_(cx, &si);
+
     DebugScopes &debugScopes = *cx->runtime->debugScopes;
     if (DebugScopeObject *debugScope = debugScopes.hasDebugScope(cx, si))
         return debugScope;
 
-    JSObject *enclosingDebug = GetDebugScope(cx, si.enclosing());
+    RootedObject enclosingDebug(cx, GetDebugScope(cx, si.enclosing()));
     if (!enclosingDebug)
         return NULL;
 
@@ -1784,12 +1780,12 @@ GetDebugScopeForMissing(JSContext *cx, ScopeIter si)
         if (callobj->enclosingScope().isDeclEnv()) {
             JS_ASSERT(CallObjectLambdaName(callobj->getCalleeFunction()));
             DeclEnvObject &declenv = callobj->enclosingScope().asDeclEnv();
-            enclosingDebug = DebugScopeObject::create(cx, declenv, *enclosingDebug);
+            enclosingDebug = DebugScopeObject::create(cx, declenv, enclosingDebug);
             if (!enclosingDebug)
                 return NULL;
         }
 
-        debugScope = DebugScopeObject::create(cx, *callobj, *enclosingDebug);
+        debugScope = DebugScopeObject::create(cx, *callobj, enclosingDebug);
         break;
       }
       case ScopeIter::Block: {
@@ -1798,7 +1794,7 @@ GetDebugScopeForMissing(JSContext *cx, ScopeIter si)
         if (!block)
             return NULL;
 
-        debugScope = DebugScopeObject::create(cx, *block, *enclosingDebug);
+        debugScope = DebugScopeObject::create(cx, *block, enclosingDebug);
         break;
       }
       case ScopeIter::With:
diff --git a/js/src/vm/ScopeObject.h b/js/src/vm/ScopeObject.h
index f25a7e82dd9d..b90fa0081971 100644
--- a/js/src/vm/ScopeObject.h
+++ b/js/src/vm/ScopeObject.h
@@ -12,6 +12,8 @@
 #include "jsobj.h"
 #include "jsweakmap.h"
 
+#include "gc/Barrier.h"
+
 namespace js {
 
 /*****************************************************************************/
@@ -402,7 +404,7 @@ class DebugScopeObject : public JSObject
     static const unsigned ENCLOSING_EXTRA = 0;
 
   public:
-    static DebugScopeObject *create(JSContext *cx, ScopeObject &scope, JSObject &enclosing);
+    static DebugScopeObject *create(JSContext *cx, ScopeObject &scope, HandleObject enclosing);
 
     ScopeObject &scope() const;
     JSObject &enclosingScope() const;
diff --git a/js/src/vm/Stack.h b/js/src/vm/Stack.h
index 812f62bc74d4..2537038ab734 100644
--- a/js/src/vm/Stack.h
+++ b/js/src/vm/Stack.h
@@ -36,10 +36,11 @@ class ScriptFrameIter;
 class AllFramesIter;
 
 class ArgumentsObject;
-class ScopeCoordinate;
 class ScopeObject;
 class StaticBlockObject;
 
+struct ScopeCoordinate;
+
 #ifdef JS_METHODJIT
 namespace mjit {
     class CallCompiler;
@@ -415,7 +416,7 @@ class StackFrame
 #ifdef JS_METHODJIT
     friend class mjit::CallCompiler;
     friend class mjit::GetPropCompiler;
-    friend class mjit::ic::GetElementIC;
+    friend struct mjit::ic::GetElementIC;
 #endif
 
     /*
diff --git a/js/xpconnect/src/XPCJSRuntime.cpp b/js/xpconnect/src/XPCJSRuntime.cpp
index a5f0f8733409..b75d02958770 100644
--- a/js/xpconnect/src/XPCJSRuntime.cpp
+++ b/js/xpconnect/src/XPCJSRuntime.cpp
@@ -357,15 +357,6 @@ TraceJSHolder(JSDHashTable *table, JSDHashEntryHdr *hdr, uint32_t number,
     return JS_DHASH_NEXT;
 }
 
-static PLDHashOperator
-TraceExpandos(XPCWrappedNative *wn, JSObject *&expando, void *aClosure)
-{
-    if (wn->IsWrapperExpired())
-        return PL_DHASH_REMOVE;
-    JS_CALL_OBJECT_TRACER(static_cast<JSTracer *>(aClosure), expando, "expando object");
-    return PL_DHASH_NEXT;
-}
-
 static PLDHashOperator
 TraceDOMExpandos(nsPtrHashKey<JSObject> *expando, void *aClosure)
 {
@@ -400,8 +391,6 @@ void XPCJSRuntime::TraceXPConnectRoots(JSTracer *trc)
     XPCCompartmentSet &set = GetCompartmentSet();
     for (XPCCompartmentRange r = set.all(); !r.empty(); r.popFront()) {
         CompartmentPrivate *priv = GetCompartmentPrivate(r.front());
-        if (priv->expandoMap)
-            priv->expandoMap->Enumerate(TraceExpandos, trc);
         if (priv->domExpandoMap)
             priv->domExpandoMap->EnumerateEntries(TraceDOMExpandos, trc);
     }
@@ -464,15 +453,6 @@ XPCJSRuntime::SuspectWrappedNative(XPCWrappedNative *wrapper,
         cb.NoteJSRoot(obj);
 }
 
-static PLDHashOperator
-SuspectExpandos(XPCWrappedNative *wrapper, JSObject *expando, void *arg)
-{
-    Closure* closure = static_cast<Closure*>(arg);
-    XPCJSRuntime::SuspectWrappedNative(wrapper, *closure->cb);
-
-    return PL_DHASH_NEXT;
-}
-
 static PLDHashOperator
 SuspectDOMExpandos(nsPtrHashKey<JSObject> *key, void *arg)
 {
@@ -546,12 +526,10 @@ XPCJSRuntime::AddXPConnectRoots(nsCycleCollectionTraversalCallback &cb)
         JS_DHashTableEnumerate(&mJSHolders, NoteJSHolder, &closure);
     }
 
-    // Suspect wrapped natives with expando objects.
+    // Suspect objects with expando objects.
     XPCCompartmentSet &set = GetCompartmentSet();
     for (XPCCompartmentRange r = set.all(); !r.empty(); r.popFront()) {
         CompartmentPrivate *priv = GetCompartmentPrivate(r.front());
-        if (priv->expandoMap)
-            priv->expandoMap->EnumerateRead(SuspectExpandos, &closure);
         if (priv->domExpandoMap)
             priv->domExpandoMap->EnumerateEntries(SuspectDOMExpandos, &closure);
     }
@@ -599,14 +577,6 @@ DoDeferredRelease(nsTArray<T> &array)
     }
 }
 
-static PLDHashOperator
-SweepExpandos(XPCWrappedNative *wn, JSObject *&expando, void *arg)
-{
-    return JS_IsAboutToBeFinalized(wn->GetFlatJSObjectPreserveColor())
-           ? PL_DHASH_REMOVE
-           : PL_DHASH_NEXT;
-}
-
 /* static */ void
 XPCJSRuntime::GCCallback(JSRuntime *rt, JSGCStatus status)
 {
@@ -688,8 +658,6 @@ XPCJSRuntime::FinalizeCallback(JSFreeOp *fop, JSFinalizeStatus status, JSBool is
                 CompartmentPrivate *priv = GetCompartmentPrivate(r.front());
                 if (priv->waiverWrapperMap)
                     priv->waiverWrapperMap->Sweep();
-                if (priv->expandoMap)
-                    priv->expandoMap->Enumerate(SweepExpandos, NULL);
             }
 
             self->mDoingFinalization = true;
diff --git a/js/xpconnect/src/XPCMaps.cpp b/js/xpconnect/src/XPCMaps.cpp
index dce55474a35b..43f938c0bfd2 100644
--- a/js/xpconnect/src/XPCMaps.cpp
+++ b/js/xpconnect/src/XPCMaps.cpp
@@ -129,7 +129,11 @@ Native2WrappedNativeMap::newMap(int size)
     Native2WrappedNativeMap* map = new Native2WrappedNativeMap(size);
     if (map && map->mTable)
         return map;
-    delete map;
+    // Allocation of the map or the creation of its hash table has
+    // failed. This will cause a NULL deref later when we attempt to
+    // use the map, so we abort immediately to provide a more useful
+    // crash stack.
+    NS_RUNTIMEABORT("Ran out of memory.");
     return nsnull;
 }
 
@@ -297,7 +301,11 @@ ClassInfo2WrappedNativeProtoMap::newMap(int size)
     ClassInfo2WrappedNativeProtoMap* map = new ClassInfo2WrappedNativeProtoMap(size);
     if (map && map->mTable)
         return map;
-    delete map;
+    // Allocation of the map or the creation of its hash table has
+    // failed. This will cause a NULL deref later when we attempt to
+    // use the map, so we abort immediately to provide a more useful
+    // crash stack.
+    NS_RUNTIMEABORT("Ran out of memory.");
     return nsnull;
 }
 
diff --git a/js/xpconnect/src/XPCWrappedNative.cpp b/js/xpconnect/src/XPCWrappedNative.cpp
index c10f8a047737..6719eb823bbb 100644
--- a/js/xpconnect/src/XPCWrappedNative.cpp
+++ b/js/xpconnect/src/XPCWrappedNative.cpp
@@ -17,6 +17,7 @@
 #include "jsproxy.h"
 #include "AccessCheck.h"
 #include "WrapperFactory.h"
+#include "XrayWrapper.h"
 #include "dombindings.h"
 
 #include "nsContentUtils.h"
@@ -90,16 +91,6 @@ NS_CYCLE_COLLECTION_CLASSNAME(XPCWrappedNative)::Traverse(void *p,
         cb.NoteJSChild(obj);
     }
 
-    if (tmp->MightHaveExpandoObject()) {
-        XPCJSRuntime *rt = tmp->GetRuntime();
-        XPCCompartmentSet &set = rt->GetCompartmentSet();
-        for (XPCCompartmentRange r = set.all(); !r.empty(); r.popFront()) {
-            CompartmentPrivate *priv = GetCompartmentPrivate(r.front());
-            NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "XPCWrappedNative expando object");
-            cb.NoteJSChild(priv->LookupExpandoObjectPreserveColor(tmp));
-        }
-    }
-
     // XPCWrappedNative keeps its native object alive.
     NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mIdentity");
     cb.NoteXPCOMChild(tmp->GetIdentityObject());
@@ -1192,10 +1183,11 @@ XPCWrappedNative::Init(XPCCallContext& ccx, JSObject* parent,
 JSBool
 XPCWrappedNative::Init(XPCCallContext &ccx, JSObject *existingJSObject)
 {
+    // Set up the private to point to the WN.
     JS_SetPrivate(existingJSObject, this);
 
-    // Morph the existing object.
-    JS_SetReservedSlot(existingJSObject, 0, JSVAL_VOID);
+    // Officially mark us as non-slim.
+    MorphMultiSlot(existingJSObject);
 
     mScriptableInfo = GetProto()->GetScriptableInfo();
     mFlatJSObject = existingJSObject;
@@ -1210,6 +1202,11 @@ XPCWrappedNative::Init(XPCCallContext &ccx, JSObject *existingJSObject)
 JSBool
 XPCWrappedNative::FinishInit(XPCCallContext &ccx)
 {
+    // For all WNs, we want to make sure that the multislot starts out as null.
+    // This happens explicitly when morphing a slim wrapper, but we need to
+    // make sure it happens in the other cases too.
+    JS_SetReservedSlot(mFlatJSObject, WRAPPER_MULTISLOT, JSVAL_NULL);
+
     // This reference will be released when mFlatJSObject is finalized.
     // Since this reference will push the refcount to 2 it will also root
     // mFlatJSObject;
@@ -1614,6 +1611,12 @@ XPCWrappedNative::ReparentWrapperIfFound(XPCCallContext& ccx,
             if (!propertyHolder || !JS_CopyPropertiesFrom(ccx, propertyHolder, flat))
                 return NS_ERROR_OUT_OF_MEMORY;
 
+            // Expandos from other compartments are attached to the target JS object.
+            // Copy them over, and let the old ones die a natural death.
+            SetExpandoChain(newobj, nsnull);
+            if (!XrayUtils::CloneExpandoChain(ccx, newobj, flat))
+                return NS_ERROR_FAILURE;
+
             // Before proceeding, eagerly create any same-compartment security wrappers
             // that the object might have. This forces us to take the 'WithWrapper' path
             // while transplanting that handles this stuff correctly.
@@ -1652,40 +1655,13 @@ XPCWrappedNative::ReparentWrapperIfFound(XPCCallContext& ccx,
                 }
 
                 // Ok, now we do the special object-plus-wrapper transplant.
-                //
-                // This is some pretty serious brain surgery.
-                //
-                // In the case where we wrap a Location object from a same-
-                // origin compartment, we actually want our cross-compartment
-                // wrapper to point to the same-compartment wrapper in the
-                // other compartment. This double-wrapping allows expandos to
-                // be shared. So our wrapping callback (in WrapperFactory.cpp)
-                // calls XPCWrappedNative::GetSameCompartmentSecurityWrapper
-                // before wrapping same-origin Location objects.
-                //
-                // This normally works fine, but gets tricky here.
-                // js_TransplantObjectWithWrapper needs to update the old
-                // same-compartment security wrapper to be a cross-compartment
-                // wrapper to the newly transplanted object. So it needs to go
-                // through the aforementioned double-wrapping mechanism.
-                // But during the call, things aren't really in a consistent
-                // state, because mFlatJSObject hasn't yet been updated to
-                // point to the object in the new compartment.
-                //
-                // So we need to cache the new same-compartment security
-                // wrapper on the XPCWN before the call, so that
-                // GetSameCompartmentSecurityWrapper can return early before
-                // getting confused. Hold your breath.
-                JSObject *wwsaved = ww;
-                wrapper->SetWrapper(newwrapper);
                 ww = js_TransplantObjectWithWrapper(ccx, flat, ww, newobj,
                                                     newwrapper);
-                if (!ww) {
-                    wrapper->SetWrapper(wwsaved);
+                if (!ww)
                     return NS_ERROR_FAILURE;
-                }
 
                 flat = newobj;
+                wrapper->SetWrapper(ww);
             } else {
                 flat = JS_TransplantObject(ccx, flat, newobj);
                 if (!flat)
@@ -1698,11 +1674,10 @@ XPCWrappedNative::ReparentWrapperIfFound(XPCCallContext& ccx,
             if (!JS_CopyPropertiesFrom(ccx, flat, propertyHolder))
                 return NS_ERROR_FAILURE;
         } else {
-            JS_SetReservedSlot(flat, 0,
-                               PRIVATE_TO_JSVAL(newProto.get()));
+            SetSlimWrapperProto(flat, newProto.get());
             if (!JS_SetPrototype(ccx, flat, newProto->GetJSProtoObject())) {
                 // this is bad, very bad
-                JS_SetReservedSlot(flat, 0, JSVAL_NULL);
+                SetSlimWrapperProto(flat, nsnull);
                 NS_ERROR("JS_SetPrototype failed");
                 return NS_ERROR_FAILURE;
             }
@@ -2232,10 +2207,6 @@ XPCWrappedNative::GetSameCompartmentSecurityWrapper(JSContext *cx)
     JSObject *wrapper = GetWrapper();
 
     // If we already have a wrapper, it must be what we want.
-    //
-    // NB: This must come before anything below because of some trickiness
-    // with brain transplants. See the "pretty serious brain surgery" comment
-    // in ReparentWrapperIfFound.
     if (wrapper)
         return wrapper;
 
@@ -3936,7 +3907,7 @@ ConstructSlimWrapper(XPCCallContext &ccx,
         return false;
 
     JS_SetPrivate(wrapper, identityObj);
-    JS_SetReservedSlot(wrapper, 0, PRIVATE_TO_JSVAL(xpcproto.get()));
+    SetSlimWrapperProto(wrapper, xpcproto.get());
 
     // Transfer ownership to the wrapper's private.
     aHelper.forgetCanonical();
diff --git a/js/xpconnect/src/xpcprivate.h b/js/xpconnect/src/xpcprivate.h
index e8f19fba113f..0e06bdf3b4f0 100644
--- a/js/xpconnect/src/xpcprivate.h
+++ b/js/xpconnect/src/xpcprivate.h
@@ -301,8 +301,44 @@ typedef XPCCompartmentSet::Range XPCCompartmentRange;
 #define WRAPPER_SLOTS (JSCLASS_HAS_PRIVATE | JSCLASS_IMPLEMENTS_BARRIERS | \
                        JSCLASS_HAS_RESERVED_SLOTS(1))
 
+// WRAPPER_MULTISLOT is defined in xpcpublic.h
+
 #define INVALID_OBJECT ((JSObject *)1)
 
+inline void SetSlimWrapperProto(JSObject *obj, XPCWrappedNativeProto *proto)
+{
+    JS_SetReservedSlot(obj, WRAPPER_MULTISLOT, PRIVATE_TO_JSVAL(proto));
+}
+
+inline XPCWrappedNativeProto* GetSlimWrapperProto(JSObject *obj)
+{
+    MOZ_ASSERT(IS_SLIM_WRAPPER(obj));
+    const JS::Value &v = js::GetReservedSlot(obj, WRAPPER_MULTISLOT);
+    return static_cast<XPCWrappedNativeProto*>(v.toPrivate());
+}
+
+// A slim wrapper is identified by having a native pointer in its reserved slot.
+// This function, therefore, does the official transition from a slim wrapper to
+// a non-slim wrapper.
+inline void MorphMultiSlot(JSObject *obj)
+{
+    MOZ_ASSERT(IS_SLIM_WRAPPER(obj));
+    JS_SetReservedSlot(obj, WRAPPER_MULTISLOT, JSVAL_NULL);
+    MOZ_ASSERT(!IS_SLIM_WRAPPER(obj));
+}
+
+inline void SetExpandoChain(JSObject *obj, JSObject *chain)
+{
+    MOZ_ASSERT(IS_WN_WRAPPER(obj));
+    JS_SetReservedSlot(obj, WRAPPER_MULTISLOT, JS::ObjectOrNullValue(chain));
+}
+
+inline JSObject* GetExpandoChain(JSObject *obj)
+{
+    MOZ_ASSERT(IS_WN_WRAPPER(obj));
+    return JS_GetReservedSlot(obj, WRAPPER_MULTISLOT).toObjectOrNull();
+}
+
 /***************************************************************************/
 // Auto locking support class...
 
@@ -2426,14 +2462,6 @@ extern JSBool ConstructSlimWrapper(XPCCallContext &ccx,
                                    jsval *rval);
 extern JSBool MorphSlimWrapper(JSContext *cx, JSObject *obj);
 
-static inline XPCWrappedNativeProto*
-GetSlimWrapperProto(JSObject *obj)
-{
-  const js::Value &v = js::GetReservedSlot(obj, 0);
-  return static_cast<XPCWrappedNativeProto*>(v.toPrivate());
-}
-
-
 /***********************************************/
 // XPCWrappedNativeTearOff represents the info needed to make calls to one
 // interface on the underlying native object of a XPCWrappedNative.
@@ -2807,8 +2835,6 @@ public:
     void SetNeedsSOW() { mWrapperWord |= NEEDS_SOW; }
     JSBool NeedsCOW() { return !!(mWrapperWord & NEEDS_COW); }
     void SetNeedsCOW() { mWrapperWord |= NEEDS_COW; }
-    JSBool MightHaveExpandoObject() { return !!(mWrapperWord & MIGHT_HAVE_EXPANDO); }
-    void SetHasExpandoObject() { mWrapperWord |= MIGHT_HAVE_EXPANDO; }
 
     JSObject* GetWrapperPreserveColor() const
         {return (JSObject*)(mWrapperWord & (size_t)~(size_t)FLAG_MASK);}
@@ -2875,7 +2901,6 @@ private:
     enum {
         NEEDS_SOW = JS_BIT(0),
         NEEDS_COW = JS_BIT(1),
-        MIGHT_HAVE_EXPANDO = JS_BIT(2),
         FLAG_MASK = JS_BITMASK(3)
     };
 
@@ -4354,7 +4379,6 @@ namespace xpc {
 class CompartmentPrivate
 {
 public:
-    typedef nsDataHashtable<nsPtrHashKey<XPCWrappedNative>, JSObject *> ExpandoMap;
     typedef nsTHashtable<nsPtrHashKey<JSObject> > DOMExpandoMap;
 
     CompartmentPrivate(bool wantXrays)
@@ -4367,40 +4391,8 @@ public:
 
     bool wantXrays;
     nsAutoPtr<JSObject2JSObjectMap> waiverWrapperMap;
-    // NB: we don't want this map to hold a strong reference to the wrapper.
-    nsAutoPtr<ExpandoMap> expandoMap;
     nsAutoPtr<DOMExpandoMap> domExpandoMap;
 
-    bool RegisterExpandoObject(XPCWrappedNative *wn, JSObject *expando) {
-        if (!expandoMap) {
-            expandoMap = new ExpandoMap();
-            expandoMap->Init(8);
-        }
-        wn->SetHasExpandoObject();
-        return expandoMap->Put(wn, expando, mozilla::fallible_t());
-    }
-
-    /**
-     * This lookup does not change the color of the JSObject meaning that the
-     * object returned is not guaranteed to be kept alive past the next CC.
-     *
-     * This should only be called if you are certain that the return value won't
-     * be passed into a JS API function and that it won't be stored without
-     * being rooted (or otherwise signaling the stored value to the CC).
-     */
-    JSObject *LookupExpandoObjectPreserveColor(XPCWrappedNative *wn) {
-        return expandoMap ? expandoMap->Get(wn) : nsnull;
-    }
-
-    /**
-     * This lookup clears the gray bit before handing out the JSObject which
-     * means that the object is guaranteed to be kept alive past the next CC.
-     */
-    JSObject *LookupExpandoObject(XPCWrappedNative *wn) {
-        JSObject *obj = LookupExpandoObjectPreserveColor(wn);
-        return xpc_UnmarkGrayObject(obj);
-    }
-
     bool RegisterDOMExpandoObject(JSObject *expando) {
         if (!domExpandoMap) {
             domExpandoMap = new DOMExpandoMap();
diff --git a/js/xpconnect/src/xpcpublic.h b/js/xpconnect/src/xpcpublic.h
index 339c17903912..66e6ccda9aac 100644
--- a/js/xpconnect/src/xpcpublic.h
+++ b/js/xpconnect/src/xpcpublic.h
@@ -74,13 +74,21 @@ DebugCheckWrapperClass(JSObject* obj)
 // a slim wrapper, holding a native in its private slot, or a wrappednative
 // wrapper, holding the XPCWrappedNative in its private slot. A slim wrapper
 // also holds a pointer to its XPCWrappedNativeProto in a reserved slot, we can
-// check that slot for a non-void value to distinguish between the two.
+// check that slot for a private value (i.e. a double) to distinguish between
+// the two. This allows us to store a JSObject in that slot for non-slim wrappers
+// while still being able to distinguish the two cases.
+
+// NB: This slot isn't actually reserved for us on globals, because SpiderMonkey
+// uses the first N slots on globals internally. The fact that we use it for
+// wrapped global objects is totally broken. But due to a happy coincidence, the
+// JS engine never uses that slot. This still needs fixing though. See bug 760095.
+#define WRAPPER_MULTISLOT 0
 
 // Only use these macros if IS_WRAPPER_CLASS(GetObjectClass(obj)) is true.
 #define IS_WN_WRAPPER_OBJECT(obj)                                             \
-    (DebugCheckWrapperClass(obj) && js::GetReservedSlot(obj, 0).isUndefined())
+    (DebugCheckWrapperClass(obj) && !js::GetReservedSlot(obj, WRAPPER_MULTISLOT).isDouble())
 #define IS_SLIM_WRAPPER_OBJECT(obj)                                           \
-    (DebugCheckWrapperClass(obj) && !js::GetReservedSlot(obj, 0).isUndefined())
+    (DebugCheckWrapperClass(obj) && js::GetReservedSlot(obj, WRAPPER_MULTISLOT).isDouble())
 
 // Use these macros if IS_WRAPPER_CLASS(GetObjectClass(obj)) might be false.
 // Avoid calling them if IS_WRAPPER_CLASS(GetObjectClass(obj)) can only be
diff --git a/js/xpconnect/tests/chrome/Makefile.in b/js/xpconnect/tests/chrome/Makefile.in
index 3f2c1405e99b..730a26f409a2 100644
--- a/js/xpconnect/tests/chrome/Makefile.in
+++ b/js/xpconnect/tests/chrome/Makefile.in
@@ -47,6 +47,8 @@ _CHROME_FILES = \
 		test_exnstack.xul \
 		test_weakref.xul \
 		test_bug726949.xul \
+		test_expandosharing.xul \
+		file_expandosharing.jsm \
 		test_bug758563.xul \
 		test_bug760076.xul \
 		$(NULL)
diff --git a/js/xpconnect/tests/chrome/file_expandosharing.jsm b/js/xpconnect/tests/chrome/file_expandosharing.jsm
new file mode 100644
index 000000000000..19e18ebdbb49
--- /dev/null
+++ b/js/xpconnect/tests/chrome/file_expandosharing.jsm
@@ -0,0 +1,10 @@
+var EXPORTED_SYMBOLS = ['checkFromJSM'];
+
+function checkFromJSM(target, is_op) {
+  is_op(target.numProp, 42, "Number expando works");
+  is_op(target.strProp, "foo", "String expando works");
+  // If is_op is todo_is, target.objProp will be undefined.
+  try {
+    is_op(target.objProp.bar, "baz", "Object expando works");
+  } catch(e) { is_op(0, 1, "No object expando"); }
+}
diff --git a/js/xpconnect/tests/chrome/test_expandosharing.xul b/js/xpconnect/tests/chrome/test_expandosharing.xul
new file mode 100644
index 000000000000..ed57ac880bc9
--- /dev/null
+++ b/js/xpconnect/tests/chrome/test_expandosharing.xul
@@ -0,0 +1,141 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/css" href="chrome://global/skin"?>
+<?xml-stylesheet type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css"?>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=758415
+-->
+<window title="Mozilla Bug 758415"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"/>
+
+  <!-- test results are displayed in the html:body -->
+  <body xmlns="http://www.w3.org/1999/xhtml">
+  <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=758415"
+     target="_blank">Mozilla Bug 758415</a>
+  </body>
+
+  <!-- test code goes here -->
+  <script type="application/javascript">
+  <![CDATA[
+
+  /** Test for Cross-Origin Xray Expando Sharing. **/
+  SimpleTest.waitForExplicitFinish();
+  const Cu = Components.utils;
+
+  // Import our test JSM. We first strip the filename off
+  // the chrome url, then append the jsm filename.
+  var base = /.*\//.exec(window.location.href)[0];
+  Cu.import(base + "file_expandosharing.jsm");
+
+  // Wait for all child frames to load.
+  var gLoadCount = 0;
+  function frameLoaded() {
+    if (++gLoadCount == 4)
+      go();
+  }
+
+  function go() {
+
+    // Empower the content windows with some functions.
+    var wins = document.getElementsByTagName('iframe');
+    for (var i = 0; i < wins.length; ++i) {
+      var win = wins[i].contentWindow.wrappedJSObject;
+      win.ok = ok;
+      win.is = is;
+    }
+
+    // Grab references to the content windows. We abbreviate the origins as follows:
+    // A: test1.example.org
+    // B: test2.example.org
+    // C: sub1.test1.example.org
+    window.gWinA1 = document.getElementById('frameA1').contentWindow;
+    window.gWinA2 = document.getElementById('frameA2').contentWindow;
+    window.gWinB = document.getElementById('frameB').contentWindow;
+    window.gWinC = document.getElementById('frameC').contentWindow;
+
+    // Test expando sharing with a JSM for different types of Xrays.
+    // Note that we don't yet support it for nodelists and new bindings.
+    testJSM(XPCNativeWrapper(gWinC.wrappedJSObject.targetWN), is);
+    testJSM(XPCNativeWrapper(gWinC.wrappedJSObject.targetNodeList), todo_is);
+    testJSM(XPCNativeWrapper(gWinC.wrappedJSObject.targetXHR), todo_is);
+
+    // Make sure sandboxes never share expandos with anyone else.
+    testSandbox(XPCNativeWrapper(gWinB.wrappedJSObject.targetWN));
+    testSandbox(XPCNativeWrapper(gWinB.wrappedJSObject.targetNodeList));
+    testSandbox(XPCNativeWrapper(gWinB.wrappedJSObject.targetXHR));
+
+    // Test XOWs using Location objects.
+    testLocation();
+
+    SimpleTest.finish();
+  }
+
+  // Make sure that expandos are shared between us and a JSM.
+  function testJSM(target, is_op) {
+    target.numProp = 42;
+    target.strProp = "foo";
+    target.objProp = { bar: "baz" };
+    checkFromJSM(target, is_op);
+  }
+
+  function testSandbox(target) {
+
+    // This gets both run in this scope and the sandbox scope.
+    var name = "harness";
+    function placeExpando() {
+      target.prop = name;
+    }
+
+    // Set up the sandboxes.
+    sb1 = Cu.Sandbox(window);
+    sb2 = Cu.Sandbox(window);
+    sb1.target = target;
+    sb2.target = target;
+    sb1.name = "sandbox1";
+    sb2.name = "sandbox2";
+    placeExpando();
+    Cu.evalInSandbox(placeExpando.toSource() + "placeExpando();", sb1);
+    Cu.evalInSandbox(placeExpando.toSource() + "placeExpando();", sb2);
+
+    // Make sure everyone sees a different value.
+    is(target.prop, "harness", "Harness sees its own value");
+    is(Cu.evalInSandbox("target.prop", sb1), "sandbox1", "Sandbox 1 sees its own value");
+    is(Cu.evalInSandbox("target.prop", sb2), "sandbox2", "Sandbox 2 sees its own value");
+  }
+
+  // Location is special in that same-origin access for content still involves
+  // an Xray wrapper. This gives us a good opportunity to test that we don't
+  // mix up chrome and content expandos.
+  function testLocation() {
+
+    // Each scope has an Xray wrapper to Location. make sure the sharing happens.
+    gWinA1.wrappedJSObject.placeExpando('A1_expando', 11, gWinA2.location);
+    gWinA2.wrappedJSObject.placeExpando('A2_expando', 22, gWinA2.location);
+    gWinA2.location.Chrome_expando = 33;
+
+    is(gWinA2.location.Chrome_expando, 33, "Read chrome expando properly");
+    is(typeof gWinA2.location.A1_expando, 'undefined', "Chrome doesn't see content expandos");
+    is(typeof gWinA2.location.A2_expando, 'undefined', "Chrome doesn't see content expandos");
+    gWinA1.wrappedJSObject.checkExpando('A1_expando', 11, gWinA2.location, "Content sees proper expandos");
+    gWinA2.wrappedJSObject.checkExpando('A1_expando', 11, gWinA2.location, "Content sees proper expandos");
+    gWinA1.wrappedJSObject.checkExpando('A2_expando', 22, gWinA2.location, "Content sees proper expandos");
+    gWinA2.wrappedJSObject.checkExpando('A2_expando', 22, gWinA2.location, "Content sees proper expandos");
+    gWinA1.wrappedJSObject.checkExpando('Chrome_expando', null, gWinA2.location, "Content doesn't see chrome expandos");
+    gWinA2.wrappedJSObject.checkExpando('Chrome_expando', null, gWinA2.location, "Content doesn't see chrome expandos");
+
+    // We very explicitly do not support expando sharing via document.domain.
+    // A comment in the implementation explains why.
+    gWinA1.document.domain = 'test1.example.org';
+    gWinA2.document.domain = 'test1.example.org';
+    gWinC.document.domain = 'test1.example.org';
+    gWinC.wrappedJSObject.checkExpando('A1_expando', null, gWinA2.location, "document.domain should have no effect here");
+    gWinC.wrappedJSObject.checkExpando('A2_expando', null, gWinA2.location, "document.domain should have no effect here");
+  }
+
+  ]]>
+  </script>
+  <iframe id="frameA1" onload="frameLoaded();" type="content" src="http://test1.example.org/tests/js/xpconnect/tests/mochitest/file_expandosharing.html" />
+  <iframe id="frameA2" onload="frameLoaded();" type="content" src="http://test1.example.org/tests/js/xpconnect/tests/mochitest/file_expandosharing.html" />
+  <iframe id="frameB" onload="frameLoaded();" type="content" src="http://test2.example.org/tests/js/xpconnect/tests/mochitest/file_expandosharing.html" />
+  <iframe id="frameC" onload="frameLoaded();" type="content" src="http://sub1.test1.example.org/tests/js/xpconnect/tests/mochitest/file_expandosharing.html" />
+</window>
diff --git a/js/xpconnect/tests/mochitest/Makefile.in b/js/xpconnect/tests/mochitest/Makefile.in
index c87d90edcf10..71783c0d2c41 100644
--- a/js/xpconnect/tests/mochitest/Makefile.in
+++ b/js/xpconnect/tests/mochitest/Makefile.in
@@ -67,6 +67,7 @@ _TEST_FILES =	bug500931_helper.html \
 		file_nodelists.html \
 		file_bug706301.html \
 		file_exnstack.html \
+		file_expandosharing.html \
 		$(NULL)
 
 _CHROME_FILES	= \
diff --git a/js/xpconnect/tests/mochitest/file_expandosharing.html b/js/xpconnect/tests/mochitest/file_expandosharing.html
new file mode 100644
index 000000000000..7b3564bcbde7
--- /dev/null
+++ b/js/xpconnect/tests/mochitest/file_expandosharing.html
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="application/javascript">
+  function setup() {
+    // Set up different target objects for expandos, one for each binding type.
+    window.targetWN = document.body.firstChild;
+    window.targetNodeList = document.getElementsByTagName('span');
+    window.targetXHR = new XMLHttpRequest();
+  }
+
+  function placeExpando(name, val, target) {
+    target[name] = val;
+  }
+
+  // If val === null, then we shouldn't have access.
+  function checkExpando(name, val, target, msg) {
+    if (val !== null) {
+      ok(name in target, msg);
+      try {
+        is(target[name], val, "Got the right expando value");
+      } catch(e) { ok(false, "Threw when accessing same-origin expando"); }
+    }
+    else {
+      ok(!(name in target), msg);
+    }
+  }
+
+</script>
+</head>
+<body onload="setup();">
+    <span>Salut, Ma Cherise. ;-)</span>
+</body>
+</html>
diff --git a/js/xpconnect/wrappers/WrapperFactory.cpp b/js/xpconnect/wrappers/WrapperFactory.cpp
index e29fa0cfeef7..994a1a24e012 100644
--- a/js/xpconnect/wrappers/WrapperFactory.cpp
+++ b/js/xpconnect/wrappers/WrapperFactory.cpp
@@ -379,47 +379,26 @@ WrapperFactory::Rewrap(JSContext *cx, JSObject *obj, JSObject *wrappedProto, JSO
         // For the same-origin case we use a transparent wrapper, unless one
         // of the following is true:
         // * The object is flagged as needing a SOW.
-        // * The object is a location object.
+        // * The object is a Location object.
+        // * The object is a Components object.
         // * The context compartment specifically requested Xray vision into
         //   same-origin compartments.
         //
         // The first two cases always require a security wrapper for non-chrome
         // access, regardless of the origin of the object.
-        //
-        // The Location case is a bit tricky. Because the security characteristics
-        // depend on the current outer window, we always have a security wrapper
-        // around locations, same-compartment or cross-compartment. We would
-        // normally just use an identical security policy and just switch between
-        // Wrapper and CrossCompartmentWrapper to differentiate the cases (LW/XLW).
-        // However, there's an added wrinkle that same-origin-but-cross-compartment
-        // scripts expect to be able to see expandos on each others' location
-        // objects. So if all cross-compartment access used XLWs, then the expandos
-        // would live on the per-compartment XrayWrapper expando object, and would
-        // not be shared. So to make sure that expandos work correctly in the
-        // same-origin case, we need to use a transparent CrossCompartmentWrapper
-        // to the LW in the host compartment, rather than an XLW directly to the
-        // Location object. This still doesn't share expandos in the
-        // document.domain case, but that's probably fine. Double-wrapping sucks,
-        // but it's kind of unavoidable here.
         XrayType type;
         if (AccessCheck::needsSystemOnlyWrapper(obj)) {
             wrapper = &FilteringWrapper<CrossCompartmentSecurityWrapper,
                                         OnlyIfSubjectIsSystem>::singleton;
+        } else if (IsLocationObject(obj)) {
+            typedef XrayWrapper<CrossCompartmentSecurityWrapper> Xray;
+            usingXray = true;
+            wrapper = &FilteringWrapper<Xray, LocationPolicy>::singleton;
         } else if (IsComponentsObject(obj)) {
             wrapper = &FilteringWrapper<CrossCompartmentSecurityWrapper,
                                         ComponentsObjectPolicy>::singleton;
         } else if (!targetdata || !targetdata->wantXrays ||
                    (type = GetXrayType(obj)) == NotXray) {
-            // Do the double-wrapping if need be.
-            if (IsLocationObject(obj)) {
-                JSAutoEnterCompartment ac;
-                if (!ac.enter(cx, obj))
-                    return nsnull;
-                XPCWrappedNative *wn = GetWrappedNative(cx, obj);
-                if (!wn)
-                    return nsnull;
-                obj = wn->GetSameCompartmentSecurityWrapper(cx);
-            }
             wrapper = &CrossCompartmentWrapper::singleton;
         } else if (type == XrayForDOMObject) {
             wrapper = &XrayDOM::singleton;
diff --git a/js/xpconnect/wrappers/XrayWrapper.cpp b/js/xpconnect/wrappers/XrayWrapper.cpp
index 2b1af9fdfc33..8325c01ff09f 100644
--- a/js/xpconnect/wrappers/XrayWrapper.cpp
+++ b/js/xpconnect/wrappers/XrayWrapper.cpp
@@ -29,7 +29,6 @@ using namespace js;
 
 static const uint32_t JSSLOT_WN = 0;
 static const uint32_t JSSLOT_RESOLVING = 1;
-static const uint32_t JSSLOT_EXPANDO = 2;
 
 static XPCWrappedNative *GetWrappedNative(JSObject *obj);
 
@@ -37,11 +36,194 @@ namespace XrayUtils {
 
 JSClass HolderClass = {
     "NativePropertyHolder",
-    JSCLASS_HAS_RESERVED_SLOTS(3),
+    JSCLASS_HAS_RESERVED_SLOTS(2),
     JS_PropertyStub,        JS_PropertyStub, holder_get,      holder_set,
     JS_EnumerateStub,       JS_ResolveStub,  JS_ConvertStub
 };
 
+/*
+ * Xray expando handling.
+ *
+ * We hang expandos for Xray wrappers off a reserved slot on the target object
+ * so that same-origin compartments can share expandos for a given object. We
+ * have a linked list of expando objects, one per origin. The properties on these
+ * objects are generally wrappers pointing back to the compartment that applied
+ * them.
+ *
+ * The expando objects should _never_ be exposed to script. The fact that they
+ * live in the target compartment is a detail of the implementation, and does
+ * not imply that code in the target compartment should be allowed to inspect
+ * them. They are private to the origin that placed them.
+ */
+
+enum ExpandoSlots {
+    JSSLOT_EXPANDO_NEXT = 0,
+    JSSLOT_EXPANDO_ORIGIN,
+    JSSLOT_EXPANDO_EXCLUSIVE_GLOBAL,
+    JSSLOT_EXPANDO_COUNT
+};
+
+static nsIPrincipal*
+ObjectPrincipal(JSObject *obj)
+{
+    return GetCompartmentPrincipal(js::GetObjectCompartment(obj));
+}
+
+static nsIPrincipal*
+GetExpandoObjectPrincipal(JSObject *expandoObject)
+{
+    JS::Value v = JS_GetReservedSlot(expandoObject, JSSLOT_EXPANDO_ORIGIN);
+    return static_cast<nsIPrincipal*>(v.toPrivate());
+}
+
+static void
+ExpandoObjectFinalize(JSFreeOp *fop, JSObject *obj)
+{
+    // Release the principal.
+    nsIPrincipal *principal = GetExpandoObjectPrincipal(obj);
+    NS_RELEASE(principal);
+}
+
+JSClass ExpandoObjectClass = {
+    "XrayExpandoObject",
+    JSCLASS_HAS_RESERVED_SLOTS(JSSLOT_EXPANDO_COUNT),
+    JS_PropertyStub, JS_PropertyStub, JS_PropertyStub, JS_StrictPropertyStub,
+    JS_EnumerateStub, JS_ResolveStub, JS_ConvertStub, ExpandoObjectFinalize
+};
+
+bool
+ExpandoObjectMatchesConsumer(JSObject *expandoObject,
+                             nsIPrincipal *consumerOrigin,
+                             JSObject *exclusiveGlobal)
+{
+    // First, compare the principals.
+    nsIPrincipal *o = GetExpandoObjectPrincipal(expandoObject);
+    bool equal;
+    // Note that it's very important here to ignore document.domain. We
+    // pull the principal for the expando object off of the first consumer
+    // for a given origin, and freely share the expandos amongst multiple
+    // same-origin consumers afterwards. However, this means that we have
+    // no way to know whether _all_ consumers have opted in to collaboration
+    // by explicitly setting document.domain. So we just mandate that expando
+    // sharing is unaffected by it.
+    nsresult rv = consumerOrigin->EqualsIgnoringDomain(o, &equal);
+    if (NS_FAILED(rv) || !equal)
+        return false;
+
+    // Sandboxes want exclusive expando objects.
+    JSObject *owner = JS_GetReservedSlot(expandoObject,
+                                         JSSLOT_EXPANDO_EXCLUSIVE_GLOBAL)
+                                        .toObjectOrNull();
+    if (!owner && !exclusiveGlobal)
+        return true;
+    return owner == exclusiveGlobal;
+}
+
+JSObject *
+LookupExpandoObject(JSObject *target, nsIPrincipal *origin,
+                    JSObject *exclusiveGlobal)
+{
+    // Iterate through the chain, looking for a same-origin object.
+    JSObject *head = GetExpandoChain(target);
+    while (head) {
+        if (ExpandoObjectMatchesConsumer(head, origin, exclusiveGlobal))
+            return head;
+        head = JS_GetReservedSlot(head, JSSLOT_EXPANDO_NEXT).toObjectOrNull();
+    }
+
+    // Not found.
+    return nsnull;
+}
+
+// Convenience method for the above.
+JSObject *
+LookupExpandoObject(JSObject *target, JSObject *consumer)
+{
+    JSObject *consumerGlobal = js::GetGlobalForObjectCrossCompartment(consumer);
+    bool isSandbox = !strcmp(js::GetObjectJSClass(consumerGlobal)->name, "Sandbox");
+    return LookupExpandoObject(target, ObjectPrincipal(consumer),
+                               isSandbox ? consumerGlobal : nsnull);
+}
+
+JSObject *
+AttachExpandoObject(JSContext *cx, JSObject *target, nsIPrincipal *origin,
+                    JSObject *exclusiveGlobal)
+{
+    // We should only be used for WNs.
+    MOZ_ASSERT(IS_WN_WRAPPER(target));
+
+    // No duplicates allowed.
+    MOZ_ASSERT(!LookupExpandoObject(target, origin, exclusiveGlobal));
+
+    // Create the expando object. We parent it directly to the target object.
+    JSObject *expandoObject = JS_NewObjectWithGivenProto(cx, &ExpandoObjectClass,
+                                                         nsnull, target);
+    if (!expandoObject)
+        return nsnull;
+
+    // AddRef and store the principal.
+    NS_ADDREF(origin);
+    JS_SetReservedSlot(expandoObject, JSSLOT_EXPANDO_ORIGIN, PRIVATE_TO_JSVAL(origin));
+
+    // Note the exclusive global, if any.
+    JS_SetReservedSlot(expandoObject, JSSLOT_EXPANDO_EXCLUSIVE_GLOBAL,
+                       OBJECT_TO_JSVAL(exclusiveGlobal));
+
+    // If this is our first expando object, take the opportunity to preserve
+    // the wrapper. This keeps our expandos alive even if the Xray wrapper gets
+    // collected.
+    JSObject *chain = GetExpandoChain(target);
+    if (!chain) {
+        XPCWrappedNative *wn =
+          static_cast<XPCWrappedNative *>(xpc_GetJSPrivate(target));
+        nsRefPtr<nsXPCClassInfo> ci;
+        CallQueryInterface(wn->Native(), getter_AddRefs(ci));
+        if (ci)
+            ci->PreserveWrapper(wn->Native());
+    }
+
+    // Insert it at the front of the chain.
+    JS_SetReservedSlot(expandoObject, JSSLOT_EXPANDO_NEXT, OBJECT_TO_JSVAL(chain));
+    SetExpandoChain(target, expandoObject);
+
+    return expandoObject;
+}
+
+JSObject *
+EnsureExpandoObject(JSContext *cx, JSObject *wrapper, JSObject *target)
+{
+    JSObject *expandoObject = LookupExpandoObject(target, wrapper);
+    if (!expandoObject) {
+        // If the object is a sandbox, we don't want it to share expandos with
+        // anyone else, so we tag it with the sandbox global.
+        JSObject *consumerGlobal = js::GetGlobalForObjectCrossCompartment(wrapper);
+        bool isSandbox = !strcmp(js::GetObjectJSClass(consumerGlobal)->name, "Sandbox");
+        expandoObject = AttachExpandoObject(cx, target, ObjectPrincipal(wrapper),
+                                            isSandbox ? consumerGlobal : nsnull);
+    }
+    return expandoObject;
+}
+
+bool
+CloneExpandoChain(JSContext *cx, JSObject *dst, JSObject *src)
+{
+    MOZ_ASSERT(js::IsObjectInContextCompartment(dst, cx));
+    MOZ_ASSERT(GetExpandoChain(dst) == nsnull);
+
+    JSObject *oldHead = GetExpandoChain(src);
+    while (oldHead) {
+        JSObject *exclusive = JS_GetReservedSlot(oldHead,
+                                                 JSSLOT_EXPANDO_EXCLUSIVE_GLOBAL)
+                                                .toObjectOrNull();
+        JSObject *newHead =
+          AttachExpandoObject(cx, dst, GetExpandoObjectPrincipal(oldHead), exclusive);
+        if (!JS_CopyPropertiesFrom(cx, newHead, oldHead))
+            return false;
+        oldHead = JS_GetReservedSlot(oldHead, JSSLOT_EXPANDO_NEXT).toObjectOrNull();
+    }
+    return true;
+}
+
 JSObject *
 createHolder(JSContext *cx, JSObject *wrappedNative, JSObject *parent)
 {
@@ -49,10 +231,8 @@ createHolder(JSContext *cx, JSObject *wrappedNative, JSObject *parent)
     if (!holder)
         return nsnull;
 
