Merge inbound to m-c on a CLOSED TREE.

CLOBBER

@@ -22,4 +22,4 @@
 # changes to stick? As of bug 928195, this shouldn't be necessary! Please
 # don't change CLOBBER for WebIDL changes any more.
 
-Bug 1004726 requires a clobber for B2G Emulator builds
+Bug 994964 apparently requires a clobber, unclear why

accessible/src/base/Logging.cpp

@@ -408,8 +408,7 @@ logging::DocLoad(const char* aMsg, nsIWebProgress* aWebProgress,
 
   LogDocInfo(documentNode, document);
 
-  nsCOMPtr<nsIWebNavigation> webNav(do_GetInterface(DOMWindow));
-  nsCOMPtr<nsIDocShell> docShell(do_QueryInterface(webNav));
+  nsCOMPtr<nsIDocShell> docShell = window->GetDocShell();
   printf("\n    ");
   LogShellLoadType(docShell);
   printf("\n");

accessible/src/jsat/Utils.jsm

@@ -151,8 +151,19 @@ this.Utils = {
   get AllMessageManagers() {
     let messageManagers = [];
 
-    for (let i = 0; i < this.win.messageManager.childCount; i++)
-      messageManagers.push(this.win.messageManager.getChildAt(i));
+    function collectLeafMessageManagers(mm) {
+      for (let i = 0; i < mm.childCount; i++) {
+        let childMM = mm.getChildAt(i);
+
+        if ("sendAsyncMessage" in childMM) {
+          messageManagers.push(childMM);
+        } else {
+          collectLeafMessageManagers(childMM);
+        }
+      }
+    }
+
+    collectLeafMessageManagers(this.win.messageManager);
 
     let document = this.CurrentContentDoc;
 

b2g/app/b2g.js

@@ -946,6 +946,11 @@ pref("apz.enlarge_displayport_when_clipped", true);
 pref("apz.axis_lock_mode", 2);
 pref("apz.subframe.enabled", true);
 
+// Overscroll-related settings
+pref("apz.overscroll.enabled", false);
+pref("apz.overscroll.snap_back_accel", "0.003");
+pref("apz.overscroll.snap_back_init_vel", "1");
+
 // This preference allows FirefoxOS apps (and content, I think) to force
 // the use of software (instead of hardware accelerated) 2D canvases by
 // creating a context like this:

b2g/chrome/content/settings.js

@@ -645,6 +645,7 @@ let settingsToObserve = {
     prefName: 'dom.browser_frames.useAsyncPanZoom',
     defaultValue: false
   },
+  'apz.overscroll.enabled': false,
   'debug.fps.enabled': {
     prefName: 'layers.acceleration.draw-fps',
     defaultValue: false

browser/base/content/browser-sets.inc

@@ -425,8 +425,8 @@
     <key id="key_sanitize" command="Tools:Sanitize" keycode="VK_DELETE" modifiers="accel,shift"/>
 #ifdef XP_MACOSX
     <key id="key_sanitize_mac" command="Tools:Sanitize" keycode="VK_BACK" modifiers="accel,shift"/>
-#endif
-#ifdef XP_UNIX
+    <key id="key_quitApplication" key="&quitApplicationCmdUnix.key;" modifiers="accel"/>
+#elifdef XP_UNIX
     <key id="key_quitApplication" key="&quitApplicationCmdUnix.key;" command="cmd_quitApplication" modifiers="accel"/>
 #endif
 

browser/components/shell/src/nsWindowsShellService.cpp

@@ -915,24 +915,24 @@ nsWindowsShellService::SetDesktopBackground(nsIDOMElement* aElement,
     nsAutoString style;
     switch (aPosition) {
       case BACKGROUND_TILE:
-        style.AssignLiteral("0");
-        tile.AssignLiteral("1");
+        style.Assign('0');
+        tile.Assign('1');
         break;
       case BACKGROUND_CENTER:
-        style.AssignLiteral("0");
-        tile.AssignLiteral("0");
+        style.Assign('0');
+        tile.Assign('0');
         break;
       case BACKGROUND_STRETCH:
-        style.AssignLiteral("2");
-        tile.AssignLiteral("0");
+        style.Assign('2');
+        tile.Assign('0');
         break;
       case BACKGROUND_FILL:
         style.AssignLiteral("10");
-        tile.AssignLiteral("0");
+        tile.Assign('0');
         break;
       case BACKGROUND_FIT:
-        style.AssignLiteral("6");
-        tile.AssignLiteral("0");
+        style.Assign('6');
+        tile.Assign('0');
         break;
     }
 
@@ -990,7 +990,7 @@ nsWindowsShellService::OpenApplication(int32_t aApplication)
   ::RegCloseKey(theKey);
 