-    CompartmentPrivate *priv = GetCompartmentPrivate(holder);
     JSObject *inner = JS_ObjectToInnerObject(cx, wrappedNative);
     XPCWrappedNative *wn = GetWrappedNative(inner);
-    Value expando = ObjectOrNullValue(priv->LookupExpandoObject(wn));
 
     // A note about ownership: the holder has a direct pointer to the wrapped
     // native that we're wrapping. Normally, we'd have to AddRef the pointer
@@ -66,7 +246,6 @@ createHolder(JSContext *cx, JSObject *wrappedNative, JSObject *parent)
               js::GetObjectClass(wrappedNative)->ext.innerObject);
     js::SetReservedSlot(holder, JSSLOT_WN, PrivateValue(wn));
     js::SetReservedSlot(holder, JSSLOT_RESOLVING, PrivateValue(NULL));
-    js::SetReservedSlot(holder, JSSLOT_EXPANDO, expando);
     return holder;
 }
 
@@ -243,43 +422,6 @@ GetWrappedNativeObjectFromHolder(JSObject *holder)
     return GetWrappedNativeFromHolder(holder)->GetFlatJSObject();
 }
 
-static JSObject *
-GetExpandoObject(JSObject *holder)
-{
-    MOZ_ASSERT(js::GetObjectJSClass(holder) == &HolderClass);
-    return js::GetReservedSlot(holder, JSSLOT_EXPANDO).toObjectOrNull();
-}
-
-static JSObject *
-EnsureExpandoObject(JSContext *cx, JSObject *holder)
-{
-    MOZ_ASSERT(js::GetObjectJSClass(holder) == &HolderClass);
-    JSObject *expando = GetExpandoObject(holder);
-    if (expando)
-        return expando;
-    CompartmentPrivate *priv = GetCompartmentPrivate(holder);
-    XPCWrappedNative *wn = GetWrappedNativeFromHolder(holder);
-    expando = priv->LookupExpandoObject(wn);
-    if (!expando) {
-        expando = JS_NewObjectWithGivenProto(cx, nsnull, nsnull,
-                                             js::GetObjectParent(holder));
-        if (!expando)
-            return NULL;
-        // Add the expando object to the expando map to keep it alive.
-        if (!priv->RegisterExpandoObject(wn, expando)) {
-            JS_ReportOutOfMemory(cx);
-            return NULL;
-        }
-        // Make sure the wn stays alive so it keeps the expando object alive.
-        nsRefPtr<nsXPCClassInfo> ci;
-        CallQueryInterface(wn->Native(), getter_AddRefs(ci));
-        if (ci)
-            ci->PreserveWrapper(wn->Native());
-    }
-    js::SetReservedSlot(holder, JSSLOT_EXPANDO, ObjectValue(*expando));
-    return expando;
-}
-
 static inline JSObject *
 FindWrapper(JSObject *wrapper)
 {
@@ -654,13 +796,22 @@ XPCWrappedNativeXrayTraits::resolveOwnProperty(JSContext *cx, js::Wrapper &jsWra
     desc->obj = NULL;
 
     unsigned flags = (set ? JSRESOLVE_ASSIGNING : 0) | JSRESOLVE_QUALIFIED;
-    JSObject *expando = GetExpandoObject(holder);
+    JSObject *target = GetWrappedNativeObjectFromHolder(holder);
+    JSObject *expando = LookupExpandoObject(target, wrapper);
 
-    // Check for expando properties first.
-    if (expando && !JS_GetPropertyDescriptorById(cx, expando, id, flags, desc)) {
-        return false;
+    // Check for expando properties first. Note that the expando object lives
+    // in the target compartment.
+    if (expando) {
+        JSAutoEnterCompartment ac;
+        if (!ac.enter(cx, expando) ||
+            !JS_GetPropertyDescriptorById(cx, expando, id, flags, desc))
+        {
+            return false;
+        }
     }
     if (desc->obj) {
+        if (!JS_WrapPropertyDescriptor(cx, desc))
+            return false;
         // Pretend the property lives on the wrapper.
         desc->obj = wrapper;
         return true;
@@ -718,24 +869,42 @@ XPCWrappedNativeXrayTraits::defineProperty(JSContext *cx, JSObject *wrapper, jsi
                                      desc->attrs);
     }
 
-    JSObject *expando = EnsureExpandoObject(cx, holder);
-    if (!expando)
+    // We're placing an expando. The expando objects live in the target
+    // compartment, so we need to enter it.
+    JSObject *target = GetWrappedNativeObjectFromHolder(holder);
+    JSAutoEnterCompartment ac;
+    if (!ac.enter(cx, target))
         return false;
 
-    return JS_DefinePropertyById(cx, expando, id, desc->value, desc->getter, desc->setter,
-                                 desc->attrs);
+    // Grab the relevant expando object.
+    JSObject *expandoObject = EnsureExpandoObject(cx, wrapper, target);
+    if (!expandoObject)
+        return false;
+
+    // Wrap the property descriptor for the target compartment.
+    PropertyDescriptor wrappedDesc = *desc;
+    if (!JS_WrapPropertyDescriptor(cx, &wrappedDesc))
+        return false;
+
+    return JS_DefinePropertyById(cx, expandoObject, id, wrappedDesc.value,
+                                 wrappedDesc.getter, wrappedDesc.setter,
+                                 wrappedDesc.attrs);
 }
 
 bool
 XPCWrappedNativeXrayTraits::delete_(JSContext *cx, JSObject *wrapper, jsid id, bool *bp)
 {
     JSObject *holder = getHolderObject(wrapper);
-    JSObject *expando = GetExpandoObject(holder);
+    JSObject *target = GetWrappedNativeObjectFromHolder(holder);
+    JSObject *expando = LookupExpandoObject(target, wrapper);
+    JSAutoEnterCompartment ac;
     JSBool b = true;
     jsval v;
     if (expando &&
-        (!JS_DeletePropertyById2(cx, expando, id, &v) ||
-         !JS_ValueToBoolean(cx, v, &b))) {
+        (!ac.enter(cx, expando) ||
+         !JS_DeletePropertyById2(cx, expando, id, &v) ||
+         !JS_ValueToBoolean(cx, v, &b)))
+    {
         return false;
     }
 
@@ -749,9 +918,19 @@ XPCWrappedNativeXrayTraits::enumerateNames(JSContext *cx, JSObject *wrapper, uns
 {
     JSObject *holder = getHolderObject(wrapper);
 
-    // Enumerate expando properties first.
-    JSObject *expando = GetExpandoObject(holder);
-    if (expando && !js::GetPropertyNames(cx, expando, flags, &props))
+    // Enumerate expando properties first. Note that the expando object lives
+    // in the target compartment.
+    JSObject *target = GetWrappedNativeObjectFromHolder(holder);
+    JSObject *expando = LookupExpandoObject(target, wrapper);
+    if (expando) {
+        JSAutoEnterCompartment ac;
+        if (!ac.enter(cx, expando) ||
+            !js::GetPropertyNames(cx, expando, flags, &props))
+        {
+            return false;
+        }
+    }
+    if (!JS_WrapAutoIdVector(cx, props))
         return false;
 
     // Force all native properties to be materialized onto the wrapped native.
diff --git a/js/xpconnect/wrappers/XrayWrapper.h b/js/xpconnect/wrappers/XrayWrapper.h
index 316bcd30c0d5..bafcd84eecc9 100644
--- a/js/xpconnect/wrappers/XrayWrapper.h
+++ b/js/xpconnect/wrappers/XrayWrapper.h
@@ -27,6 +27,8 @@ namespace XrayUtils {
 
 extern JSClass HolderClass;
 
+bool CloneExpandoChain(JSContext *cx, JSObject *src, JSObject *dst);
+
 JSObject *createHolder(JSContext *cx, JSObject *wrappedNative, JSObject *parent);
 
 bool
diff --git a/layout/base/nsPresArena.cpp b/layout/base/nsPresArena.cpp
index 3188e8827fcc..8a132f4f053c 100644
--- a/layout/base/nsPresArena.cpp
+++ b/layout/base/nsPresArena.cpp
@@ -414,16 +414,14 @@ nsPresArena::~nsPresArena()
 void*
 nsPresArena::AllocateBySize(size_t aSize)
 {
-  return mState->Allocate(PRUint32(aSize) |
-                          PRUint32(nsQueryFrame::NON_FRAME_MARKER),
+  return mState->Allocate(PRUint32(aSize) | PRUint32(NON_OBJECT_MARKER),
                           aSize);
 }
 
 void
 nsPresArena::FreeBySize(size_t aSize, void* aPtr)
 {
-  mState->Free(PRUint32(aSize) |
-               PRUint32(nsQueryFrame::NON_FRAME_MARKER), aPtr);
+  mState->Free(PRUint32(aSize) | PRUint32(NON_OBJECT_MARKER), aPtr);
 }
 
 void*
diff --git a/layout/forms/nsGfxButtonControlFrame.h b/layout/forms/nsGfxButtonControlFrame.h
index c9250a8dd5a5..2a3ca35b182a 100644
--- a/layout/forms/nsGfxButtonControlFrame.h
+++ b/layout/forms/nsGfxButtonControlFrame.h
@@ -69,7 +69,6 @@ protected:
 
   virtual bool IsInput() { return true; }
 private:
-  nsSize mSuggestedSize;
   nsCOMPtr<nsIContent> mTextContent;
 };
 
diff --git a/layout/generic/nsBlockFrame.cpp b/layout/generic/nsBlockFrame.cpp
index 017e6f946c01..3ba219073b5b 100644
--- a/layout/generic/nsBlockFrame.cpp
+++ b/layout/generic/nsBlockFrame.cpp
@@ -669,6 +669,27 @@ nsBlockFrame::MarkIntrinsicWidthsDirty()
   nsBlockFrameSuper::MarkIntrinsicWidthsDirty();
 }
 
+void
+nsBlockFrame::CheckIntrinsicCacheAgainstShrinkWrapState()
+{
+  nsPresContext *presContext = PresContext();
+  if (!nsLayoutUtils::FontSizeInflationEnabled(presContext)) {
+    return;
+  }
+  bool inflationEnabled =
+    !presContext->mInflationDisabledForShrinkWrap;
+  if (inflationEnabled !=
+      !!(GetStateBits() & NS_BLOCK_FRAME_INTRINSICS_INFLATED)) {
+    mMinWidth = NS_INTRINSIC_WIDTH_UNKNOWN;
+    mPrefWidth = NS_INTRINSIC_WIDTH_UNKNOWN;
+    if (inflationEnabled) {
+      AddStateBits(NS_BLOCK_FRAME_INTRINSICS_INFLATED);
+    } else {
+      RemoveStateBits(NS_BLOCK_FRAME_INTRINSICS_INFLATED);
+    }
+  }
+}
+
 /* virtual */ nscoord
 nsBlockFrame::GetMinWidth(nsRenderingContext *aRenderingContext)
 {
@@ -677,6 +698,9 @@ nsBlockFrame::GetMinWidth(nsRenderingContext *aRenderingContext)
     return firstInFlow->GetMinWidth(aRenderingContext);
 
   DISPLAY_MIN_WIDTH(this, mMinWidth);
+
+  CheckIntrinsicCacheAgainstShrinkWrapState();
+
   if (mMinWidth != NS_INTRINSIC_WIDTH_UNKNOWN)
     return mMinWidth;
 
@@ -755,6 +779,8 @@ nsBlockFrame::GetPrefWidth(nsRenderingContext *aRenderingContext)
 
   DISPLAY_PREF_WIDTH(this, mPrefWidth);
 
+  CheckIntrinsicCacheAgainstShrinkWrapState();
+
   if (mPrefWidth != NS_INTRINSIC_WIDTH_UNKNOWN)
     return mPrefWidth;
 
diff --git a/layout/generic/nsBlockFrame.h b/layout/generic/nsBlockFrame.h
index 3422dbeb0d89..eedbf325232e 100644
--- a/layout/generic/nsBlockFrame.h
+++ b/layout/generic/nsBlockFrame.h
@@ -91,6 +91,16 @@ class nsIntervalSet;
 // (including <BR CLEAR="..."> frames)
 #define NS_BLOCK_HAS_CLEAR_CHILDREN         NS_FRAME_STATE_BIT(27)
 
+// Are our cached intrinsic widths intrinsic widths for font size
+// inflation?  i.e., what was the current state of
+// GetPresContext()->mInflationDisabledForShrinkWrap at the time they
+// were computed?
+// nsBlockFrame is the only thing that caches intrinsic widths that
+// needs to track this because it's the only thing that caches intrinsic
+// widths that lives inside of things (form controls) that do intrinsic
+// sizing with font inflation enabled.
+#define NS_BLOCK_FRAME_INTRINSICS_INFLATED  NS_FRAME_STATE_BIT(62)
+
 #define nsBlockFrameSuper nsContainerFrame
 
 /*
@@ -241,6 +251,9 @@ public:
   }
 
   virtual void MarkIntrinsicWidthsDirty();
+private:
+  void CheckIntrinsicCacheAgainstShrinkWrapState();
+public:
   virtual nscoord GetMinWidth(nsRenderingContext *aRenderingContext);
   virtual nscoord GetPrefWidth(nsRenderingContext *aRenderingContext);
 
diff --git a/layout/generic/nsFontInflationData.cpp b/layout/generic/nsFontInflationData.cpp
index 149121fcbbee..58ee4c14660a 100644
--- a/layout/generic/nsFontInflationData.cpp
+++ b/layout/generic/nsFontInflationData.cpp
@@ -131,6 +131,11 @@ ComputeDescendantWidth(const nsHTMLReflowState& aAncestorReflowState,
     frames.AppendElement(f);
   }
 
+  // This ignores the width contributions made by scrollbars, though in
+  // reality we don't have any scrollbars on the sorts of devices on
+  // which we use font inflation, so it's not a problem.  But it may
+  // occasionally cause problems when writing tests on desktop.
+
   PRUint32 len = frames.Length();
   nsHTMLReflowState *reflowStates = static_cast<nsHTMLReflowState*>
                                 (moz_xmalloc(sizeof(nsHTMLReflowState) * len));
diff --git a/layout/generic/nsTextFrameThebes.cpp b/layout/generic/nsTextFrameThebes.cpp
index b1d311190373..40a8b0c6cf84 100644
--- a/layout/generic/nsTextFrameThebes.cpp
+++ b/layout/generic/nsTextFrameThebes.cpp
@@ -6696,6 +6696,12 @@ nsTextFrame::AddInlineMinWidth(nsRenderingContext *aRenderingContext,
   float inflation = nsLayoutUtils::FontSizeInflationFor(this);
   TextRunType trtype = (inflation == 1.0f) ? eNotInflated : eInflated;
 
+  if (trtype == eInflated && inflation != GetFontSizeInflation()) {
+    // FIXME: Ideally, if we already have a text run, we'd move it to be
+    // the uninflated text run.
+    ClearTextRun(nsnull, nsTextFrame::eInflated);
+  }
+
   nsTextFrame* f;
   gfxTextRun* lastTextRun = nsnull;
   // nsContinuingTextFrame does nothing for AddInlineMinWidth; all text frames
@@ -6826,6 +6832,12 @@ nsTextFrame::AddInlinePrefWidth(nsRenderingContext *aRenderingContext,
   float inflation = nsLayoutUtils::FontSizeInflationFor(this);
   TextRunType trtype = (inflation == 1.0f) ? eNotInflated : eInflated;
 
+  if (trtype == eInflated && inflation != GetFontSizeInflation()) {
+    // FIXME: Ideally, if we already have a text run, we'd move it to be
+    // the uninflated text run.
+    ClearTextRun(nsnull, nsTextFrame::eInflated);
+  }
+
   nsTextFrame* f;
   gfxTextRun* lastTextRun = nsnull;
   // nsContinuingTextFrame does nothing for AddInlineMinWidth; all text frames
diff --git a/layout/reftests/font-inflation/min-width-passes-1-ref.html b/layout/reftests/font-inflation/min-width-passes-1-ref.html
new file mode 100644
index 000000000000..1027e29d992e
--- /dev/null
+++ b/layout/reftests/font-inflation/min-width-passes-1-ref.html
@@ -0,0 +1,23 @@
+<html>
+<head>
+<title>Bug Reproduction</title>
+</head>
+<style type="text/css">
+html, body {
+  /*
+   * Work around bug 759755 / bug 757179.  Setting overflow hidden
+   * avoids these bugs being triggered due to the hypothetical scrollbar
+   * reflows.
+   */
+  overflow: hidden;
+}
+table { width: 100% }
+body, table, tbody, tr, td {
+  margin: 0; border: none; padding: 0; border-spacing: 0;
+}
+</style>
+<body>
+  <h1 id="welcome">Welcome to Bugzilla</h1>
+  <input type="button" id="find" value="Quick Search"></input>
+</body>
+</html>
diff --git a/layout/reftests/font-inflation/min-width-passes-1.html b/layout/reftests/font-inflation/min-width-passes-1.html
new file mode 100644
index 000000000000..0ab18996d9f3
--- /dev/null
+++ b/layout/reftests/font-inflation/min-width-passes-1.html
@@ -0,0 +1,25 @@
+<html>
+<head>
+<title>Bug Reproduction</title>
+</head>
+<style type="text/css">
+html, body {
+  /*
+   * Work around bug 759755 / bug 757179.  Setting overflow hidden
+   * avoids these bugs being triggered due to the hypothetical scrollbar
+   * reflows.
+   */
+  overflow: hidden;
+}
+table { width: 100% }
+body, table, tbody, tr, td {
+  margin: 0; border: none; padding: 0; border-spacing: 0;
+}
+</style>
+<body>
+<table><tr><td>
+  <h1 id="welcome">Welcome to Bugzilla</h1>
+  <input type="button" id="find" value="Quick Search"></input>
+</td></tr></table>
+</body>
+</html>
diff --git a/layout/reftests/font-inflation/reftest.list b/layout/reftests/font-inflation/reftest.list
index 575f81224b57..924812a89478 100644
--- a/layout/reftests/font-inflation/reftest.list
+++ b/layout/reftests/font-inflation/reftest.list
@@ -95,3 +95,5 @@ fuzzy-if(gtk2Widget,1,8) test-pref(font.size.inflation.emPerLine,15) test-pref(f
 
 test-pref(font.size.inflation.emPerLine,15) test-pref(font.size.inflation.lineThreshold,0) == relevant-width-1.html relevant-width-1-ref.html
 test-pref(font.size.inflation.emPerLine,15) test-pref(font.size.inflation.lineThreshold,0) == relevant-width-overflow-1.html relevant-width-overflow-1-ref.html
+
+pref(font.size.inflation.emPerLine,15) pref(font.size.inflation.lineThreshold,0) == min-width-passes-1.html min-width-passes-1-ref.html
diff --git a/media/libjpeg/MOZCHANGES b/media/libjpeg/MOZCHANGES
index 17267e5a5de0..f73bf918da38 100644
--- a/media/libjpeg/MOZCHANGES
+++ b/media/libjpeg/MOZCHANGES
@@ -58,6 +58,9 @@ To upgrade to a new revision of libjpeg-turbo, do the following:
 
     $ hg addremove
 
+== June 5, 2012 (libjpeg-turbo v1.2.x branch, r831 2012-05-30) ==
+
+* Updated to latest version on v1.2.x branch (bug 759891).
 
 == February 10, 2012 (libjpeg-turbo v1.2.0 r807 2012-02-10) ==
 
diff --git a/media/libjpeg/jccolext.c b/media/libjpeg/jccolext.c
index acbfa2352391..dbac84a9095c 100644
--- a/media/libjpeg/jccolext.c
+++ b/media/libjpeg/jccolext.c
@@ -2,7 +2,7 @@
  * jccolext.c
  *
  * Copyright (C) 1991-1996, Thomas G. Lane.
- * Copyright (C) 2009-2011, D. R. Commander.
+ * Copyright (C) 2009-2012, D. R. Commander.
  * This file is part of the Independent JPEG Group's software.
  * For conditions of distribution and use, see the accompanying README file.
  *
@@ -112,3 +112,35 @@ rgb_gray_convert_internal (j_compress_ptr cinfo,
     }
   }
 }
+
+
+/*
+ * Convert some rows of samples to the JPEG colorspace.
+ * This version handles extended RGB->plain RGB conversion
+ */
+
+INLINE
+LOCAL(void)
+rgb_rgb_convert_internal (j_compress_ptr cinfo,
+                          JSAMPARRAY input_buf, JSAMPIMAGE output_buf,
+                          JDIMENSION output_row, int num_rows)
+{
+  register JSAMPROW inptr;
+  register JSAMPROW outptr0, outptr1, outptr2;
+  register JDIMENSION col;
+  JDIMENSION num_cols = cinfo->image_width;
+
+  while (--num_rows >= 0) {
+    inptr = *input_buf++;
+    outptr0 = output_buf[0][output_row];
+    outptr1 = output_buf[1][output_row];
+    outptr2 = output_buf[2][output_row];
+    output_row++;
+    for (col = 0; col < num_cols; col++) {
+      outptr0[col] = GETJSAMPLE(inptr[RGB_RED]);
+      outptr1[col] = GETJSAMPLE(inptr[RGB_GREEN]);
+      outptr2[col] = GETJSAMPLE(inptr[RGB_BLUE]);
+      inptr += RGB_PIXELSIZE;
+    }
+  }
+}
diff --git a/media/libjpeg/jccolor.c b/media/libjpeg/jccolor.c
index 973055574249..3a0772bb5a77 100644
--- a/media/libjpeg/jccolor.c
+++ b/media/libjpeg/jccolor.c
@@ -3,7 +3,7 @@
  *
  * Copyright (C) 1991-1996, Thomas G. Lane.
  * Copyright 2009 Pierre Ossman <ossman@cendio.se> for Cendio AB
- * Copyright (C) 2009-2011, D. R. Commander.
+ * Copyright (C) 2009-2012, D. R. Commander.
  * This file is part of the Independent JPEG Group's software.
  * For conditions of distribution and use, see the accompanying README file.
  *
@@ -96,6 +96,7 @@ typedef my_color_converter * my_cconvert_ptr;
 #define RGB_PIXELSIZE EXT_RGB_PIXELSIZE
 #define rgb_ycc_convert_internal extrgb_ycc_convert_internal
 #define rgb_gray_convert_internal extrgb_gray_convert_internal
+#define rgb_rgb_convert_internal extrgb_rgb_convert_internal
 #include "jccolext.c"
 #undef RGB_RED
 #undef RGB_GREEN
@@ -103,6 +104,7 @@ typedef my_color_converter * my_cconvert_ptr;
 #undef RGB_PIXELSIZE
 #undef rgb_ycc_convert_internal
 #undef rgb_gray_convert_internal
+#undef rgb_rgb_convert_internal
 
 #define RGB_RED EXT_RGBX_RED
 #define RGB_GREEN EXT_RGBX_GREEN
@@ -110,6 +112,7 @@ typedef my_color_converter * my_cconvert_ptr;
 #define RGB_PIXELSIZE EXT_RGBX_PIXELSIZE
 #define rgb_ycc_convert_internal extrgbx_ycc_convert_internal
 #define rgb_gray_convert_internal extrgbx_gray_convert_internal
+#define rgb_rgb_convert_internal extrgbx_rgb_convert_internal
 #include "jccolext.c"
 #undef RGB_RED
 #undef RGB_GREEN
@@ -117,6 +120,7 @@ typedef my_color_converter * my_cconvert_ptr;
 #undef RGB_PIXELSIZE
 #undef rgb_ycc_convert_internal
 #undef rgb_gray_convert_internal
+#undef rgb_rgb_convert_internal
 
 #define RGB_RED EXT_BGR_RED
 #define RGB_GREEN EXT_BGR_GREEN
@@ -124,6 +128,7 @@ typedef my_color_converter * my_cconvert_ptr;
 #define RGB_PIXELSIZE EXT_BGR_PIXELSIZE
 #define rgb_ycc_convert_internal extbgr_ycc_convert_internal
 #define rgb_gray_convert_internal extbgr_gray_convert_internal
+#define rgb_rgb_convert_internal extbgr_rgb_convert_internal
 #include "jccolext.c"
 #undef RGB_RED
 #undef RGB_GREEN
@@ -131,6 +136,7 @@ typedef my_color_converter * my_cconvert_ptr;
 #undef RGB_PIXELSIZE
 #undef rgb_ycc_convert_internal
 #undef rgb_gray_convert_internal
+#undef rgb_rgb_convert_internal
 
 #define RGB_RED EXT_BGRX_RED
 #define RGB_GREEN EXT_BGRX_GREEN
@@ -138,6 +144,7 @@ typedef my_color_converter * my_cconvert_ptr;
 #define RGB_PIXELSIZE EXT_BGRX_PIXELSIZE
 #define rgb_ycc_convert_internal extbgrx_ycc_convert_internal
 #define rgb_gray_convert_internal extbgrx_gray_convert_internal
+#define rgb_rgb_convert_internal extbgrx_rgb_convert_internal
 #include "jccolext.c"
 #undef RGB_RED
 #undef RGB_GREEN
@@ -145,6 +152,7 @@ typedef my_color_converter * my_cconvert_ptr;
 #undef RGB_PIXELSIZE
 #undef rgb_ycc_convert_internal
 #undef rgb_gray_convert_internal
+#undef rgb_rgb_convert_internal
 
 #define RGB_RED EXT_XBGR_RED
 #define RGB_GREEN EXT_XBGR_GREEN
@@ -152,6 +160,7 @@ typedef my_color_converter * my_cconvert_ptr;
 #define RGB_PIXELSIZE EXT_XBGR_PIXELSIZE
 #define rgb_ycc_convert_internal extxbgr_ycc_convert_internal
 #define rgb_gray_convert_internal extxbgr_gray_convert_internal
+#define rgb_rgb_convert_internal extxbgr_rgb_convert_internal
 #include "jccolext.c"
 #undef RGB_RED
 #undef RGB_GREEN
@@ -159,6 +168,7 @@ typedef my_color_converter * my_cconvert_ptr;
 #undef RGB_PIXELSIZE
 #undef rgb_ycc_convert_internal
 #undef rgb_gray_convert_internal
+#undef rgb_rgb_convert_internal
 
 #define RGB_RED EXT_XRGB_RED
 #define RGB_GREEN EXT_XRGB_GREEN
@@ -166,6 +176,7 @@ typedef my_color_converter * my_cconvert_ptr;
 #define RGB_PIXELSIZE EXT_XRGB_PIXELSIZE
 #define rgb_ycc_convert_internal extxrgb_ycc_convert_internal
 #define rgb_gray_convert_internal extxrgb_gray_convert_internal
+#define rgb_rgb_convert_internal extxrgb_rgb_convert_internal
 #include "jccolext.c"
 #undef RGB_RED
 #undef RGB_GREEN
@@ -173,6 +184,7 @@ typedef my_color_converter * my_cconvert_ptr;
 #undef RGB_PIXELSIZE
 #undef rgb_ycc_convert_internal
 #undef rgb_gray_convert_internal
+#undef rgb_rgb_convert_internal
 
 
 /*
@@ -306,6 +318,52 @@ rgb_gray_convert (j_compress_ptr cinfo,
 }
 
 
+/*
+ * Extended RGB to plain RGB conversion
+ */
+
+METHODDEF(void)
+rgb_rgb_convert (j_compress_ptr cinfo,
+		  JSAMPARRAY input_buf, JSAMPIMAGE output_buf,
+		  JDIMENSION output_row, int num_rows)
+{
+  switch (cinfo->in_color_space) {
+    case JCS_EXT_RGB:
+      extrgb_rgb_convert_internal(cinfo, input_buf, output_buf, output_row,
+                                  num_rows);
+      break;
+    case JCS_EXT_RGBX:
+    case JCS_EXT_RGBA:
+      extrgbx_rgb_convert_internal(cinfo, input_buf, output_buf, output_row,
+                                   num_rows);
+      break;
+    case JCS_EXT_BGR:
+      extbgr_rgb_convert_internal(cinfo, input_buf, output_buf, output_row,
+                                  num_rows);
+      break;
+    case JCS_EXT_BGRX:
+    case JCS_EXT_BGRA:
+      extbgrx_rgb_convert_internal(cinfo, input_buf, output_buf, output_row,
+                                   num_rows);
+      break;
+    case JCS_EXT_XBGR:
+    case JCS_EXT_ABGR:
+      extxbgr_rgb_convert_internal(cinfo, input_buf, output_buf, output_row,
+                                   num_rows);
+      break;
+    case JCS_EXT_XRGB:
+    case JCS_EXT_ARGB:
+      extxrgb_rgb_convert_internal(cinfo, input_buf, output_buf, output_row,
+                                   num_rows);
+      break;
+    default:
+      rgb_rgb_convert_internal(cinfo, input_buf, output_buf, output_row,
+                               num_rows);
+      break;
+  }
+}
+
+
 /*
  * Convert some rows of samples to the JPEG colorspace.
  * This version handles Adobe-style CMYK->YCCK conversion,
@@ -523,21 +581,25 @@ jinit_color_converter (j_compress_ptr cinfo)
     break;
 
   case JCS_RGB:
-  case JCS_EXT_RGB:
-  case JCS_EXT_RGBX:
-  case JCS_EXT_BGR:
-  case JCS_EXT_BGRX:
-  case JCS_EXT_XBGR:
-  case JCS_EXT_XRGB:
-  case JCS_EXT_RGBA:
-  case JCS_EXT_BGRA:
-  case JCS_EXT_ABGR:
-  case JCS_EXT_ARGB:
     if (cinfo->num_components != 3)
       ERREXIT(cinfo, JERR_BAD_J_COLORSPACE);
-    if (cinfo->in_color_space == cinfo->jpeg_color_space &&
-      rgb_pixelsize[cinfo->in_color_space] == 3)
+    if (rgb_red[cinfo->in_color_space] == 0 &&
+        rgb_green[cinfo->in_color_space] == 1 &&
+        rgb_blue[cinfo->in_color_space] == 2 &&
+        rgb_pixelsize[cinfo->in_color_space] == 3)
       cconvert->pub.color_convert = null_convert;
+    else if (cinfo->in_color_space == JCS_RGB ||
+             cinfo->in_color_space == JCS_EXT_RGB ||
+             cinfo->in_color_space == JCS_EXT_RGBX ||
+             cinfo->in_color_space == JCS_EXT_BGR ||
+             cinfo->in_color_space == JCS_EXT_BGRX ||
+             cinfo->in_color_space == JCS_EXT_XBGR ||
+             cinfo->in_color_space == JCS_EXT_XRGB ||
+             cinfo->in_color_space == JCS_EXT_RGBA ||
+             cinfo->in_color_space == JCS_EXT_BGRA ||
+             cinfo->in_color_space == JCS_EXT_ABGR ||
+             cinfo->in_color_space == JCS_EXT_ARGB)
+      cconvert->pub.color_convert = rgb_rgb_convert;
     else
       ERREXIT(cinfo, JERR_CONVERSION_NOTIMPL);
     break;
diff --git a/media/libjpeg/jdcolext.c b/media/libjpeg/jdcolext.c
index 07da949fae02..3b8aeffc9f3a 100644
--- a/media/libjpeg/jdcolext.c
+++ b/media/libjpeg/jdcolext.c
@@ -102,3 +102,40 @@ gray_rgb_convert_internal (j_decompress_ptr cinfo,
     }
   }
 }
+
+
+/*
+ * Convert RGB to extended RGB: just swap the order of source pixels
+ */
+
+INLINE
+LOCAL(void)
+rgb_rgb_convert_internal (j_decompress_ptr cinfo,
+                          JSAMPIMAGE input_buf, JDIMENSION input_row,
+                          JSAMPARRAY output_buf, int num_rows)
+{
+  register JSAMPROW inptr0, inptr1, inptr2;
+  register JSAMPROW outptr;
+  register JDIMENSION col;
+  JDIMENSION num_cols = cinfo->output_width;
+
+  while (--num_rows >= 0) {
+    inptr0 = input_buf[0][input_row];
+    inptr1 = input_buf[1][input_row];
+    inptr2 = input_buf[2][input_row];
+    input_row++;
+    outptr = *output_buf++;
+    for (col = 0; col < num_cols; col++) {
+      /* We can dispense with GETJSAMPLE() here */
+      outptr[RGB_RED] = inptr0[col];
+      outptr[RGB_GREEN] = inptr1[col];
+      outptr[RGB_BLUE] = inptr2[col];
+      /* Set unused byte to 0xFF so it can be interpreted as an opaque */
+      /* alpha channel value */
+#ifdef RGB_ALPHA
+      outptr[RGB_ALPHA] = 0xFF;
+#endif
+      outptr += RGB_PIXELSIZE;
+    }
+  }
+}
diff --git a/media/libjpeg/jdcolor.c b/media/libjpeg/jdcolor.c
index d9268dbb5224..694de9b64e41 100644
--- a/media/libjpeg/jdcolor.c
+++ b/media/libjpeg/jdcolor.c
@@ -3,7 +3,7 @@
  *
  * Copyright (C) 1991-1997, Thomas G. Lane.
  * Copyright 2009 Pierre Ossman <ossman@cendio.se> for Cendio AB
- * Copyright (C) 2009, 2011, D. R. Commander.
+ * Copyright (C) 2009, 2011-2012, D. R. Commander.
  * This file is part of the Independent JPEG Group's software.
  * For conditions of distribution and use, see the accompanying README file.
  *
@@ -80,6 +80,7 @@ typedef my_color_deconverter * my_cconvert_ptr;
 #define RGB_PIXELSIZE EXT_RGB_PIXELSIZE
 #define ycc_rgb_convert_internal ycc_extrgb_convert_internal
 #define gray_rgb_convert_internal gray_extrgb_convert_internal
+#define rgb_rgb_convert_internal rgb_extrgb_convert_internal
 #include "jdcolext.c"
 #undef RGB_RED
 #undef RGB_GREEN
@@ -87,6 +88,7 @@ typedef my_color_deconverter * my_cconvert_ptr;
 #undef RGB_PIXELSIZE
 #undef ycc_rgb_convert_internal
 #undef gray_rgb_convert_internal
+#undef rgb_rgb_convert_internal
 
 #define RGB_RED EXT_RGBX_RED
 #define RGB_GREEN EXT_RGBX_GREEN
@@ -95,6 +97,7 @@ typedef my_color_deconverter * my_cconvert_ptr;
 #define RGB_PIXELSIZE EXT_RGBX_PIXELSIZE
 #define ycc_rgb_convert_internal ycc_extrgbx_convert_internal
 #define gray_rgb_convert_internal gray_extrgbx_convert_internal
+#define rgb_rgb_convert_internal rgb_extrgbx_convert_internal
 #include "jdcolext.c"
 #undef RGB_RED
 #undef RGB_GREEN
@@ -103,6 +106,7 @@ typedef my_color_deconverter * my_cconvert_ptr;
 #undef RGB_PIXELSIZE
 #undef ycc_rgb_convert_internal
 #undef gray_rgb_convert_internal
+#undef rgb_rgb_convert_internal
 
 #define RGB_RED EXT_BGR_RED
 #define RGB_GREEN EXT_BGR_GREEN
@@ -110,6 +114,7 @@ typedef my_color_deconverter * my_cconvert_ptr;
 #define RGB_PIXELSIZE EXT_BGR_PIXELSIZE
 #define ycc_rgb_convert_internal ycc_extbgr_convert_internal
 #define gray_rgb_convert_internal gray_extbgr_convert_internal
+#define rgb_rgb_convert_internal rgb_extbgr_convert_internal
 #include "jdcolext.c"
 #undef RGB_RED
 #undef RGB_GREEN
@@ -117,6 +122,7 @@ typedef my_color_deconverter * my_cconvert_ptr;
 #undef RGB_PIXELSIZE
 #undef ycc_rgb_convert_internal
 #undef gray_rgb_convert_internal
+#undef rgb_rgb_convert_internal
 
 #define RGB_RED EXT_BGRX_RED
 #define RGB_GREEN EXT_BGRX_GREEN
@@ -125,6 +131,7 @@ typedef my_color_deconverter * my_cconvert_ptr;
 #define RGB_PIXELSIZE EXT_BGRX_PIXELSIZE
 #define ycc_rgb_convert_internal ycc_extbgrx_convert_internal
 #define gray_rgb_convert_internal gray_extbgrx_convert_internal
+#define rgb_rgb_convert_internal rgb_extbgrx_convert_internal
 #include "jdcolext.c"
 #undef RGB_RED
 #undef RGB_GREEN
@@ -133,6 +140,7 @@ typedef my_color_deconverter * my_cconvert_ptr;
 #undef RGB_PIXELSIZE
 #undef ycc_rgb_convert_internal
 #undef gray_rgb_convert_internal
+#undef rgb_rgb_convert_internal
 
 #define RGB_RED EXT_XBGR_RED
 #define RGB_GREEN EXT_XBGR_GREEN
@@ -141,6 +149,7 @@ typedef my_color_deconverter * my_cconvert_ptr;
 #define RGB_PIXELSIZE EXT_XBGR_PIXELSIZE
 #define ycc_rgb_convert_internal ycc_extxbgr_convert_internal
 #define gray_rgb_convert_internal gray_extxbgr_convert_internal
+#define rgb_rgb_convert_internal rgb_extxbgr_convert_internal
 #include "jdcolext.c"
 #undef RGB_RED
 #undef RGB_GREEN
@@ -149,6 +158,7 @@ typedef my_color_deconverter * my_cconvert_ptr;
 #undef RGB_PIXELSIZE
 #undef ycc_rgb_convert_internal
 #undef gray_rgb_convert_internal
+#undef rgb_rgb_convert_internal
 
 #define RGB_RED EXT_XRGB_RED
 #define RGB_GREEN EXT_XRGB_GREEN
@@ -157,6 +167,7 @@ typedef my_color_deconverter * my_cconvert_ptr;
 #define RGB_PIXELSIZE EXT_XRGB_PIXELSIZE
 #define ycc_rgb_convert_internal ycc_extxrgb_convert_internal
 #define gray_rgb_convert_internal gray_extxrgb_convert_internal
+#define rgb_rgb_convert_internal rgb_extxrgb_convert_internal
 #include "jdcolext.c"
 #undef RGB_RED
 #undef RGB_GREEN
@@ -165,6 +176,7 @@ typedef my_color_deconverter * my_cconvert_ptr;
 #undef RGB_PIXELSIZE
 #undef ycc_rgb_convert_internal
 #undef gray_rgb_convert_internal
+#undef rgb_rgb_convert_internal
 
 
 /*
@@ -352,6 +364,51 @@ gray_rgb_convert (j_decompress_ptr cinfo,
 }
 
 
+/*
+ * Convert plain RGB to extended RGB
+ */
+
+METHODDEF(void)
+rgb_rgb_convert (j_decompress_ptr cinfo,
+		  JSAMPIMAGE input_buf, JDIMENSION input_row,
+		  JSAMPARRAY output_buf, int num_rows)
+{
+  switch (cinfo->out_color_space) {
+    case JCS_EXT_RGB:
+      rgb_extrgb_convert_internal(cinfo, input_buf, input_row, output_buf,
+                                  num_rows);
+      break;
+    case JCS_EXT_RGBX:
+    case JCS_EXT_RGBA:
+      rgb_extrgbx_convert_internal(cinfo, input_buf, input_row, output_buf,
+                                   num_rows);
+      break;
+    case JCS_EXT_BGR:
+      rgb_extbgr_convert_internal(cinfo, input_buf, input_row, output_buf,
+                                  num_rows);
+      break;
+    case JCS_EXT_BGRX:
+    case JCS_EXT_BGRA:
+      rgb_extbgrx_convert_internal(cinfo, input_buf, input_row, output_buf,
+                                   num_rows);
+      break;
+    case JCS_EXT_XBGR:
+    case JCS_EXT_ABGR:
+      rgb_extxbgr_convert_internal(cinfo, input_buf, input_row, output_buf,
+                                   num_rows);
+      break;
+    case JCS_EXT_XRGB:
+    case JCS_EXT_ARGB:
+      rgb_extxrgb_convert_internal(cinfo, input_buf, input_row, output_buf,
+                                   num_rows);
+      break;
+    default:
+      rgb_rgb_convert_internal(cinfo, input_buf, input_row, output_buf,
+                               num_rows);
+      break;
+  }
+}
+
 /*
  * Adobe-style YCCK->CMYK conversion.
  * We convert YCbCr to R=1-C, G=1-M, and B=1-Y using the same
@@ -494,9 +551,14 @@ jinit_color_deconverter (j_decompress_ptr cinfo)
       }
     } else if (cinfo->jpeg_color_space == JCS_GRAYSCALE) {
       cconvert->pub.color_convert = gray_rgb_convert;
-    } else if (cinfo->jpeg_color_space == cinfo->out_color_space &&
-      rgb_pixelsize[cinfo->out_color_space] == 3) {
-      cconvert->pub.color_convert = null_convert;
+    } else if (cinfo->jpeg_color_space == JCS_RGB) {
+      if (rgb_red[cinfo->out_color_space] == 0 &&
+          rgb_green[cinfo->out_color_space] == 1 &&
+          rgb_blue[cinfo->out_color_space] == 2 &&
+          rgb_pixelsize[cinfo->out_color_space] == 3)
+        cconvert->pub.color_convert = null_convert;
+      else
+        cconvert->pub.color_convert = rgb_rgb_convert;
     } else
       ERREXIT(cinfo, JERR_CONVERSION_NOTIMPL);
     break;
diff --git a/media/libjpeg/jdmarker.c b/media/libjpeg/jdmarker.c
index d8dcba98fa06..6fc0f7dcab2e 100644
--- a/media/libjpeg/jdmarker.c
+++ b/media/libjpeg/jdmarker.c
@@ -323,14 +323,15 @@ get_sos (j_decompress_ptr cinfo)
 