   // Find the "open" command
-  application.AppendLiteral("\\");
+  application.Append('\\');
   application.Append(buf);
   application.AppendLiteral("\\shell\\open\\command");
 

content/base/src/Element.cpp

@@ -2262,7 +2262,7 @@ Element::DescribeAttribute(uint32_t index, nsAString& aOutDescription) const
       value.Insert(char16_t('\\'), uint32_t(i));
   }
   aOutDescription.Append(value);
-  aOutDescription.AppendLiteral("\"");
+  aOutDescription.Append('"');
 }
 
 #ifdef DEBUG

content/base/src/WebSocket.cpp

@@ -992,7 +992,7 @@ WebSocket::ParseURL(const nsString& aURL)
   nsAutoCString filePath;
   rv = parsedURL->GetFilePath(filePath);
   if (filePath.IsEmpty()) {
-    filePath.AssignLiteral("/");
+    filePath.Assign('/');
   }
   NS_ENSURE_SUCCESS(rv, NS_ERROR_DOM_SYNTAX_ERR);
 

content/base/src/nsCCUncollectableMarker.cpp

@@ -93,6 +93,56 @@ MarkUserDataHandler(void* aNode, nsIAtom* aKey, void* aValue, void* aData)
   }
 }
 
+static void
+MarkChildMessageManagers(nsIMessageBroadcaster* aMM)
+{
+  aMM->MarkForCC();
+
+  uint32_t tabChildCount = 0;
+  aMM->GetChildCount(&tabChildCount);
+  for (uint32_t j = 0; j < tabChildCount; ++j) {
+    nsCOMPtr<nsIMessageListenerManager> childMM;
+    aMM->GetChildAt(j, getter_AddRefs(childMM));
+    if (!childMM) {
+      continue;
+    }
+
+    nsCOMPtr<nsIMessageBroadcaster> strongNonLeafMM = do_QueryInterface(childMM);
+    nsIMessageBroadcaster* nonLeafMM = strongNonLeafMM;
+
+    nsCOMPtr<nsIMessageSender> strongTabMM = do_QueryInterface(childMM);
+    nsIMessageSender* tabMM = strongTabMM;
+
+    strongNonLeafMM = nullptr;
+    strongTabMM = nullptr;
+    childMM = nullptr;
+
+    if (nonLeafMM) {
+      MarkChildMessageManagers(nonLeafMM);
+      continue;
+    }
+
+    tabMM->MarkForCC();
+
+    //XXX hack warning, but works, since we know that
+    //    callback is frameloader.
+    mozilla::dom::ipc::MessageManagerCallback* cb =
+      static_cast<nsFrameMessageManager*>(tabMM)->GetCallback();
+    if (cb) {
+      nsFrameLoader* fl = static_cast<nsFrameLoader*>(cb);
+      EventTarget* et = fl->GetTabChildGlobalAsEventTarget();
+      if (!et) {
+        continue;
+      }
+      static_cast<nsInProcessTabChildGlobal*>(et)->MarkForCC();
+      EventListenerManager* elm = et->GetExistingListenerManager();
+      if (elm) {
+        elm->MarkForCC();
+      }
+    }
+  }
+}
+
 static void
 MarkMessageManagers()
 {
@@ -107,52 +157,8 @@ MarkMessageManagers()
   }
   nsIMessageBroadcaster* globalMM = strongGlobalMM;
   strongGlobalMM = nullptr;
+  MarkChildMessageManagers(globalMM);
 
-  globalMM->MarkForCC();
-  uint32_t childCount = 0;
-  globalMM->GetChildCount(&childCount);
-  for (uint32_t i = 0; i < childCount; ++i) {
-    nsCOMPtr<nsIMessageListenerManager> childMM;
-    globalMM->GetChildAt(i, getter_AddRefs(childMM));
-    if (!childMM) {
-      continue;
-    }
-    nsCOMPtr<nsIMessageBroadcaster> strongWindowMM = do_QueryInterface(childMM);
-    nsIMessageBroadcaster* windowMM = strongWindowMM;
-    childMM = nullptr;
-    strongWindowMM = nullptr;
-    windowMM->MarkForCC();
-    uint32_t tabChildCount = 0;
-    windowMM->GetChildCount(&tabChildCount);
-    for (uint32_t j = 0; j < tabChildCount; ++j) {
-      nsCOMPtr<nsIMessageListenerManager> childMM;
-      windowMM->GetChildAt(j, getter_AddRefs(childMM));
-      if (!childMM) {
-        continue;
-      }
-      nsCOMPtr<nsIMessageSender> strongTabMM = do_QueryInterface(childMM);
-      nsIMessageSender* tabMM = strongTabMM;
-      childMM = nullptr;
-      strongTabMM = nullptr;
-      tabMM->MarkForCC();
-      //XXX hack warning, but works, since we know that
-      //    callback is frameloader.
-      mozilla::dom::ipc::MessageManagerCallback* cb =
-        static_cast<nsFrameMessageManager*>(tabMM)->GetCallback();
-      if (cb) {
-        nsFrameLoader* fl = static_cast<nsFrameLoader*>(cb);
-        EventTarget* et = fl->GetTabChildGlobalAsEventTarget();
-        if (!et) {
-          continue;
-        }
-        static_cast<nsInProcessTabChildGlobal*>(et)->MarkForCC();
-        EventListenerManager* elm = et->GetExistingListenerManager();
-        if (elm) {
-          elm->MarkForCC();
-        }
-      }
-    }
-  }
   if (nsFrameMessageManager::sParentProcessManager) {
     nsFrameMessageManager::sParentProcessManager->MarkForCC();
     uint32_t childCount = 0;