   /* Collect the component-spec parameters */
 
-  for (i = 0; i < cinfo->num_components; i++)
+  for (i = 0; i < MAX_COMPS_IN_SCAN; i++)
     cinfo->cur_comp_info[i] = NULL;
 
   for (i = 0; i < n; i++) {
     INPUT_BYTE(cinfo, cc, return FALSE);
     INPUT_BYTE(cinfo, c, return FALSE);
     
-    for (ci = 0, compptr = cinfo->comp_info; ci < cinfo->num_components;
+    for (ci = 0, compptr = cinfo->comp_info;
+	 ci < cinfo->num_components && ci < MAX_COMPS_IN_SCAN;
 	 ci++, compptr++) {
       if (cc == compptr->component_id && !cinfo->cur_comp_info[ci])
 	goto id_found;
diff --git a/media/libjpeg/jdmerge.c b/media/libjpeg/jdmerge.c
index cfa3bb921d38..53361252d11b 100644
--- a/media/libjpeg/jdmerge.c
+++ b/media/libjpeg/jdmerge.c
@@ -103,6 +103,7 @@ typedef my_upsampler * my_upsample_ptr;
 #define RGB_RED EXT_RGBX_RED
 #define RGB_GREEN EXT_RGBX_GREEN
 #define RGB_BLUE EXT_RGBX_BLUE
+#define RGB_ALPHA 3
 #define RGB_PIXELSIZE EXT_RGBX_PIXELSIZE
 #define h2v1_merged_upsample_internal extrgbx_h2v1_merged_upsample_internal
 #define h2v2_merged_upsample_internal extrgbx_h2v2_merged_upsample_internal
@@ -110,6 +111,7 @@ typedef my_upsampler * my_upsample_ptr;
 #undef RGB_RED
 #undef RGB_GREEN
 #undef RGB_BLUE
+#undef RGB_ALPHA
 #undef RGB_PIXELSIZE
 #undef h2v1_merged_upsample_internal
 #undef h2v2_merged_upsample_internal
@@ -131,6 +133,7 @@ typedef my_upsampler * my_upsample_ptr;
 #define RGB_RED EXT_BGRX_RED
 #define RGB_GREEN EXT_BGRX_GREEN
 #define RGB_BLUE EXT_BGRX_BLUE
+#define RGB_ALPHA 3
 #define RGB_PIXELSIZE EXT_BGRX_PIXELSIZE
 #define h2v1_merged_upsample_internal extbgrx_h2v1_merged_upsample_internal
 #define h2v2_merged_upsample_internal extbgrx_h2v2_merged_upsample_internal
@@ -138,6 +141,7 @@ typedef my_upsampler * my_upsample_ptr;
 #undef RGB_RED
 #undef RGB_GREEN
 #undef RGB_BLUE
+#undef RGB_ALPHA
 #undef RGB_PIXELSIZE
 #undef h2v1_merged_upsample_internal
 #undef h2v2_merged_upsample_internal
@@ -145,6 +149,7 @@ typedef my_upsampler * my_upsample_ptr;
 #define RGB_RED EXT_XBGR_RED
 #define RGB_GREEN EXT_XBGR_GREEN
 #define RGB_BLUE EXT_XBGR_BLUE
+#define RGB_ALPHA 0
 #define RGB_PIXELSIZE EXT_XBGR_PIXELSIZE
 #define h2v1_merged_upsample_internal extxbgr_h2v1_merged_upsample_internal
 #define h2v2_merged_upsample_internal extxbgr_h2v2_merged_upsample_internal
@@ -152,6 +157,7 @@ typedef my_upsampler * my_upsample_ptr;
 #undef RGB_RED
 #undef RGB_GREEN
 #undef RGB_BLUE
+#undef RGB_ALPHA
 #undef RGB_PIXELSIZE
 #undef h2v1_merged_upsample_internal
 #undef h2v2_merged_upsample_internal
@@ -159,6 +165,7 @@ typedef my_upsampler * my_upsample_ptr;
 #define RGB_RED EXT_XRGB_RED
 #define RGB_GREEN EXT_XRGB_GREEN
 #define RGB_BLUE EXT_XRGB_BLUE
+#define RGB_ALPHA 0
 #define RGB_PIXELSIZE EXT_XRGB_PIXELSIZE
 #define h2v1_merged_upsample_internal extxrgb_h2v1_merged_upsample_internal
 #define h2v2_merged_upsample_internal extxrgb_h2v2_merged_upsample_internal
@@ -166,6 +173,7 @@ typedef my_upsampler * my_upsample_ptr;
 #undef RGB_RED
 #undef RGB_GREEN
 #undef RGB_BLUE
+#undef RGB_ALPHA
 #undef RGB_PIXELSIZE
 #undef h2v1_merged_upsample_internal
 #undef h2v2_merged_upsample_internal
diff --git a/media/libjpeg/jdmrgext.c b/media/libjpeg/jdmrgext.c
index 95ddd556230f..2b9326550d43 100644
--- a/media/libjpeg/jdmrgext.c
+++ b/media/libjpeg/jdmrgext.c
@@ -2,6 +2,7 @@
  * jdmrgext.c
  *
  * Copyright (C) 1994-1996, Thomas G. Lane.
+ * Copyright (C) 2011, D. R. Commander.
  * This file is part of the Independent JPEG Group's software.
  * For conditions of distribution and use, see the accompanying README file.
  *
@@ -54,11 +55,17 @@ h2v1_merged_upsample_internal (j_decompress_ptr cinfo,
     outptr[RGB_RED] =   range_limit[y + cred];
     outptr[RGB_GREEN] = range_limit[y + cgreen];
     outptr[RGB_BLUE] =  range_limit[y + cblue];
+#ifdef RGB_ALPHA
+    outptr[RGB_ALPHA] = 0xFF;
+#endif
     outptr += RGB_PIXELSIZE;
     y  = GETJSAMPLE(*inptr0++);
     outptr[RGB_RED] =   range_limit[y + cred];
     outptr[RGB_GREEN] = range_limit[y + cgreen];
     outptr[RGB_BLUE] =  range_limit[y + cblue];
+#ifdef RGB_ALPHA
+    outptr[RGB_ALPHA] = 0xFF;
+#endif
     outptr += RGB_PIXELSIZE;
   }
   /* If image width is odd, do the last output column separately */
@@ -72,6 +79,9 @@ h2v1_merged_upsample_internal (j_decompress_ptr cinfo,
     outptr[RGB_RED] =   range_limit[y + cred];
     outptr[RGB_GREEN] = range_limit[y + cgreen];
     outptr[RGB_BLUE] =  range_limit[y + cblue];
+#ifdef RGB_ALPHA
+    outptr[RGB_ALPHA] = 0xFF;
+#endif
   }
 }
 
@@ -120,21 +130,33 @@ h2v2_merged_upsample_internal (j_decompress_ptr cinfo,
     outptr0[RGB_RED] =   range_limit[y + cred];
     outptr0[RGB_GREEN] = range_limit[y + cgreen];
     outptr0[RGB_BLUE] =  range_limit[y + cblue];
+#ifdef RGB_ALPHA
+    outptr0[RGB_ALPHA] = 0xFF;
+#endif
     outptr0 += RGB_PIXELSIZE;
     y  = GETJSAMPLE(*inptr00++);
     outptr0[RGB_RED] =   range_limit[y + cred];
     outptr0[RGB_GREEN] = range_limit[y + cgreen];
     outptr0[RGB_BLUE] =  range_limit[y + cblue];
+#ifdef RGB_ALPHA
+    outptr0[RGB_ALPHA] = 0xFF;
+#endif
     outptr0 += RGB_PIXELSIZE;
     y  = GETJSAMPLE(*inptr01++);
     outptr1[RGB_RED] =   range_limit[y + cred];
     outptr1[RGB_GREEN] = range_limit[y + cgreen];
     outptr1[RGB_BLUE] =  range_limit[y + cblue];
+#ifdef RGB_ALPHA
+    outptr1[RGB_ALPHA] = 0xFF;
+#endif
     outptr1 += RGB_PIXELSIZE;
     y  = GETJSAMPLE(*inptr01++);
     outptr1[RGB_RED] =   range_limit[y + cred];
     outptr1[RGB_GREEN] = range_limit[y + cgreen];
     outptr1[RGB_BLUE] =  range_limit[y + cblue];
+#ifdef RGB_ALPHA
+    outptr1[RGB_ALPHA] = 0xFF;
+#endif
     outptr1 += RGB_PIXELSIZE;
   }
   /* If image width is odd, do the last output column separately */
@@ -148,9 +170,15 @@ h2v2_merged_upsample_internal (j_decompress_ptr cinfo,
     outptr0[RGB_RED] =   range_limit[y + cred];
     outptr0[RGB_GREEN] = range_limit[y + cgreen];
     outptr0[RGB_BLUE] =  range_limit[y + cblue];
+#ifdef RGB_ALPHA
+    outptr0[RGB_ALPHA] = 0xFF;
+#endif
     y  = GETJSAMPLE(*inptr01);
     outptr1[RGB_RED] =   range_limit[y + cred];
     outptr1[RGB_GREEN] = range_limit[y + cgreen];
     outptr1[RGB_BLUE] =  range_limit[y + cblue];
+#ifdef RGB_ALPHA
+    outptr1[RGB_ALPHA] = 0xFF;
+#endif
   }
 }
diff --git a/media/libjpeg/simd/jsimdext.inc b/media/libjpeg/simd/jsimdext.inc
index 4ab9bc0facd9..1d4d3e2d037f 100644
--- a/media/libjpeg/simd/jsimdext.inc
+++ b/media/libjpeg/simd/jsimdext.inc
@@ -322,15 +322,15 @@ const_base:
 	push rsi
 	push rdi
 	sub     rsp, SIZEOF_XMMWORD
-	movlpd  XMMWORD [rsp], xmm6
+	movaps  XMMWORD [rsp], xmm6
 	sub     rsp, SIZEOF_XMMWORD
-	movlpd  XMMWORD [rsp], xmm7
+	movaps  XMMWORD [rsp], xmm7
 %endmacro
 
 %imacro uncollect_args 0
-	movlpd  xmm7, XMMWORD [rsp]
+	movaps  xmm7, XMMWORD [rsp]
 	add     rsp, SIZEOF_XMMWORD
-	movlpd  xmm6, XMMWORD [rsp]
+	movaps  xmm6, XMMWORD [rsp]
 	add     rsp, SIZEOF_XMMWORD
 	pop rdi
 	pop rsi
diff --git a/mfbt/Assertions.cpp b/mfbt/Assertions.cpp
index 272b31dbc393..5b531f7f9fdb 100644
--- a/mfbt/Assertions.cpp
+++ b/mfbt/Assertions.cpp
@@ -1,7 +1,5 @@
-/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*-
- * vim: set ts=8 sw=4 et tw=99 ft=cpp:
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
diff --git a/mfbt/Assertions.h b/mfbt/Assertions.h
index 7ff242597ef2..70aee5a58bd7 100644
--- a/mfbt/Assertions.h
+++ b/mfbt/Assertions.h
@@ -1,7 +1,5 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
- * vim: set ts=8 sw=4 et tw=99 ft=cpp:
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
diff --git a/mfbt/Attributes.h b/mfbt/Attributes.h
index 0ff971576488..0cfcd60336b9 100644
--- a/mfbt/Attributes.h
+++ b/mfbt/Attributes.h
@@ -1,7 +1,5 @@
-/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*-
- * vim: set ts=8 sw=4 et tw=99 ft=cpp:
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
diff --git a/mfbt/BloomFilter.h b/mfbt/BloomFilter.h
index ec31b60a964e..9effa1756c06 100644
--- a/mfbt/BloomFilter.h
+++ b/mfbt/BloomFilter.h
@@ -1,4 +1,4 @@
-/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
@@ -52,7 +52,8 @@ namespace mozilla {
  */
 
 template<unsigned KeySize, class T>
-class BloomFilter {
+class BloomFilter
+{
     /*
      * A counting Bloom filter with 8-bit counters.  For now we assume
      * that having two hash functions is enough, but we may revisit that
@@ -101,7 +102,7 @@ class BloomFilter {
      * positive rate for N == 100 and to quite bad false positive
      * rates for larger N.
      */
-public:
+  public:
     BloomFilter() {
         MOZ_STATIC_ASSERT(KeySize <= keyShift, "KeySize too big");
 
@@ -142,7 +143,7 @@ public:
     void remove(uint32_t hash);
     bool mightContain(uint32_t hash) const;
 
-private:
+  private:
     static const size_t arraySize = (1 << KeySize);
     static const uint32_t keyMask = (1 << KeySize) - 1;
     static const uint32_t keyShift = 16;
@@ -164,67 +165,67 @@ template<unsigned KeySize, class T>
 inline void
 BloomFilter<KeySize, T>::clear()
 {
-    memset(counters, 0, arraySize);
+  memset(counters, 0, arraySize);
 }
 
 template<unsigned KeySize, class T>
 inline void
 BloomFilter<KeySize, T>::add(uint32_t hash)
 {
-    uint8_t& slot1 = firstSlot(hash);
-    if (MOZ_LIKELY(!full(slot1)))
-        ++slot1;
+  uint8_t& slot1 = firstSlot(hash);
+  if (MOZ_LIKELY(!full(slot1)))
+    ++slot1;
 
-    uint8_t& slot2 = secondSlot(hash);
-    if (MOZ_LIKELY(!full(slot2)))
-        ++slot2;
+  uint8_t& slot2 = secondSlot(hash);
+  if (MOZ_LIKELY(!full(slot2)))
+    ++slot2;
 }
 
 template<unsigned KeySize, class T>
 MOZ_ALWAYS_INLINE void
 BloomFilter<KeySize, T>::add(const T* t)
 {
-    uint32_t hash = t->hash();
-    return add(hash);
+  uint32_t hash = t->hash();
+  return add(hash);
 }
 
 template<unsigned KeySize, class T>
 inline void
 BloomFilter<KeySize, T>::remove(uint32_t hash)
 {
-    // If the slots are full, we don't know whether we bumped them to be
-    // there when we added or not, so just leave them full.
-    uint8_t& slot1 = firstSlot(hash);
-    if (MOZ_LIKELY(!full(slot1)))
-        --slot1;
+  // If the slots are full, we don't know whether we bumped them to be
+  // there when we added or not, so just leave them full.
+  uint8_t& slot1 = firstSlot(hash);
+  if (MOZ_LIKELY(!full(slot1)))
+    --slot1;
 
-    uint8_t& slot2 = secondSlot(hash);
-    if (MOZ_LIKELY(!full(slot2)))
-        --slot2;
+  uint8_t& slot2 = secondSlot(hash);
+  if (MOZ_LIKELY(!full(slot2)))
+    --slot2;
 }
 
 template<unsigned KeySize, class T>
 MOZ_ALWAYS_INLINE void
 BloomFilter<KeySize, T>::remove(const T* t)
 {
-    uint32_t hash = t->hash();
-    remove(hash);
+  uint32_t hash = t->hash();
+  remove(hash);
 }
 
 template<unsigned KeySize, class T>
 MOZ_ALWAYS_INLINE bool
 BloomFilter<KeySize, T>::mightContain(uint32_t hash) const
 {
-    // Check that all the slots for this hash contain something
-    return firstSlot(hash) && secondSlot(hash);
+  // Check that all the slots for this hash contain something
+  return firstSlot(hash) && secondSlot(hash);
 }
 
 template<unsigned KeySize, class T>
 MOZ_ALWAYS_INLINE bool
 BloomFilter<KeySize, T>::mightContain(const T* t) const
 {
-    uint32_t hash = t->hash();
-    return mightContain(hash);
+  uint32_t hash = t->hash();
+  return mightContain(hash);
 }
 
 } // namespace mozilla
diff --git a/mfbt/FloatingPoint.h b/mfbt/FloatingPoint.h
index 029ecf23a6f1..cb1394e1a4a3 100644
--- a/mfbt/FloatingPoint.h
+++ b/mfbt/FloatingPoint.h
@@ -226,16 +226,6 @@ MOZ_DOUBLE_MIN_VALUE()
   return pun.d;
 }
 
-/** Computes a 32-bit hash of the given double. */
-static MOZ_ALWAYS_INLINE uint32_t
-MOZ_HASH_DOUBLE(double d)
-{
-  union MozDoublePun pun;
-  pun.d = d;
-
-  return ((uint32_t)(pun.u >> 32)) ^ ((uint32_t)(pun.u));
-}
-
 static MOZ_ALWAYS_INLINE int
 MOZ_DOUBLE_IS_INT32(double d, int32_t* i)
 {
diff --git a/mfbt/GuardObjects.h b/mfbt/GuardObjects.h
index f509506337a8..95aa37a19d72 100644
--- a/mfbt/GuardObjects.h
+++ b/mfbt/GuardObjects.h
@@ -1,5 +1,4 @@
-/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
-/* vim: set ts=8 sw=4 et tw=99 ft=cpp: */
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
@@ -18,6 +17,7 @@
 
 namespace mozilla {
 namespace detail {
+
 /*
  * The following classes are designed to cause assertions to detect
  * inadvertent use of guard objects as temporaries. In other words,
@@ -25,11 +25,11 @@ namespace detail {
  * destructor (and is never otherwise referenced), the intended use
  * might be:
  *
- *     AutoRestore savePainting(mIsPainting);
+ *   AutoRestore savePainting(mIsPainting);
  *
  * but is is easy to accidentally write:
  *
- *     AutoRestore(mIsPainting);
+ *   AutoRestore(mIsPainting);
  *
  * which compiles just fine, but runs the destructor well before the
  * intended time.
@@ -72,14 +72,14 @@ class MOZ_EXPORT_API(GuardObjectNotifier)
     bool* statementDone;
 
   public:
-    GuardObjectNotifier() : statementDone(NULL) {}
+    GuardObjectNotifier() : statementDone(NULL) { }
 
     ~GuardObjectNotifier() {
-        *statementDone = true;
+      *statementDone = true;
     }
 
     void setStatementDone(bool* statementIsDone) {
-        statementDone = statementIsDone;
+      statementDone = statementIsDone;
     }
 };
 
@@ -89,25 +89,24 @@ class MOZ_EXPORT_API(GuardObjectNotificationReceiver)
     bool statementDone;
 
   public:
-    GuardObjectNotificationReceiver() : statementDone(false) {}
+    GuardObjectNotificationReceiver() : statementDone(false) { }
 
     ~GuardObjectNotificationReceiver() {
-        /*
-         * Assert that the guard object was not used as a temporary.
-         * (Note that this assert might also fire if init is not called
-         * because the guard object's implementation is not using the
-         * above macros correctly.)
-         */
-        MOZ_ASSERT(statementDone);
+      /*
+       * Assert that the guard object was not used as a temporary.  (Note that
+       * this assert might also fire if init is not called because the guard
+       * object's implementation is not using the above macros correctly.)
+       */
+      MOZ_ASSERT(statementDone);
     }
 
     void init(const GuardObjectNotifier& constNotifier) {
-        /*
-         * constNotifier is passed as a const reference so that we can pass a
-         * temporary, but we really intend it as non-const.
-         */
-        GuardObjectNotifier& notifier = const_cast<GuardObjectNotifier&>(constNotifier);
-        notifier.setStatementDone(&statementDone);
+      /*
+       * constNotifier is passed as a const reference so that we can pass a
+       * temporary, but we really intend it as non-const.
+       */
+      GuardObjectNotifier& notifier = const_cast<GuardObjectNotifier&>(constNotifier);
+      notifier.setStatementDone(&statementDone);
     }
 };
 
diff --git a/mfbt/HashFunctions.cpp b/mfbt/HashFunctions.cpp
index 81983ff66212..199e265de52e 100644
--- a/mfbt/HashFunctions.cpp
+++ b/mfbt/HashFunctions.cpp
@@ -1,13 +1,12 @@
-/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*-
- * vim: set ts=8 sw=4 et tw=99 ft=cpp:
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-/* Implementations of hash functions */
+/* Implementations of hash functions. */
 
 #include "mozilla/HashFunctions.h"
+
 #include <string.h>
 
 namespace mozilla {
@@ -29,9 +28,8 @@ HashBytes(const void* bytes, size_t length)
   }
 
   /* Get the remaining bytes. */
-  for (; i < length; i++) {
+  for (; i < length; i++)
     hash = AddToHash(hash, b[i]);
-  }
 
   return hash;
 }
diff --git a/mfbt/HashFunctions.h b/mfbt/HashFunctions.h
index 4f8ff406e905..64ac6f91ce5c 100644
--- a/mfbt/HashFunctions.h
+++ b/mfbt/HashFunctions.h
@@ -1,11 +1,9 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
- * vim: set ts=8 sw=4 et tw=99 ft=cpp:
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-/* Utilities for hashing */
+/* Utilities for hashing. */
 
 /*
  * This file exports functions for hashing data down to a 32-bit value,
@@ -26,16 +24,18 @@
  *
  * You can chain these functions together to hash complex objects.  For example:
  *
- *  class ComplexObject {
- *    char* str;
- *    uint32_t uint1, uint2;
- *    void (*callbackFn)();
+ *  class ComplexObject
+ *  {
+ *      char* str;
+ *      uint32_t uint1, uint2;
+ *      void (*callbackFn)();
  *
- *    uint32_t Hash() {
- *      uint32_t hash = HashString(str);
- *      hash = AddToHash(hash, uint1, uint2);
- *      return AddToHash(hash, callbackFn);
- *    }
+ *    public:
+ *      uint32_t hash() {
+ *        uint32_t hash = HashString(str);
+ *        hash = AddToHash(hash, uint1, uint2);
+ *        return AddToHash(hash, callbackFn);
+ *      }
  *  };
  *
  * If you want to hash an nsAString or nsACString, use the HashString functions
diff --git a/mfbt/Likely.h b/mfbt/Likely.h
index 6534239b16d6..a217e60c68e4 100644
--- a/mfbt/Likely.h
+++ b/mfbt/Likely.h
@@ -1,3 +1,4 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
@@ -7,8 +8,8 @@
  * boolean predicate should be branch-predicted.
  */
 
-#ifndef Likely_h_
-#define Likely_h_
+#ifndef mozilla_Likely_h_
+#define mozilla_Likely_h_
 
 #if defined(__clang__) || (defined(__GNUC__) && (__GNUC__ > 2))
 #  define MOZ_LIKELY(x)   (__builtin_expect((x), 1))
@@ -18,4 +19,4 @@
 #  define MOZ_UNLIKELY(x) (x)
 #endif
 
-#endif /* Likely_h_ */
+#endif /* mozilla_Likely_h_ */
diff --git a/mfbt/LinkedList.h b/mfbt/LinkedList.h
index b92ebed70f2b..d7d3b23607a5 100644
--- a/mfbt/LinkedList.h
+++ b/mfbt/LinkedList.h
@@ -1,7 +1,5 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
- * vim: set ts=4 sw=4 tw=80 et cin:
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
@@ -20,36 +18,30 @@
  *
  *   class Observer : public LinkedListElement<Observer>
  *   {
- *     void observe(char* topic) { ... }
+ *     public:
+ *       void observe(char* topic) { ... }
  *   };
  *
  *   class ObserverContainer
  *   {
- *   private:
- *     LinkedList<Observer> list;
+ *     private:
+ *       LinkedList<Observer> list;
  *
- *   public:
- *
- *     void addObserver(Observer* observer)
- *     {
- *       // Will assert if |observer| is part of another list.
- *       list.insertBack(observer);
- *     }
- *
- *     void removeObserver(Observer* observer)
- *     {
- *       // Will assert if |observer| is not part of some list.
- *       observer.remove();
- *     }
- *
- *     void notifyObservers(char* topic)
- *     {
- *       for (Observer* o = list.getFirst();
- *            o != NULL;
- *            o = o->getNext()) {
- *         o->Observe(topic);
+ *     public:
+ *       void addObserver(Observer* observer) {
+ *         // Will assert if |observer| is part of another list.
+ *         list.insertBack(observer);
+ *       }
+ *
+ *       void removeObserver(Observer* observer) {
+ *         // Will assert if |observer| is not part of some list.
+ *         observer.remove();
+ *       }
+ *
+ *       void notifyObservers(char* topic) {
+ *         for (Observer* o = list.getFirst(); o != NULL; o = o->getNext())
+ *           o->Observe(topic);
  *       }
- *     }
  *   };
  *
  */
@@ -104,51 +96,41 @@ class LinkedListElement
      * lists, and supporting this painlessly was a key design criterion.
      */
 
-private:
+  private:
     LinkedListElement* next;
     LinkedListElement* prev;
     const bool isSentinel;
 
-public:
-    LinkedListElement()
-        : next(this)
-        , prev(this)
-        , isSentinel(false)
-    {
-    }
+  public:
+    LinkedListElement() : next(this), prev(this), isSentinel(false) { }
 
     /*
      * Get the next element in the list, or NULL if this is the last element in
      * the list.
      */
-    T* getNext()
-    {
-        return next->asT();
+    T* getNext() {
+      return next->asT();
     }
-    const T* getNext() const
-    {
-        return next->asT();
+    const T* getNext() const {
+      return next->asT();
     }
 
     /*
      * Get the previous element in the list, or NULL if this is the first element
      * in the list.
      */
-    T* getPrevious()
-    {
-        return prev->asT();
+    T* getPrevious() {
+      return prev->asT();
     }
-    const T* getPrevious() const
-    {
-        return prev->asT();
+    const T* getPrevious() const {
+      return prev->asT();
     }
 
     /*
      * Insert elem after this element in the list.  |this| must be part of a
      * linked list when you call setNext(); otherwise, this method will assert.
      */
-    void setNext(T* elem)
-    {
+    void setNext(T* elem) {
         MOZ_ASSERT(isInList());
         setNextUnsafe(elem);
     }
@@ -158,50 +140,44 @@ public:
      * linked list when you call setPrevious(); otherwise, this method will
      * assert.
      */
-    void setPrevious(T* elem)
-    {
-        MOZ_ASSERT(isInList());
-        setPreviousUnsafe(elem);
+    void setPrevious(T* elem) {
+      MOZ_ASSERT(isInList());
+      setPreviousUnsafe(elem);
     }
 
     /*
      * Remove this element from the list which contains it.  If this element is
      * not currently part of a linked list, this method asserts.
      */
-    void remove()
-    {
-        MOZ_ASSERT(isInList());
+    void remove() {
+      MOZ_ASSERT(isInList());
 
-        prev->next = next;
-        next->prev = prev;
-        next = this;
-        prev = this;
+      prev->next = next;
+      next->prev = prev;
+      next = this;
+      prev = this;
     }
 
     /*
      * Return true if |this| part is of a linked list, and false otherwise.
      */
-    bool isInList() const
-    {
-        MOZ_ASSERT((next == this) == (prev == this));
-        return next != this;
+    bool isInList() const {
+      MOZ_ASSERT((next == this) == (prev == this));
+      return next != this;
     }
 
-private:
-    LinkedListElement& operator=(const LinkedList<T>& other) MOZ_DELETE;
-    LinkedListElement(const LinkedList<T>& other) MOZ_DELETE;
-
+  private:
     friend class LinkedList<T>;
 
     enum NodeKind {
-        NODE_KIND_NORMAL,
-        NODE_KIND_SENTINEL
+      NODE_KIND_NORMAL,
+      NODE_KIND_SENTINEL
     };
 
     LinkedListElement(NodeKind nodeKind)
-        : next(this)
-        , prev(this)
-        , isSentinel(nodeKind == NODE_KIND_SENTINEL)
+      : next(this),
+        prev(this),
+        isSentinel(nodeKind == NODE_KIND_SENTINEL)
     {
     }
 
@@ -209,140 +185,123 @@ private:
      * Return |this| cast to T* if we're a normal node, or return NULL if we're
      * a sentinel node.
      */
-    T* asT()
-    {
-        if (isSentinel)
-            return NULL;
+    T* asT() {
+      if (isSentinel)
+        return NULL;
 
-        return static_cast<T*>(this);
+      return static_cast<T*>(this);
     }
-    const T* asT() const
-    {
-        if (isSentinel)
-            return NULL;
+    const T* asT() const {
+      if (isSentinel)
+        return NULL;
 
-        return static_cast<const T*>(this);
+      return static_cast<const T*>(this);
     }
 
     /*
      * Insert elem after this element, but don't check that this element is in
      * the list.  This is called by LinkedList::insertFront().
      */
-    void setNextUnsafe(T* elem)
-    {
-        LinkedListElement *listElem = static_cast<LinkedListElement*>(elem);
-        MOZ_ASSERT(!listElem->isInList());
+    void setNextUnsafe(T* elem) {
+      LinkedListElement *listElem = static_cast<LinkedListElement*>(elem);
+      MOZ_ASSERT(!listElem->isInList());
 
-        listElem->next = this->next;
-        listElem->prev = this;
-        this->next->prev = listElem;
-        this->next = listElem;
+      listElem->next = this->next;
+      listElem->prev = this;
+      this->next->prev = listElem;
+      this->next = listElem;
     }
 
     /*
      * Insert elem before this element, but don't check that this element is in
      * the list.  This is called by LinkedList::insertBack().
      */
-    void setPreviousUnsafe(T* elem)
-    {
-        LinkedListElement<T>* listElem = static_cast<LinkedListElement<T>*>(elem);
-        MOZ_ASSERT(!listElem->isInList());
+    void setPreviousUnsafe(T* elem) {
+      LinkedListElement<T>* listElem = static_cast<LinkedListElement<T>*>(elem);
+      MOZ_ASSERT(!listElem->isInList());
 
-        listElem->next = this;
-        listElem->prev = this->prev;
-        this->prev->next = listElem;
-        this->prev = listElem;
+      listElem->next = this;
+      listElem->prev = this->prev;
+      this->prev->next = listElem;
+      this->prev = listElem;
     }
+
+  private:
+    LinkedListElement& operator=(const LinkedList<T>& other) MOZ_DELETE;
+    LinkedListElement(const LinkedList<T>& other) MOZ_DELETE;
 };
 
 template<typename T>
 class LinkedList
 {
-private:
+  private:
     LinkedListElement<T> sentinel;
 
-public:
-    LinkedList& operator=(const LinkedList<T>& other) MOZ_DELETE;
-    LinkedList(const LinkedList<T>& other) MOZ_DELETE;
-
-    LinkedList()
-        : sentinel(LinkedListElement<T>::NODE_KIND_SENTINEL)
-    {
-    }
+  public:
+    LinkedList() : sentinel(LinkedListElement<T>::NODE_KIND_SENTINEL) { }
 
     /*
      * Add elem to the front of the list.
      */
-    void insertFront(T* elem)
-    {
-        /* Bypass setNext()'s this->isInList() assertion. */
-        sentinel.setNextUnsafe(elem);
+    void insertFront(T* elem) {
+      /* Bypass setNext()'s this->isInList() assertion. */
+      sentinel.setNextUnsafe(elem);
     }
 
     /*
      * Add elem to the back of the list.
      */
-    void insertBack(T* elem)
-    {
-        sentinel.setPreviousUnsafe(elem);
+    void insertBack(T* elem) {
+      sentinel.setPreviousUnsafe(elem);
     }
 
     /*
      * Get the first element of the list, or NULL if the list is empty.
      */
-    T* getFirst()
-    {
-        return sentinel.getNext();
+    T* getFirst() {
+      return sentinel.getNext();
     }
-    const T* getFirst() const
-    {
-        return sentinel.getNext();
+    const T* getFirst() const {
+      return sentinel.getNext();
     }
 
     /*
      * Get the last element of the list, or NULL if the list is empty.
      */
-    T* getLast()
-    {
-        return sentinel.getPrevious();
+    T* getLast() {
+      return sentinel.getPrevious();
     }
-    const T* getLast() const
-    {
-        return sentinel.getPrevious();
+    const T* getLast() const {
+      return sentinel.getPrevious();
     }
 
     /*
      * Get and remove the first element of the list.  If the list is empty,
      * return NULL.
      */
-    T* popFirst()
-    {
-        T* ret = sentinel.getNext();
-        if (ret)
-            static_cast<LinkedListElement<T>*>(ret)->remove();
-
-        return ret;
+    T* popFirst() {
+      T* ret = sentinel.getNext();
+      if (ret)
+        static_cast<LinkedListElement<T>*>(ret)->remove();
+      return ret;
     }
 
     /*
      * Get and remove the last element of the list.  If the list is empty,
      * return NULL.
      */
-    T* popLast()
-    {
-        T* ret = sentinel.getPrevious();
-        if (ret)
-            static_cast<LinkedListElement<T>*>(ret)->remove();
-
-        return ret;
+    T* popLast() {
+      T* ret = sentinel.getPrevious();
+      if (ret)
+        static_cast<LinkedListElement<T>*>(ret)->remove();
+      return ret;
     }
 
     /*
      * Return true if the list is empty, or false otherwise.
      */
-    bool isEmpty() const
-    {
-        return !sentinel.isInList();
+    bool isEmpty() const {
+      return !sentinel.isInList();
     }
 
     /*
@@ -351,71 +310,73 @@ public:
      * This runs in time linear to the list's length, because we have to mark
      * each element as not in the list.
      */
-    void clear()
-    {
-        while (popFirst())
-            continue;
+    void clear() {
+      while (popFirst())
+        continue;
     }
 
     /*
      * In a debug build, make sure that the list is sane (no cycles, consistent
      * next/prev pointers, only one sentinel).  Has no effect in release builds.
      */
-    void debugAssertIsSane() const
-    {
+    void debugAssertIsSane() const {
 #ifdef DEBUG
-        /*
-         * Check for cycles in the forward singly-linked list using the
-         * tortoise/hare algorithm.
-         */
-        for (const LinkedListElement<T>* slow = sentinel.next,
-                                       * fast1 = sentinel.next->next,
-                                       * fast2 = sentinel.next->next->next;
-             slow != sentinel && fast1 != sentinel && fast2 != sentinel;
-             slow = slow->next,
-             fast1 = fast2->next,
-             fast2 = fast1->next) {
+      const LinkedListElement<T>* slow;
+      const LinkedListElement<T>* fast1;
+      const LinkedListElement<T>* fast2;
 
-            MOZ_ASSERT(slow != fast1);
-            MOZ_ASSERT(slow != fast2);
-        }
+      /*
+       * Check for cycles in the forward singly-linked list using the
+       * tortoise/hare algorithm.
+       */
+      for (slow = sentinel.next,
+           fast1 = sentinel.next->next,
+           fast2 = sentinel.next->next->next;
+           slow != sentinel && fast1 != sentinel && fast2 != sentinel;
+           slow = slow->next, fast1 = fast2->next, fast2 = fast1->next)
+      {
+        MOZ_ASSERT(slow != fast1);
+        MOZ_ASSERT(slow != fast2);
+      }
 
-        /* Check for cycles in the backward singly-linked list. */
-        for (const LinkedListElement<T>* slow = sentinel.prev,
-                                       * fast1 = sentinel.prev->prev,
-                                       * fast2 = sentinel.prev->prev->prev;
-             slow != sentinel && fast1 != sentinel && fast2 != sentinel;
-             slow = slow->prev,
-             fast1 = fast2->prev,
-             fast2 = fast1->prev) {
+      /* Check for cycles in the backward singly-linked list. */
+      for (slow = sentinel.prev,
+           fast1 = sentinel.prev->prev,
+           fast2 = sentinel.prev->prev->prev;
+           slow != sentinel && fast1 != sentinel && fast2 != sentinel;
+           slow = slow->prev, fast1 = fast2->prev, fast2 = fast1->prev)
+      {
+        MOZ_ASSERT(slow != fast1);
+        MOZ_ASSERT(slow != fast2);
+      }
 
-            MOZ_ASSERT(slow != fast1);
-            MOZ_ASSERT(slow != fast2);
-        }
+      /*
+       * Check that |sentinel| is the only node in the list with
+       * isSentinel == true.
+       */
+      for (const LinkedListElement<T>* elem = sentinel.next;
+           elem != sentinel;
+           elem = elem->next)
+      {
+        MOZ_ASSERT(!elem->isSentinel);
+      }
 
-        /*
-         * Check that |sentinel| is the only node in the list with
-         * isSentinel == true.
-         */
-        for (const LinkedListElement<T>* elem = sentinel.next;
-             elem != sentinel;
-             elem = elem->next) {
+      /* Check that the next/prev pointers match up. */
+      const LinkedListElement<T>* prev = sentinel;
+      const LinkedListElement<T>* cur = sentinel.next;
+      do {
+          MOZ_ASSERT(cur->prev == prev);
+          MOZ_ASSERT(prev->next == cur);
 
-          MOZ_ASSERT(!elem->isSentinel);
-        }
-
-        /* Check that the next/prev pointers match up. */
-        const LinkedListElement<T>* prev = sentinel;
-        const LinkedListElement<T>* cur = sentinel.next;
-        do {
-            MOZ_ASSERT(cur->prev == prev);
-            MOZ_ASSERT(prev->next == cur);
-
-            prev = cur;
-            cur = cur->next;
-        } while (cur != sentinel);
+          prev = cur;
+          cur = cur->next;
+      } while (cur != sentinel);
 #endif /* ifdef DEBUG */
     }
+
+  private:
+    LinkedList& operator=(const LinkedList<T>& other) MOZ_DELETE;
+    LinkedList(const LinkedList<T>& other) MOZ_DELETE;
 };
 
 } /* namespace mozilla */
diff --git a/mfbt/RangedPtr.h b/mfbt/RangedPtr.h
index a6029ee2ce45..7c8d58147d99 100644
--- a/mfbt/RangedPtr.h
+++ b/mfbt/RangedPtr.h
@@ -1,7 +1,5 @@
-/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*-
- * vim: set ts=8 sw=4 et tw=99 ft=cpp:
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
@@ -38,7 +36,7 @@ namespace mozilla {
  * explicitly convert to T*.  Keep in mind that the raw pointer of course won't
  * implement bounds checking in debug builds.
  */
-template <typename T>
+template<typename T>
 class RangedPtr
 {
     T* ptr;
@@ -49,16 +47,16 @@ class RangedPtr
 #endif
 
     void checkSanity() {
-        MOZ_ASSERT(rangeStart <= ptr);
-        MOZ_ASSERT(ptr <= rangeEnd);
+      MOZ_ASSERT(rangeStart <= ptr);
+      MOZ_ASSERT(ptr <= rangeEnd);
     }
 
     /* Creates a new pointer for |ptr|, restricted to this pointer's range. */
     RangedPtr<T> create(T *ptr) const {
 #ifdef DEBUG
-        return RangedPtr<T>(ptr, rangeStart, rangeEnd);
+      return RangedPtr<T>(ptr, rangeStart, rangeEnd);
 #else
-        return RangedPtr<T>(ptr, NULL, size_t(0));
+      return RangedPtr<T>(ptr, NULL, size_t(0));
 #endif
     }
 
@@ -69,8 +67,8 @@ class RangedPtr
       , rangeStart(start), rangeEnd(end)
 #endif
     {
-        MOZ_ASSERT(rangeStart <= rangeEnd);
-        checkSanity();
+      MOZ_ASSERT(rangeStart <= rangeEnd);
+      checkSanity();
     }
     RangedPtr(T* p, T* start, size_t length)
       : ptr(p)
@@ -78,9 +76,9 @@ class RangedPtr
       , rangeStart(start), rangeEnd(start + length)
 #endif
     {
-        MOZ_ASSERT(length <= size_t(-1) / sizeof(T));
-        MOZ_ASSERT(uintptr_t(rangeStart) + length * sizeof(T) >= uintptr_t(rangeStart));
-        checkSanity();
+      MOZ_ASSERT(length <= size_t(-1) / sizeof(T));
+      MOZ_ASSERT(uintptr_t(rangeStart) + length * sizeof(T) >= uintptr_t(rangeStart));
+      checkSanity();
     }
 
     /* Equivalent to RangedPtr(p, p, length). */
@@ -90,9 +88,9 @@ class RangedPtr
       , rangeStart(p), rangeEnd(p + length)
 #endif
     {
-        MOZ_ASSERT(length <= size_t(-1) / sizeof(T));
-        MOZ_ASSERT(uintptr_t(rangeStart) + length * sizeof(T) >= uintptr_t(rangeStart));
-        checkSanity();
+      MOZ_ASSERT(length <= size_t(-1) / sizeof(T));
+      MOZ_ASSERT(uintptr_t(rangeStart) + length * sizeof(T) >= uintptr_t(rangeStart));
+      checkSanity();
     }
 
     /* Equivalent to RangedPtr(arr, arr, N). */
@@ -107,7 +105,7 @@ class RangedPtr
     }
 
     T* get() const {
-        return ptr;
+      return ptr;
     }
 
     /*
@@ -121,23 +119,23 @@ class RangedPtr
      *   p1 = RangedPtr<char>(arr2, 3);                  // asserts
      */
     RangedPtr<T>& operator=(const RangedPtr<T>& other) {
-        MOZ_ASSERT(rangeStart == other.rangeStart);
-        MOZ_ASSERT(rangeEnd == other.rangeEnd);
-        ptr = other.ptr;
-        checkSanity();
-        return *this;
+      MOZ_ASSERT(rangeStart == other.rangeStart);
+      MOZ_ASSERT(rangeEnd == other.rangeEnd);
+      ptr = other.ptr;
+      checkSanity();
+      return *this;
     }
 
     RangedPtr<T> operator+(size_t inc) {
-        MOZ_ASSERT(inc <= size_t(-1) / sizeof(T));
-        MOZ_ASSERT(ptr + inc > ptr);
-        return create(ptr + inc);
+      MOZ_ASSERT(inc <= size_t(-1) / sizeof(T));
+      MOZ_ASSERT(ptr + inc > ptr);
+      return create(ptr + inc);
     }
 
     RangedPtr<T> operator-(size_t dec) {
-        MOZ_ASSERT(dec <= size_t(-1) / sizeof(T));
-        MOZ_ASSERT(ptr - dec < ptr);
-        return create(ptr - dec);
+      MOZ_ASSERT(dec <= size_t(-1) / sizeof(T));
+      MOZ_ASSERT(ptr - dec < ptr);
+      return create(ptr - dec);
     }
 
     /*
@@ -146,97 +144,97 @@ class RangedPtr
      */
     template <typename U>
     RangedPtr<T>& operator=(U* p) {
-        *this = create(p);
-        return *this;
+      *this = create(p);
+      return *this;
     }
 
     template <typename U>
     RangedPtr<T>& operator=(const RangedPtr<U>& p) {
-        MOZ_ASSERT(rangeStart <= p.ptr);
-        MOZ_ASSERT(p.ptr <= rangeEnd);
-        ptr = p.ptr;
-        checkSanity();
-        return *this;
+      MOZ_ASSERT(rangeStart <= p.ptr);
+      MOZ_ASSERT(p.ptr <= rangeEnd);
+      ptr = p.ptr;
+      checkSanity();
+      return *this;
     }
 
     RangedPtr<T>& operator++() {
-        return (*this += 1);
+      return (*this += 1);
     }
 
     RangedPtr<T> operator++(int) {
-        RangedPtr<T> rcp = *this;
-        ++*this;
-        return rcp;
+      RangedPtr<T> rcp = *this;
+      ++*this;
+      return rcp;
     }
 
     RangedPtr<T>& operator--() {
-        return (*this -= 1);
+      return (*this -= 1);
     }
 
     RangedPtr<T> operator--(int) {
-        RangedPtr<T> rcp = *this;
-        --*this;
-        return rcp;
+      RangedPtr<T> rcp = *this;
+      --*this;
+      return rcp;
     }
 
     RangedPtr<T>& operator+=(size_t inc) {
-        this->operator=<T>(*this + inc);
-        return *this;
+      *this = *this + inc;
+      return *this;
     }
 
     RangedPtr<T>& operator-=(size_t dec) {
-        this->operator=<T>(*this - dec);
-        return *this;
+      *this = *this - dec;
+      return *this;
     }
 
     T& operator[](int index) const {
-        MOZ_ASSERT(size_t(index > 0 ? index : -index) <= size_t(-1) / sizeof(T));
-        return *create(ptr + index);
+      MOZ_ASSERT(size_t(index > 0 ? index : -index) <= size_t(-1) / sizeof(T));
+      return *create(ptr + index);
     }
 
     T& operator*() const {
-        return *ptr;
+      return *ptr;
     }
 
     template <typename U>
     bool operator==(const RangedPtr<U>& other) const {
-        return ptr == other.ptr;
+      return ptr == other.ptr;
     }
     template <typename U>
     bool operator!=(const RangedPtr<U>& other) const {
-        return !(*this == other);
+      return !(*this == other);
     }
 
     template<typename U>
     bool operator==(const U* u) const {
-        return ptr == u;
+      return ptr == u;
     }
     template<typename U>
     bool operator!=(const U* u) const {
-        return !(*this == u);
+      return !(*this == u);
     }
 
     template <typename U>
     bool operator<(const RangedPtr<U>& other) const {
-        return ptr < other.ptr;
+      return ptr < other.ptr;
     }
     template <typename U>
     bool operator<=(const RangedPtr<U>& other) const {
-        return ptr <= other.ptr;
+      return ptr <= other.ptr;
     }
 
     template <typename U>
     bool operator>(const RangedPtr<U>& other) const {
-        return ptr > other.ptr;
+      return ptr > other.ptr;
     }
     template <typename U>
     bool operator>=(const RangedPtr<U>& other) const {
-        return ptr >= other.ptr;
+      return ptr >= other.ptr;
     }
 
     size_t operator-(const RangedPtr<T>& other) const {
-        MOZ_ASSERT(ptr >= other.ptr);
-        return PointerRangeSize(other.ptr, ptr);
+      MOZ_ASSERT(ptr >= other.ptr);
+      return PointerRangeSize(other.ptr, ptr);
     }
 
   private:
diff --git a/mfbt/RefPtr.h b/mfbt/RefPtr.h
index 843bee076b34..15ace62ef8b0 100644
--- a/mfbt/RefPtr.h
+++ b/mfbt/RefPtr.h
@@ -1,7 +1,5 @@
-/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*-
- * vim: set ts=8 sw=4 et tw=99 ft=cpp:
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
@@ -47,24 +45,24 @@ class RefCounted
 {
     friend class RefPtr<T>;
 
-public:
+  public:
     RefCounted() : refCnt(0) { }
     ~RefCounted() { MOZ_ASSERT(refCnt == -0xdead); }
 
     // Compatibility with nsRefPtr.
     void AddRef() {
-        MOZ_ASSERT(refCnt >= 0);
-        ++refCnt;
+      MOZ_ASSERT(refCnt >= 0);
+      ++refCnt;
     }
 
     void Release() {
-        MOZ_ASSERT(refCnt > 0);
-        if (0 == --refCnt) {
+      MOZ_ASSERT(refCnt > 0);
+      if (0 == --refCnt) {
 #ifdef DEBUG
-            refCnt = -0xdead;
+        refCnt = -0xdead;
 #endif
-            delete static_cast<T*>(this);
-        }
+        delete static_cast<T*>(this);
+      }
     }
 
     // Compatibility with wtf::RefPtr.
@@ -72,11 +70,11 @@ public:
     void deref() { Release(); }
     int refCount() const { return refCnt; }
     bool hasOneRef() const {
-        MOZ_ASSERT(refCnt > 0);
-        return refCnt == 1;
+      MOZ_ASSERT(refCnt > 0);
+      return refCnt == 1;
     }
 
-private:
+  private:
     int refCnt;
 };
 
@@ -97,9 +95,9 @@ class RefPtr
     friend class TemporaryRef<T>;
     friend class OutParamRef<T>;
 
-    struct dontRef {};
+    struct DontRef {};
 
-public:
+  public:
     RefPtr() : ptr(0) { }
     RefPtr(const RefPtr& o) : ptr(ref(o.ptr)) {}
     RefPtr(const TemporaryRef<T>& o) : ptr(o.drop()) {}
@@ -111,28 +109,28 @@ public:
     ~RefPtr() { unref(ptr); }
 
     RefPtr& operator=(const RefPtr& o) {
-        assign(ref(o.ptr));
-        return *this;
+      assign(ref(o.ptr));
+      return *this;
     }
     RefPtr& operator=(const TemporaryRef<T>& o) {
-        assign(o.drop());
-        return *this;
+      assign(o.drop());
+      return *this;
     }
     RefPtr& operator=(T* t) {
-        assign(ref(t));
-        return *this;
+      assign(ref(t));
+      return *this;
     }
 
     template<typename U>
     RefPtr& operator=(const RefPtr<U>& o) {
-        assign(ref(o.get()));
-        return *this;
+      assign(ref(o.get()));
+      return *this;
     }
 
     TemporaryRef<T> forget() {
-        T* tmp = ptr;
-        ptr = 0;
-        return TemporaryRef<T>(tmp, dontRef());
+      T* tmp = ptr;
+      ptr = 0;
+      return TemporaryRef<T>(tmp, DontRef());
     }
 
     T* get() const { return ptr; }
@@ -142,25 +140,23 @@ public:
     template<typename U>
     operator TemporaryRef<U>() { return TemporaryRef<U>(ptr); }
 
-private:
+  private:
     void assign(T* t) {
-        unref(ptr);
-        ptr = t;
+      unref(ptr);
+      ptr = t;
     }
 
     T* ptr;
 
     static MOZ_ALWAYS_INLINE T* ref(T* t) {
-        if (t) {
-            t->AddRef();
-        }
-        return t;
+      if (t)
+        t->AddRef();
+      return t;
     }
 
     static MOZ_ALWAYS_INLINE void unref(T* t) {
-        if (t) {
-            t->Release();
-        }
+      if (t)
+        t->Release();
     }
 };
 
@@ -176,9 +172,9 @@ class TemporaryRef
     // To allow it to construct TemporaryRef from a bare T*
     friend class RefPtr<T>;
 
-    typedef typename RefPtr<T>::dontRef dontRef;
+    typedef typename RefPtr<T>::DontRef DontRef;
 
-public:
+  public:
     TemporaryRef(T* t) : ptr(RefPtr<T>::ref(t)) {}
     TemporaryRef(const TemporaryRef& o) : ptr(o.drop()) {}
 
@@ -188,18 +184,18 @@ public:
     ~TemporaryRef() { RefPtr<T>::unref(ptr); }
 
     T* drop() const {
-        T* tmp = ptr;
-        ptr = 0;
-        return tmp;
+      T* tmp = ptr;
+      ptr = 0;
+      return tmp;
     }
 
-private:
-    TemporaryRef(T* t, const dontRef&) : ptr(t) {}
+  private:
+    TemporaryRef(T* t, const DontRef&) : ptr(t) {}
 
     mutable T* ptr;
 
-    TemporaryRef();
-    TemporaryRef& operator=(const TemporaryRef&);
+    TemporaryRef() MOZ_DELETE;
+    void operator=(const TemporaryRef&) MOZ_DELETE;
 };
 
 /**
@@ -221,15 +217,15 @@ class OutParamRef
 {
     friend OutParamRef byRef<T>(RefPtr<T>&);
 
-public:
+  public:
     ~OutParamRef() {
-        RefPtr<T>::unref(refPtr.ptr);
-        refPtr.ptr = tmp;
+      RefPtr<T>::unref(refPtr.ptr);
+      refPtr.ptr = tmp;
     }
 
     operator T**() { return &tmp; }
 
-private:
+  private:
     OutParamRef(RefPtr<T>& p) : refPtr(p), tmp(p.get()) {}
 
     RefPtr<T>& refPtr;
@@ -246,7 +242,7 @@ template<typename T>
 OutParamRef<T>
 byRef(RefPtr<T>& ptr)
 {
-    return OutParamRef<T>(ptr);
+  return OutParamRef<T>(ptr);
 }
 
 } // namespace mozilla
@@ -264,15 +260,15 @@ using namespace mozilla;
 
 struct Foo : public RefCounted<Foo>
 {
-    Foo() : dead(false) { }
-    ~Foo() {
-        MOZ_ASSERT(!dead);
-        dead = true;
-        numDestroyed++;
-    }
+  Foo() : dead(false) { }
+  ~Foo() {
+    MOZ_ASSERT(!dead);
+    dead = true;
+    numDestroyed++;
+  }
 
-    bool dead;
-    static int numDestroyed;
+  bool dead;
+  static int numDestroyed;
 };
 int Foo::numDestroyed;
 
@@ -281,34 +277,34 @@ struct Bar : public Foo { };
 TemporaryRef<Foo>
 NewFoo()
 {
-    return RefPtr<Foo>(new Foo());
+  return RefPtr<Foo>(new Foo());
 }
 
 TemporaryRef<Foo>
 NewBar()
 {
-    return new Bar();
+  return new Bar();
 }
 
 void
 GetNewFoo(Foo** f)
 {
-    *f = new Bar();
-    // Kids, don't try this at home
-    (*f)->AddRef();
+  *f = new Bar();
+  // Kids, don't try this at home
+  (*f)->AddRef();
 }
 
 void
 GetPassedFoo(Foo** f)
 {
-    // Kids, don't try this at home
-    (*f)->AddRef();
+  // Kids, don't try this at home
+  (*f)->AddRef();
 }
 
 void
 GetNewFoo(RefPtr<Foo>* f)
 {
-    *f = new Bar();
+  *f = new Bar();
 }
 
 void
@@ -318,93 +314,93 @@ GetPassedFoo(RefPtr<Foo>* f)
 TemporaryRef<Foo>
 GetNullFoo()
 {
-    return 0;
+  return 0;
 }
 
 int
 main(int argc, char** argv)
 {
-    // This should blow up
+  // This should blow up
 //    Foo* f = new Foo(); delete f;
 
-    MOZ_ASSERT(0 == Foo::numDestroyed);
-    {
-        RefPtr<Foo> f = new Foo();
-        MOZ_ASSERT(f->refCount() == 1);
-    }
+  MOZ_ASSERT(0 == Foo::numDestroyed);
+  {
+    RefPtr<Foo> f = new Foo();
+    MOZ_ASSERT(f->refCount() == 1);
+  }
+  MOZ_ASSERT(1 == Foo::numDestroyed);
+
+  {
+    RefPtr<Foo> f1 = NewFoo();
+    RefPtr<Foo> f2(NewFoo());
     MOZ_ASSERT(1 == Foo::numDestroyed);
+  }
+  MOZ_ASSERT(3 == Foo::numDestroyed);
 
-    {
-        RefPtr<Foo> f1 = NewFoo();
-        RefPtr<Foo> f2(NewFoo());
-        MOZ_ASSERT(1 == Foo::numDestroyed);
-    }
+  {
+    RefPtr<Foo> b = NewBar();
     MOZ_ASSERT(3 == Foo::numDestroyed);
+  }
+  MOZ_ASSERT(4 == Foo::numDestroyed);
 
+  {
+    RefPtr<Foo> f1;
     {
-        RefPtr<Foo> b = NewBar();
-        MOZ_ASSERT(3 == Foo::numDestroyed);
+      f1 = new Foo();
+      RefPtr<Foo> f2(f1);
+      RefPtr<Foo> f3 = f2;
+      MOZ_ASSERT(4 == Foo::numDestroyed);
     }
     MOZ_ASSERT(4 == Foo::numDestroyed);
+  }
+  MOZ_ASSERT(5 == Foo::numDestroyed);
 
-    {
-        RefPtr<Foo> f1;
-        {
-            f1 = new Foo();
-            RefPtr<Foo> f2(f1);
-            RefPtr<Foo> f3 = f2;
-            MOZ_ASSERT(4 == Foo::numDestroyed);
-        }
-        MOZ_ASSERT(4 == Foo::numDestroyed);
-    }
-    MOZ_ASSERT(5 == Foo::numDestroyed);
+  {
+    RefPtr<Foo> f = new Foo();
+    f.forget();
+    MOZ_ASSERT(6 == Foo::numDestroyed);
+  }
 
-    {
-        RefPtr<Foo> f = new Foo();
-        f.forget();
-        MOZ_ASSERT(6 == Foo::numDestroyed);
-    }
+  {
+    RefPtr<Foo> f = new Foo();
+    GetNewFoo(byRef(f));
+    MOZ_ASSERT(7 == Foo::numDestroyed);
+  }
+  MOZ_ASSERT(8 == Foo::numDestroyed);
 
-    {
-        RefPtr<Foo> f = new Foo();
-        GetNewFoo(byRef(f));
-        MOZ_ASSERT(7 == Foo::numDestroyed);
-    }
+  {
+    RefPtr<Foo> f = new Foo();
+    GetPassedFoo(byRef(f));
     MOZ_ASSERT(8 == Foo::numDestroyed);
+  }
+  MOZ_ASSERT(9 == Foo::numDestroyed);
 
-    {
-        RefPtr<Foo> f = new Foo();
-        GetPassedFoo(byRef(f));
-        MOZ_ASSERT(8 == Foo::numDestroyed);
-    }
-    MOZ_ASSERT(9 == Foo::numDestroyed);
+  {
+    RefPtr<Foo> f = new Foo();
+    GetNewFoo(&f);
+    MOZ_ASSERT(10 == Foo::numDestroyed);
+  }
+  MOZ_ASSERT(11 == Foo::numDestroyed);
 
-    {
-        RefPtr<Foo> f = new Foo();
-        GetNewFoo(&f);
-        MOZ_ASSERT(10 == Foo::numDestroyed);
-    }
+  {
+    RefPtr<Foo> f = new Foo();
+    GetPassedFoo(&f);
     MOZ_ASSERT(11 == Foo::numDestroyed);
+  }
+  MOZ_ASSERT(12 == Foo::numDestroyed);
 
-    {
-        RefPtr<Foo> f = new Foo();
-        GetPassedFoo(&f);
-        MOZ_ASSERT(11 == Foo::numDestroyed);
-    }
-    MOZ_ASSERT(12 == Foo::numDestroyed);
+  {
+    RefPtr<Foo> f1 = new Bar();
+  }
+  MOZ_ASSERT(13 == Foo::numDestroyed);
 
-    {
-        RefPtr<Foo> f1 = new Bar();
-    }
+  {
+    RefPtr<Foo> f = GetNullFoo();
     MOZ_ASSERT(13 == Foo::numDestroyed);
+  }
+  MOZ_ASSERT(13 == Foo::numDestroyed);
 
-    {
-        RefPtr<Foo> f = GetNullFoo();
-        MOZ_ASSERT(13 == Foo::numDestroyed);
-    }
-    MOZ_ASSERT(13 == Foo::numDestroyed);
-
-    return 0;
+  return 0;
 }
 
 #endif
diff --git a/mfbt/Scoped.h b/mfbt/Scoped.h
index a39a077c46a2..27016b3c32ee 100644
--- a/mfbt/Scoped.h
+++ b/mfbt/Scoped.h
@@ -66,87 +66,87 @@
  *     const static void release(type);
  *   }
  */
-template <typename Traits>
+template<typename Traits>
 class Scoped
 {
-public:
-  typedef typename Traits::type Resource;
+  public:
+    typedef typename Traits::type Resource;
 
-  explicit Scoped(MOZ_GUARD_OBJECT_NOTIFIER_ONLY_PARAM)
-    : value(Traits::empty())
-  {
-    MOZ_GUARD_OBJECT_NOTIFIER_INIT;
-  }
-  explicit Scoped(const Resource& value
-                  MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
-    : value(value)
-  {
-    MOZ_GUARD_OBJECT_NOTIFIER_INIT;
-  }
-  ~Scoped() {
-    Traits::release(value);
-  }
+    explicit Scoped(MOZ_GUARD_OBJECT_NOTIFIER_ONLY_PARAM)
+      : value(Traits::empty())
+    {
+      MOZ_GUARD_OBJECT_NOTIFIER_INIT;
+    }
+    explicit Scoped(const Resource& value
+                    MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
+      : value(value)
+    {
+      MOZ_GUARD_OBJECT_NOTIFIER_INIT;
+    }
+    ~Scoped() {
+      Traits::release(value);
+    }
 
-  // Constant getter
-  operator const Resource&() const { return value; }
-  const Resource& operator->() const { return value; }
-  const Resource& get() const { return value; }
-  // Non-constant getter.
-  Resource& rwget() { return value; }
+    // Constant getter
+    operator const Resource&() const { return value; }
+    const Resource& operator->() const { return value; }
+    const Resource& get() const { return value; }
+    // Non-constant getter.
+    Resource& rwget() { return value; }
 
-  /*
-   * Forget the resource.
-   *
-   * Once |forget| has been called, the |Scoped| is neutralized, i.e. it will
-   * have no effect at destruction (unless it is reset to another resource by
-   * |operator=|).
-   *
-   * @return The original resource.
-   */
-  Resource forget() {
-    Resource tmp = value;
-    value = Traits::empty();
-    return tmp;
-  }
+    /*
+     * Forget the resource.
+     *
+     * Once |forget| has been called, the |Scoped| is neutralized, i.e. it will
+     * have no effect at destruction (unless it is reset to another resource by
+     * |operator=|).
+     *
+     * @return The original resource.
+     */
+    Resource forget() {
+      Resource tmp = value;
+      value = Traits::empty();
+      return tmp;
+    }
 
-  /*
-   * Perform immediate clean-up of this |Scoped|.
-   *
-   * If this |Scoped| is currently empty, this method has no effect.
-   */
-  void dispose() {
-    Traits::release(value);
-    value = Traits::empty();
-  }
+    /*
+     * Perform immediate clean-up of this |Scoped|.
+     *
+     * If this |Scoped| is currently empty, this method has no effect.
+     */
+    void dispose() {
+      Traits::release(value);
+      value = Traits::empty();
+    }
 
-  bool operator==(const Resource& other) const {
-    return value == other;
-  }
+    bool operator==(const Resource& other) const {
+      return value == other;
+    }
 
-  /*
-   * Replace the resource with another resource.
-   *
-   * Calling |operator=| has the side-effect of triggering clean-up. If you do
-   * not want to trigger clean-up, you should first invoke |forget|.
-   *
-   * @return this
-   */
-  Scoped<Traits>& operator=(const Resource& other) {
-    return reset(other);
-  }
-  Scoped<Traits>& reset(const Resource& other) {
-    Traits::release(value);
-    value = other;
-    return *this;
-  }
+    /*
+     * Replace the resource with another resource.
+     *
+     * Calling |operator=| has the side-effect of triggering clean-up. If you do
+     * not want to trigger clean-up, you should first invoke |forget|.
+     *
+     * @return this
+     */
+    Scoped<Traits>& operator=(const Resource& other) {
+      return reset(other);
+    }
+    Scoped<Traits>& reset(const Resource& other) {
+      Traits::release(value);
+      value = other;
+      return *this;
+    }
 
-private:
-  explicit Scoped(const Scoped<Traits>& value) MOZ_DELETE;
-  Scoped<Traits>& operator=(const Scoped<Traits>& value) MOZ_DELETE;
+  private:
+    explicit Scoped(const Scoped<Traits>& value) MOZ_DELETE;
+    Scoped<Traits>& operator=(const Scoped<Traits>& value) MOZ_DELETE;
 
-private:
-  Resource value;
-  MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
+  private:
+    Resource value;
+    MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
 };
 
 /*
@@ -158,25 +158,25 @@ private:
  * for more details.
  */
 #define SCOPED_TEMPLATE(name, Traits)                          \
-template <typename Type>                                       \
+template<typename Type>                                        \
 struct name : public Scoped<Traits<Type> >                     \
 {                                                              \
-  typedef Scoped<Traits<Type> > Super;                         \
-  typedef typename Super::Resource Resource;                   \
-  name& operator=(Resource ptr) {                              \
-    Super::operator=(ptr);                                     \
-    return *this;                                              \
-  }                                                            \
-  explicit name(MOZ_GUARD_OBJECT_NOTIFIER_ONLY_PARAM)          \
-    : Super(MOZ_GUARD_OBJECT_NOTIFIER_ONLY_PARAM_TO_PARENT)    \
-  {}                                                           \
-  explicit name(Resource ptr                                   \
-                MOZ_GUARD_OBJECT_NOTIFIER_PARAM)               \
-    : Super(ptr MOZ_GUARD_OBJECT_NOTIFIER_PARAM_TO_PARENT)     \
-  {}                                                           \
-private:                                                       \
-  explicit name(name& source) MOZ_DELETE;                      \
-  name& operator=(name& source) MOZ_DELETE;                    \
+    typedef Scoped<Traits<Type> > Super;                       \
+    typedef typename Super::Resource Resource;                 \
+    name& operator=(Resource ptr) {                            \
+      Super::operator=(ptr);                                   \
+      return *this;                                            \
+    }                                                          \
+    explicit name(MOZ_GUARD_OBJECT_NOTIFIER_ONLY_PARAM)        \
+      : Super(MOZ_GUARD_OBJECT_NOTIFIER_ONLY_PARAM_TO_PARENT)  \
+    {}                                                         \
+    explicit name(Resource ptr                                 \
+                  MOZ_GUARD_OBJECT_NOTIFIER_PARAM)             \
+      : Super(ptr MOZ_GUARD_OBJECT_NOTIFIER_PARAM_TO_PARENT)   \
+    {}                                                         \
+  private:                                                     \
+    explicit name(name& source) MOZ_DELETE;                    \
+    name& operator=(name& source) MOZ_DELETE;                  \
 };
 
 /*
@@ -186,12 +186,12 @@ private:                                                       \
  *   ScopedFreePtr<S> foo = malloc(sizeof(S));
  *   ScopedFreePtr<char> bar = strdup(str);
  */
-template <typename T>
+template<typename T>
 struct ScopedFreePtrTraits
 {
-  typedef T* type;
-  static T* empty() { return NULL; }
-  static void release(T* ptr) { free(ptr); }
+    typedef T* type;
+    static T* empty() { return NULL; }
+    static void release(T* ptr) { free(ptr); }
 };
 SCOPED_TEMPLATE(ScopedFreePtr, ScopedFreePtrTraits)
 
@@ -201,9 +201,10 @@ SCOPED_TEMPLATE(ScopedFreePtr, ScopedFreePtrTraits)
  *   struct S { ... };
  *   ScopedDeletePtr<S> foo = new S();
  */
-template <typename T>
-struct ScopedDeletePtrTraits : public ScopedFreePtrTraits<T> {
-  static void release(T* ptr) { delete ptr; }
+template<typename T>
+struct ScopedDeletePtrTraits : public ScopedFreePtrTraits<T>
+{
+    static void release(T* ptr) { delete ptr; }
 };
 SCOPED_TEMPLATE(ScopedDeletePtr, ScopedDeletePtrTraits)
 
@@ -213,12 +214,11 @@ SCOPED_TEMPLATE(ScopedDeletePtr, ScopedDeletePtrTraits)
  *   struct S { ... };
  *   ScopedDeleteArray<S> foo = new S[42];
  */
-template <typename T>
+template<typename T>
 struct ScopedDeleteArrayTraits : public ScopedFreePtrTraits<T>
 {
-  static void release(T* ptr) { delete [] ptr; }
+    static void release(T* ptr) { delete [] ptr; }
 };
 SCOPED_TEMPLATE(ScopedDeleteArray, ScopedDeleteArrayTraits)
 
-
 #endif // mozilla_Scoped_h_
diff --git a/mfbt/StandardInteger.h b/mfbt/StandardInteger.h
index 23e25f0cc816..8e4c8578f17c 100644
--- a/mfbt/StandardInteger.h
+++ b/mfbt/StandardInteger.h
@@ -1,7 +1,5 @@
-/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*-
- * vim: set ts=8 sw=4 et tw=99 ft=cpp:
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
diff --git a/mfbt/ThreadLocal.h b/mfbt/ThreadLocal.h
index 1c0624267c70..712f1f12d404 100644
--- a/mfbt/ThreadLocal.h
+++ b/mfbt/ThreadLocal.h
@@ -1,8 +1,9 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-// Cross-platform lightweight thread local data wrappers
+/* Cross-platform lightweight thread local data wrappers. */
 
 #ifndef mozilla_TLS_h_
 #define mozilla_TLS_h_
@@ -63,7 +64,7 @@ typedef sig_atomic_t sig_safe_t;
  * // Get the TLS value
  * int value = tlsKey.get();
  */
-template <typename T>
+template<typename T>
 class ThreadLocal
 {
 #if defined(XP_WIN)
@@ -73,7 +74,7 @@ class ThreadLocal
 #endif
 
     union Helper {
-      void *ptr;
+      void* ptr;
       T value;
     };
 
@@ -93,10 +94,13 @@ class ThreadLocal
     bool inited;
 };
 
-template <typename T>
+template<typename T>
 inline bool
-ThreadLocal<T>::init() {
-  MOZ_STATIC_ASSERT(sizeof(T) <= sizeof(void *), "mozilla::ThreadLocal can't be used for types larger than a pointer");
+ThreadLocal<T>::init()
+{
+  MOZ_STATIC_ASSERT(sizeof(T) <= sizeof(void *),
+                    "mozilla::ThreadLocal can't be used for types larger than "
+                    "a pointer");
   MOZ_ASSERT(!initialized());
 #ifdef XP_WIN
   key = TlsAlloc();
@@ -107,9 +111,10 @@ ThreadLocal<T>::init() {
   return inited;
 }
 
-template <typename T>
+template<typename T>
 inline T
-ThreadLocal<T>::get() const {
+ThreadLocal<T>::get() const
+{
   MOZ_ASSERT(initialized());
   Helper h;
 #ifdef XP_WIN
@@ -120,9 +125,10 @@ ThreadLocal<T>::get() const {
   return h.value;
 }
 
-template <typename T>
+template<typename T>
 inline bool
-ThreadLocal<T>::set(const T value) {
+ThreadLocal<T>::set(const T value)
+{
   MOZ_ASSERT(initialized());
   Helper h;
   h.value = value;
diff --git a/mfbt/Types.h b/mfbt/Types.h
index e29fd9347897..f803586ec117 100644
--- a/mfbt/Types.h
+++ b/mfbt/Types.h
@@ -1,7 +1,5 @@
-/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*-
- * vim: set ts=8 sw=4 et tw=99 ft=cpp:
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
diff --git a/mfbt/Util.h b/mfbt/Util.h
index ee6286b6df42..735c0679405b 100644
--- a/mfbt/Util.h
+++ b/mfbt/Util.h
@@ -1,7 +1,5 @@
-/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*-
- * vim: set ts=8 sw=4 et tw=99 ft=cpp:
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
@@ -22,40 +20,37 @@
 namespace mozilla {
 
 /**
- * DebugOnly contains a value of type T, but only in debug builds.  In
- * release builds, it does not contain a value.  This helper is
- * intended to be used along with ASSERT()-style macros, allowing one
- * to write
+ * DebugOnly contains a value of type T, but only in debug builds.  In release
+ * builds, it does not contain a value.  This helper is intended to be used with
+ * MOZ_ASSERT()-style macros, allowing one to write:
  *
- *   DebugOnly<bool> check = Func();
- *   ASSERT(check);
+ *   DebugOnly<bool> check = func();
+ *   MOZ_ASSERT(check);
  *
- * more concisely than declaring |check| conditional on #ifdef DEBUG,
- * but also without allocating storage space for |check| in release
- * builds.
+ * more concisely than declaring |check| conditional on #ifdef DEBUG, but also
+ * without allocating storage space for |check| in release builds.
  *
- * DebugOnly instances can only be coerced to T in debug builds; in
- * release builds, they don't have a value so type coercion is not
- * well defined.
+ * DebugOnly instances can only be coerced to T in debug builds.  In release
+ * builds they don't have a value, so type coercion is not well defined.
  */
-template <typename T>
+template<typename T>
 struct DebugOnly
 {
 #ifdef DEBUG
     T value;
 
-    DebugOnly() {}
-    DebugOnly(const T& other) : value(other) {}
-    DebugOnly(const DebugOnly& other) : value(other.value) {}
+    DebugOnly() { }
+    DebugOnly(const T& other) : value(other) { }
+    DebugOnly(const DebugOnly& other) : value(other.value) { }
     DebugOnly& operator=(const T& rhs) {
-        value = rhs;
-        return *this;
+      value = rhs;
+      return *this;
     }
     void operator++(int) {
-        value++;
+      value++;
     }
     void operator--(int) {
-        value--;
+      value--;
     }
 
     T *operator&() { return &value; }
@@ -66,12 +61,12 @@ struct DebugOnly
     T& operator->() { return value; }
 
 #else
-    DebugOnly() {}
-    DebugOnly(const T&) {}
-    DebugOnly(const DebugOnly&) {}
+    DebugOnly() { }
+    DebugOnly(const T&) { }
+    DebugOnly(const DebugOnly&) { }
     DebugOnly& operator=(const T&) { return *this; }
-    void operator++(int) {}
-    void operator--(int) {}
+    void operator++(int) { }
+    void operator--(int) { }
 #endif
 
     /*
@@ -87,17 +82,16 @@ struct DebugOnly
  * bytes of alignment a given type needs.
  */
 template<class T>
-struct AlignmentFinder
+class AlignmentFinder
 {
-private:
-  struct Aligner
-  {
-    char c;
-    T t;
-  };
+    struct Aligner
+    {
+        char c;
+        T t;
+    };
 
-public:
-  static const int alignment = sizeof(Aligner) - sizeof(T);
+  public:
+    static const size_t alignment = sizeof(Aligner) - sizeof(T);
 };
 
 #define MOZ_ALIGNOF(T) mozilla::AlignmentFinder<T>::alignment
@@ -124,7 +118,8 @@ public:
 #endif
 
 /*
- * AlignedElem<N> is a structure whose alignment is guaranteed to be at least N bytes.
+ * AlignedElem<N> is a structure whose alignment is guaranteed to be at least N
+ * bytes.
  *
  * We support 1, 2, 4, 8, and 16-bit alignment.
  */
@@ -139,31 +134,31 @@ struct AlignedElem;
 template<>
 struct AlignedElem<1>
 {
-  MOZ_ALIGNED_DECL(uint8_t elem, 1);
+    MOZ_ALIGNED_DECL(uint8_t elem, 1);
 };
 
 template<>
 struct AlignedElem<2>
 {
-  MOZ_ALIGNED_DECL(uint8_t elem, 2);
+    MOZ_ALIGNED_DECL(uint8_t elem, 2);
 };
 
 template<>
 struct AlignedElem<4>
 {
-  MOZ_ALIGNED_DECL(uint8_t elem, 4);
+    MOZ_ALIGNED_DECL(uint8_t elem, 4);
 };
 
 template<>
 struct AlignedElem<8>
 {
-  MOZ_ALIGNED_DECL(uint8_t elem, 8);
+    MOZ_ALIGNED_DECL(uint8_t elem, 8);
 };
 
 template<>
 struct AlignedElem<16>
 {
-  MOZ_ALIGNED_DECL(uint8_t elem, 16);
+    MOZ_ALIGNED_DECL(uint8_t elem, 16);
 };
 
 /*
@@ -176,28 +171,28 @@ struct AlignedElem<16>
  * false negatives when we cast from the char buffer to whatever type we've
  * constructed using the bytes.
  */
-template <size_t nbytes>
+template<size_t nbytes>
 struct AlignedStorage
 {
     union U {
-        char bytes[nbytes];
-        uint64_t _;
+      char bytes[nbytes];
+      uint64_t _;
     } u;
 
-    const void *addr() const { return u.bytes; }
-    void *addr() { return u.bytes; }
+    const void* addr() const { return u.bytes; }
+    void* addr() { return u.bytes; }
 };
 
-template <class T>
+template<class T>
 struct AlignedStorage2
 {
     union U {
-        char bytes[sizeof(T)];
-        uint64_t _;
+      char bytes[sizeof(T)];
+      uint64_t _;
     } u;
 
-    const T *addr() const { return (const T *)u.bytes; }
-    T *addr() { return (T *)(void *)u.bytes; }
+    const T* addr() const { return reinterpret_cast<const T*>(u.bytes); }
+    T* addr() { return static_cast<T*>(static_cast<void*>(u.bytes)); }
 };
 
 /*
@@ -211,16 +206,13 @@ struct AlignedStorage2
  * N.B. GCC seems to miss some optimizations with Maybe and may generate extra
  * branches/loads/stores. Use with caution on hot paths.
  */
-template <class T>
+template<class T>
 class Maybe
 {
     AlignedStorage2<T> storage;
     bool constructed;
 
-    T &asT() { return *storage.addr(); }
-
-    explicit Maybe(const Maybe &other);
-    const Maybe &operator=(const Maybe &other);
+    T& asT() { return *storage.addr(); }
 
   public:
     Maybe() { constructed = false; }
@@ -229,63 +221,67 @@ class Maybe
     bool empty() const { return !constructed; }
 
     void construct() {
-        MOZ_ASSERT(!constructed);
-        new(storage.addr()) T();
-        constructed = true;
+      MOZ_ASSERT(!constructed);
+      new (storage.addr()) T();
+      constructed = true;
     }
 
-    template <class T1>
-    void construct(const T1 &t1) {
-        MOZ_ASSERT(!constructed);
-        new(storage.addr()) T(t1);
-        constructed = true;
+    template<class T1>
+    void construct(const T1& t1) {
+      MOZ_ASSERT(!constructed);
+      new (storage.addr()) T(t1);
+      constructed = true;
     }
 
-    template <class T1, class T2>
-    void construct(const T1 &t1, const T2 &t2) {
-        MOZ_ASSERT(!constructed);
-        new(storage.addr()) T(t1, t2);
-        constructed = true;
+    template<class T1, class T2>
+    void construct(const T1& t1, const T2& t2) {
+      MOZ_ASSERT(!constructed);
+      new (storage.addr()) T(t1, t2);
+      constructed = true;
     }
 
-    template <class T1, class T2, class T3>
-    void construct(const T1 &t1, const T2 &t2, const T3 &t3) {
-        MOZ_ASSERT(!constructed);
-        new(storage.addr()) T(t1, t2, t3);
-        constructed = true;
+    template<class T1, class T2, class T3>
+    void construct(const T1& t1, const T2& t2, const T3& t3) {
+      MOZ_ASSERT(!constructed);
+      new (storage.addr()) T(t1, t2, t3);
+      constructed = true;
     }
 
-    template <class T1, class T2, class T3, class T4>
-    void construct(const T1 &t1, const T2 &t2, const T3 &t3, const T4 &t4) {
-        MOZ_ASSERT(!constructed);
-        new(storage.addr()) T(t1, t2, t3, t4);
-        constructed = true;
+    template<class T1, class T2, class T3, class T4>
+    void construct(const T1& t1, const T2& t2, const T3& t3, const T4& t4) {
+      MOZ_ASSERT(!constructed);
+      new (storage.addr()) T(t1, t2, t3, t4);
+      constructed = true;
     }
 
-    T *addr() {
-        MOZ_ASSERT(constructed);
-        return &asT();
+    T* addr() {
+      MOZ_ASSERT(constructed);
+      return &asT();
     }
 
-    T &ref() {
-        MOZ_ASSERT(constructed);
-        return asT();
+    T& ref() {
+      MOZ_ASSERT(constructed);
+      return asT();
     }
 
-    const T &ref() const {
-        MOZ_ASSERT(constructed);
-        return const_cast<Maybe *>(this)->asT();
+    const T& ref() const {
+      MOZ_ASSERT(constructed);
+      return const_cast<Maybe*>(this)->asT();
     }
 
     void destroy() {
-        ref().~T();
-        constructed = false;
+      ref().~T();
+      constructed = false;
     }
 
     void destroyIfConstructed() {
-        if (!empty())
-            destroy();
+      if (!empty())
+        destroy();
     }
+
+  private:
+    Maybe(const Maybe& other) MOZ_DELETE;
+    const Maybe& operator=(const Maybe& other) MOZ_DELETE;
 };
 
 /*
@@ -294,12 +290,12 @@ class Maybe
  * set, the unsigned subtraction followed by right shift will produce -1, or
  * size_t(-1), instead of the real difference.
  */
-template <class T>
+template<class T>
 MOZ_ALWAYS_INLINE size_t
 PointerRangeSize(T* begin, T* end)
 {
-    MOZ_ASSERT(end >= begin);
-    return (size_t(end) - size_t(begin)) / sizeof(T);
+  MOZ_ASSERT(end >= begin);
+  return (size_t(end) - size_t(begin)) / sizeof(T);
 }
 
 /*
@@ -312,7 +308,7 @@ template<typename T, size_t N>
 size_t
 ArrayLength(T (&arr)[N])
 {
-    return N;
+  return N;
 }
 
 /*
@@ -324,7 +320,7 @@ template<typename T, size_t N>
 T*
 ArrayEnd(T (&arr)[N])
 {
-    return arr + ArrayLength(arr);
+  return arr + ArrayLength(arr);
 }
 
 } /* namespace mozilla */
diff --git a/mobile/android/base/AwesomeBar.java b/mobile/android/base/AwesomeBar.java
index 9c4a24b51fcc..7f2dc2f84641 100644
--- a/mobile/android/base/AwesomeBar.java
+++ b/mobile/android/base/AwesomeBar.java
@@ -11,6 +11,7 @@ import android.content.DialogInterface;
 import android.content.Intent;
 import android.content.ContentResolver;
 import android.content.Context;
+import android.content.SharedPreferences;
 import android.content.res.Configuration;
 import android.database.Cursor;
 import android.graphics.Bitmap;
@@ -42,6 +43,7 @@ import android.widget.TabWidget;
 import android.widget.Toast;
 
 import java.net.URLEncoder;
+import java.util.ArrayList;
 import java.util.Map;
 
 import org.mozilla.gecko.db.BrowserContract.Bookmarks;
@@ -54,6 +56,9 @@ import org.json.JSONObject;
 public class AwesomeBar extends GeckoActivity implements GeckoEventListener {
     private static final String LOGTAG = "GeckoAwesomeBar";
 
+    private static final int SUGGESTION_TIMEOUT = 2000;
+    private static final int SUGGESTION_MAX = 3;
+
     static final String URL_KEY = "url";
     static final String CURRENT_URL_KEY = "currenturl";
     static final String TYPE_KEY = "type";
@@ -67,6 +72,11 @@ public class AwesomeBar extends GeckoActivity implements GeckoEventListener {
     private ImageButton mGoButton;
     private ContentResolver mResolver;
     private ContextMenuSubject mContextMenuSubject;
+    private SuggestClient mSuggestClient;
+    private AsyncTask<String, Void, ArrayList<String>> mSuggestTask;
+
+    private static String sSuggestEngine;
+    private static String sSuggestTemplate;
 
     @Override
     public void onCreate(Bundle savedInstanceState) {
@@ -91,8 +101,20 @@ public class AwesomeBar extends GeckoActivity implements GeckoEventListener {
                 openUrlAndFinish(url);
             }
 
-            public void onSearch(String engine) {
-                openSearchAndFinish(mText.getText().toString(), engine);
+            public void onSearch(String engine, String text) {
+                openSearchAndFinish(text, engine);
+            }
+
+            public void onEditSuggestion(final String text) {
+                GeckoApp.mAppContext.mMainHandler.post(new Runnable() {
+                    public void run() {
+                        mText.setText(text);
+                        mText.setSelection(mText.getText().length());
+                        mText.requestFocus();
+                        InputMethodManager imm = (InputMethodManager) getSystemService(Context.INPUT_METHOD_SERVICE);
+                        imm.showSoftInput(mText, InputMethodManager.SHOW_IMPLICIT);
+                    }
+                });
             }
         });
 
@@ -159,6 +181,24 @@ public class AwesomeBar extends GeckoActivity implements GeckoEventListener {
 
                 // no composition string. It is safe to update IME flags.
                 updateGoButton(text);
+
+                // cancel previous query
+                if (mSuggestTask != null) {
+                    mSuggestTask.cancel(true);
+                }
+
+                if (mSuggestClient != null) {
+                    mSuggestTask = new AsyncTask<String, Void, ArrayList<String>>() {
+                         protected ArrayList<String> doInBackground(String... query) {
+                             return mSuggestClient.query(query[0]);
+                         }
+
+                         protected void onPostExecute(ArrayList<String> suggestions) {
+                             mAwesomeTabs.setSuggestions(suggestions);
+                         }
+                    };
+                    mSuggestTask.execute(text);
+                }
             }
 
             public void beforeTextChanged(CharSequence s, int start, int count,
@@ -190,14 +230,46 @@ public class AwesomeBar extends GeckoActivity implements GeckoEventListener {
         registerForContextMenu(mAwesomeTabs.findViewById(R.id.bookmarks_list));
         registerForContextMenu(mAwesomeTabs.findViewById(R.id.history_list));
 
+        if (sSuggestTemplate == null) {
+            loadSuggestClientFromPrefs();
+        } else {
+            loadSuggestClient();
+        }
+
         GeckoAppShell.registerGeckoEventListener("SearchEngines:Data", this);
         GeckoAppShell.sendEventToGecko(GeckoEvent.createBroadcastEvent("SearchEngines:Get", null));
     }
 
+    private void loadSuggestClientFromPrefs() {
+        GeckoAppShell.getHandler().post(new Runnable() {
+            public void run() {
+                SharedPreferences prefs = getSearchPreferences();
+                sSuggestEngine = prefs.getString("suggestEngine", null);
+                sSuggestTemplate = prefs.getString("suggestTemplate", null);
+                if (sSuggestTemplate != null) {
+                    loadSuggestClient();
+                    mAwesomeTabs.setSuggestEngine(sSuggestEngine, null);
+                }
+            }
+        });
+    }
+
+    private void loadSuggestClient() {
+        mSuggestClient = new SuggestClient(GeckoApp.mAppContext, sSuggestTemplate, SUGGESTION_TIMEOUT, SUGGESTION_MAX);
+    }
+
     public void handleMessage(String event, JSONObject message) {
         try {
             if (event.equals("SearchEngines:Data")) {
-                mAwesomeTabs.setSearchEngines(message.getJSONArray("searchEngines"));
+                final String suggestEngine = message.optString("suggestEngine");
+                final String suggestTemplate = message.optString("suggestTemplate");
+                if (!TextUtils.equals(suggestTemplate, sSuggestTemplate)) {
+                    saveSuggestEngineData(suggestEngine, suggestTemplate);
+                    sSuggestEngine = suggestEngine;
+                    sSuggestTemplate = suggestTemplate;
+                    loadSuggestClient();
+                }
+                mAwesomeTabs.setSearchEngines(suggestEngine, message.getJSONArray("searchEngines"));
             }
         } catch (Exception e) {
             // do nothing
@@ -205,6 +277,18 @@ public class AwesomeBar extends GeckoActivity implements GeckoEventListener {
         }
     }
 
+    private void saveSuggestEngineData(final String suggestEngine, final String suggestTemplate) {
+        GeckoAppShell.getHandler().post(new Runnable() {
+            public void run() {
+                SharedPreferences prefs = getSearchPreferences();
+                SharedPreferences.Editor editor = prefs.edit();
+                editor.putString("suggestEngine", suggestEngine);
+                editor.putString("suggestTemplate", suggestTemplate);
+                editor.commit();
+            }
+        });
+    }
+
     @Override
     public void onConfigurationChanged(Configuration newConfiguration) {
         super.onConfigurationChanged(newConfiguration);
@@ -678,4 +762,8 @@ public class AwesomeBar extends GeckoActivity implements GeckoEventListener {
             mOnKeyPreImeListener = listener;
         }
     }
+
+    private SharedPreferences getSearchPreferences() {
+        return getSharedPreferences("search.prefs", MODE_PRIVATE);
+    }
 }
diff --git a/mobile/android/base/AwesomeBarTabs.java b/mobile/android/base/AwesomeBarTabs.java
index 8769ea525d95..f94e98e2714d 100644
--- a/mobile/android/base/AwesomeBarTabs.java
+++ b/mobile/android/base/AwesomeBarTabs.java
@@ -39,6 +39,7 @@ import android.widget.TextView;
 
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
+import java.util.ArrayList;
 import java.util.Date;
 import java.util.HashMap;
 import java.util.LinkedList;
@@ -67,9 +68,10 @@ public class AwesomeBarTabs extends TabHost {
     private boolean mInflated;
     private LayoutInflater mInflater;
     private OnUrlOpenListener mUrlOpenListener;
-    private JSONArray mSearchEngines;
     private ContentResolver mContentResolver;
     private ContentObserver mContentObserver;
+    private SearchEngine mSuggestEngine;
+    private ArrayList<SearchEngine> mSearchEngines;
 
     private BookmarksQueryTask mBookmarksQueryTask;
     private HistoryQueryTask mHistoryQueryTask;
@@ -86,16 +88,24 @@ public class AwesomeBarTabs extends TabHost {
 
     public interface OnUrlOpenListener {
         public void onUrlOpen(String url);
-        public void onSearch(String engine);
+        public void onSearch(String engine, String text);
+        public void onEditSuggestion(String suggestion);
     }
 
-    private class ViewHolder {
+    private class AwesomeEntryViewHolder {
         public TextView titleView;
         public TextView urlView;
         public ImageView faviconView;
         public ImageView starView;
     }
 
+    private class SearchEntryViewHolder {
+        public FlowLayout suggestionView;
+        public ImageView iconView;
+        public LinearLayout userEnteredView;
+        public TextView userEnteredTextView;
+    }
+
     private class HistoryListAdapter extends SimpleExpandableListAdapter {
         public HistoryListAdapter(Context context, List<? extends Map<String, ?>> groupData,
                 int groupLayout, String[] groupFrom, int[] groupTo,
@@ -108,12 +118,12 @@ public class AwesomeBarTabs extends TabHost {
         @Override
         public View getChildView(int groupPosition, int childPosition, boolean isLastChild,
                 View convertView, ViewGroup parent) {
-            ViewHolder viewHolder = null;
+            AwesomeEntryViewHolder viewHolder = null;
 
             if (convertView == null) {
                 convertView = mInflater.inflate(R.layout.awesomebar_row, null);
 
-                viewHolder = new ViewHolder();
+                viewHolder = new AwesomeEntryViewHolder();
                 viewHolder.titleView = (TextView) convertView.findViewById(R.id.title);
                 viewHolder.urlView = (TextView) convertView.findViewById(R.id.url);
                 viewHolder.faviconView = (ImageView) convertView.findViewById(R.id.favicon);
@@ -121,7 +131,7 @@ public class AwesomeBarTabs extends TabHost {
 
                 convertView.setTag(viewHolder);
             } else {
-                viewHolder = (ViewHolder) convertView.getTag();
+                viewHolder = (AwesomeEntryViewHolder) convertView.getTag();
             }
 
             @SuppressWarnings("unchecked")
@@ -256,7 +266,7 @@ public class AwesomeBarTabs extends TabHost {
         @Override
         public View getView(int position, View convertView, ViewGroup parent) {
             int viewType = getItemViewType(position);
-            ViewHolder viewHolder = null;
+            AwesomeEntryViewHolder viewHolder = null;
 
             if (convertView == null) {
                 if (viewType == VIEW_TYPE_ITEM)
@@ -264,7 +274,7 @@ public class AwesomeBarTabs extends TabHost {
                 else
                     convertView = mInflater.inflate(R.layout.awesomebar_folder_row, null);
 
-                viewHolder = new ViewHolder();
+                viewHolder = new AwesomeEntryViewHolder();
                 viewHolder.titleView = (TextView) convertView.findViewById(R.id.title);
                 viewHolder.faviconView = (ImageView) convertView.findViewById(R.id.favicon);
 
@@ -273,7 +283,7 @@ public class AwesomeBarTabs extends TabHost {
 
                 convertView.setTag(viewHolder);
             } else {
-                viewHolder = (ViewHolder) convertView.getTag();
+                viewHolder = (AwesomeEntryViewHolder) convertView.getTag();
             }
 
             Cursor cursor = getCursor();
@@ -608,9 +618,49 @@ public class AwesomeBarTabs extends TabHost {
         }
     }
 
+    private interface AwesomeBarItem {
+        public void onClick();
+    }
+
     private class AwesomeBarCursorAdapter extends SimpleCursorAdapter {
         private String mSearchTerm;
 
+        private static final int ROW_SEARCH = 0;
+        private static final int ROW_STANDARD = 1;
+
+        private class AwesomeBarCursorItem implements AwesomeBarItem {
+            private Cursor mCursor;
+
+            public AwesomeBarCursorItem(Cursor cursor) {
+                mCursor = cursor;
+            }
+
+            public void onClick() {
+                String url = mCursor.getString(mCursor.getColumnIndexOrThrow(URLColumns.URL));
+                if (mUrlOpenListener != null) {
+                    int display = mCursor.getInt(mCursor.getColumnIndexOrThrow(Combined.DISPLAY));
+                    if (display == Combined.DISPLAY_READER) {
+                        url = getReaderForUrl(url);
+                    }
+
+                    mUrlOpenListener.onUrlOpen(url);
+                }
+            }
+        }
+
+        private class AwesomeBarSearchEngineItem implements AwesomeBarItem {
+            private String mSearchEngine;
+
+            public AwesomeBarSearchEngineItem(String searchEngine) {
+                mSearchEngine = searchEngine;
+            }
+
+            public void onClick() {
+                if (mUrlOpenListener != null)
+                    mUrlOpenListener.onSearch(mSearchEngine, mSearchTerm);
+            }
+        }
+
         public AwesomeBarCursorAdapter(Context context) {
             super(context, -1, null, new String[] {}, new int[] {});
             mSearchTerm = "";
@@ -621,58 +671,123 @@ public class AwesomeBarTabs extends TabHost {
             getFilter().filter(searchTerm);
         }
 
+        private int getSuggestEngineCount() {
+            return (mSearchTerm.length() == 0 || mSuggestEngine == null) ? 0 : 1;
+        }
+
         // Add the search engines to the number of reported results.
         @Override
         public int getCount() {
             final int resultCount = super.getCount();
 
-            // don't show additional search engines if search field is empty
+            // don't show search engines or suggestions if search field is empty
             if (mSearchTerm.length() == 0)
                 return resultCount;
 
-            return resultCount + mSearchEngines.length();
+            return resultCount + mSearchEngines.size() + getSuggestEngineCount();
         }
 
         // If an item is part of the cursor result set, return that entry.
         // Otherwise, return the search engine data.
         @Override
         public Object getItem(int position) {
-            final int resultCount = super.getCount();
-            if (position < resultCount)
-                return super.getItem(position);
+            int engineIndex = getEngineIndex(position);
 
-            JSONObject engine;
-            String engineName = null;
-            try {
-                engine = mSearchEngines.getJSONObject(position - resultCount);
-                engineName = engine.getString("name");
-            } catch (JSONException e) {
-                Log.e(LOGTAG, "error getting json arguments");
+            if (engineIndex == -1) {
+                // return awesomebar result
+                position -= getSuggestEngineCount();
+                return new AwesomeBarCursorItem((Cursor) super.getItem(position));
             }
 
-            return engineName;
+            // return search engine
+            return new AwesomeBarSearchEngineItem(getEngine(engineIndex).name);
+        }
+
+        private SearchEngine getEngine(int index) {
+            final int suggestEngineCount = getSuggestEngineCount();
+            if (index < suggestEngineCount)
+                return mSuggestEngine;
+            return mSearchEngines.get(index - suggestEngineCount);
+        }
+
+        private int getEngineIndex(int position) {
+            final int resultCount = super.getCount();
+            final int suggestEngineCount = getSuggestEngineCount();
+
+            // return suggest engine index
+            if (position < suggestEngineCount)
+                return 0;
+
+            // not an engine
+            if (position - suggestEngineCount < resultCount)
+                return -1;
+
+            // return search engine index
+            return position - resultCount;
+        }
+
+        @Override
+        public int getItemViewType(int position) {
+            return getEngineIndex(position) == -1 ? ROW_STANDARD : ROW_SEARCH;
+        }
+
+        @Override
+        public int getViewTypeCount() {
+            // view can be either a standard awesomebar row or a search engine row
+            return 2;
+        }
+
+        @Override
+        public boolean isEnabled(int position) {
+            // If the suggestion row only contains one item (the user-entered
+            // query), allow the entire row to be clickable; clicking the row
+            // has the same effect as clicking the single suggestion. If the
+            // row contains multiple items, clicking the row will do nothing.
+            int index = getEngineIndex(position);
+            if (index != -1) {
+                return getEngine(index).suggestions.isEmpty();
+            }
+            return true;
         }
 
         @Override
         public View getView(int position, View convertView, ViewGroup parent) {
-            ViewHolder viewHolder = null;
+            if (getItemViewType(position) == ROW_SEARCH) {
+                SearchEntryViewHolder viewHolder = null;
 
-            if (convertView == null) {
-                convertView = mInflater.inflate(R.layout.awesomebar_row, null);
+                if (convertView == null) {
+                    convertView = mInflater.inflate(R.layout.awesomebar_suggestion_row, null);
 
-                viewHolder = new ViewHolder();
-                viewHolder.titleView = (TextView) convertView.findViewById(R.id.title);
-                viewHolder.urlView = (TextView) convertView.findViewById(R.id.url);
-                viewHolder.faviconView = (ImageView) convertView.findViewById(R.id.favicon);
-                viewHolder.starView = (ImageView) convertView.findViewById(R.id.bookmark_star);
+                    viewHolder = new SearchEntryViewHolder();
+                    viewHolder.suggestionView = (FlowLayout) convertView.findViewById(R.id.suggestion_layout);
+                    viewHolder.iconView = (ImageView) convertView.findViewById(R.id.suggestion_icon);
+                    viewHolder.userEnteredView = (LinearLayout) convertView.findViewById(R.id.suggestion_user_entered);
+                    viewHolder.userEnteredTextView = (TextView) convertView.findViewById(R.id.suggestion_text);
 
-                convertView.setTag(viewHolder);
+                    convertView.setTag(viewHolder);
+                } else {
+                    viewHolder = (SearchEntryViewHolder) convertView.getTag();
+                }
+
+                bindSearchEngineView(getEngine(getEngineIndex(position)), viewHolder);
             } else {
-                viewHolder = (ViewHolder) convertView.getTag();
-            }
+                AwesomeEntryViewHolder viewHolder = null;
 
-            final int resultCount = super.getCount();
-            if (position < resultCount) {
+                if (convertView == null) {
+                    convertView = mInflater.inflate(R.layout.awesomebar_row, null);
+
+                    viewHolder = new AwesomeEntryViewHolder();
+                    viewHolder.titleView = (TextView) convertView.findViewById(R.id.title);
+                    viewHolder.urlView = (TextView) convertView.findViewById(R.id.url);
+                    viewHolder.faviconView = (ImageView) convertView.findViewById(R.id.favicon);
+                    viewHolder.starView = (ImageView) convertView.findViewById(R.id.bookmark_star);
+
+                    convertView.setTag(viewHolder);
+                } else {
+                    viewHolder = (AwesomeEntryViewHolder) convertView.getTag();
+                }
+
+                position -= getSuggestEngineCount();
                 Cursor cursor = getCursor();
                 if (!cursor.moveToPosition(position))
                     throw new IllegalStateException("Couldn't move cursor to position " + position);
@@ -681,45 +796,69 @@ public class AwesomeBarTabs extends TabHost {
                 updateUrl(viewHolder.urlView, cursor);
                 updateFavicon(viewHolder.faviconView, cursor);
                 updateBookmarkStar(viewHolder.starView, cursor);
-            } else {
-                bindSearchEngineView(position - resultCount, viewHolder);
             }
 
             return convertView;
         }
 
-        private Drawable getDrawableFromDataURI(String dataURI) {
-            String base64 = dataURI.substring(dataURI.indexOf(',') + 1);
-            Drawable drawable = null;
-            try {
-                byte[] bytes = GeckoAppShell.decodeBase64(base64, GeckoAppShell.BASE64_DEFAULT);
-                ByteArrayInputStream stream = new ByteArrayInputStream(bytes);
-                drawable = Drawable.createFromStream(stream, "src");
-                stream.close();
-            } catch (IllegalArgumentException e) {
-                Log.i(LOGTAG, "exception while decoding drawable: " + base64, e);
-            } catch (IOException e) { }
-            return drawable;
-        }
+        private void bindSearchEngineView(final SearchEngine engine, SearchEntryViewHolder viewHolder) {
+            // when a suggestion is clicked, do a search
+            OnClickListener clickListener = new OnClickListener() {
+                public void onClick(View v) {
+                    if (mUrlOpenListener != null) {
+                        String suggestion = ((TextView) v.findViewById(R.id.suggestion_text)).getText().toString();
+                        mUrlOpenListener.onSearch(engine.name, suggestion);
+                    }
+                }
+            };
 
-        private void bindSearchEngineView(int position, ViewHolder viewHolder) {
-            String name;
-            String iconURI;
-            String searchText = getResources().getString(R.string.awesomebar_search_engine, mSearchTerm);
-            try {
-                JSONObject searchEngine = mSearchEngines.getJSONObject(position);
-                name = searchEngine.getString("name");
-                iconURI = searchEngine.getString("iconURI");
-            } catch (JSONException e) {
-                Log.e(LOGTAG, "error getting json arguments");
-                return;
+            // when a suggestion is long-clicked, copy the suggestion into the URL EditText
+            OnLongClickListener longClickListener = new OnLongClickListener() {
+                public boolean onLongClick(View v) {
+                    if (mUrlOpenListener != null) {
+                        String suggestion = ((TextView) v.findViewById(R.id.suggestion_text)).getText().toString();
+                        mUrlOpenListener.onEditSuggestion(suggestion);
+                        return true;
+                    }
+                    return false;
+                }
+            };
+
+            // set the search engine icon (e.g., Google) for the row
+            FlowLayout suggestionView = viewHolder.suggestionView;
+            viewHolder.iconView.setImageDrawable(engine.icon);
+
+            // user-entered search term is first suggestion
+            viewHolder.userEnteredTextView.setText(mSearchTerm);
+            viewHolder.userEnteredView.setOnClickListener(clickListener);
+            
+            // add additional suggestions given by this engine
+            int recycledSuggestionCount = suggestionView.getChildCount();
+            int suggestionCount = engine.suggestions.size();
+            int i = 0;
+            for (i = 0; i < suggestionCount; i++) {
+                String suggestion = engine.suggestions.get(i);
+                View suggestionItem = null;
+
+                // reuse suggestion views from recycled view, if possible
+                if (i+1 < recycledSuggestionCount) {
+                    suggestionItem = suggestionView.getChildAt(i+1);
+                    suggestionItem.setVisibility(View.VISIBLE);
+                } else {
+                    suggestionItem = mInflater.inflate(R.layout.awesomebar_suggestion_item, null);
+                    ((ImageView) suggestionItem.findViewById(R.id.suggestion_magnifier)).setVisibility(View.GONE);
+                    suggestionView.addView(suggestionItem);
+                }
+                ((TextView) suggestionItem.findViewById(R.id.suggestion_text)).setText(suggestion);
+
+                suggestionItem.setOnClickListener(clickListener);
+                suggestionItem.setOnLongClickListener(longClickListener);
+            }
+            
+            // hide extra suggestions that have been recycled
+            for (++i; i < recycledSuggestionCount; i++) {
+                suggestionView.getChildAt(i).setVisibility(View.GONE);
             }
-
-            viewHolder.titleView.setText(name);
-            viewHolder.urlView.setText(searchText);
-            Drawable drawable = getDrawableFromDataURI(iconURI);
-            viewHolder.faviconView.setImageDrawable(drawable);
-            viewHolder.starView.setVisibility(View.GONE);
         }
     };
 
@@ -730,7 +869,7 @@ public class AwesomeBarTabs extends TabHost {
 
         mContext = context;
         mInflated = false;
-        mSearchEngines = new JSONArray();
+        mSearchEngines = new ArrayList<SearchEngine>();
         mContentResolver = context.getContentResolver();
         mContentObserver = null;
         mInflater = (LayoutInflater) mContext.getSystemService(Context.LAYOUT_INFLATER_SERVICE);
@@ -837,7 +976,7 @@ public class AwesomeBarTabs extends TabHost {
 
         allPagesList.setOnItemClickListener(new AdapterView.OnItemClickListener() {
             public void onItemClick(AdapterView<?> parent, View view, int position, long id) {
-                handleItemClick(allPagesList, position);
+                ((AwesomeBarItem) allPagesList.getItemAtPosition(position)).onClick();
             }
         });
 
@@ -928,28 +1067,6 @@ public class AwesomeBarTabs extends TabHost {
             mUrlOpenListener.onUrlOpen(url);
     }
 
-    private void handleItemClick(ListView list, int position) {
-        Object item = list.getItemAtPosition(position);
-        // If an AwesomeBar entry is clicked, item will be a Cursor containing
-        // the entry's data.  Otherwise, a search engine entry was clicked, and
-        // item will be a String containing the name of the search engine.
-        if (item instanceof Cursor) {
-            Cursor cursor = (Cursor) item;
-            String url = cursor.getString(cursor.getColumnIndexOrThrow(URLColumns.URL));
-            if (mUrlOpenListener != null) {
-                int display = cursor.getInt(cursor.getColumnIndexOrThrow(Combined.DISPLAY));
-                if (display == Combined.DISPLAY_READER) {
-                    url = getReaderForUrl(url);
-                }
-
-                mUrlOpenListener.onUrlOpen(url);
-            }
-        } else {
-            if (mUrlOpenListener != null)
-                mUrlOpenListener.onSearch((String)item);
-        }
-    }
-
     private void updateFavicon(ImageView faviconView, Cursor cursor) {
         byte[] b = cursor.getBlob(cursor.getColumnIndexOrThrow(URLColumns.FAVICON));
         if (b == null) {
@@ -1028,10 +1145,98 @@ public class AwesomeBarTabs extends TabHost {
         mAllPagesCursorAdapter.filter(searchTerm);
     }
 
-    public void setSearchEngines(final JSONArray engines) {
+    private Drawable getDrawableFromDataURI(String dataURI) {
+        String base64 = dataURI.substring(dataURI.indexOf(',') + 1);
+        Drawable drawable = null;
+        try {
+            byte[] bytes = GeckoAppShell.decodeBase64(base64, GeckoAppShell.BASE64_DEFAULT);
+            ByteArrayInputStream stream = new ByteArrayInputStream(bytes);
+            drawable = Drawable.createFromStream(stream, "src");
+            stream.close();
+        } catch (IllegalArgumentException e) {
+            Log.i(LOGTAG, "exception while decoding drawable: " + base64, e);
+        } catch (IOException e) { }
+        return drawable;
+    }
+
+    private class SearchEngine {
+        public String name;
+        public Drawable icon;
+        public ArrayList<String> suggestions;
+
+        public SearchEngine(String name) {
+            this(name, null);
+        }
+
+        public SearchEngine(String name, Drawable icon) {
+            this.name = name;
+            this.icon = icon;
+            this.suggestions = new ArrayList<String>();
+        }
+    };
+
+    /**
+     * Sets the suggest engine, which will show suggestions for user-entered queries.
+     * If the suggest engine has already been set, it will be replaced, and its
+     * suggestions will be copied to the new suggest engine.
+     */
+    public void setSuggestEngine(String name, Drawable icon) {
+        // We currently save the suggest engine in shared preferences, so this
+        // method is called immediately when the AwesomeBar is created. It's
+        // called again in setSuggestions(), when the list of search engines is
+        // received from Gecko (in case the suggestion engine has changed).
+        final SearchEngine suggestEngine = new SearchEngine(name, icon);
+        if (mSuggestEngine != null)
+            suggestEngine.suggestions = mSuggestEngine.suggestions;
+
         GeckoAppShell.getMainHandler().post(new Runnable() {
             public void run() {
-                mSearchEngines = engines;
+                mSuggestEngine = suggestEngine;
+                mAllPagesCursorAdapter.notifyDataSetChanged();
+            }
+        });
+    }
+
+    /**
+     * Sets suggestions associated with the current suggest engine.
+     * If there is no suggest engine, this does nothing.
+     */
+    public void setSuggestions(final ArrayList<String> suggestions) {
+        GeckoAppShell.getMainHandler().post(new Runnable() {
+            public void run() {
+                if (mSuggestEngine != null) {
+                    mSuggestEngine.suggestions = suggestions;
+                    mAllPagesCursorAdapter.notifyDataSetChanged();
+                }
+            }
+        });
+    }
+
+    /**
+     * Sets search engines to be shown for user-entered queries.
+     */
+    public void setSearchEngines(String suggestEngine, JSONArray engines) {
+        final ArrayList<SearchEngine> searchEngines = new ArrayList<SearchEngine>();
+        for (int i = 0; i < engines.length(); i++) {
+            try {
+                JSONObject engineJSON = engines.getJSONObject(i);
+                String name = engineJSON.getString("name");
+                String iconURI = engineJSON.getString("iconURI");
+                Drawable icon = getDrawableFromDataURI(iconURI);
+                if (name.equals(suggestEngine)) {
+                    setSuggestEngine(name, icon);
+                } else {
+                    searchEngines.add(new SearchEngine(name, icon));
+                }
+            } catch (JSONException e) {
+                Log.e(LOGTAG, "Error getting search engine JSON", e);
+                return;
+            }
+        }
+
+        GeckoAppShell.getMainHandler().post(new Runnable() {
+            public void run() {
+                mSearchEngines = searchEngines;
                 mAllPagesCursorAdapter.notifyDataSetChanged();
             }
         });
@@ -1043,7 +1248,10 @@ public class AwesomeBarTabs extends TabHost {
 
     @Override
     public boolean onInterceptTouchEvent(MotionEvent ev) {
-        hideSoftInput(this);
+        // we should only have to hide the soft keyboard once - when the user
+        // initially touches the screen
+        if (ev.getAction() == MotionEvent.ACTION_DOWN)
+            hideSoftInput(this);
 
         // the android docs make no sense, but returning false will cause this and other
         // motion events to be sent to the view the user tapped on
diff --git a/mobile/android/base/FlowLayout.java b/mobile/android/base/FlowLayout.java
new file mode 100644
index 000000000000..f68a9bd6889f
--- /dev/null
+++ b/mobile/android/base/FlowLayout.java
@@ -0,0 +1,90 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko;
+
+import android.content.Context;
+import android.content.res.TypedArray;
+import android.util.AttributeSet;
+import android.view.View;
+import android.view.ViewGroup;
+
+public class FlowLayout extends ViewGroup {
+    private static final int DEFAULT_SPACING = 5;
+    private int mSpacing = DEFAULT_SPACING;
+
+    public FlowLayout(Context context) {
+        super(context);
+    }
+
+    public FlowLayout(Context context, AttributeSet attrs) {
+        super(context, attrs);
+        TypedArray a = context.obtainStyledAttributes(attrs, org.mozilla.gecko.R.styleable.FlowLayout);
+        mSpacing = a.getDimensionPixelSize(R.styleable.FlowLayout_spacing, DEFAULT_SPACING);
+        a.recycle();
+    }
+
+    @Override
+    protected void onMeasure(int widthMeasureSpec, int heightMeasureSpec) {
+        final int parentWidth = MeasureSpec.getSize(widthMeasureSpec);
+        final int childCount = getChildCount();
+        int rowWidth = 0;
+        int totalWidth = 0;
+        int totalHeight = 0;
+        boolean firstChild = true;
+
+        for (int i = 0; i < childCount; i++) {
+            final View child = getChildAt(i);
+            if (child.getVisibility() == GONE)
+                continue;
+
+            measureChild(child, widthMeasureSpec, heightMeasureSpec);
+
+            final int childWidth = child.getMeasuredWidth();
+            final int childHeight = child.getMeasuredHeight();
+
+            if (firstChild || (rowWidth + childWidth > parentWidth)) {
+                rowWidth = 0;
+                totalHeight += childHeight;
+                if (!firstChild)
+                    totalHeight += mSpacing;
+                firstChild = false;
+            }
+
+            rowWidth += childWidth;
+
+            if (rowWidth > totalWidth)
+                totalWidth = rowWidth;
+
+            rowWidth += mSpacing;
+        }
+
+        setMeasuredDimension(totalWidth, totalHeight);
+    }
+
+    @Override
+    protected void onLayout(boolean changed, int l, int t, int r, int b) {
+        final int childCount = getChildCount();
+        final int totalWidth = r - l;
+        int x = 0;
+        int y = 0;
+        int prevChildHeight = 0;
+
+        for (int i = 0; i < childCount; i++) {
+            final View child = getChildAt(i);
+            if (child.getVisibility() == GONE)
+                continue;
+
+            final int childWidth = child.getMeasuredWidth();
+            final int childHeight = child.getMeasuredHeight();
+            if (x + childWidth > totalWidth) {
+                x = 0;
+                y += prevChildHeight + mSpacing;
+            }
+            prevChildHeight = childHeight;
+            child.layout(x, y, x + childWidth, y + childHeight);
+            x += childWidth + mSpacing;
+        }
+    }
+}
diff --git a/mobile/android/base/GeckoApp.java b/mobile/android/base/GeckoApp.java
index 7e4444d1db40..e910c2508203 100644
--- a/mobile/android/base/GeckoApp.java
+++ b/mobile/android/base/GeckoApp.java
@@ -167,17 +167,50 @@ abstract public class GeckoApp
 
     String[] getPluginDirectories() {
 
-        // An awful hack to detect Tegra devices. Easiest way to do it without spinning up a EGL context
-        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.HONEYCOMB) {
-            File tegraDriverPath = new File("/system/lib/hw/gralloc.tegra.so");
-            if (tegraDriverPath.exists())
+        // An awful hack to detect Tegra devices. Easiest way to do it without spinning up a EGL context.
+        boolean isTegra = (new File("/system/lib/hw/gralloc.tegra.so")).exists();
+        if (isTegra) {
+            // disable Flash on pre-HC Tegra (bug 703056)
+            if (Build.VERSION.SDK_INT < Build.VERSION_CODES.HONEYCOMB) {
+                Log.w(LOGTAG, "Blocking plugins because of Tegra 2 + Gingerbread bug (bug 703056)");
                 return new String[0];
+            }
+
+            // disable Flash on Tegra ICS with CM9 and other custom firmware (bug 736421)
+            File vfile = new File("/proc/version");
+            FileReader vreader = null;
+            try {
+                if (vfile.canRead()) {
+                    vreader = new FileReader(vfile);
+                    String version = new BufferedReader(vreader).readLine();
+                    if (version.indexOf("CM9") != -1 ||
+                        version.indexOf("cyanogen") != -1 ||
+                        version.indexOf("Nova") != -1)
+                    {
+                        Log.w(LOGTAG, "Blocking plugins because of Tegra 2 + unofficial ICS bug (bug 736421)");
+                        return new String[0];
+                    }
+                }
+            } catch (IOException ex) {
+                // nothing
+            } finally {
+                try {
+                    if (vreader != null) {
+                        vreader.close();
+                    }
+                } catch (IOException ex) {
+                    // nothing
+                }
+            }
         }
 
         // we don't support Honeycomb
         if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.HONEYCOMB &&
             Build.VERSION.SDK_INT < 14 /*Build.VERSION_CODES.ICE_CREAM_SANDWICH*/ )
+        {
+            Log.w(LOGTAG, "Blocking plugins because of Honeycomb");
             return new String[0];
+        }
 
         Log.w(LOGTAG, "zerdatime " + SystemClock.uptimeMillis() + " - start of getPluginDirectories");
 
@@ -474,6 +507,10 @@ abstract public class GeckoApp
 
     @Override
     public void openOptionsMenu() {
+        // Scroll custom menu to the top
+        if (mMenuPanel != null)
+            mMenuPanel.scrollTo(0, 0);
+
         if (!mBrowserToolbar.openOptionsMenu())
             super.openOptionsMenu();
     }
@@ -574,6 +611,10 @@ abstract public class GeckoApp
                 onPreparePanel(featureId, mMenuPanel, sMenu);
             }
 
+            // Scroll custom menu to the top
+            if (mMenuPanel != null)
+                mMenuPanel.scrollTo(0, 0);
+
             return true;
         }
 
diff --git a/mobile/android/base/Makefile.in b/mobile/android/base/Makefile.in
index 955e5080b21c..a200360a9058 100644
--- a/mobile/android/base/Makefile.in
+++ b/mobile/android/base/Makefile.in
@@ -59,6 +59,7 @@ FENNEC_JAVA_FILES = \
   Favicons.java \
   FindInPageBar.java \
   FloatUtils.java \
+  FlowLayout.java \
   FormAssistPopup.java \
   GeckoActionBar.java \
   GeckoApplication.java \
@@ -97,6 +98,7 @@ FENNEC_JAVA_FILES = \
   RemoteTabs.java \
   SetupScreen.java \
   SiteIdentityPopup.java \
+  SuggestClient.java \
   SurfaceBits.java \
   Tab.java \
   Tabs.java \
@@ -253,6 +255,8 @@ RES_LAYOUT = \
   res/layout/awesomebar_folder_row.xml \
   res/layout/awesomebar_header_row.xml \
   res/layout/awesomebar_row.xml \
+  res/layout/awesomebar_suggestion_item.xml \
+  res/layout/awesomebar_suggestion_row.xml \
   res/layout/awesomebar_search.xml \
   res/layout/awesomebar_tab_indicator.xml \
   res/layout/awesomebar_tabs.xml \
@@ -814,6 +818,7 @@ MOZ_ANDROID_DRAWABLES += \
   mobile/android/base/resources/drawable/remote_tabs_group_bg_repeat.xml        \
   mobile/android/base/resources/drawable/start.png                              \
   mobile/android/base/resources/drawable/site_security_level.xml                \
+  mobile/android/base/resources/drawable/suggestion_selector.xml                \
   mobile/android/base/resources/drawable/tabs_button.xml                        \
   mobile/android/base/resources/drawable/tabs_level.xml                         \
   mobile/android/base/resources/drawable/tabs_tray_bg_repeat.xml                \
diff --git a/mobile/android/base/SuggestClient.java b/mobile/android/base/SuggestClient.java
new file mode 100644
index 000000000000..496a6d197da6
--- /dev/null
+++ b/mobile/android/base/SuggestClient.java
@@ -0,0 +1,131 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko;
+
+import org.json.JSONArray;
+
+import android.content.Context;
+import android.net.ConnectivityManager;
+import android.net.NetworkInfo;
+import android.text.TextUtils;
+import android.util.Log;
+
+import java.io.BufferedInputStream;
+import java.io.InputStream;
+import java.io.InterruptedIOException;
+import java.net.HttpURLConnection;
+import java.net.URL;
+import java.net.URLEncoder;
+import java.util.ArrayList;
+
+/**
+ * Use network-based search suggestions.
+ */
+public class SuggestClient {
+    private static final String LOGTAG = "GeckoSuggestClient";
+    private static final String USER_AGENT = GeckoApp.mAppContext.getDefaultUAString();
+
+    private final Context mContext;
+    private final int mTimeout;
+
+    // should contain the string "__searchTerms__", which is replaced with the query
+    private final String mSuggestTemplate;
+
+    // the maximum number of suggestions to return
+    private final int mMaxResults;
+
+    // used by robocop for testing; referenced via reflection
+    private boolean mCheckNetwork;
+
+    public SuggestClient(Context context, String suggestTemplate, int timeout, int maxResults) {
+        mContext = context;
+        mMaxResults = maxResults;
+        mSuggestTemplate = suggestTemplate;
+        mTimeout = timeout;
+        mCheckNetwork = true;
+    }
+
+    public SuggestClient(Context context, String suggestTemplate, int timeout) {
+        this(context, suggestTemplate, timeout, Integer.MAX_VALUE);
+    }
+
+    /**
+     * Queries for a given search term and returns an ArrayList of suggestions.
+     */
+    public ArrayList<String> query(String query) {
+        ArrayList<String> suggestions = new ArrayList<String>();
+        if (TextUtils.isEmpty(mSuggestTemplate) || TextUtils.isEmpty(query)) {
+            return suggestions;
+        }
+
+        if (!isNetworkConnected() && mCheckNetwork) {
+            Log.i(LOGTAG, "Not connected to network");
+            return suggestions;
+        }
+
+        try {
+            String encoded = URLEncoder.encode(query, "UTF-8");
+            String suggestUri = mSuggestTemplate.replace("__searchTerms__", encoded);
+
+            URL url = new URL(suggestUri);
+            String json = null;
+            HttpURLConnection urlConnection = (HttpURLConnection) url.openConnection();
+            try {
+                urlConnection.setConnectTimeout(mTimeout);
+                urlConnection.setRequestProperty("User-Agent", USER_AGENT);
+                InputStream in = new BufferedInputStream(urlConnection.getInputStream());
+                json = convertStreamToString(in);
+            } finally {
+                urlConnection.disconnect();
+            }
+
+            if (json != null) {
+                /*
+                 * Sample result:
+                 * ["foo",["food network","foothill college","foot locker",...]]
+                 */
+                JSONArray results = new JSONArray(json);
+                JSONArray jsonSuggestions = results.getJSONArray(1);
+                
+                int added = 0;
+                for (int i = 0; (i < jsonSuggestions.length()) && (added < mMaxResults); i++) {
+                    String suggestion = jsonSuggestions.getString(i);
+                    if (!suggestion.equalsIgnoreCase(query)) {
+                        suggestions.add(suggestion);
+                        added++;
+                    }
+                }
+            } else {
+                Log.d(LOGTAG, "Suggestion query failed");
+            }
+        } catch (InterruptedIOException e) {
+            Log.d(LOGTAG, "Suggestion query interrupted");
+        } catch (Exception e) {
+            Log.w(LOGTAG, "Error", e);
+        }
+        return suggestions;
+    }
+
+    private boolean isNetworkConnected() {
+        NetworkInfo networkInfo = getActiveNetworkInfo();
+        return networkInfo != null && networkInfo.isConnected();
+    }
+
+    private NetworkInfo getActiveNetworkInfo() {
+        ConnectivityManager connectivity = (ConnectivityManager) mContext
+                .getSystemService(Context.CONNECTIVITY_SERVICE);
+        if (connectivity == null)
+            return null;
+        return connectivity.getActiveNetworkInfo();
+    }
+
+    private String convertStreamToString(java.io.InputStream is) {
+        try {
+            return new java.util.Scanner(is).useDelimiter("\\A").next();
+        } catch (java.util.NoSuchElementException e) {
+            return "";
+        }
+    }
+}
diff --git a/mobile/android/base/android-sync-files.mk b/mobile/android/base/android-sync-files.mk
index ee30eca15385..899ae3066af9 100644
--- a/mobile/android/base/android-sync-files.mk
+++ b/mobile/android/base/android-sync-files.mk
@@ -3,7 +3,7 @@
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 # These files are managed in the android-sync repo. Do not modify directly, or your changes will be lost.
-SYNC_JAVA_FILES := sync/AlreadySyncingException.java sync/CollectionKeys.java sync/CommandProcessor.java sync/CommandRunner.java sync/CredentialsSource.java sync/crypto/CryptoException.java sync/crypto/CryptoInfo.java sync/crypto/HKDF.java sync/crypto/HMACVerificationException.java sync/crypto/KeyBundle.java sync/crypto/MissingCryptoInputException.java sync/crypto/NoKeyBundleException.java sync/crypto/PersistedCrypto5Keys.java sync/CryptoRecord.java sync/DelayedWorkTracker.java sync/delegates/ClientsDataDelegate.java sync/delegates/FreshStartDelegate.java sync/delegates/GlobalSessionCallback.java sync/delegates/InfoCollectionsDelegate.java sync/delegates/KeyUploadDelegate.java sync/delegates/MetaGlobalDelegate.java sync/delegates/WipeServerDelegate.java sync/EngineSettings.java sync/ExtendedJSONObject.java sync/GlobalSession.java sync/HTTPFailureException.java sync/InfoCollections.java sync/jpake/BigIntegerHelper.java sync/jpake/Gx3OrGx4IsZeroOrOneException.java sync/jpake/IncorrectZkpException.java sync/jpake/JPakeClient.java sync/jpake/JPakeCrypto.java sync/jpake/JPakeJson.java sync/jpake/JPakeNoActivePairingException.java sync/jpake/JPakeNumGenerator.java sync/jpake/JPakeNumGeneratorRandom.java sync/jpake/JPakeParty.java sync/jpake/JPakeRequest.java sync/jpake/JPakeRequestDelegate.java sync/jpake/JPakeResponse.java sync/jpake/stage/CompleteStage.java sync/jpake/stage/ComputeFinalStage.java sync/jpake/stage/ComputeKeyVerificationStage.java sync/jpake/stage/ComputeStepOneStage.java sync/jpake/stage/ComputeStepTwoStage.java sync/jpake/stage/DecryptDataStage.java sync/jpake/stage/DeleteChannel.java sync/jpake/stage/GetChannelStage.java sync/jpake/stage/GetRequestStage.java sync/jpake/stage/JPakeStage.java sync/jpake/stage/PutRequestStage.java sync/jpake/stage/VerifyPairingStage.java sync/jpake/Zkp.java sync/KeyBundleProvider.java sync/Logger.java sync/MetaGlobal.java sync/MetaGlobalException.java sync/MetaGlobalMissingEnginesException.java sync/MetaGlobalNotSetException.java sync/middleware/Crypto5MiddlewareRepository.java sync/middleware/Crypto5MiddlewareRepositorySession.java sync/middleware/MiddlewareRepository.java sync/middleware/MiddlewareRepositorySession.java sync/net/BaseResource.java sync/net/CompletedEntity.java sync/net/ConnectionMonitorThread.java sync/net/HandleProgressException.java sync/net/HttpResponseObserver.java sync/net/Resource.java sync/net/ResourceDelegate.java sync/net/SyncResourceDelegate.java sync/net/SyncResponse.java sync/net/SyncStorageCollectionRequest.java sync/net/SyncStorageCollectionRequestDelegate.java sync/net/SyncStorageRecordRequest.java sync/net/SyncStorageRequest.java sync/net/SyncStorageRequestDelegate.java sync/net/SyncStorageRequestIncrementalDelegate.java sync/net/SyncStorageResponse.java sync/net/TLSSocketFactory.java sync/net/WBOCollectionRequestDelegate.java sync/net/WBORequestDelegate.java sync/NoCollectionKeysSetException.java sync/NodeAuthenticationException.java sync/NonArrayJSONException.java sync/NonObjectJSONException.java sync/NullClusterURLException.java sync/PersistedMetaGlobal.java sync/PrefsSource.java sync/receivers/UpgradeReceiver.java sync/repositories/android/AndroidBrowserBookmarksDataAccessor.java sync/repositories/android/AndroidBrowserBookmarksRepository.java sync/repositories/android/AndroidBrowserBookmarksRepositorySession.java sync/repositories/android/AndroidBrowserHistoryDataAccessor.java sync/repositories/android/AndroidBrowserHistoryDataExtender.java sync/repositories/android/AndroidBrowserHistoryRepository.java sync/repositories/android/AndroidBrowserHistoryRepositorySession.java sync/repositories/android/AndroidBrowserRepository.java sync/repositories/android/AndroidBrowserRepositoryDataAccessor.java sync/repositories/android/AndroidBrowserRepositorySession.java sync/repositories/android/BookmarksDeletionManager.java sync/repositories/android/BookmarksInsertionManager.java sync/repositories/android/BrowserContractHelpers.java sync/repositories/android/CachedSQLiteOpenHelper.java sync/repositories/android/ClientsDatabase.java sync/repositories/android/ClientsDatabaseAccessor.java sync/repositories/android/FennecControlHelper.java sync/repositories/android/FennecTabsRepository.java sync/repositories/android/FormHistoryRepositorySession.java sync/repositories/android/PasswordsRepositorySession.java sync/repositories/android/RepoUtils.java sync/repositories/BookmarkNeedsReparentingException.java sync/repositories/BookmarksRepository.java sync/repositories/ConstrainedServer11Repository.java sync/repositories/delegates/DeferrableRepositorySessionCreationDelegate.java sync/repositories/delegates/DeferredRepositorySessionBeginDelegate.java sync/repositories/delegates/DeferredRepositorySessionFetchRecordsDelegate.java sync/repositories/delegates/DeferredRepositorySessionFinishDelegate.java sync/repositories/delegates/DeferredRepositorySessionStoreDelegate.java sync/repositories/delegates/RepositorySessionBeginDelegate.java sync/repositories/delegates/RepositorySessionCleanDelegate.java sync/repositories/delegates/RepositorySessionCreationDelegate.java sync/repositories/delegates/RepositorySessionFetchRecordsDelegate.java sync/repositories/delegates/RepositorySessionFinishDelegate.java sync/repositories/delegates/RepositorySessionGuidsSinceDelegate.java sync/repositories/delegates/RepositorySessionStoreDelegate.java sync/repositories/delegates/RepositorySessionWipeDelegate.java sync/repositories/domain/BookmarkRecord.java sync/repositories/domain/BookmarkRecordFactory.java sync/repositories/domain/ClientRecord.java sync/repositories/domain/ClientRecordFactory.java sync/repositories/domain/FormHistoryRecord.java sync/repositories/domain/HistoryRecord.java sync/repositories/domain/HistoryRecordFactory.java sync/repositories/domain/PasswordRecord.java sync/repositories/domain/Record.java sync/repositories/domain/TabsRecord.java sync/repositories/domain/VersionConstants.java sync/repositories/FetchFailedException.java sync/repositories/HashSetStoreTracker.java sync/repositories/HistoryRepository.java sync/repositories/IdentityRecordFactory.java sync/repositories/InactiveSessionException.java sync/repositories/InvalidBookmarkTypeException.java sync/repositories/InvalidRequestException.java sync/repositories/InvalidSessionTransitionException.java sync/repositories/MultipleRecordsForGuidException.java sync/repositories/NoContentProviderException.java sync/repositories/NoGuidForIdException.java sync/repositories/NoStoreDelegateException.java sync/repositories/NullCursorException.java sync/repositories/ParentNotFoundException.java sync/repositories/ProfileDatabaseException.java sync/repositories/RecordFactory.java sync/repositories/RecordFilter.java sync/repositories/Repository.java sync/repositories/RepositorySession.java sync/repositories/RepositorySessionBundle.java sync/repositories/Server11Repository.java sync/repositories/Server11RepositorySession.java sync/repositories/StoreFailedException.java sync/repositories/StoreTracker.java sync/repositories/StoreTrackingRepositorySession.java sync/Server11PreviousPostFailedException.java sync/Server11RecordPostFailedException.java sync/setup/activities/AccountActivity.java sync/setup/activities/ActivityUtils.java sync/setup/activities/SetupFailureActivity.java sync/setup/activities/SetupSuccessActivity.java sync/setup/activities/SetupSyncActivity.java sync/setup/Constants.java sync/setup/InvalidSyncKeyException.java sync/setup/SyncAccounts.java sync/setup/SyncAuthenticatorService.java sync/stage/AbstractNonRepositorySyncStage.java sync/stage/AndroidBrowserBookmarksServerSyncStage.java sync/stage/AndroidBrowserHistoryServerSyncStage.java sync/stage/CheckPreconditionsStage.java sync/stage/CompletedStage.java sync/stage/EnsureClusterURLStage.java sync/stage/EnsureCrypto5KeysStage.java sync/stage/FennecTabsServerSyncStage.java sync/stage/FetchInfoCollectionsStage.java sync/stage/FetchMetaGlobalStage.java sync/stage/FormHistoryServerSyncStage.java sync/stage/GlobalSyncStage.java sync/stage/NoSuchStageException.java sync/stage/NoSyncIDException.java sync/stage/PasswordsServerSyncStage.java sync/stage/ServerSyncStage.java sync/stage/SyncClientsEngineStage.java sync/stage/UploadMetaGlobalStage.java sync/StubActivity.java sync/syncadapter/SyncAdapter.java sync/syncadapter/SyncService.java sync/SyncConfiguration.java sync/SyncConfigurationException.java sync/SyncException.java sync/synchronizer/ConcurrentRecordConsumer.java sync/synchronizer/RecordConsumer.java sync/synchronizer/RecordsChannel.java sync/synchronizer/RecordsChannelDelegate.java sync/synchronizer/RecordsConsumerDelegate.java sync/synchronizer/SerialRecordConsumer.java sync/synchronizer/ServerLocalSynchronizer.java sync/synchronizer/ServerLocalSynchronizerSession.java sync/synchronizer/SessionNotBegunException.java sync/synchronizer/Synchronizer.java sync/synchronizer/SynchronizerDelegate.java sync/synchronizer/SynchronizerSession.java sync/synchronizer/SynchronizerSessionDelegate.java sync/synchronizer/UnbundleError.java sync/synchronizer/UnexpectedSessionException.java sync/SynchronizerConfiguration.java sync/ThreadPool.java sync/UnexpectedJSONException.java sync/UnknownSynchronizerConfigurationVersionException.java sync/Utils.java
+SYNC_JAVA_FILES := sync/AlreadySyncingException.java sync/CollectionKeys.java sync/CommandProcessor.java sync/CommandRunner.java sync/CredentialsSource.java sync/crypto/CryptoException.java sync/crypto/CryptoInfo.java sync/crypto/HKDF.java sync/crypto/HMACVerificationException.java sync/crypto/KeyBundle.java sync/crypto/MissingCryptoInputException.java sync/crypto/NoKeyBundleException.java sync/crypto/PersistedCrypto5Keys.java sync/CryptoRecord.java sync/DelayedWorkTracker.java sync/delegates/ClientsDataDelegate.java sync/delegates/FreshStartDelegate.java sync/delegates/GlobalSessionCallback.java sync/delegates/InfoCollectionsDelegate.java sync/delegates/KeyUploadDelegate.java sync/delegates/MetaGlobalDelegate.java sync/delegates/WipeServerDelegate.java sync/EngineSettings.java sync/ExtendedJSONObject.java sync/GlobalSession.java sync/HTTPFailureException.java sync/InfoCollections.java sync/jpake/BigIntegerHelper.java sync/jpake/Gx3OrGx4IsZeroOrOneException.java sync/jpake/IncorrectZkpException.java sync/jpake/JPakeClient.java sync/jpake/JPakeCrypto.java sync/jpake/JPakeJson.java sync/jpake/JPakeNoActivePairingException.java sync/jpake/JPakeNumGenerator.java sync/jpake/JPakeNumGeneratorRandom.java sync/jpake/JPakeParty.java sync/jpake/JPakeRequest.java sync/jpake/JPakeRequestDelegate.java sync/jpake/JPakeResponse.java sync/jpake/stage/CompleteStage.java sync/jpake/stage/ComputeFinalStage.java sync/jpake/stage/ComputeKeyVerificationStage.java sync/jpake/stage/ComputeStepOneStage.java sync/jpake/stage/ComputeStepTwoStage.java sync/jpake/stage/DecryptDataStage.java sync/jpake/stage/DeleteChannel.java sync/jpake/stage/GetChannelStage.java sync/jpake/stage/GetRequestStage.java sync/jpake/stage/JPakeStage.java sync/jpake/stage/PutRequestStage.java sync/jpake/stage/VerifyPairingStage.java sync/jpake/Zkp.java sync/KeyBundleProvider.java sync/Logger.java sync/MetaGlobal.java sync/MetaGlobalException.java sync/MetaGlobalMissingEnginesException.java sync/MetaGlobalNotSetException.java sync/middleware/Crypto5MiddlewareRepository.java sync/middleware/Crypto5MiddlewareRepositorySession.java sync/middleware/MiddlewareRepository.java sync/middleware/MiddlewareRepositorySession.java sync/net/BaseResource.java sync/net/CompletedEntity.java sync/net/ConnectionMonitorThread.java sync/net/HandleProgressException.java sync/net/HttpResponseObserver.java sync/net/Resource.java sync/net/ResourceDelegate.java sync/net/SyncResourceDelegate.java sync/net/SyncResponse.java sync/net/SyncStorageCollectionRequest.java sync/net/SyncStorageCollectionRequestDelegate.java sync/net/SyncStorageRecordRequest.java sync/net/SyncStorageRequest.java sync/net/SyncStorageRequestDelegate.java sync/net/SyncStorageRequestIncrementalDelegate.java sync/net/SyncStorageResponse.java sync/net/TLSSocketFactory.java sync/net/WBOCollectionRequestDelegate.java sync/net/WBORequestDelegate.java sync/NoCollectionKeysSetException.java sync/NodeAuthenticationException.java sync/NonArrayJSONException.java sync/NonObjectJSONException.java sync/NullClusterURLException.java sync/PersistedMetaGlobal.java sync/PrefsSource.java sync/receivers/UpgradeReceiver.java sync/repositories/android/AndroidBrowserBookmarksDataAccessor.java sync/repositories/android/AndroidBrowserBookmarksRepository.java sync/repositories/android/AndroidBrowserBookmarksRepositorySession.java sync/repositories/android/AndroidBrowserHistoryDataAccessor.java sync/repositories/android/AndroidBrowserHistoryDataExtender.java sync/repositories/android/AndroidBrowserHistoryRepository.java sync/repositories/android/AndroidBrowserHistoryRepositorySession.java sync/repositories/android/AndroidBrowserRepository.java sync/repositories/android/AndroidBrowserRepositoryDataAccessor.java sync/repositories/android/AndroidBrowserRepositorySession.java sync/repositories/android/BookmarksDeletionManager.java sync/repositories/android/BookmarksInsertionManager.java sync/repositories/android/BrowserContractHelpers.java sync/repositories/android/CachedSQLiteOpenHelper.java sync/repositories/android/ClientsDatabase.java sync/repositories/android/ClientsDatabaseAccessor.java sync/repositories/android/FennecControlHelper.java sync/repositories/android/FennecTabsRepository.java sync/repositories/android/FormHistoryRepositorySession.java sync/repositories/android/PasswordsRepositorySession.java sync/repositories/android/RepoUtils.java sync/repositories/BookmarkNeedsReparentingException.java sync/repositories/BookmarksRepository.java sync/repositories/ConstrainedServer11Repository.java sync/repositories/delegates/DeferrableRepositorySessionCreationDelegate.java sync/repositories/delegates/DeferredRepositorySessionBeginDelegate.java sync/repositories/delegates/DeferredRepositorySessionFetchRecordsDelegate.java sync/repositories/delegates/DeferredRepositorySessionFinishDelegate.java sync/repositories/delegates/DeferredRepositorySessionStoreDelegate.java sync/repositories/delegates/RepositorySessionBeginDelegate.java sync/repositories/delegates/RepositorySessionCleanDelegate.java sync/repositories/delegates/RepositorySessionCreationDelegate.java sync/repositories/delegates/RepositorySessionFetchRecordsDelegate.java sync/repositories/delegates/RepositorySessionFinishDelegate.java sync/repositories/delegates/RepositorySessionGuidsSinceDelegate.java sync/repositories/delegates/RepositorySessionStoreDelegate.java sync/repositories/delegates/RepositorySessionWipeDelegate.java sync/repositories/domain/BookmarkRecord.java sync/repositories/domain/BookmarkRecordFactory.java sync/repositories/domain/ClientRecord.java sync/repositories/domain/ClientRecordFactory.java sync/repositories/domain/FormHistoryRecord.java sync/repositories/domain/HistoryRecord.java sync/repositories/domain/HistoryRecordFactory.java sync/repositories/domain/PasswordRecord.java sync/repositories/domain/Record.java sync/repositories/domain/TabsRecord.java sync/repositories/domain/VersionConstants.java sync/repositories/FetchFailedException.java sync/repositories/HashSetStoreTracker.java sync/repositories/HistoryRepository.java sync/repositories/IdentityRecordFactory.java sync/repositories/InactiveSessionException.java sync/repositories/InvalidBookmarkTypeException.java sync/repositories/InvalidRequestException.java sync/repositories/InvalidSessionTransitionException.java sync/repositories/MultipleRecordsForGuidException.java sync/repositories/NoContentProviderException.java sync/repositories/NoGuidForIdException.java sync/repositories/NoStoreDelegateException.java sync/repositories/NullCursorException.java sync/repositories/ParentNotFoundException.java sync/repositories/ProfileDatabaseException.java sync/repositories/RecordFactory.java sync/repositories/RecordFilter.java sync/repositories/Repository.java sync/repositories/RepositorySession.java sync/repositories/RepositorySessionBundle.java sync/repositories/Server11Repository.java sync/repositories/Server11RepositorySession.java sync/repositories/StoreFailedException.java sync/repositories/StoreTracker.java sync/repositories/StoreTrackingRepositorySession.java sync/Server11PreviousPostFailedException.java sync/Server11RecordPostFailedException.java sync/setup/activities/AccountActivity.java sync/setup/activities/ActivityUtils.java sync/setup/activities/SetupFailureActivity.java sync/setup/activities/SetupSuccessActivity.java sync/setup/activities/SetupSyncActivity.java sync/setup/auth/AccountAuthenticator.java sync/setup/auth/AuthenticateAccountStage.java sync/setup/auth/AuthenticationResult.java sync/setup/auth/AuthenticatorStage.java sync/setup/auth/EnsureUserExistenceStage.java sync/setup/auth/FetchUserNodeStage.java sync/setup/Constants.java sync/setup/InvalidSyncKeyException.java sync/setup/SyncAccounts.java sync/setup/SyncAuthenticatorService.java sync/stage/AbstractNonRepositorySyncStage.java sync/stage/AndroidBrowserBookmarksServerSyncStage.java sync/stage/AndroidBrowserHistoryServerSyncStage.java sync/stage/CheckPreconditionsStage.java sync/stage/CompletedStage.java sync/stage/EnsureClusterURLStage.java sync/stage/EnsureCrypto5KeysStage.java sync/stage/FennecTabsServerSyncStage.java sync/stage/FetchInfoCollectionsStage.java sync/stage/FetchMetaGlobalStage.java sync/stage/FormHistoryServerSyncStage.java sync/stage/GlobalSyncStage.java sync/stage/NoSuchStageException.java sync/stage/NoSyncIDException.java sync/stage/PasswordsServerSyncStage.java sync/stage/ServerSyncStage.java sync/stage/SyncClientsEngineStage.java sync/stage/UploadMetaGlobalStage.java sync/StubActivity.java sync/syncadapter/SyncAdapter.java sync/syncadapter/SyncService.java sync/SyncConfiguration.java sync/SyncConfigurationException.java sync/SyncException.java sync/synchronizer/ConcurrentRecordConsumer.java sync/synchronizer/RecordConsumer.java sync/synchronizer/RecordsChannel.java sync/synchronizer/RecordsChannelDelegate.java sync/synchronizer/RecordsConsumerDelegate.java sync/synchronizer/SerialRecordConsumer.java sync/synchronizer/ServerLocalSynchronizer.java sync/synchronizer/ServerLocalSynchronizerSession.java sync/synchronizer/SessionNotBegunException.java sync/synchronizer/Synchronizer.java sync/synchronizer/SynchronizerDelegate.java sync/synchronizer/SynchronizerSession.java sync/synchronizer/SynchronizerSessionDelegate.java sync/synchronizer/UnbundleError.java sync/synchronizer/UnexpectedSessionException.java sync/SynchronizerConfiguration.java sync/ThreadPool.java sync/UnexpectedJSONException.java sync/UnknownSynchronizerConfigurationVersionException.java sync/Utils.java
 SYNC_PP_JAVA_FILES := sync/GlobalConstants.java
 SYNC_THIRDPARTY_JAVA_FILES := httpclientandroidlib/androidextra/HttpClientAndroidLog.java httpclientandroidlib/annotation/GuardedBy.java httpclientandroidlib/annotation/Immutable.java httpclientandroidlib/annotation/NotThreadSafe.java httpclientandroidlib/annotation/ThreadSafe.java httpclientandroidlib/auth/AUTH.java httpclientandroidlib/auth/AuthenticationException.java httpclientandroidlib/auth/AuthScheme.java httpclientandroidlib/auth/AuthSchemeFactory.java httpclientandroidlib/auth/AuthSchemeRegistry.java httpclientandroidlib/auth/AuthScope.java httpclientandroidlib/auth/AuthState.java httpclientandroidlib/auth/BasicUserPrincipal.java httpclientandroidlib/auth/ContextAwareAuthScheme.java httpclientandroidlib/auth/Credentials.java httpclientandroidlib/auth/InvalidCredentialsException.java httpclientandroidlib/auth/MalformedChallengeException.java httpclientandroidlib/auth/NTCredentials.java httpclientandroidlib/auth/NTUserPrincipal.java httpclientandroidlib/auth/params/AuthParamBean.java httpclientandroidlib/auth/params/AuthParams.java httpclientandroidlib/auth/params/AuthPNames.java httpclientandroidlib/auth/UsernamePasswordCredentials.java httpclientandroidlib/client/AuthCache.java httpclientandroidlib/client/AuthenticationHandler.java httpclientandroidlib/client/CircularRedirectException.java httpclientandroidlib/client/ClientProtocolException.java httpclientandroidlib/client/CookieStore.java httpclientandroidlib/client/CredentialsProvider.java httpclientandroidlib/client/entity/DecompressingEntity.java httpclientandroidlib/client/entity/DeflateDecompressingEntity.java httpclientandroidlib/client/entity/GzipDecompressingEntity.java httpclientandroidlib/client/entity/UrlEncodedFormEntity.java httpclientandroidlib/client/HttpClient.java httpclientandroidlib/client/HttpRequestRetryHandler.java httpclientandroidlib/client/HttpResponseException.java httpclientandroidlib/client/methods/AbortableHttpRequest.java httpclientandroidlib/client/methods/HttpDelete.java httpclientandroidlib/client/methods/HttpEntityEnclosingRequestBase.java httpclientandroidlib/client/methods/HttpGet.java httpclientandroidlib/client/methods/HttpHead.java httpclientandroidlib/client/methods/HttpOptions.java httpclientandroidlib/client/methods/HttpPost.java httpclientandroidlib/client/methods/HttpPut.java httpclientandroidlib/client/methods/HttpRequestBase.java httpclientandroidlib/client/methods/HttpTrace.java httpclientandroidlib/client/methods/HttpUriRequest.java httpclientandroidlib/client/NonRepeatableRequestException.java httpclientandroidlib/client/params/AllClientPNames.java httpclientandroidlib/client/params/AuthPolicy.java httpclientandroidlib/client/params/ClientParamBean.java httpclientandroidlib/client/params/ClientPNames.java httpclientandroidlib/client/params/CookiePolicy.java httpclientandroidlib/client/params/HttpClientParams.java httpclientandroidlib/client/protocol/ClientContext.java httpclientandroidlib/client/protocol/ClientContextConfigurer.java httpclientandroidlib/client/protocol/RequestAcceptEncoding.java httpclientandroidlib/client/protocol/RequestAddCookies.java httpclientandroidlib/client/protocol/RequestAuthCache.java httpclientandroidlib/client/protocol/RequestClientConnControl.java httpclientandroidlib/client/protocol/RequestDefaultHeaders.java httpclientandroidlib/client/protocol/RequestProxyAuthentication.java httpclientandroidlib/client/protocol/RequestTargetAuthentication.java httpclientandroidlib/client/protocol/ResponseAuthCache.java httpclientandroidlib/client/protocol/ResponseContentEncoding.java httpclientandroidlib/client/protocol/ResponseProcessCookies.java httpclientandroidlib/client/RedirectException.java httpclientandroidlib/client/RedirectHandler.java httpclientandroidlib/client/RedirectStrategy.java httpclientandroidlib/client/RequestDirector.java httpclientandroidlib/client/ResponseHandler.java httpclientandroidlib/client/UserTokenHandler.java httpclientandroidlib/client/utils/CloneUtils.java httpclientandroidlib/client/utils/Idn.java httpclientandroidlib/client/utils/JdkIdn.java httpclientandroidlib/client/utils/Punycode.java httpclientandroidlib/client/utils/Rfc3492Idn.java httpclientandroidlib/client/utils/URIUtils.java httpclientandroidlib/client/utils/URLEncodedUtils.java httpclientandroidlib/conn/BasicEofSensorWatcher.java httpclientandroidlib/conn/BasicManagedEntity.java httpclientandroidlib/conn/ClientConnectionManager.java httpclientandroidlib/conn/ClientConnectionManagerFactory.java httpclientandroidlib/conn/ClientConnectionOperator.java httpclientandroidlib/conn/ClientConnectionRequest.java httpclientandroidlib/conn/ConnectionKeepAliveStrategy.java httpclientandroidlib/conn/ConnectionPoolTimeoutException.java httpclientandroidlib/conn/ConnectionReleaseTrigger.java httpclientandroidlib/conn/ConnectTimeoutException.java httpclientandroidlib/conn/EofSensorInputStream.java httpclientandroidlib/conn/EofSensorWatcher.java httpclientandroidlib/conn/HttpHostConnectException.java httpclientandroidlib/conn/HttpRoutedConnection.java httpclientandroidlib/conn/ManagedClientConnection.java httpclientandroidlib/conn/MultihomePlainSocketFactory.java httpclientandroidlib/conn/OperatedClientConnection.java httpclientandroidlib/conn/params/ConnConnectionParamBean.java httpclientandroidlib/conn/params/ConnConnectionPNames.java httpclientandroidlib/conn/params/ConnManagerParamBean.java httpclientandroidlib/conn/params/ConnManagerParams.java httpclientandroidlib/conn/params/ConnManagerPNames.java httpclientandroidlib/conn/params/ConnPerRoute.java httpclientandroidlib/conn/params/ConnPerRouteBean.java httpclientandroidlib/conn/params/ConnRouteParamBean.java httpclientandroidlib/conn/params/ConnRouteParams.java httpclientandroidlib/conn/params/ConnRoutePNames.java httpclientandroidlib/conn/routing/BasicRouteDirector.java httpclientandroidlib/conn/routing/HttpRoute.java httpclientandroidlib/conn/routing/HttpRouteDirector.java httpclientandroidlib/conn/routing/HttpRoutePlanner.java httpclientandroidlib/conn/routing/RouteInfo.java httpclientandroidlib/conn/routing/RouteTracker.java httpclientandroidlib/conn/scheme/HostNameResolver.java httpclientandroidlib/conn/scheme/LayeredSchemeSocketFactory.java httpclientandroidlib/conn/scheme/LayeredSchemeSocketFactoryAdaptor.java httpclientandroidlib/conn/scheme/LayeredSocketFactory.java httpclientandroidlib/conn/scheme/LayeredSocketFactoryAdaptor.java httpclientandroidlib/conn/scheme/PlainSocketFactory.java httpclientandroidlib/conn/scheme/Scheme.java httpclientandroidlib/conn/scheme/SchemeRegistry.java httpclientandroidlib/conn/scheme/SchemeSocketFactory.java httpclientandroidlib/conn/scheme/SchemeSocketFactoryAdaptor.java httpclientandroidlib/conn/scheme/SocketFactory.java httpclientandroidlib/conn/scheme/SocketFactoryAdaptor.java httpclientandroidlib/conn/ssl/AbstractVerifier.java httpclientandroidlib/conn/ssl/AllowAllHostnameVerifier.java httpclientandroidlib/conn/ssl/BrowserCompatHostnameVerifier.java httpclientandroidlib/conn/ssl/SSLSocketFactory.java httpclientandroidlib/conn/ssl/StrictHostnameVerifier.java httpclientandroidlib/conn/ssl/TrustManagerDecorator.java httpclientandroidlib/conn/ssl/TrustSelfSignedStrategy.java httpclientandroidlib/conn/ssl/TrustStrategy.java httpclientandroidlib/conn/ssl/X509HostnameVerifier.java httpclientandroidlib/conn/util/InetAddressUtils.java httpclientandroidlib/ConnectionClosedException.java httpclientandroidlib/ConnectionReuseStrategy.java httpclientandroidlib/cookie/ClientCookie.java httpclientandroidlib/cookie/Cookie.java httpclientandroidlib/cookie/CookieAttributeHandler.java httpclientandroidlib/cookie/CookieIdentityComparator.java httpclientandroidlib/cookie/CookieOrigin.java httpclientandroidlib/cookie/CookiePathComparator.java httpclientandroidlib/cookie/CookieRestrictionViolationException.java httpclientandroidlib/cookie/CookieSpec.java httpclientandroidlib/cookie/CookieSpecFactory.java httpclientandroidlib/cookie/CookieSpecRegistry.java httpclientandroidlib/cookie/MalformedCookieException.java httpclientandroidlib/cookie/params/CookieSpecParamBean.java httpclientandroidlib/cookie/params/CookieSpecPNames.java httpclientandroidlib/cookie/SetCookie.java httpclientandroidlib/cookie/SetCookie2.java httpclientandroidlib/cookie/SM.java httpclientandroidlib/entity/AbstractHttpEntity.java httpclientandroidlib/entity/BasicHttpEntity.java httpclientandroidlib/entity/BufferedHttpEntity.java httpclientandroidlib/entity/ByteArrayEntity.java httpclientandroidlib/entity/ContentLengthStrategy.java httpclientandroidlib/entity/ContentProducer.java httpclientandroidlib/entity/EntityTemplate.java httpclientandroidlib/entity/FileEntity.java httpclientandroidlib/entity/HttpEntityWrapper.java httpclientandroidlib/entity/InputStreamEntity.java httpclientandroidlib/entity/SerializableEntity.java httpclientandroidlib/entity/StringEntity.java httpclientandroidlib/FormattedHeader.java httpclientandroidlib/Header.java httpclientandroidlib/HeaderElement.java httpclientandroidlib/HeaderElementIterator.java httpclientandroidlib/HeaderIterator.java httpclientandroidlib/HttpClientConnection.java httpclientandroidlib/HttpConnection.java httpclientandroidlib/HttpConnectionMetrics.java httpclientandroidlib/HttpEntity.java httpclientandroidlib/HttpEntityEnclosingRequest.java httpclientandroidlib/HttpException.java httpclientandroidlib/HttpHeaders.java httpclientandroidlib/HttpHost.java httpclientandroidlib/HttpInetConnection.java httpclientandroidlib/HttpMessage.java httpclientandroidlib/HttpRequest.java httpclientandroidlib/HttpRequestFactory.java httpclientandroidlib/HttpRequestInterceptor.java httpclientandroidlib/HttpResponse.java httpclientandroidlib/HttpResponseFactory.java httpclientandroidlib/HttpResponseInterceptor.java httpclientandroidlib/HttpServerConnection.java httpclientandroidlib/HttpStatus.java httpclientandroidlib/HttpVersion.java httpclientandroidlib/impl/AbstractHttpClientConnection.java httpclientandroidlib/impl/AbstractHttpServerConnection.java httpclientandroidlib/impl/auth/AuthSchemeBase.java httpclientandroidlib/impl/auth/BasicScheme.java httpclientandroidlib/impl/auth/BasicSchemeFactory.java httpclientandroidlib/impl/auth/DigestScheme.java httpclientandroidlib/impl/auth/DigestSchemeFactory.java httpclientandroidlib/impl/auth/NTLMEngine.java httpclientandroidlib/impl/auth/NTLMEngineException.java httpclientandroidlib/impl/auth/NTLMEngineImpl.java httpclientandroidlib/impl/auth/NTLMScheme.java httpclientandroidlib/impl/auth/NTLMSchemeFactory.java httpclientandroidlib/impl/auth/RFC2617Scheme.java httpclientandroidlib/impl/auth/SpnegoTokenGenerator.java httpclientandroidlib/impl/auth/UnsupportedDigestAlgorithmException.java httpclientandroidlib/impl/client/AbstractAuthenticationHandler.java httpclientandroidlib/impl/client/AbstractHttpClient.java httpclientandroidlib/impl/client/BasicAuthCache.java httpclientandroidlib/impl/client/BasicCookieStore.java httpclientandroidlib/impl/client/BasicCredentialsProvider.java httpclientandroidlib/impl/client/BasicResponseHandler.java httpclientandroidlib/impl/client/ClientParamsStack.java httpclientandroidlib/impl/client/ContentEncodingHttpClient.java httpclientandroidlib/impl/client/DefaultConnectionKeepAliveStrategy.java httpclientandroidlib/impl/client/DefaultHttpClient.java httpclientandroidlib/impl/client/DefaultHttpRequestRetryHandler.java httpclientandroidlib/impl/client/DefaultProxyAuthenticationHandler.java httpclientandroidlib/impl/client/DefaultRedirectHandler.java httpclientandroidlib/impl/client/DefaultRedirectStrategy.java httpclientandroidlib/impl/client/DefaultRedirectStrategyAdaptor.java httpclientandroidlib/impl/client/DefaultRequestDirector.java httpclientandroidlib/impl/client/DefaultTargetAuthenticationHandler.java httpclientandroidlib/impl/client/DefaultUserTokenHandler.java httpclientandroidlib/impl/client/EntityEnclosingRequestWrapper.java httpclientandroidlib/impl/client/RedirectLocations.java httpclientandroidlib/impl/client/RequestWrapper.java httpclientandroidlib/impl/client/RoutedRequest.java httpclientandroidlib/impl/client/TunnelRefusedException.java httpclientandroidlib/impl/conn/AbstractClientConnAdapter.java httpclientandroidlib/impl/conn/AbstractPooledConnAdapter.java httpclientandroidlib/impl/conn/AbstractPoolEntry.java httpclientandroidlib/impl/conn/ConnectionShutdownException.java httpclientandroidlib/impl/conn/DefaultClientConnection.java httpclientandroidlib/impl/conn/DefaultClientConnectionOperator.java httpclientandroidlib/impl/conn/DefaultHttpRoutePlanner.java httpclientandroidlib/impl/conn/DefaultResponseParser.java httpclientandroidlib/impl/conn/HttpInetSocketAddress.java httpclientandroidlib/impl/conn/IdleConnectionHandler.java httpclientandroidlib/impl/conn/LoggingSessionInputBuffer.java httpclientandroidlib/impl/conn/LoggingSessionOutputBuffer.java httpclientandroidlib/impl/conn/ProxySelectorRoutePlanner.java httpclientandroidlib/impl/conn/SchemeRegistryFactory.java httpclientandroidlib/impl/conn/SingleClientConnManager.java httpclientandroidlib/impl/conn/tsccm/AbstractConnPool.java httpclientandroidlib/impl/conn/tsccm/BasicPooledConnAdapter.java httpclientandroidlib/impl/conn/tsccm/BasicPoolEntry.java httpclientandroidlib/impl/conn/tsccm/BasicPoolEntryRef.java httpclientandroidlib/impl/conn/tsccm/ConnPoolByRoute.java httpclientandroidlib/impl/conn/tsccm/PoolEntryRequest.java httpclientandroidlib/impl/conn/tsccm/RefQueueHandler.java httpclientandroidlib/impl/conn/tsccm/RefQueueWorker.java httpclientandroidlib/impl/conn/tsccm/RouteSpecificPool.java httpclientandroidlib/impl/conn/tsccm/ThreadSafeClientConnManager.java httpclientandroidlib/impl/conn/tsccm/WaitingThread.java httpclientandroidlib/impl/conn/tsccm/WaitingThreadAborter.java httpclientandroidlib/impl/conn/Wire.java httpclientandroidlib/impl/cookie/AbstractCookieAttributeHandler.java httpclientandroidlib/impl/cookie/AbstractCookieSpec.java httpclientandroidlib/impl/cookie/BasicClientCookie.java httpclientandroidlib/impl/cookie/BasicClientCookie2.java httpclientandroidlib/impl/cookie/BasicCommentHandler.java httpclientandroidlib/impl/cookie/BasicDomainHandler.java httpclientandroidlib/impl/cookie/BasicExpiresHandler.java httpclientandroidlib/impl/cookie/BasicMaxAgeHandler.java httpclientandroidlib/impl/cookie/BasicPathHandler.java httpclientandroidlib/impl/cookie/BasicSecureHandler.java httpclientandroidlib/impl/cookie/BestMatchSpec.java httpclientandroidlib/impl/cookie/BestMatchSpecFactory.java httpclientandroidlib/impl/cookie/BrowserCompatSpec.java httpclientandroidlib/impl/cookie/BrowserCompatSpecFactory.java httpclientandroidlib/impl/cookie/CookieSpecBase.java httpclientandroidlib/impl/cookie/DateParseException.java httpclientandroidlib/impl/cookie/DateUtils.java httpclientandroidlib/impl/cookie/IgnoreSpec.java httpclientandroidlib/impl/cookie/IgnoreSpecFactory.java httpclientandroidlib/impl/cookie/NetscapeDomainHandler.java httpclientandroidlib/impl/cookie/NetscapeDraftHeaderParser.java httpclientandroidlib/impl/cookie/NetscapeDraftSpec.java httpclientandroidlib/impl/cookie/NetscapeDraftSpecFactory.java httpclientandroidlib/impl/cookie/PublicSuffixFilter.java httpclientandroidlib/impl/cookie/PublicSuffixListParser.java httpclientandroidlib/impl/cookie/RFC2109DomainHandler.java httpclientandroidlib/impl/cookie/RFC2109Spec.java httpclientandroidlib/impl/cookie/RFC2109SpecFactory.java httpclientandroidlib/impl/cookie/RFC2109VersionHandler.java httpclientandroidlib/impl/cookie/RFC2965CommentUrlAttributeHandler.java httpclientandroidlib/impl/cookie/RFC2965DiscardAttributeHandler.java httpclientandroidlib/impl/cookie/RFC2965DomainAttributeHandler.java httpclientandroidlib/impl/cookie/RFC2965PortAttributeHandler.java httpclientandroidlib/impl/cookie/RFC2965Spec.java httpclientandroidlib/impl/cookie/RFC2965SpecFactory.java httpclientandroidlib/impl/cookie/RFC2965VersionAttributeHandler.java httpclientandroidlib/impl/DefaultConnectionReuseStrategy.java httpclientandroidlib/impl/DefaultHttpClientConnection.java httpclientandroidlib/impl/DefaultHttpRequestFactory.java httpclientandroidlib/impl/DefaultHttpResponseFactory.java httpclientandroidlib/impl/DefaultHttpServerConnection.java httpclientandroidlib/impl/EnglishReasonPhraseCatalog.java httpclientandroidlib/impl/entity/EntityDeserializer.java httpclientandroidlib/impl/entity/EntitySerializer.java httpclientandroidlib/impl/entity/LaxContentLengthStrategy.java httpclientandroidlib/impl/entity/StrictContentLengthStrategy.java httpclientandroidlib/impl/HttpConnectionMetricsImpl.java httpclientandroidlib/impl/io/AbstractMessageParser.java httpclientandroidlib/impl/io/AbstractMessageWriter.java httpclientandroidlib/impl/io/AbstractSessionInputBuffer.java httpclientandroidlib/impl/io/AbstractSessionOutputBuffer.java httpclientandroidlib/impl/io/ChunkedInputStream.java httpclientandroidlib/impl/io/ChunkedOutputStream.java httpclientandroidlib/impl/io/ContentLengthInputStream.java httpclientandroidlib/impl/io/ContentLengthOutputStream.java httpclientandroidlib/impl/io/HttpRequestParser.java httpclientandroidlib/impl/io/HttpRequestWriter.java httpclientandroidlib/impl/io/HttpResponseParser.java httpclientandroidlib/impl/io/HttpResponseWriter.java httpclientandroidlib/impl/io/HttpTransportMetricsImpl.java httpclientandroidlib/impl/io/IdentityInputStream.java httpclientandroidlib/impl/io/IdentityOutputStream.java httpclientandroidlib/impl/io/SocketInputBuffer.java httpclientandroidlib/impl/io/SocketOutputBuffer.java httpclientandroidlib/impl/NoConnectionReuseStrategy.java httpclientandroidlib/impl/SocketHttpClientConnection.java httpclientandroidlib/impl/SocketHttpServerConnection.java httpclientandroidlib/io/BufferInfo.java httpclientandroidlib/io/EofSensor.java httpclientandroidlib/io/HttpMessageParser.java httpclientandroidlib/io/HttpMessageWriter.java httpclientandroidlib/io/HttpTransportMetrics.java httpclientandroidlib/io/SessionInputBuffer.java httpclientandroidlib/io/SessionOutputBuffer.java httpclientandroidlib/MalformedChunkCodingException.java httpclientandroidlib/message/AbstractHttpMessage.java httpclientandroidlib/message/BasicHeader.java httpclientandroidlib/message/BasicHeaderElement.java httpclientandroidlib/message/BasicHeaderElementIterator.java httpclientandroidlib/message/BasicHeaderIterator.java httpclientandroidlib/message/BasicHeaderValueFormatter.java httpclientandroidlib/message/BasicHeaderValueParser.java httpclientandroidlib/message/BasicHttpEntityEnclosingRequest.java httpclientandroidlib/message/BasicHttpRequest.java httpclientandroidlib/message/BasicHttpResponse.java httpclientandroidlib/message/BasicLineFormatter.java httpclientandroidlib/message/BasicLineParser.java httpclientandroidlib/message/BasicListHeaderIterator.java httpclientandroidlib/message/BasicNameValuePair.java httpclientandroidlib/message/BasicRequestLine.java httpclientandroidlib/message/BasicStatusLine.java httpclientandroidlib/message/BasicTokenIterator.java httpclientandroidlib/message/BufferedHeader.java httpclientandroidlib/message/HeaderGroup.java httpclientandroidlib/message/HeaderValueFormatter.java httpclientandroidlib/message/HeaderValueParser.java httpclientandroidlib/message/LineFormatter.java httpclientandroidlib/message/LineParser.java httpclientandroidlib/message/ParserCursor.java httpclientandroidlib/MethodNotSupportedException.java httpclientandroidlib/NameValuePair.java httpclientandroidlib/NoHttpResponseException.java httpclientandroidlib/params/AbstractHttpParams.java httpclientandroidlib/params/BasicHttpParams.java httpclientandroidlib/params/CoreConnectionPNames.java httpclientandroidlib/params/CoreProtocolPNames.java httpclientandroidlib/params/DefaultedHttpParams.java httpclientandroidlib/params/HttpAbstractParamBean.java httpclientandroidlib/params/HttpConnectionParamBean.java httpclientandroidlib/params/HttpConnectionParams.java httpclientandroidlib/params/HttpParams.java httpclientandroidlib/params/HttpProtocolParamBean.java httpclientandroidlib/params/HttpProtocolParams.java httpclientandroidlib/params/SyncBasicHttpParams.java httpclientandroidlib/ParseException.java httpclientandroidlib/protocol/BasicHttpContext.java httpclientandroidlib/protocol/BasicHttpProcessor.java httpclientandroidlib/protocol/DefaultedHttpContext.java httpclientandroidlib/protocol/ExecutionContext.java httpclientandroidlib/protocol/HTTP.java httpclientandroidlib/protocol/HttpContext.java httpclientandroidlib/protocol/HttpDateGenerator.java httpclientandroidlib/protocol/HttpExpectationVerifier.java httpclientandroidlib/protocol/HttpProcessor.java httpclientandroidlib/protocol/HttpRequestExecutor.java httpclientandroidlib/protocol/HttpRequestHandler.java httpclientandroidlib/protocol/HttpRequestHandlerRegistry.java httpclientandroidlib/protocol/HttpRequestHandlerResolver.java httpclientandroidlib/protocol/HttpRequestInterceptorList.java httpclientandroidlib/protocol/HttpResponseInterceptorList.java httpclientandroidlib/protocol/HttpService.java httpclientandroidlib/protocol/ImmutableHttpProcessor.java httpclientandroidlib/protocol/RequestConnControl.java httpclientandroidlib/protocol/RequestContent.java httpclientandroidlib/protocol/RequestDate.java httpclientandroidlib/protocol/RequestExpectContinue.java httpclientandroidlib/protocol/RequestTargetHost.java httpclientandroidlib/protocol/RequestUserAgent.java httpclientandroidlib/protocol/ResponseConnControl.java httpclientandroidlib/protocol/ResponseContent.java httpclientandroidlib/protocol/ResponseDate.java httpclientandroidlib/protocol/ResponseServer.java httpclientandroidlib/protocol/SyncBasicHttpContext.java httpclientandroidlib/protocol/UriPatternMatcher.java httpclientandroidlib/ProtocolException.java httpclientandroidlib/ProtocolVersion.java httpclientandroidlib/ReasonPhraseCatalog.java httpclientandroidlib/RequestLine.java httpclientandroidlib/StatusLine.java httpclientandroidlib/TokenIterator.java httpclientandroidlib/TruncatedChunkException.java httpclientandroidlib/UnsupportedHttpVersionException.java httpclientandroidlib/util/ByteArrayBuffer.java httpclientandroidlib/util/CharArrayBuffer.java httpclientandroidlib/util/EncodingUtils.java httpclientandroidlib/util/EntityUtils.java httpclientandroidlib/util/ExceptionUtils.java httpclientandroidlib/util/LangUtils.java httpclientandroidlib/util/VersionInfo.java json-simple/ItemList.java json-simple/JSONArray.java json-simple/JSONAware.java json-simple/JSONObject.java json-simple/JSONStreamAware.java json-simple/JSONValue.java json-simple/parser/ContainerFactory.java json-simple/parser/ContentHandler.java json-simple/parser/JSONParser.java json-simple/parser/ParseException.java json-simple/parser/Yylex.java json-simple/parser/Yytoken.java apache/commons/codec/binary/Base32.java apache/commons/codec/binary/Base32InputStream.java apache/commons/codec/binary/Base32OutputStream.java apache/commons/codec/binary/Base64.java apache/commons/codec/binary/Base64InputStream.java apache/commons/codec/binary/Base64OutputStream.java apache/commons/codec/binary/BaseNCodec.java apache/commons/codec/binary/BaseNCodecInputStream.java apache/commons/codec/binary/BaseNCodecOutputStream.java apache/commons/codec/binary/BinaryCodec.java apache/commons/codec/binary/Hex.java apache/commons/codec/binary/StringUtils.java apache/commons/codec/BinaryDecoder.java apache/commons/codec/BinaryEncoder.java apache/commons/codec/CharEncoding.java apache/commons/codec/Decoder.java apache/commons/codec/DecoderException.java apache/commons/codec/digest/DigestUtils.java apache/commons/codec/Encoder.java apache/commons/codec/EncoderException.java apache/commons/codec/language/AbstractCaverphone.java apache/commons/codec/language/Caverphone.java apache/commons/codec/language/Caverphone1.java apache/commons/codec/language/Caverphone2.java apache/commons/codec/language/ColognePhonetic.java apache/commons/codec/language/DoubleMetaphone.java apache/commons/codec/language/Metaphone.java apache/commons/codec/language/RefinedSoundex.java apache/commons/codec/language/Soundex.java apache/commons/codec/language/SoundexUtils.java apache/commons/codec/net/BCodec.java apache/commons/codec/net/QCodec.java apache/commons/codec/net/QuotedPrintableCodec.java apache/commons/codec/net/RFC1522Codec.java apache/commons/codec/net/URLCodec.java apache/commons/codec/net/Utils.java apache/commons/codec/StringDecoder.java apache/commons/codec/StringEncoder.java apache/commons/codec/StringEncoderComparator.java
 SYNC_RES_DRAWABLE := mobile/android/base/resources/drawable/pin_background.xml mobile/android/base/resources/drawable/sync_ic_launcher.png
diff --git a/mobile/android/base/locales/en-US/android_strings.dtd b/mobile/android/base/locales/en-US/android_strings.dtd
index 98dd4cb1783f..371e00100052 100644
--- a/mobile/android/base/locales/en-US/android_strings.dtd
+++ b/mobile/android/base/locales/en-US/android_strings.dtd
@@ -84,6 +84,7 @@
 <!ENTITY pref_font_size_xlarge "Extra Large">
 <!ENTITY pref_use_master_password "Use master password">
 <!ENTITY pref_sync "Sync">
+<!ENTITY pref_search_suggestions "Show search suggestions">
 
 <!ENTITY quit "Quit">
 
diff --git a/mobile/android/base/locales/en-US/sync_strings.dtd b/mobile/android/base/locales/en-US/sync_strings.dtd
index ee1c3ef00ef4..cb0d69b61a1d 100644
--- a/mobile/android/base/locales/en-US/sync_strings.dtd
+++ b/mobile/android/base/locales/en-US/sync_strings.dtd
@@ -78,4 +78,7 @@
 <!ENTITY sync.notification.oneaccount.label 'Only one &syncBrand.fullName.label; account is supported.'>
 
 <!-- Incorrect settings and changing credentials. -->
+<!ENTITY sync.invalidcreds.label 'Incorrect account name or password.'>
+<!ENTITY sync.invalidserver.label 'Please enter a valid server URL'>
+<!ENTITY sync.verifying.label 'Verifying…'>
 <!ENTITY sync.new.recoverykey.status.incorrect 'Recovery Key incorrect. Please try again.'>
diff --git a/mobile/android/base/resources/drawable/suggestion_selector.xml b/mobile/android/base/resources/drawable/suggestion_selector.xml
new file mode 100644
index 000000000000..99a0034c3f3e
--- /dev/null
+++ b/mobile/android/base/resources/drawable/suggestion_selector.xml
@@ -0,0 +1,36 @@
+<?xml version="1.0" encoding="utf-8"?>
+<selector xmlns:android="http://schemas.android.com/apk/res/android">
+
+    <item android:state_pressed="true">
+        <shape>
+            <solid android:color="@color/suggestion_pressed" />
+
+            <padding android:left="7dp"
+                     android:top="7dp"
+                     android:right="7dp"
+                     android:bottom="7dp" /> 
+           
+            <corners android:bottomRightRadius="4dp"
+                     android:bottomLeftRadius="4dp"
+                     android:topLeftRadius="4dp"
+                     android:topRightRadius="4dp"/> 
+        </shape>
+    </item>
+
+    <item android:state_enabled="true">
+        <shape>
+            <solid android:color="@color/suggestion_primary" />
+
+            <padding android:left="7dp"
+                     android:top="7dp"
+                     android:right="7dp"
+                     android:bottom="7dp" /> 
+           
+            <corners android:bottomRightRadius="4dp"
+                     android:bottomLeftRadius="4dp"
+                     android:topLeftRadius="4dp"
+                     android:topRightRadius="4dp"/> 
+        </shape>
+    </item>
+
+</selector>
diff --git a/mobile/android/base/resources/layout/awesomebar_suggestion_item.xml b/mobile/android/base/resources/layout/awesomebar_suggestion_item.xml
new file mode 100644
index 000000000000..7bc91803692b
--- /dev/null
+++ b/mobile/android/base/resources/layout/awesomebar_suggestion_item.xml
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="utf-8"?>
+<LinearLayout xmlns:android="http://schemas.android.com/apk/res/android"
+              android:layout_width="wrap_content"
+              android:layout_height="wrap_content"
+              android:background="@drawable/suggestion_selector"
+              android:gravity="center_vertical"
+              android:orientation="horizontal">
+
+    <ImageView xmlns:android="http://schemas.android.com/apk/res/android"  
+               android:id="@+id/suggestion_magnifier"
+               android:src="@drawable/ic_awesomebar_search"
+               android:layout_marginRight="3dip"
+               android:layout_width="16dip"
+               android:layout_height="16dip" />
+
+    <TextView xmlns:android="http://schemas.android.com/apk/res/android"  
+              android:id="@+id/suggestion_text"
+              android:layout_width="wrap_content"
+              android:layout_height="wrap_content"
+              android:textColor="?android:attr/textColorPrimary"/>
+
+</LinearLayout>
diff --git a/mobile/android/base/resources/layout/awesomebar_suggestion_row.xml b/mobile/android/base/resources/layout/awesomebar_suggestion_row.xml
new file mode 100644
index 000000000000..8dcab9ab864c
--- /dev/null
+++ b/mobile/android/base/resources/layout/awesomebar_suggestion_row.xml
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="utf-8"?>
+<RelativeLayout xmlns:android="http://schemas.android.com/apk/res/android"
+                android:layout_width="fill_parent"
+                android:layout_height="wrap_content"
+                android:padding="6dip">
+
+    <ImageView android:id="@+id/suggestion_icon"
+               android:layout_width="32dip"
+               android:layout_height="32dip"
+               android:layout_marginRight="10dip"
+               android:minWidth="32dip"
+               android:minHeight="32dip"
+               android:scaleType="fitCenter"/>
+
+    <org.mozilla.gecko.FlowLayout android:id="@+id/suggestion_layout"
+                                  android:layout_toRightOf="@id/suggestion_icon"
+                                  android:layout_width="wrap_content"
+                                  android:layout_height="wrap_content">
+
+        <include layout="@layout/awesomebar_suggestion_item"
+                 android:id="@+id/suggestion_user_entered"/>
+
+    </org.mozilla.gecko.FlowLayout>
+
+</RelativeLayout>
diff --git a/mobile/android/base/resources/layout/sync_account.xml b/mobile/android/base/resources/layout/sync_account.xml
index 1ef2ea0c1423..fda07b8b0ba7 100644
--- a/mobile/android/base/resources/layout/sync_account.xml
+++ b/mobile/android/base/resources/layout/sync_account.xml
@@ -43,6 +43,10 @@
 	  <EditText android:id="@+id/keyInput"
 	    style="@style/SyncEditItem"
 	    android:hint="@string/sync_input_key" />
+
+	  <TextView android:id="@+id/cred_error"
+	    style="@style/SyncTextError"
+	    android:text="@string/sync_invalidcreds_label" />
 	
 	  <CheckBox android:id="@+id/checkbox_server"
 	    android:layout_width="wrap_content"
@@ -56,6 +60,10 @@
 	    android:visibility="gone"
 	    android:hint="@string/sync_input_server" />
 
+	  <TextView android:id="@+id/server_error"
+	    style="@style/SyncTextError"
+	    android:text="@string/sync_invalidserver_label" />
+
 	</LinearLayout>
   </ScrollView>
 
@@ -65,6 +73,7 @@
     android:orientation="horizontal" >
 
     <Button
+      android:id="@+id/accountCancelButton"
       style="@style/SyncButton"
       android:onClick="cancelClickHandler"
       android:text="@string/sync_button_cancel" />
diff --git a/mobile/android/base/resources/layout/sync_setup.xml b/mobile/android/base/resources/layout/sync_setup.xml
index ca44d04fabef..6583a485e30d 100644
--- a/mobile/android/base/resources/layout/sync_setup.xml
+++ b/mobile/android/base/resources/layout/sync_setup.xml
@@ -99,8 +99,7 @@
     style="@style/SyncBottom"
     android:orientation="horizontal" >
     <Button
-      android:layout_width="wrap_content"
-      android:layout_height="wrap_content"
+      style="@style/SyncButton"
       android:onClick="cancelClickHandler"
       android:text="@string/sync_button_cancel" />
   </LinearLayout>
diff --git a/mobile/android/base/resources/layout/sync_setup_failure.xml b/mobile/android/base/resources/layout/sync_setup_failure.xml
index 8f35e092e515..c63622f2da23 100644
--- a/mobile/android/base/resources/layout/sync_setup_failure.xml
+++ b/mobile/android/base/resources/layout/sync_setup_failure.xml
@@ -27,22 +27,17 @@
     android:orientation="horizontal" >
 
     <Button
-      android:layout_width="fill_parent"
-      android:layout_height="wrap_content"
-      android:layout_weight="1"
+      style="@style/SyncButton"
       android:onClick="tryAgainClickHandler"
       android:text="@string/sync_button_tryagain" />
 
     <Button
-      android:layout_width="fill_parent"
-      android:layout_height="wrap_content"
-      android:layout_weight="1"
+      style="@style/SyncButton"
       android:onClick="manualClickHandler"
       android:text="@string/sync_button_manual" />
+
      <Button
-      android:layout_width="fill_parent"
-      android:layout_height="wrap_content"
-      android:layout_weight="1"
+      style="@style/SyncButton"
       android:onClick="cancelClickHandler"
       android:text="@string/sync_button_cancel" />
   </LinearLayout>
diff --git a/mobile/android/base/resources/layout/sync_setup_pair.xml b/mobile/android/base/resources/layout/sync_setup_pair.xml
index 679518729e59..6f645b5588d2 100644
--- a/mobile/android/base/resources/layout/sync_setup_pair.xml
+++ b/mobile/android/base/resources/layout/sync_setup_pair.xml
@@ -66,7 +66,7 @@
         android:visibility="invisible" >
 
         <TextView
-          style="@style/SyncTextItem"
+          style="@style/SyncTextError"
           android:layout_margin="10dp"
           android:text="@string/sync_pair_tryagain"
           android:textSize="10dp" />
diff --git a/mobile/android/base/resources/values/attrs.xml b/mobile/android/base/resources/values/attrs.xml
index a95e944b3ba1..8d245f6faf23 100644
--- a/mobile/android/base/resources/values/attrs.xml
+++ b/mobile/android/base/resources/values/attrs.xml
@@ -23,4 +23,9 @@
         <attr name="showAsAction" format="boolean"/>
     </declare-styleable>
 
+    <declare-styleable name="FlowLayout">
+         <attr name="spacing" format="dimension"/>
+    </declare-styleable>
+
 </resources>
+
diff --git a/mobile/android/base/resources/values/colors.xml b/mobile/android/base/resources/values/colors.xml
index 478718b3e996..8fa047ccfd2e 100644
--- a/mobile/android/base/resources/values/colors.xml
+++ b/mobile/android/base/resources/values/colors.xml
@@ -14,5 +14,7 @@
   <color name="identity_identified">#B7D46A</color>
   <color name="tabs_counter_color">#C7D1DB</color>
   <color name="url_bar_text_highlight">#FF9500</color>
+  <color name="suggestion_primary">#dddddd</color>
+  <color name="suggestion_pressed">#bbbbbb</color>
 </resources>
 
diff --git a/mobile/android/base/resources/values/sync_styles.xml b/mobile/android/base/resources/values/sync_styles.xml
index b4163b011f3d..72d5a27aeadc 100644
--- a/mobile/android/base/resources/values/sync_styles.xml
+++ b/mobile/android/base/resources/values/sync_styles.xml
@@ -28,7 +28,12 @@
     <item name="android:layout_height">wrap_content</item>
     <item name="android:textSize">15dp</item>
   </style>
-  <style name="SyncLinkItem" parent="SyncTextItem">
+  <style name="SyncTextError" parent="@style/SyncTextItem">
+    <item name="android:layout_margin">10dp</item>
+    <item name="android:textSize">15dp</item>
+    <item name="android:visibility">gone</item>
+  </style>
+  <style name="SyncLinkItem" parent="@style/SyncTextItem">
     <item name="android:clickable">true</item>
     <item name="android:textColor">#ACC4D5</item>
   </style>
@@ -43,6 +48,7 @@
     <item name="android:layout_width">fill_parent</item>
     <item name="android:layout_height">wrap_content</item>
     <item name="android:singleLine">true</item>
+    <item name="android:inputType">textNoSuggestions</item>
   </style>
   <style name="SyncEditPin" parent="@style/SyncEditItem">
     <item name="android:layout_width">wrap_content</item>
@@ -66,6 +72,7 @@
     <style name="SyncBottom">
     <item name="android:layout_width">fill_parent</item>
     <item name="android:layout_height">wrap_content</item>
+    <item name="android:layout_gravity">center</item>
     <item name="android:gravity">center</item>
     <item name="android:layout_alignParentBottom">true</item>
     <item name="android:background">@android:drawable/bottom_bar</item>
diff --git a/mobile/android/base/resources/xml/preferences.xml b/mobile/android/base/resources/xml/preferences.xml
index 4be566760299..3bb09c7d26a1 100644
--- a/mobile/android/base/resources/xml/preferences.xml
+++ b/mobile/android/base/resources/xml/preferences.xml
@@ -75,6 +75,11 @@
                             android:defaultValue="false"
                             android:persistent="false" />
 
+        <CheckBoxPreference android:key="browser.search.suggest.enabled"
+                            android:title="@string/pref_search_suggestions"
+                            android:defaultValue="true"
+                            android:persistent="false" />
+
     </PreferenceCategory>
 
 </PreferenceScreen>
diff --git a/mobile/android/base/strings.xml.in b/mobile/android/base/strings.xml.in
index cffd94bd00dc..335436e49315 100644
--- a/mobile/android/base/strings.xml.in
+++ b/mobile/android/base/strings.xml.in
@@ -92,6 +92,7 @@
   <string name="pref_font_size_large">&pref_font_size_large;</string>
   <string name="pref_font_size_xlarge">&pref_font_size_xlarge;</string>
   <string name="pref_sync">&pref_sync;</string>
+  <string name="pref_search_suggestions">&pref_search_suggestions;</string>
 
   <string name="reload">&reload;</string>
   <string name="forward">&forward;</string>
diff --git a/mobile/android/base/sync/jpake/stage/DeleteChannel.java b/mobile/android/base/sync/jpake/stage/DeleteChannel.java
index 624ffc057973..480d7ffceefd 100644
--- a/mobile/android/base/sync/jpake/stage/DeleteChannel.java
+++ b/mobile/android/base/sync/jpake/stage/DeleteChannel.java
@@ -12,6 +12,7 @@ import org.mozilla.gecko.sync.Logger;
 import org.mozilla.gecko.sync.jpake.JPakeClient;
 import org.mozilla.gecko.sync.net.BaseResource;
 import org.mozilla.gecko.sync.net.SyncResourceDelegate;
+import org.mozilla.gecko.sync.setup.auth.AccountAuthenticator;
 
 import ch.boye.httpclientandroidlib.HttpResponse;
 import ch.boye.httpclientandroidlib.client.ClientProtocolException;
@@ -85,7 +86,7 @@ public class DeleteChannel {
       }
     };
 
-    JPakeClient.runOnThread(new Runnable() {
+    AccountAuthenticator.runOnThread(new Runnable() {
       @Override
       public void run() {
         httpResource.delete();
diff --git a/mobile/android/base/sync/setup/Constants.java b/mobile/android/base/sync/setup/Constants.java
index 9238d13147f4..f0f8f10048b3 100644
--- a/mobile/android/base/sync/setup/Constants.java
+++ b/mobile/android/base/sync/setup/Constants.java
@@ -26,6 +26,17 @@ public class Constants {
     Intent.FLAG_ACTIVITY_REORDER_TO_FRONT |
     Intent.FLAG_ACTIVITY_NO_ANIMATION;
 
+  // Constants for Account Authentication.
+  public static final String AUTH_NODE_DEFAULT    = "https://auth.services.mozilla.com/";
+  public static final String AUTH_NODE_PATHNAME   = "user/";
+  public static final String AUTH_NODE_VERSION    = "1.0/";
+  public static final String AUTH_NODE_SUFFIX     = "node/weave";
+  public static final String AUTH_SERVER_VERSION  = "1.1/";
+  public static final String AUTH_SERVER_SUFFIX   = "info/collections/";
+
+  // Account Authentication Errors.
+  public static final String AUTH_ERROR_NOUSER    = "auth.error.badcredentials";
+
   // Links for J-PAKE setup help pages.
   public static final String LINK_FIND_CODE       = "https://support.mozilla.org/kb/find-code-to-add-device-to-firefox-sync";
   public static final String LINK_FIND_ADD_DEVICE = "https://support.mozilla.org/kb/add-a-device-to-firefox-sync";
diff --git a/mobile/android/base/sync/setup/activities/AccountActivity.java b/mobile/android/base/sync/setup/activities/AccountActivity.java
index 8aa85c5975e4..5c99ef818138 100644
--- a/mobile/android/base/sync/setup/activities/AccountActivity.java
+++ b/mobile/android/base/sync/setup/activities/AccountActivity.java
@@ -12,19 +12,22 @@ import org.mozilla.gecko.sync.setup.Constants;
 import org.mozilla.gecko.sync.setup.InvalidSyncKeyException;
 import org.mozilla.gecko.sync.setup.SyncAccounts;
 import org.mozilla.gecko.sync.setup.SyncAccounts.SyncAccountParameters;
+import org.mozilla.gecko.sync.setup.auth.AccountAuthenticator;
+import org.mozilla.gecko.sync.setup.auth.AuthenticationResult;
 
 import android.accounts.Account;
 import android.accounts.AccountAuthenticatorActivity;
 import android.accounts.AccountManager;
+import android.app.ProgressDialog;
 import android.content.Context;
 import android.content.Intent;
 import android.os.Bundle;
 import android.text.Editable;
 import android.text.TextWatcher;
-import android.util.Log;
 import android.view.View;
 import android.view.Window;
 import android.view.WindowManager;
+import android.view.View.OnClickListener;
 import android.widget.Button;
 import android.widget.CheckBox;
 import android.widget.CompoundButton;
@@ -33,14 +36,14 @@ import android.widget.EditText;
 import android.widget.Toast;
 
 public class AccountActivity extends AccountAuthenticatorActivity {
-  private final static String LOG_TAG        = "AccountActivity";
+  private final static String LOG_TAG = "AccountActivity";
 
   private AccountManager      mAccountManager;
   private Context             mContext;
   private String              username;
   private String              password;
   private String              key;
-  private String              server;
+  private String              server = Constants.AUTH_NODE_DEFAULT;
 
   // UI elements.
   private EditText            serverInput;
@@ -49,6 +52,10 @@ public class AccountActivity extends AccountAuthenticatorActivity {
   private EditText            synckeyInput;
   private CheckBox            serverCheckbox;
   private Button              connectButton;
+  private Button              cancelButton;
+  private ProgressDialog      progressDialog;
+
+  private AccountAuthenticator accountAuthenticator;
 
   @Override
   public void onCreate(Bundle savedInstanceState) {
@@ -56,7 +63,7 @@ public class AccountActivity extends AccountAuthenticatorActivity {
     super.onCreate(savedInstanceState);
     setContentView(R.layout.sync_account);
     mContext = getApplicationContext();
-    Log.d(LOG_TAG, "AccountManager.get(" + mContext + ")");
+    Logger.debug(LOG_TAG, "AccountManager.get(" + mContext + ")");
     mAccountManager = AccountManager.get(mContext);
 
     // Set "screen on" flag.
@@ -78,18 +85,20 @@ public class AccountActivity extends AccountAuthenticatorActivity {
     serverInput.addTextChangedListener(inputValidator);
 
     connectButton = (Button) findViewById(R.id.accountConnectButton);
+    cancelButton = (Button) findViewById(R.id.accountCancelButton);
     serverCheckbox = (CheckBox) findViewById(R.id.checkbox_server);
 
     serverCheckbox.setOnCheckedChangeListener(new OnCheckedChangeListener() {
       @Override
       public void onCheckedChanged(CompoundButton buttonView, boolean isChecked) {
-        Log.i(LOG_TAG, "Toggling checkbox: " + isChecked);
-        // Hack for pre-3.0 Android: can enter text into disabled EditText.
+        Logger.info(LOG_TAG, "Toggling checkbox: " + isChecked);
         if (!isChecked) { // Clear server input.
           serverInput.setVisibility(View.GONE);
+          findViewById(R.id.server_error).setVisibility(View.GONE);
           serverInput.setText("");
         } else {
           serverInput.setVisibility(View.VISIBLE);
+          serverInput.setEnabled(true);
         }
         // Activate connectButton if necessary.
         activateView(connectButton, validateInputs());
@@ -98,31 +107,49 @@ public class AccountActivity extends AccountAuthenticatorActivity {
   }
 
   @Override
-  public void onStart() {
-    super.onStart();
-    // Start with an empty form
-    usernameInput.setText("");
-    passwordInput.setText("");
-    synckeyInput.setText("");
-    passwordInput.setText("");
+  public void onResume() {
+    super.onResume();
+    clearCredentials();
+    usernameInput.requestFocus();
+    cancelButton.setOnClickListener(new OnClickListener() {
+
+      @Override
+      public void onClick(View v) {
+        cancelClickHandler(v);
+      }
+
+    });
   }
 
   public void cancelClickHandler(View target) {
     finish();
   }
 
+  public void cancelConnectHandler(View target) {
+    if (accountAuthenticator != null) {
+      accountAuthenticator.isCanceled = true;
+      accountAuthenticator = null;
+    }
+    displayVerifying(false);
+    activateView(connectButton, true);
+    clearCredentials();
+    usernameInput.requestFocus();
+  }
+
+  private void clearCredentials() {
+    // Only clear password. Re-typing the sync key or email is annoying.
+    passwordInput.setText("");
+  }
   /*
    * Get credentials on "Connect" and write to AccountManager, where it can be
    * accessed by Fennec and Sync Service.
    */
   public void connectClickHandler(View target) {
-    Log.d(LOG_TAG, "connectClickHandler for view " + target);
-    enableCredEntry(false);
+    Logger.debug(LOG_TAG, "connectClickHandler for view " + target);
     // Validate sync key format.
     try {
       key = ActivityUtils.validateSyncKey(synckeyInput.getText().toString());
     } catch (InvalidSyncKeyException e) {
-      enableCredEntry(true);
       // Toast: invalid sync key format.
       Toast toast = Toast.makeText(mContext, R.string.sync_new_recoverykey_status_incorrect, Toast.LENGTH_LONG);
       toast.show();
@@ -130,26 +157,42 @@ public class AccountActivity extends AccountAuthenticatorActivity {
     }
     username = usernameInput.getText().toString().toLowerCase(Locale.US);
     password = passwordInput.getText().toString();
+    key      = synckeyInput.getText().toString();
+    server   = Constants.AUTH_NODE_DEFAULT;
+
     if (serverCheckbox.isChecked()) {
-      server = serverInput.getText().toString();
+      String userServer = serverInput.getText().toString();
+      if (userServer != null) {
+        userServer = userServer.trim();
+        if (userServer.length() != 0) {
+          if (!userServer.startsWith("https://") &&
+              !userServer.startsWith("http://")) {
+            // Assume HTTPS if not specified.
+            userServer = "https://" + userServer;
+            serverInput.setText(userServer);
+          }
+          server = userServer;
+        }
+      }
     }
 
-    // TODO : Authenticate with Sync Service, once implemented, with
-    // onAuthSuccess as callback
+    clearErrors();
+    displayVerifying(true);
+    cancelButton.setOnClickListener(new OnClickListener() {
+      @Override
+      public void onClick(View v) {
+        cancelConnectHandler(v);
+        // Set cancel click handler to leave account setup.
+        cancelButton.setOnClickListener(new OnClickListener() {
+          public void onClick(View v) {
+            cancelClickHandler(v);
+          }
+        });
+      }
+    });
 
-    authCallback();
-  }
-
-  /* Helper UI functions */
-  private void enableCredEntry(boolean toEnable) {
-    usernameInput.setEnabled(toEnable);
-    passwordInput.setEnabled(toEnable);
-    synckeyInput.setEnabled(toEnable);
-    if (!toEnable) {
-      serverInput.setEnabled(toEnable);
-    } else {
-      serverInput.setEnabled(serverCheckbox.isChecked());
-    }
+    accountAuthenticator = new AccountAuthenticator(this);
+    accountAuthenticator.authenticate(server, username, password);
   }
 
   private TextWatcher makeInputValidator() {
@@ -185,13 +228,18 @@ public class AccountActivity extends AccountAuthenticatorActivity {
   /*
    * Callback that handles auth based on success/failure
    */
-  private void authCallback() {
-    // Create and add account to AccountManager
-    // TODO: only allow one account to be added?
-    final SyncAccountParameters syncAccount = new SyncAccountParameters(mContext, mAccountManager,
-        username, key, password, server);
+  public void authCallback(final AuthenticationResult result) {
+    displayVerifying(false);
+    if (result != AuthenticationResult.SUCCESS) {
+      Logger.debug(LOG_TAG, "displayFailure()");
+      displayFailure(result);
+      return;
+    }
+    // Successful authentication. Create and add account to AccountManager.
+    final SyncAccountParameters syncAccount = new SyncAccountParameters(
+        mContext, mAccountManager, username, key, password, server);
     final Account account = SyncAccounts.createSyncAccount(syncAccount);
-    final boolean result = (account != null);
+    final boolean accountResult = (account != null);
 
     final Intent intent = new Intent(); // The intent to return.
     intent.putExtra(AccountManager.KEY_ACCOUNT_NAME, syncAccount.username);
@@ -199,39 +247,77 @@ public class AccountActivity extends AccountAuthenticatorActivity {
     intent.putExtra(AccountManager.KEY_AUTHTOKEN, Constants.ACCOUNTTYPE_SYNC);
     setAccountAuthenticatorResult(intent.getExtras());
 
-    if (!result) {
+    if (!accountResult) {
       // Failed to add account!
       setResult(RESULT_CANCELED, intent);
       runOnUiThread(new Runnable() {
         @Override
         public void run() {
-          authFailure();
+          // Use default error.
+          // TODO: Display more accurate error (Account failed to be created).
+          Logger.debug(LOG_TAG, "displayFailure()");
+          displayFailure(result);
         }
       });
       return;
     }
 
-    // TODO: Currently, we do not actually authenticate username/pass against
-    // Moz sync server.
+    clearErrors();
+    if (intent != null) {
+      setAccountAuthenticatorResult(intent.getExtras());
+      setResult(RESULT_OK, intent);
 
-    // Successfully added account.
-    setResult(RESULT_OK, intent);
+      runOnUiThread(new Runnable() {
+        @Override
+        public void run() {
+          authSuccess();
+        }
+      });
+      return;
+    }
+  }
+
+  private void displayVerifying(final boolean isVerifying) {
+    if (isVerifying) {
+      progressDialog = ProgressDialog.show(AccountActivity.this, "", getString(R.string.sync_verifying_label), true);
+    } else {
+      progressDialog.dismiss();
+    }
+  }
+
+  private void displayFailure(final AuthenticationResult result) {
     runOnUiThread(new Runnable() {
       @Override
       public void run() {
-        authSuccess();
+        switch (result) {
+        case FAILURE_USERNAME:
+          // No such username. Don't leak whether the username exists.
+        case FAILURE_PASSWORD:
+          findViewById(R.id.cred_error).setVisibility(View.VISIBLE);
+          usernameInput.requestFocus();
+          break;
+        case FAILURE_SERVER:
+          findViewById(R.id.server_error).setVisibility(View.VISIBLE);
+          serverInput.requestFocus();
+          break;
+        case FAILURE_OTHER:
+        default:
+          // Display default error screen.
+          Logger.debug(LOG_TAG, "displaying default failure.");
+          Intent intent = new Intent(mContext, SetupFailureActivity.class);
+          intent.setFlags(Constants.FLAG_ACTIVITY_REORDER_TO_FRONT_NO_ANIMATION);
+          startActivity(intent);
+        }
       }
     });
+    return;
   }
 
-  private void authFailure() {
-    enableCredEntry(true);
-    Intent intent = new Intent(mContext, SetupFailureActivity.class);
-    intent.setFlags(Constants.FLAG_ACTIVITY_REORDER_TO_FRONT_NO_ANIMATION);
-    startActivity(intent);
-  }
-
-  private void authSuccess() {
+  /**
+   * Feedback to user of account setup success.
+   */
+  public void authSuccess() {
+    // Display feedback of successful account setup.
     Intent intent = new Intent(mContext, SetupSuccessActivity.class);
     intent.setFlags(Constants.FLAG_ACTIVITY_REORDER_TO_FRONT_NO_ANIMATION);
     startActivity(intent);
@@ -242,4 +328,14 @@ public class AccountActivity extends AccountAuthenticatorActivity {
     view.setEnabled(toActivate);
     view.setClickable(toActivate);
   }
+
+  private void clearErrors() {
+    runOnUiThread(new Runnable() {
+      @Override
+      public void run() {
+        findViewById(R.id.cred_error).setVisibility(View.GONE);
+        findViewById(R.id.server_error).setVisibility(View.GONE);
+      }
+    });
+  }
 }
diff --git a/mobile/android/base/sync/setup/activities/SetupFailureActivity.java b/mobile/android/base/sync/setup/activities/SetupFailureActivity.java
index f1c6783a6aee..83af4e4bae7e 100644
--- a/mobile/android/base/sync/setup/activities/SetupFailureActivity.java
+++ b/mobile/android/base/sync/setup/activities/SetupFailureActivity.java
@@ -36,6 +36,7 @@ public class SetupFailureActivity extends Activity {
 
   public void cancelClickHandler(View target) {
     setResult(RESULT_CANCELED);
+    moveTaskToBack(true);
     finish();
   }
 }
diff --git a/mobile/android/base/sync/setup/auth/AccountAuthenticator.java b/mobile/android/base/sync/setup/auth/AccountAuthenticator.java
new file mode 100644
index 000000000000..af41ccdd10c8
--- /dev/null
+++ b/mobile/android/base/sync/setup/auth/AccountAuthenticator.java
@@ -0,0 +1,108 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko.sync.setup.auth;
+
+import java.util.LinkedList;
+import java.util.Queue;
+
+import org.mozilla.gecko.sync.Logger;
+import org.mozilla.gecko.sync.ThreadPool;
+import org.mozilla.gecko.sync.crypto.KeyBundle;
+import org.mozilla.gecko.sync.setup.activities.AccountActivity;
+
+import android.util.Log;
+
+public class AccountAuthenticator {
+  private final String LOG_TAG = "AccountAuthenticator";
+
+  private AccountActivity activityCallback;
+  private Queue<AuthenticatorStage> stages;
+
+  // Values for authentication.
+  public String password;
+  public String username;
+
+  public String authServer;
+  public String nodeServer;
+
+  public boolean isSuccess = false;
+  public boolean isCanceled = false;
+
+  public AccountAuthenticator(AccountActivity activity) {
+    activityCallback = activity;
+    prepareStages();
+  }
+
+  private void prepareStages() {
+    stages = new LinkedList<AuthenticatorStage>();
+    stages.add(new EnsureUserExistenceStage());
+    stages.add(new FetchUserNodeStage());
+    stages.add(new AuthenticateAccountStage());
+  }
+
+  public void authenticate(String server, String account, String password) {
+    // Set authentication values.
+    if (!server.endsWith("/")) {
+      server += "/";
+    }
+    nodeServer = server;
+    this.password = password;
+
+    // Calculate and save username hash.
+    try {
+      username = KeyBundle.usernameFromAccount(account);
+    } catch (Exception e) {
+      abort(AuthenticationResult.FAILURE_OTHER, e);
+      return;
+    }
+    Logger.debug(LOG_TAG, "username:" + username);
+
+    Log.d(LOG_TAG, "running first stage.");
+    // Start first stage of authentication.
+    runNextStage();
+  }
+
+  /**
+   * Run next stage of authentication.
+   */
+  public void runNextStage() {
+    if (isCanceled) {
+      return;
+    }
+    if (stages.size() == 0) {
+      Logger.debug(LOG_TAG, "Authentication completed.");
+      activityCallback.authCallback(isSuccess ? AuthenticationResult.SUCCESS : AuthenticationResult.FAILURE_PASSWORD);
+      return;
+    }
+    AuthenticatorStage nextStage = stages.remove();
+    try {
+      nextStage.execute(this);
+    } catch (Exception e) {
+      Logger.warn(LOG_TAG, "Unhandled exception in stage " + nextStage);
+      abort(AuthenticationResult.FAILURE_OTHER, e);
+    }
+  }
+
+  /**
+   * Abort authentication.
+   *
+   * @param e
+   *    Exception causing abort.
+   * @param reason
+   *    Reason for abort.
+   */
+  public void abort(AuthenticationResult result, Exception e) {
+    if (isCanceled) {
+      return;
+    }
+    Logger.warn(LOG_TAG, "Authentication failed.", e);
+    activityCallback.authCallback(result);
+  }
+
+  /* Helper functions */
+  public static void runOnThread(Runnable run) {
+    ThreadPool.run(run);
+  }
+}
diff --git a/mobile/android/base/sync/setup/auth/AuthenticateAccountStage.java b/mobile/android/base/sync/setup/auth/AuthenticateAccountStage.java
new file mode 100644
index 000000000000..979ebf76399d
--- /dev/null
+++ b/mobile/android/base/sync/setup/auth/AuthenticateAccountStage.java
@@ -0,0 +1,175 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko.sync.setup.auth;
+
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.InputStreamReader;
+import java.io.UnsupportedEncodingException;
+import java.net.URI;
+import java.net.URISyntaxException;
+import java.security.GeneralSecurityException;
+
+import org.mozilla.apache.commons.codec.binary.Base64;
+import org.mozilla.gecko.sync.GlobalConstants;
+import org.mozilla.gecko.sync.Logger;
+import org.mozilla.gecko.sync.net.BaseResource;
+import org.mozilla.gecko.sync.net.SyncResourceDelegate;
+import org.mozilla.gecko.sync.setup.Constants;
+
+import ch.boye.httpclientandroidlib.HttpResponse;
+import ch.boye.httpclientandroidlib.client.ClientProtocolException;
+import ch.boye.httpclientandroidlib.client.methods.HttpRequestBase;
+import ch.boye.httpclientandroidlib.impl.client.DefaultHttpClient;
+import ch.boye.httpclientandroidlib.message.BasicHeader;
+
+public class AuthenticateAccountStage implements AuthenticatorStage {
+  private final String LOG_TAG = "AuthAccountStage";
+  private HttpRequestBase httpRequest = null;
+
+  public interface AuthenticateAccountStageDelegate {
+    public void handleSuccess(boolean isSuccess);
+    public void handleFailure(HttpResponse response);
+    public void handleError(Exception e);
+  }
+
+  @Override
+  public void execute(final AccountAuthenticator aa) throws URISyntaxException, UnsupportedEncodingException {
+    AuthenticateAccountStageDelegate callbackDelegate = new AuthenticateAccountStageDelegate() {
+
+      @Override
+      public void handleSuccess(boolean isSuccess) {
+        aa.isSuccess = isSuccess;
+        aa.runNextStage();
+      }
+
+      @Override
+      public void handleFailure(HttpResponse response) {
+        Logger.debug(LOG_TAG, "handleFailure");
+        aa.abort(AuthenticationResult.FAILURE_OTHER, new Exception(response.getStatusLine().getStatusCode() + " error."));
+        if (response.getEntity() == null) {
+          // No cleanup necessary.
+          return;
+        }
+        try {
+          BufferedReader reader = new BufferedReader(new InputStreamReader(response.getEntity().getContent(), "UTF-8"));
+          Logger.warn(LOG_TAG, "content: " + reader.readLine());
+          BaseResource.consumeReader(reader);
+        } catch (IllegalStateException e) {
+          Logger.debug(LOG_TAG, "Error reading content.", e);
+        } catch (RuntimeException e) {
+          Logger.debug(LOG_TAG, "Unexpected exception.", e);
+          if (httpRequest != null) {
+            httpRequest.abort();
+          }
+        } catch (IOException e) {
+          Logger.debug(LOG_TAG, "Error reading content.", e);
+        }
+      }
+
+      @Override
+      public void handleError(Exception e) {
+        Logger.debug(LOG_TAG, "handleError", e);
+        aa.abort(AuthenticationResult.FAILURE_OTHER, e);
+      }
+    };
+
+    // Calculate BasicAuth hash of username/password.
+    String authHeader = makeAuthHeader(aa.username, aa.password);
+    String authRequestUrl = makeAuthRequestUrl(aa.authServer, aa.username);
+    Logger.trace(LOG_TAG, "Making auth request to: " + authRequestUrl);
+    authenticateAccount(callbackDelegate, authRequestUrl, authHeader);
+
+  }
+
+  /**
+   * Makes an authentication request to the server and passes appropriate response back to callback.
+   * @param callbackDelegate
+   *        Delegate to deal with HTTP response.
+   * @param authRequestUrl
+   * @param authHeader
+   * @throws URISyntaxException
+   */
+  // Made public for testing.
+  public void authenticateAccount(final AuthenticateAccountStageDelegate callbackDelegate, final String authRequestUrl, final String authHeader) throws URISyntaxException {
+    final BaseResource httpResource = new BaseResource(authRequestUrl);
+    httpResource.delegate = new SyncResourceDelegate(httpResource) {
+
+      @Override
+      public void addHeaders(HttpRequestBase request, DefaultHttpClient client) {
+        // Make reference to request, to abort if necessary.
+        httpRequest = request;
+        client.log.enableDebug(true);
+        request.setHeader(new BasicHeader("User-Agent", GlobalConstants.USER_AGENT));
+        // Host header is not set for some reason, so do it explicitly.
+        try {
+          URI authServerUri = new URI(authRequestUrl);
+          request.setHeader(new BasicHeader("Host", authServerUri.getHost()));
+        } catch (URISyntaxException e) {
+          Logger.error(LOG_TAG, "Malformed uri, will be caught elsewhere.", e);
+        }
+        request.setHeader(new BasicHeader("Authorization", authHeader));
+      }
+
+      @Override
+      public void handleHttpResponse(HttpResponse response) {
+        int statusCode = response.getStatusLine().getStatusCode();
+        try {
+          switch (statusCode) {
+          case 200:
+            callbackDelegate.handleSuccess(true);
+            break;
+          case 401:
+            callbackDelegate.handleSuccess(false);
+            break;
+          default:
+            callbackDelegate.handleFailure(response);
+          }
+        } finally {
+          BaseResource.consumeEntity(response.getEntity());
+          Logger.info(LOG_TAG, "Released entity.");
+        }
+      }
+
+      @Override
+      public void handleHttpProtocolException(ClientProtocolException e) {
+        Logger.error(LOG_TAG, "Client protocol error.", e);
+        callbackDelegate.handleError(e);
+      }
+
+      @Override
+      public void handleHttpIOException(IOException e) {
+        Logger.error(LOG_TAG, "I/O exception.");
+        callbackDelegate.handleError(e);
+      }
+
+      @Override
+      public void handleTransportException(GeneralSecurityException e) {
+        Logger.error(LOG_TAG, "Transport exception.");
+        callbackDelegate.handleError(e);
+      }
+    };
+
+    AccountAuthenticator.runOnThread(new Runnable() {
+      @Override
+      public void run() {
+        httpResource.get();
+      }
+    });
+  }
+
+  public String makeAuthHeader(String usernameHash, String password) {
+    try {
+      return "Basic " + Base64.encodeBase64String((usernameHash + ":" + password).getBytes("UTF-8"));
+    } catch (UnsupportedEncodingException e) {
+      Logger.debug(LOG_TAG, "Unsupported encoding: UTF-8.");
+      return null;
+    }
+  }
+
+  public String makeAuthRequestUrl(String authServer, String usernameHash) {
+    return authServer + Constants.AUTH_SERVER_VERSION + usernameHash + "/" + Constants.AUTH_SERVER_SUFFIX;
+  }
+}
diff --git a/mobile/android/base/sync/setup/auth/AuthenticationResult.java b/mobile/android/base/sync/setup/auth/AuthenticationResult.java
new file mode 100644
index 000000000000..860a1e0d5749
--- /dev/null
+++ b/mobile/android/base/sync/setup/auth/AuthenticationResult.java
@@ -0,0 +1,9 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko.sync.setup.auth;
+
+public enum AuthenticationResult {
+  SUCCESS, FAILURE_USERNAME, FAILURE_PASSWORD, FAILURE_SERVER, FAILURE_OTHER
+}
diff --git a/mobile/android/base/sync/setup/auth/AuthenticatorStage.java b/mobile/android/base/sync/setup/auth/AuthenticatorStage.java
new file mode 100644
index 000000000000..e23004e252e7
--- /dev/null
+++ b/mobile/android/base/sync/setup/auth/AuthenticatorStage.java
@@ -0,0 +1,12 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko.sync.setup.auth;
+
+import java.io.UnsupportedEncodingException;
+import java.net.URISyntaxException;
+
+public interface AuthenticatorStage {
+  public void execute(AccountAuthenticator aa) throws URISyntaxException, UnsupportedEncodingException;
+}
diff --git a/mobile/android/base/sync/setup/auth/EnsureUserExistenceStage.java b/mobile/android/base/sync/setup/auth/EnsureUserExistenceStage.java
new file mode 100644
index 000000000000..dba1f7454aa8
--- /dev/null
+++ b/mobile/android/base/sync/setup/auth/EnsureUserExistenceStage.java
@@ -0,0 +1,117 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko.sync.setup.auth;
+
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.io.UnsupportedEncodingException;
+import java.net.URISyntaxException;
+import java.security.GeneralSecurityException;
+
+import org.mozilla.gecko.sync.Logger;
+import org.mozilla.gecko.sync.net.BaseResource;
+import org.mozilla.gecko.sync.net.SyncResourceDelegate;
+import org.mozilla.gecko.sync.setup.Constants;
+
+import android.util.Log;
+import ch.boye.httpclientandroidlib.HttpResponse;
+import ch.boye.httpclientandroidlib.client.ClientProtocolException;
+
+public class EnsureUserExistenceStage implements AuthenticatorStage {
+  private final String LOG_TAG = "EnsureUserExistence";
+
+  public interface EnsureUserExistenceStageDelegate {
+    public void handleSuccess();
+    public void handleFailure(AuthenticationResult result);
+    public void handleError(Exception e);
+  }
+  @Override
+  public void execute(final AccountAuthenticator aa) throws URISyntaxException,
+      UnsupportedEncodingException {
+    final EnsureUserExistenceStageDelegate callbackDelegate = new EnsureUserExistenceStageDelegate() {
+
+      @Override
+      public void handleSuccess() {
+        // User exists; now determine auth node.
+        Log.d(LOG_TAG, "handleSuccess()");
+        aa.runNextStage();
+      }
+
+      @Override
+      public void handleFailure(AuthenticationResult result) {
+        aa.abort(result, new Exception("Failure in EnsureUser"));
+      }
+
+      @Override
+      public void handleError(Exception e) {
+        Logger.info(LOG_TAG, "Error checking for user existence.");
+        aa.abort(AuthenticationResult.FAILURE_SERVER, e);
+      }
+
+    };
+
+    String userRequestUrl = aa.nodeServer + Constants.AUTH_NODE_PATHNAME + Constants.AUTH_NODE_VERSION + aa.username;
+    final BaseResource httpResource = new BaseResource(userRequestUrl);
+    httpResource.delegate = new SyncResourceDelegate(httpResource) {
+
+      @Override
+      public void handleHttpResponse(HttpResponse response) {
+        int statusCode = response.getStatusLine().getStatusCode();
+        switch(statusCode) {
+        case 200:
+          try {
+            InputStream content = response.getEntity().getContent();
+            BufferedReader reader = new BufferedReader(new InputStreamReader(content, "UTF-8"), 1024);
+            String inUse = reader.readLine();
+            BaseResource.consumeReader(reader);
+            reader.close();
+            // Removed Logger.debug inUse, because stalling.
+            if (inUse.equals("1")) { // Username exists.
+              callbackDelegate.handleSuccess();
+            } else { // User does not exist.
+              Logger.info(LOG_TAG, "No such user.");
+              callbackDelegate.handleFailure(AuthenticationResult.FAILURE_USERNAME);
+            }
+          } catch (Exception e) {
+            Logger.error(LOG_TAG, "Failure in content parsing.", e);
+            callbackDelegate.handleFailure(AuthenticationResult.FAILURE_OTHER);
+          }
+          break;
+        default: // No other response is acceptable.
+          callbackDelegate.handleFailure(AuthenticationResult.FAILURE_OTHER);
+        }
+        Logger.debug(LOG_TAG, "Consuming entity.");
+        BaseResource.consumeEntity(response.getEntity());
+      }
+
+      @Override
+      public void handleHttpProtocolException(ClientProtocolException e) {
+        callbackDelegate.handleError(e);
+      }
+
+      @Override
+      public void handleHttpIOException(IOException e) {
+        callbackDelegate.handleError(e);
+      }
+
+      @Override
+      public void handleTransportException(GeneralSecurityException e) {
+        callbackDelegate.handleError(e);
+      }
+
+    };
+    // Make request.
+    AccountAuthenticator.runOnThread(new Runnable() {
+
+      @Override
+      public void run() {
+        httpResource.get();
+      }
+    });
+  }
+
+}
diff --git a/mobile/android/base/sync/setup/auth/FetchUserNodeStage.java b/mobile/android/base/sync/setup/auth/FetchUserNodeStage.java
new file mode 100644
index 000000000000..f4952bd4fbb4
--- /dev/null
+++ b/mobile/android/base/sync/setup/auth/FetchUserNodeStage.java
@@ -0,0 +1,126 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko.sync.setup.auth;
+
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.net.URISyntaxException;
+import java.security.GeneralSecurityException;
+
+import org.mozilla.gecko.sync.Logger;
+import org.mozilla.gecko.sync.net.BaseResource;
+import org.mozilla.gecko.sync.net.SyncResourceDelegate;
+import org.mozilla.gecko.sync.setup.Constants;
+
+import ch.boye.httpclientandroidlib.HttpResponse;
+import ch.boye.httpclientandroidlib.client.ClientProtocolException;
+
+public class FetchUserNodeStage implements AuthenticatorStage {
+  private final String LOG_TAG = "FetchUserNodeStage";
+
+  public interface FetchNodeStageDelegate {
+    public void handleSuccess(String url);
+    public void handleFailure(HttpResponse response);
+    public void handleError(Exception e);
+  }
+
+  @Override
+  public void execute(final AccountAuthenticator aa) throws URISyntaxException {
+
+    FetchNodeStageDelegate callbackDelegate = new FetchNodeStageDelegate() {
+
+      @Override
+      public void handleSuccess(String server) {
+        if (server == null) { // No separate auth node; use server url.
+          Logger.debug(LOG_TAG, "Using server as auth node.");
+          aa.authServer = aa.nodeServer;
+          aa.runNextStage();
+          return;
+        }
+        if (!server.endsWith("/")) {
+          server += "/";
+        }
+        aa.authServer = server;
+        aa.runNextStage();
+      }
+
+      @Override
+      public void handleFailure(HttpResponse response) {
+        int statusCode = response.getStatusLine().getStatusCode();
+        Logger.debug(LOG_TAG, "Failed to fetch user node, with status " + statusCode);
+        aa.abort(AuthenticationResult.FAILURE_OTHER, new Exception("HTTP " + statusCode + " error."));
+      }
+
+      @Override
+      public void handleError(Exception e) {
+        Logger.debug(LOG_TAG, "Error in fetching node.");
+        aa.abort(AuthenticationResult.FAILURE_OTHER, e);
+      }
+    };
+    String nodeRequestUrl = aa.nodeServer + Constants.AUTH_NODE_PATHNAME + Constants.AUTH_NODE_VERSION + aa.username + "/" + Constants.AUTH_NODE_SUFFIX;
+    Logger.debug(LOG_TAG, "nodeUrl: " + nodeRequestUrl);
+    final BaseResource httpResource = makeFetchNodeRequest(callbackDelegate, nodeRequestUrl);
+    // Make request on separate thread.
+    AccountAuthenticator.runOnThread(new Runnable() {
+      @Override
+      public void run() {
+        httpResource.get();
+      }
+    });
+  }
+
+  private BaseResource makeFetchNodeRequest(final FetchNodeStageDelegate callbackDelegate, String fetchNodeUrl) throws URISyntaxException {
+    // Fetch node containing user.
+    final BaseResource httpResource = new BaseResource(fetchNodeUrl);
+    httpResource.delegate = new SyncResourceDelegate(httpResource) {
+
+      @Override
+      public void handleHttpResponse(HttpResponse response) {
+        int statusCode = response.getStatusLine().getStatusCode();
+        switch(statusCode) {
+        case 200:
+          try {
+            InputStream content = response.getEntity().getContent();
+            BufferedReader reader = new BufferedReader(new InputStreamReader(content, "UTF-8"), 1024);
+            String server = reader.readLine();
+            callbackDelegate.handleSuccess(server);
+            BaseResource.consumeReader(reader);
+            reader.close();
+          } catch (IllegalStateException e) {
+            callbackDelegate.handleError(e);
+          } catch (IOException e) {
+            callbackDelegate.handleError(e);
+          }
+          break;
+        case 404: // Does not support auth nodes, use server instead.
+          callbackDelegate.handleSuccess(null);
+          break;
+        default:
+          // No other acceptable states.
+          callbackDelegate.handleFailure(response);
+        }
+        BaseResource.consumeEntity(response.getEntity());
+      }
+
+      @Override
+      public void handleHttpProtocolException(ClientProtocolException e) {
+        callbackDelegate.handleError(e);
+      }
+
+      @Override
+      public void handleHttpIOException(IOException e) {
+        callbackDelegate.handleError(e);
+      }
+
+      @Override
+      public void handleTransportException(GeneralSecurityException e) {
+        callbackDelegate.handleError(e);
+      }
+    };
+    return httpResource;
+  }
+}
\ No newline at end of file
diff --git a/mobile/android/base/tests/BaseTest.java.in b/mobile/android/base/tests/BaseTest.java.in
index 7674ee25cec9..c0b4f175ac7e 100644
--- a/mobile/android/base/tests/BaseTest.java.in
+++ b/mobile/android/base/tests/BaseTest.java.in
@@ -32,6 +32,7 @@ abstract class BaseTest extends ActivityInstrumentationTestCase2<Activity> {
     protected Assert mAsserter;
     protected Actions mActions;
     protected String mBaseUrl;
+    protected String mRawBaseUrl;
     private String mTestType;
     private String mLogFile;
     protected String mProfile;
@@ -70,6 +71,7 @@ abstract class BaseTest extends ActivityInstrumentationTestCase2<Activity> {
 
         mLogFile = (String)config.get("logfile");
         mBaseUrl = ((String)config.get("host")).replaceAll("(/$)", "");
+        mRawBaseUrl = ((String)config.get("rawhost")).replaceAll("(/$)", "");
     }
 
     public void setTestType(String type) {
@@ -172,6 +174,10 @@ abstract class BaseTest extends ActivityInstrumentationTestCase2<Activity> {
         return mBaseUrl + "/" + url.replaceAll("(^/)", "");
     }
 
+    protected final String getAbsoluteRawUrl(String url) {
+        return mRawBaseUrl + "/" + url.replaceAll("(^/)", "");
+    }
+
     protected final boolean waitForTest(BooleanTest t, int timeout) {
         long end = SystemClock.uptimeMillis() + timeout;
         while (SystemClock.uptimeMillis() < end) {
diff --git a/mobile/android/base/tests/robocop.ini b/mobile/android/base/tests/robocop.ini
index d14209d505c8..162136f4564b 100644
--- a/mobile/android/base/tests/robocop.ini
+++ b/mobile/android/base/tests/robocop.ini
@@ -14,6 +14,7 @@
 [testPasswordEncrypt]
 [testFormHistory]
 [testBrowserProvider]
+[testSearchSuggestions]
 # [testPermissions] # see bug 757475
 # [testJarReader] # see bug 738890
 
diff --git a/mobile/android/base/tests/robocop_suggestions.sjs b/mobile/android/base/tests/robocop_suggestions.sjs
new file mode 100644
index 000000000000..2621288d91ee
--- /dev/null
+++ b/mobile/android/base/tests/robocop_suggestions.sjs
@@ -0,0 +1,32 @@
+/**
+ * Used with testSearchSuggestions.
+ * Returns a set of pre-defined suggestions for given prefixes.
+ */
+
+function handleRequest(request, response) {
+  let query = request.queryString.match(/^query=(.*)$/)[1];
+  query = decodeURIComponent(query).replace(/\+/g, " ");
+
+  let suggestMap = {
+    "f":       ["facebook", "fandango", "frys", "forever 21", "fafsa"],
+    "fo":      ["forever 21", "food network", "fox news", "foothill college", "fox"],
+    "foo":     ["food network", "foothill college", "foot locker", "footloose", "foo fighters"],
+    "foo ":    ["foo fighters", "foo bar", "foo bat", "foo bay"],
+    "foo b":   ["foo bar", "foo bat", "foo bay"],
+    "foo ba":  ["foo bar", "foo bat", "foo bay"],
+    "foo bar": ["foo bar"]
+  };
+
+  let suggestions = suggestMap[query];
+  if (!suggestions)
+    suggestions = [];
+  suggestions = [query, suggestions];
+
+  /*
+   * Sample result:
+   * ["foo",["food network","foothill college","foot locker",...]]
+   */
+  response.setHeader("Content-Type", "text/json", false);
+  response.setHeader("Cache-Control", "no-cache", false);
+  response.write(JSON.stringify(suggestions));
+}
diff --git a/mobile/android/base/tests/testSearchSuggestions.java.in b/mobile/android/base/tests/testSearchSuggestions.java.in
new file mode 100644
index 000000000000..2802e30ca583
--- /dev/null
+++ b/mobile/android/base/tests/testSearchSuggestions.java.in
@@ -0,0 +1,121 @@
+#filter substitution
+package @ANDROID_PACKAGE_NAME@.tests;
+
+import @ANDROID_PACKAGE_NAME@.*;
+import android.app.Activity;
+import android.content.Context;
+import android.view.View;
+import android.view.ViewGroup;
+import android.widget.TextView;
+import android.util.Log;
+
+import java.lang.reflect.Constructor;
+import java.lang.reflect.Field;
+import java.lang.RuntimeException;
+import java.util.ArrayList;
+import java.util.HashMap;
+
+/**
+ * Test for search suggestions.
+ * Sends queries from AwesomeBar input and verifies that suggestions match
+ * expected values.
+ */
+public class testSearchSuggestions extends BaseTest {
+    private static final int SUGGESTION_MAX = 3;
+    private static final int SUGGESTION_TIMEOUT = 5000;
+    private static final String TEST_QUERY = "foo barz";
+    private static final String SUGGESTION_TEMPLATE = "/robocop/robocop_suggestions.sjs?query=__searchTerms__";
+
+    public void testSearchSuggestions() {
+        setTestType("mochitest");
+        mActions.expectGeckoEvent("Gecko:Ready").blockForEvent();
+
+        // Map of expected values. See robocop_suggestions.sjs.
+        final HashMap<String, ArrayList<String>> suggestMap = new HashMap<String, ArrayList<String>>();
+        buildSuggestMap(suggestMap);
+
+        final int suggestionLayoutId = mDriver.findElement(getActivity(), "suggestion_layout").getId();
+        final int suggestionTextId = mDriver.findElement(getActivity(), "suggestion_text").getId();
+
+        Actions.EventExpecter enginesEventExpecter = mActions.expectGeckoEvent("SearchEngines:Data");
+        final Activity awesomeBarActivity = clickOnAwesomeBar();
+        enginesEventExpecter.blockForEvent();
+        connectSuggestClient(awesomeBarActivity);
+
+        for (int i = 0; i < TEST_QUERY.length(); i++) {
+            mActions.sendKeys(TEST_QUERY.substring(i, i+1));
+
+            final String query = TEST_QUERY.substring(0, i+1);
+            boolean success = waitForTest(new BooleanTest() {
+                public boolean test() {
+                    // get the first suggestion row
+                    ViewGroup suggestionGroup = (ViewGroup) awesomeBarActivity.findViewById(suggestionLayoutId);
+                    if (suggestionGroup == null)
+                        return false;
+
+                    ArrayList<String> expected = suggestMap.get(query);
+                    for (int i = 0; i < expected.size(); i++) {
+                        View queryChild = suggestionGroup.getChildAt(i);
+                        if (queryChild == null || queryChild.getVisibility() == View.GONE)
+                            return false;
+
+                        String suggestion = ((TextView) queryChild.findViewById(suggestionTextId)).getText().toString();
+                        if (!suggestion.equals(expected.get(i)))
+                            return false;
+                    }
+
+                    return true;
+                }
+            }, SUGGESTION_TIMEOUT);
+            mAsserter.is(success, true, "Results for query '" + query + "' matched expected suggestions");
+        }
+    }
+
+    private void buildSuggestMap(HashMap<String, ArrayList<String>> suggestMap) {
+        // these values assume SUGGESTION_MAX = 3
+        suggestMap.put("f",        new ArrayList<String>() {{ add("f"); add("facebook"); add("fandango"); add("frys"); }});
+        suggestMap.put("fo",       new ArrayList<String>() {{ add("fo"); add("forever 21"); add("food network"); add("fox news"); }});
+        suggestMap.put("foo",      new ArrayList<String>() {{ add("foo"); add("food network"); add("foothill college"); add("foot locker"); }});
+        suggestMap.put("foo ",     new ArrayList<String>() {{ add("foo "); add("foo fighters"); add("foo bar"); add("foo bat"); }});
+        suggestMap.put("foo b",    new ArrayList<String>() {{ add("foo b"); add("foo bar"); add("foo bat"); add("foo bay"); }});
+        suggestMap.put("foo ba",   new ArrayList<String>() {{ add("foo ba"); add("foo bar"); add("foo bat"); add("foo bay"); }});
+        suggestMap.put("foo bar",  new ArrayList<String>() {{ add("foo bar"); }});
+        suggestMap.put("foo barz", new ArrayList<String>() {{ add("foo barz"); }});
+    }
+
+    private void connectSuggestClient(final Activity awesomeBarActivity) {
+        try {
+            // create a SuggestClient that uses robocop_suggestions.sjs
+            ClassLoader classLoader = getActivity().getApplicationContext().getClassLoader();
+            Class suggestClass = classLoader.loadClass("org.mozilla.gecko.SuggestClient");
+            Constructor suggestConstructor = suggestClass.getConstructor(
+                    new Class[] { Context.class, String.class, int.class, int.class });
+            String suggestTemplate = getAbsoluteRawUrl(SUGGESTION_TEMPLATE);
+            Object client = suggestConstructor.newInstance(awesomeBarActivity, suggestTemplate, SUGGESTION_TIMEOUT, SUGGESTION_MAX);
+
+            // enable offline HTTP requests for testing
+            final Field checkNetworkField = suggestClass.getDeclaredField("mCheckNetwork");
+            checkNetworkField.setAccessible(true);
+            checkNetworkField.set(false, client);
+
+            // replace mSuggestClient with test client
+            Class awesomeBarClass = classLoader.loadClass("org.mozilla.gecko.AwesomeBar");
+            final Field suggestClientField = awesomeBarClass.getDeclaredField("mSuggestClient");
+            suggestClientField.setAccessible(true);
+            waitForTest(new BooleanTest() {
+                public boolean test() {
+                    // wait for mSuggestClient to be set before we replace it
+                    try {
+                        return suggestClientField.get(awesomeBarActivity) != null;
+                    } catch (IllegalAccessException e) {
+                        return false;
+                    }
+                }
+            }, SUGGESTION_TIMEOUT);
+            suggestClientField.set(awesomeBarActivity, client);
+        } catch (Exception e) {
+           throw new RuntimeException("Error setting SuggestClient", e);
+        }
+    }
+}
+
diff --git a/mobile/android/chrome/content/browser.js b/mobile/android/chrome/content/browser.js
index 0d61a3aa1c1e..6bd7fface6ea 100644
--- a/mobile/android/chrome/content/browser.js
+++ b/mobile/android/chrome/content/browser.js
@@ -4999,15 +4999,41 @@ var SearchEngines = {
         };
       });
 
+      let suggestTemplate = null;
+      let suggestEngine = null;
+      if (Services.prefs.getBoolPref("browser.search.suggest.enabled")) {
+        let engine = this.getSuggestionEngine();
+        if (engine != null) {
+          suggestEngine = engine.name;
+          suggestTemplate = engine.getSubmission("__searchTerms__", "application/x-suggestions+json").uri.spec;
+        }
+      }
+
       sendMessageToJava({
         gecko: {
           type: "SearchEngines:Data",
-          searchEngines: searchEngines
+          searchEngines: searchEngines,
+          suggestEngine: suggestEngine,
+          suggestTemplate: suggestTemplate
         }
       });
     }
   },
 
+  getSuggestionEngine: function () {
+    let engines = [ Services.search.currentEngine,
+                    Services.search.defaultEngine,
+                    Services.search.originalDefaultEngine ];
+
+    for (let i = 0; i < engines.length; i++) {
+      let engine = engines[i];
+      if (engine && engine.supportsResponseType("application/x-suggestions+json"))
+        return engine;
+    }
+
+    return null;
+  },
+
   addEngine: function addEngine(aElement) {
     let form = aElement.form;
     let charset = aElement.ownerDocument.characterSet;
diff --git a/mobile/android/sync/java-sources.mn b/mobile/android/sync/java-sources.mn
index be956b538130..a75efd30c72f 100644
--- a/mobile/android/sync/java-sources.mn
+++ b/mobile/android/sync/java-sources.mn
@@ -168,6 +168,12 @@ sync/setup/activities/ActivityUtils.java
 sync/setup/activities/SetupFailureActivity.java
 sync/setup/activities/SetupSuccessActivity.java
 sync/setup/activities/SetupSyncActivity.java
+sync/setup/auth/AccountAuthenticator.java
+sync/setup/auth/AuthenticateAccountStage.java
+sync/setup/auth/AuthenticationResult.java
+sync/setup/auth/AuthenticatorStage.java
+sync/setup/auth/EnsureUserExistenceStage.java
+sync/setup/auth/FetchUserNodeStage.java
 sync/setup/Constants.java
 sync/setup/InvalidSyncKeyException.java
 sync/setup/SyncAccounts.java
diff --git a/mobile/android/sync/strings.xml.in b/mobile/android/sync/strings.xml.in
index 8563aa3e0218..d66cf7cd8d70 100644
--- a/mobile/android/sync/strings.xml.in
+++ b/mobile/android/sync/strings.xml.in
@@ -73,4 +73,7 @@
   <string name="sync_new_tab">&new_tab;</string>
 
   <!-- Incorrect settings and changing credentials. -->
-  <string name="sync.new.recoverykey.status.incorrect">&sync.new.recoverykey.status.incorrect;</string>
+  <string name="sync_invalidcreds_label">&sync.invalidcreds.label;</string>
+  <string name="sync_invalidserver_label">&sync.invalidserver.label;</string>
+  <string name="sync_verifying_label">&sync.verifying.label;</string>
+  <string name="sync_new_recoverykey_status_incorrect">&sync.new.recoverykey.status.incorrect;</string>
diff --git a/services/sync/SyncComponents.manifest b/services/sync/SyncComponents.manifest
index a05eb1ae95ca..7aaf1a0353b5 100644
--- a/services/sync/SyncComponents.manifest
+++ b/services/sync/SyncComponents.manifest
@@ -7,6 +7,7 @@
 #   browser:        {ec8030f7-c20a-464f-9b0e-13a3a9e97384}
 #   mobile/android: {aa3c5121-dab2-40e2-81ca-7ea25febc110}
 #   mobile/xul:     {a23983c0-fd0e-11dc-95ff-0800200c9a66}
+#   suite (comm):   {92650c4d-4b8e-4d2a-b7eb-24ecf4f6b63a}
 #
 # In theory we should do this for all these instructions, but in practice it is
 # sufficient to do it for the app-startup one, and the file is simpler that way.
@@ -14,7 +15,7 @@
 # Weave.js
 component {74b89fb0-f200-4ae8-a3ec-dd164117f6de} Weave.js
 contract @mozilla.org/weave/service;1 {74b89fb0-f200-4ae8-a3ec-dd164117f6de}
-category app-startup WeaveService service,@mozilla.org/weave/service;1 application={3c2e2abc-06d4-11e1-ac3b-374f68613e61} application={ec8030f7-c20a-464f-9b0e-13a3a9e97384} application={aa3c5121-dab2-40e2-81ca-7ea25febc110} application={a23983c0-fd0e-11dc-95ff-0800200c9a66}
+category app-startup WeaveService service,@mozilla.org/weave/service;1 application={3c2e2abc-06d4-11e1-ac3b-374f68613e61} application={ec8030f7-c20a-464f-9b0e-13a3a9e97384} application={aa3c5121-dab2-40e2-81ca-7ea25febc110} application={a23983c0-fd0e-11dc-95ff-0800200c9a66} application={92650c4d-4b8e-4d2a-b7eb-24ecf4f6b63a}
 component {d28f8a0b-95da-48f4-b712-caf37097be41} Weave.js
 contract @mozilla.org/network/protocol/about;1?what=sync-log {d28f8a0b-95da-48f4-b712-caf37097be41}
 # Register resource aliases
diff --git a/testing/mochitest/runtestsremote.py b/testing/mochitest/runtestsremote.py
index 57e4c924e582..4f940b66bf8f 100644
--- a/testing/mochitest/runtestsremote.py
+++ b/testing/mochitest/runtestsremote.py
@@ -62,12 +62,12 @@ class RemoteOptions(MochitestOptions):
 
         self.add_option("--http-port", action = "store",
                     type = "string", dest = "httpPort",
-                    help = "ip address where the remote web server is hosted at")
+                    help = "http port of the remote web server")
         defaults["httpPort"] = automation.DEFAULT_HTTP_PORT
 
         self.add_option("--ssl-port", action = "store",
                     type = "string", dest = "sslPort",
-                    help = "ip address where the remote web server is hosted at")
+                    help = "ssl port of the remote web server")
         defaults["sslPort"] = automation.DEFAULT_SSL_PORT
 
         self.add_option("--pidfile", action = "store",
@@ -421,6 +421,7 @@ def main():
         fHandle.write("profile=%s\n" % (mochitest.remoteProfile))
         fHandle.write("logfile=%s\n" % (options.remoteLogFile))
         fHandle.write("host=http://mochi.test:8888/tests\n")
+        fHandle.write("rawhost=http://%s:%s/tests\n" % (options.remoteWebServer, options.httpPort))
         fHandle.close()
         deviceRoot = dm.getDeviceRoot()
       
diff --git a/testing/talos/talos.json b/testing/talos/talos.json
index b4fd780ba59f..d0a123dff85f 100644
--- a/testing/talos/talos.json
+++ b/testing/talos/talos.json
@@ -1,6 +1,6 @@
 {
     "talos.zip": {
-        "url": "http://build.mozilla.org/talos/zips/talos.df0587e8983e.zip",
+        "url": "http://build.mozilla.org/talos/zips/talos.aec9ddd2a04c.zip",
         "path": ""
     }
 }
diff --git a/toolkit/components/downloads/nsDownloadManager.cpp b/toolkit/components/downloads/nsDownloadManager.cpp
index d0af1ff01212..f550acfca3e5 100644
--- a/toolkit/components/downloads/nsDownloadManager.cpp
+++ b/toolkit/components/downloads/nsDownloadManager.cpp
@@ -2192,6 +2192,15 @@ nsDownload::SetState(DownloadState aState)
     case nsIDownloadManager::DOWNLOAD_DIRTY:
     case nsIDownloadManager::DOWNLOAD_CANCELED:
     case nsIDownloadManager::DOWNLOAD_FAILED:
+#ifdef ANDROID
+      // If we still have a temp file, remove it
+      bool tempExists;
+      if (mTempFile && NS_SUCCEEDED(mTempFile->Exists(&tempExists)) && tempExists) {
+        nsresult rv = mTempFile->Remove(false);
+        NS_ENSURE_SUCCESS(rv, rv);
+      }
+#endif
+
       // Transfers are finished, so break the reference cycle
       Finalize();
       break;
diff --git a/toolkit/components/exthelper/extApplication.js b/toolkit/components/exthelper/extApplication.js
index 8ada2a4c3552..d6d66d72fc27 100644
--- a/toolkit/components/exthelper/extApplication.js
+++ b/toolkit/components/exthelper/extApplication.js
@@ -5,26 +5,21 @@
 Components.utils.import("resource://gre/modules/XPCOMUtils.jsm");
 Components.utils.import("resource://gre/modules/AddonManager.jsm");
 
-//=================================================
-// Shutdown - used to store cleanup functions which will
-//            be called on Application shutdown
-var gShutdown = [];
-
 //=================================================
 // Console constructor
 function Console() {
   this._console = Components.classes["@mozilla.org/consoleservice;1"]
-    .getService(Ci.nsIConsoleService);
+                            .getService(Ci.nsIConsoleService);
 }
 
 //=================================================
 // Console implementation
 Console.prototype = {
-  log : function cs_log(aMsg) {
+  log: function cs_log(aMsg) {
     this._console.logStringMessage(aMsg);
   },
 
-  open : function cs_open() {
+  open: function cs_open() {
     var wMediator = Components.classes["@mozilla.org/appshell/window-mediator;1"]
                               .getService(Ci.nsIWindowMediator);
     var console = wMediator.getMostRecentWindow("global:console");
@@ -39,7 +34,7 @@ Console.prototype = {
     }
   },
 
-  QueryInterface : XPCOMUtils.generateQI([Ci.extIConsole])
+  QueryInterface: XPCOMUtils.generateQI([Ci.extIConsole])
 };
 
 
@@ -53,7 +48,7 @@ function EventItem(aType, aData) {
 //=================================================
 // EventItem implementation
 EventItem.prototype = {
-  _cancel : false,
+  _cancel: false,
 
   get type() {
     return this._type;
@@ -63,11 +58,11 @@ EventItem.prototype = {
     return this._data;
   },
 
-  preventDefault : function ei_pd() {
+  preventDefault: function ei_pd() {
     this._cancel = true;
   },
 
-  QueryInterface : XPCOMUtils.generateQI([Ci.extIEventItem])
+  QueryInterface: XPCOMUtils.generateQI([Ci.extIEventItem])
 };
 
 
@@ -81,7 +76,7 @@ function Events(notifier) {
 //=================================================
 // Events implementation
 Events.prototype = {
-  addListener : function evts_al(aEvent, aListener) {
+  addListener: function evts_al(aEvent, aListener) {
     function hasFilter(element) {
       return element.event == aEvent && element.listener == aListener;
     }
@@ -99,7 +94,7 @@ Events.prototype = {
     }
   },
 
-  removeListener : function evts_rl(aEvent, aListener) {
+  removeListener: function evts_rl(aEvent, aListener) {
     function hasFilter(element) {
       return (element.event != aEvent) || (element.listener != aListener);
     }
@@ -107,7 +102,7 @@ Events.prototype = {
     this._listeners = this._listeners.filter(hasFilter);
   },
 
-  dispatch : function evts_dispatch(aEvent, aEventItem) {
+  dispatch: function evts_dispatch(aEvent, aEventItem) {
     var eventItem = new EventItem(aEvent, aEventItem);
 
     this._listeners.forEach(function(key){
@@ -121,9 +116,82 @@ Events.prototype = {
     return !eventItem._cancel;
   },
 
-  QueryInterface : XPCOMUtils.generateQI([Ci.extIEvents])
+  QueryInterface: XPCOMUtils.generateQI([Ci.extIEvents])
 };
 
+//=================================================
+// PreferenceObserver (internal class)
+//
+// PreferenceObserver is a global singleton which watches the browser's
+// preferences and sends you events when things change.
+
+function PreferenceObserver() {
+  this._observersDict = {};
+}
+
+PreferenceObserver.prototype = {
+  /**
+   * Add a preference observer.
+   *
+   * @param aPrefs the nsIPrefBranch onto which we'll install our listener.
+   * @param aDomain the domain our listener will watch (a string).
+   * @param aEvent the event to listen to (you probably want "change").
+   * @param aListener the function to call back when the event fires.  This
+   *                  function will receive an EventData argument.
+   */
+  addListener: function po_al(aPrefs, aDomain, aEvent, aListener) {
+    var root = aPrefs.root;
+    if (!this._observersDict[root]) {
+      this._observersDict[root] = {};
+    }
+    var observer = this._observersDict[root][aDomain];
+
+    if (!observer) {
+      observer = {
+        events: new Events(),
+        observe: function po_observer_obs(aSubject, aTopic, aData) {
+          this.events.dispatch("change", aData);
+        },
+        QueryInterface: XPCOMUtils.generateQI([Ci.nsIObserver,
+                                               Ci.nsISupportsWeakReference])
+      };
+      observer.prefBranch = aPrefs;
+      observer.prefBranch.addObserver(aDomain, observer, /* ownsWeak = */ true);
+
+      // Notice that the prefBranch keeps a weak reference to the observer;
+      // it's this._observersDict which keeps the observer alive.
+      this._observersDict[root][aDomain] = observer;
+    }
+    observer.events.addListener(aEvent, aListener);
+  },
+
+  /**
+   * Remove a preference observer.
+   *
+   * This function's parameters are identical to addListener's.
+   */
+  removeListener: function po_rl(aPrefs, aDomain, aEvent, aListener) {
+    var root = aPrefs.root;
+    if (!this._observersDict[root] ||
+        !this._observersDict[root][aDomain]) {
+      return;
+    }
+    var observer = this._observersDict[root][aDomain];
+    observer.events.removeListener(aEvent, aListener);
+
+    if (observer.events._listeners.length == 0) {
+      // nsIPrefBranch objects are not singletons -- we can have two
+      // nsIPrefBranch'es for the same branch.  There's no guarantee that
+      // aPrefs is the same object as observer.prefBranch, so we have to call
+      // removeObserver on observer.prefBranch.
+      observer.prefBranch.removeObserver(aDomain, observer);
+      delete this._observersDict[root][aDomain];
+      if (Object.keys(this._observersDict[root]).length == 0) {
+        delete this._observersDict[root];
+      }
+    }
+  }
+};
 
 //=================================================
 // PreferenceBranch constructor
@@ -133,38 +201,27 @@ function PreferenceBranch(aBranch) {
 
   this._root = aBranch;
   this._prefs = Components.classes["@mozilla.org/preferences-service;1"]
-                          .getService(Ci.nsIPrefService);
+                          .getService(Ci.nsIPrefService)
+                          .QueryInterface(Ci.nsIPrefBranch);
 
   if (aBranch)
     this._prefs = this._prefs.getBranch(aBranch);
 
-  this._prefs.QueryInterface(Ci.nsIPrefBranch);
-
-  // we want to listen to "all" changes for this branch, so pass in a blank domain
-  this._prefs.addObserver("", this, true);
-  this._events = new Events();
-
-  var self = this;
-  gShutdown.push(function() { self._shutdown(); });
+  let prefs = this._prefs;
+  this._events = {
+    addListener: function pb_al(aEvent, aListener) {
+      gPreferenceObserver.addListener(prefs, "", aEvent, aListener);
+    },
+    removeListener: function pb_rl(aEvent, aListener) {
+      gPreferenceObserver.removeListener(prefs, "", aEvent, aListener);
+    },
+    QueryInterface: XPCOMUtils.generateQI([Ci.extIEvents])
+  };
 }
 
 //=================================================
 // PreferenceBranch implementation
 PreferenceBranch.prototype = {
-  // cleanup observer so we don't leak
-  _shutdown: function prefs_shutdown() {
-    this._prefs.removeObserver(this._root, this);
-
-    this._prefs = null;
-    this._events = null;
-  },
-
-  // for nsIObserver
-  observe: function prefs_observe(aSubject, aTopic, aData) {
-    if (aTopic == "nsPref:changed")
-      this._events.dispatch("change", aData);
-  },
-
   get root() {
     return this._root;
   },
@@ -183,7 +240,7 @@ PreferenceBranch.prototype = {
   // type: Boolean, Number, String (getPrefType)
   // locked: true, false (prefIsLocked)
   // modified: true, false (prefHasUserValue)
-  find : function prefs_find(aOptions) {
+  find: function prefs_find(aOptions) {
     var retVal = [];
     var items = this._prefs.getChildList("");
 
@@ -194,15 +251,15 @@ PreferenceBranch.prototype = {
     return retVal;
   },
 
-  has : function prefs_has(aName) {
+  has: function prefs_has(aName) {
     return (this._prefs.getPrefType(aName) != Ci.nsIPrefBranch.PREF_INVALID);
   },
 
-  get : function prefs_get(aName) {
+  get: function prefs_get(aName) {
     return this.has(aName) ? new Preference(aName, this) : null;
   },
 
-  getValue : function prefs_gv(aName, aValue) {
+  getValue: function prefs_gv(aName, aValue) {
     var type = this._prefs.getPrefType(aName);
 
     switch (type) {
@@ -220,7 +277,7 @@ PreferenceBranch.prototype = {
     return aValue;
   },
 
-  setValue : function prefs_sv(aName, aValue) {
+  setValue: function prefs_sv(aName, aValue) {
     var type = aValue != null ? aValue.constructor.name : "";
 
     switch (type) {
@@ -241,11 +298,11 @@ PreferenceBranch.prototype = {
     }
   },
 
-  reset : function prefs_reset() {
+  reset: function prefs_reset() {
     this._prefs.resetBranch("");
   },
 
-  QueryInterface : XPCOMUtils.generateQI([Ci.extIPreferenceBranch, Ci.nsISupportsWeakReference])
+  QueryInterface: XPCOMUtils.generateQI([Ci.extIPreferenceBranch])
 };
 
 
@@ -254,14 +311,17 @@ PreferenceBranch.prototype = {
 function Preference(aName, aBranch) {
   this._name = aName;
   this._branch = aBranch;
-  this._events = new Events();
 
   var self = this;
-
-  this.branch.events.addListener("change", function(aEvent){
-    if (aEvent.data == self.name)
-      self.events.dispatch(aEvent.type, aEvent.data);
-  });
+  this._events = {
+    addListener: function pref_al(aEvent, aListener) {
+      gPreferenceObserver.addListener(self._branch._prefs, self._name, aEvent, aListener);
+    },
+    removeListener: function pref_rl(aEvent, aListener) {
+      gPreferenceObserver.removeListener(self._branch._prefs, self._name, aEvent, aListener);
+    },
+    QueryInterface: XPCOMUtils.generateQI([Ci.extIEvents])
+  };
 }
 
 //=================================================
@@ -318,11 +378,11 @@ Preference.prototype = {
     return this._events;
   },
 
-  reset : function pref_reset() {
+  reset: function pref_reset() {
     this.branch._prefs.clearUserPref(this.name);
   },
 
-  QueryInterface : XPCOMUtils.generateQI([Ci.extIPreference])
+  QueryInterface: XPCOMUtils.generateQI([Ci.extIPreference])
 };
 
 
@@ -340,22 +400,85 @@ SessionStorage.prototype = {
     return this._events;
   },
 
-  has : function ss_has(aName) {
+  has: function ss_has(aName) {
     return this._storage.hasOwnProperty(aName);
   },
 
-  set : function ss_set(aName, aValue) {
+  set: function ss_set(aName, aValue) {
     this._storage[aName] = aValue;
     this._events.dispatch("change", aName);
   },
 
-  get : function ss_get(aName, aDefaultValue) {
+  get: function ss_get(aName, aDefaultValue) {
     return this.has(aName) ? this._storage[aName] : aDefaultValue;
   },
 
   QueryInterface : XPCOMUtils.generateQI([Ci.extISessionStorage])
 };
 
+//=================================================
+// ExtensionObserver constructor (internal class)
+//
+// ExtensionObserver is a global singleton which watches the browser's
+// extensions and sends you events when things change.
+
+function ExtensionObserver() {
+  this._eventsDict = {};
+
+  AddonManager.addAddonListener(this);
+  AddonManager.addInstallListener(this);
+}
+
+//=================================================
+// ExtensionObserver implementation (internal class)
+ExtensionObserver.prototype = {
+  onDisabling: function eo_onDisabling(addon, needsRestart) {
+    this._dispatchEvent(addon.id, "disable");
+  },
+
+  onEnabling: function eo_onEnabling(addon, needsRestart) {
+    this._dispatchEvent(addon.id, "enable");
+  },
+
+  onUninstalling: function eo_onUninstalling(addon, needsRestart) {
+    this._dispatchEvent(addon.id, "uninstall");
+  },
+
+  onOperationCancelled: function eo_onOperationCancelled(addon) {
+    this._dispatchEvent(addon.id, "cancel");
+  },
+
+  onInstallEnded: function eo_onInstallEnded(install, addon) {
+    this._dispatchEvent(addon.id, "upgrade");
+  },
+
+  addListener: function eo_al(aId, aEvent, aListener) {
+    var events = this._eventsDict[aId];
+    if (!events) {
+      events = new Events();
+      this._eventsDict[aId] = events;
+    }
+    events.addListener(aEvent, aListener);
+  },
+
+  removeListener: function eo_rl(aId, aEvent, aListener) {
+    var events = this._eventsDict[aId];
+    if (!events) {
+      return;
+    }
+    events.removeListener(aEvent, aListener);
+    if (events._listeners.length == 0) {
+      delete this._eventsDict[aId];
+    }
+  },
+
+  _dispatchEvent: function eo_dispatchEvent(aId, aEvent) {
+    var events = this._eventsDict[aId];
+    if (events) {
+      events.dispatch(aEvent, aId);
+    }
+  }
+};
 
 //=================================================
 // Extension constructor
@@ -364,60 +487,28 @@ function Extension(aItem) {
   this._firstRun = false;
   this._prefs = new PreferenceBranch("extensions." + this.id + ".");
   this._storage = new SessionStorage();
-  this._events = new Events();
+
+  let id = this.id;
+  this._events = {
+    addListener: function ext_events_al(aEvent, aListener) {
+      gExtensionObserver.addListener(id, aEvent, aListener);
+    },
+    removeListener: function ext_events_rl(aEvent, aListener) {
+      gExtensionObserver.addListener(id, aEvent, aListener);
+    },
+    QueryInterface: XPCOMUtils.generateQI([Ci.extIEvents])
+  };
 
   var installPref = "install-event-fired";
   if (!this._prefs.has(installPref)) {
     this._prefs.setValue(installPref, true);
     this._firstRun = true;
   }
-
-  AddonManager.addAddonListener(this);
-  AddonManager.addInstallListener(this);
-
-  var self = this;
-  gShutdown.push(function(){ self._shutdown(); });
 }
 
 //=================================================
 // Extension implementation
 Extension.prototype = {
-  // cleanup observer so we don't leak
-  _shutdown: function ext_shutdown() {
-    AddonManager.removeAddonListener(this);
-    AddonManager.removeInstallListener(this);
-
-    this._prefs = null;
-    this._storage = null;
-    this._events = null;
-  },
-
-  // for AddonListener
-  onDisabling: function(addon, needsRestart) {
-    if (addon.id == this.id)
-      this._events.dispatch("disable", this.id);
-  },
-
-  onEnabling: function(addon, needsRestart) {
-    if (addon.id == this.id)
-      this._events.dispatch("enable", this.id);
-  },
-
-  onUninstalling: function(addon, needsRestart) {
-    if (addon.id == this.id)
-      this._events.dispatch("uninstall", this.id);
-  },
-
-  onOperationCancelled: function(addon) {
-    if (addon.id == this.id)
-      this._events.dispatch("cancel", this.id);
-  },
-
-  onInstallEnded: function(install, addon) {
-    if (addon.id == this.id)
-      this._events.dispatch("upgrade", this.id);
-  },
-
   get id() {
     return this._item.id;
   },
@@ -450,7 +541,7 @@ Extension.prototype = {
     return this._events;
   },
 
-  QueryInterface : XPCOMUtils.generateQI([Ci.extIExtension])
+  QueryInterface: XPCOMUtils.generateQI([Ci.extIExtension])
 };
 
 
@@ -459,21 +550,14 @@ Extension.prototype = {
 function Extensions(addons) {
   this._cache = {};
 
-  addons.forEach(function(addon) {
+  addons.forEach(function (addon) {
     this._cache[addon.id] = new Extension(addon);
   }, this);
-
-  var self = this;
-  gShutdown.push(function() { self._shutdown(); });
 }
 
 //=================================================
 // Extensions implementation
 Extensions.prototype = {
-  _shutdown : function exts_shutdown() {
-    this._cache = null;
-  },
-
   get all() {
     return this.find({});
   },
@@ -484,21 +568,27 @@ Extensions.prototype = {
   // version: "1.0.1"
   // minVersion: "1.0"
   // maxVersion: "2.0"
-  find : function exts_find(aOptions) {
+  find: function exts_find(aOptions) {
     return [e for each (e in this._cache)];
   },
 
-  has : function exts_has(aId) {
+  has: function exts_has(aId) {
     return aId in this._cache;
   },
 
-  get : function exts_get(aId) {
+  get: function exts_get(aId) {
     return this.has(aId) ? this._cache[aId] : null;
   },
 
-  QueryInterface : XPCOMUtils.generateQI([Ci.extIExtensions])
+  QueryInterface: XPCOMUtils.generateQI([Ci.extIExtensions])
 };
 
+//=================================================
+// Application globals
+
+gExtensionObserver = new ExtensionObserver();
+gPreferenceObserver = new PreferenceObserver();
+
 //=================================================
 // extApplication constructor
 function extApplication() {
@@ -512,13 +602,9 @@ extApplication.prototype = {
                                        "@mozilla.org/xre/app-info;1",
                                        "nsIXULAppInfo");
 
-    // While the other event listeners are loaded only if needed,
-    // FUEL *must* listen for shutdown in order to clean up it's
-    // references to various services, and to remove itself as
-    // observer of any other notifications.
     this._obs = Cc["@mozilla.org/observer-service;1"].
                 getService(Ci.nsIObserverService);
-    this._obs.addObserver(this, "xpcom-shutdown", false);
+    this._obs.addObserver(this, "xpcom-shutdown", /* ownsWeak = */ true);
     this._registered = {"unload": true};
   },
 
@@ -553,43 +639,32 @@ extApplication.prototype = {
         aSubject.data = true;
     }
     else if (aTopic == "xpcom-shutdown") {
-
       this.events.dispatch("unload", "application");
-
-      // call the cleanup functions and empty the array
-      for (let i = 0; i < gShutdown.length; i++) {
-        gShutdown[i]();
-      }
-      gShutdown.splice(0, gShutdown.length);
-
-      // release our observers
-      this._obs.removeObserver(this, "app-startup");
-      this._obs.removeObserver(this, "final-ui-startup");
-      this._obs.removeObserver(this, "quit-application-requested");
-      this._obs.removeObserver(this, "xpcom-shutdown");
+      gExtensionObserver = null;
+      gPreferenceObserver = null;
     }
   },
 
   get console() {
     let console = new Console();
-    this.__defineGetter__("console", function() console);
+    this.__defineGetter__("console", function () console);
     return this.console;
   },
 
   get storage() {
     let storage = new SessionStorage();
-    this.__defineGetter__("storage", function() storage);
+    this.__defineGetter__("storage", function () storage);
     return this.storage;
   },
 
   get prefs() {
     let prefs = new PreferenceBranch("");
-    this.__defineGetter__("prefs", function() prefs);
+    this.__defineGetter__("prefs", function () prefs);
     return this.prefs;
   },
 
   getExtensions: function(callback) {
-    AddonManager.getAddonsByTypes(["extension"], function(addons) {
+    AddonManager.getAddonsByTypes(["extension"], function (addons) {
       callback.callback(new Extensions(addons));
     });
   },
@@ -607,12 +682,12 @@ extApplication.prototype = {
       if (!(aEvent in rmap) || aEvent in self._registered)
         return;
 
-      self._obs.addObserver(self, rmap[aEvent]);
+      self._obs.addObserver(self, rmap[aEvent], /* ownsWeak = */ true);
       self._registered[aEvent] = true;
     }
 
     let events = new Events(registerCheck);
-    this.__defineGetter__("events", function() events);
+    this.__defineGetter__("events", function () events);
     return this.events;
   },
 
@@ -640,5 +715,5 @@ extApplication.prototype = {
                                Components.interfaces.nsIAppStartup.eRestart);
   },
 
-  QueryInterface : XPCOMUtils.generateQI([Ci.extIApplication, Ci.nsISupportsWeakReference])
+  QueryInterface: XPCOMUtils.generateQI([Ci.extIApplication, Ci.nsISupportsWeakReference])
 };