content/base/src/nsContentAreaDragDrop.cpp

@@ -406,8 +406,7 @@ DragDataProducer::Produce(DataTransfer* aDataTransfer,
   // if set, serialize the content under this node
   nsCOMPtr<nsIContent> nodeToSerialize;
 
-  nsCOMPtr<nsIWebNavigation> webnav = do_GetInterface(mWindow);
-  nsCOMPtr<nsIDocShellTreeItem> dsti = do_QueryInterface(webnav);
+  nsCOMPtr<nsIDocShellTreeItem> dsti = mWindow->GetDocShell();
   const bool isChromeShell =
     dsti && dsti->ItemType() == nsIDocShellTreeItem::typeChrome;
 

content/base/src/nsContentUtils.cpp

@@ -5053,8 +5053,12 @@ nsContentUtils::CheckForSubFrameDrop(nsIDragSession* aDragSession,
   }
   
   nsIDocument* targetDoc = target->OwnerDoc();
-  nsCOMPtr<nsIWebNavigation> twebnav = do_GetInterface(targetDoc->GetWindow());
-  nsCOMPtr<nsIDocShellTreeItem> tdsti = do_QueryInterface(twebnav);
+  nsPIDOMWindow* targetWin = targetDoc->GetWindow();
+  if (!targetWin) {
+    return true;
+  }
+
+  nsCOMPtr<nsIDocShellTreeItem> tdsti = targetWin->GetDocShell();
   if (!tdsti) {
     return true;
   }
@@ -5896,7 +5900,7 @@ nsContentUtils::FlushLayoutForTree(nsIDOMWindow* aWindow)
         for (; i < i_end; ++i) {
             nsCOMPtr<nsIDocShellTreeItem> item;
             docShell->GetChildAt(i, getter_AddRefs(item));
-            nsCOMPtr<nsIDOMWindow> win = do_GetInterface(item);
+            nsCOMPtr<nsIDOMWindow> win = item->GetWindow();
             if (win) {
                 FlushLayoutForTree(win);
             }

content/base/src/nsCopySupport.cpp

@@ -637,7 +637,7 @@ nsCopySupport::FireClipboardEvent(int32_t aType, int32_t aClipboardType, nsIPres
   if (!nsContentUtils::IsSafeToRunScript())
     return false;
 
-  nsCOMPtr<nsIDocShell> docShell = do_GetInterface(piWindow);
+  nsCOMPtr<nsIDocShell> docShell = piWindow->GetDocShell();
   const bool chromeShell =
     docShell && docShell->ItemType() == nsIDocShellTreeItem::typeChrome;
 

content/base/src/nsDocument.cpp

@@ -2970,7 +2970,7 @@ nsIDocument::GetLastModified(nsAString& aLastModified) const
   } else {
     // If we for whatever reason failed to find the last modified time
     // (or even the current time), fall back to what NS4.x returned.
-    aLastModified.AssignLiteral("01/01/1970 00:00:00");
+    aLastModified.AssignLiteral(MOZ_UTF16("01/01/1970 00:00:00"));
   }
 }
 
@@ -4572,10 +4572,10 @@ nsDocument::GetWindowInternal() const
   // the docshell, the outer window might be still obtainable from the it.
   nsCOMPtr<nsPIDOMWindow> win;
   if (mRemovedFromDocShell) {
-    nsCOMPtr<nsIInterfaceRequestor> requestor(mDocumentContainer);
-    if (requestor) {
-      // The docshell returns the outer window we are done.
-      win = do_GetInterface(requestor);
+    // The docshell returns the outer window we are done.
+    nsCOMPtr<nsIDocShell> kungfuDeathGrip(mDocumentContainer);
+    if (mDocumentContainer) {
+      win = mDocumentContainer->GetWindow();
     }
   } else {
     win = do_QueryInterface(mScriptGlobalObject);
@@ -7362,8 +7362,7 @@ nsIDocument::AdoptNode(nsINode& aAdoptedNode, ErrorResult& rv)
       do {
         nsPIDOMWindow *win = doc->GetWindow();
         if (win) {
-          nsCOMPtr<nsINode> node =
-            do_QueryInterface(win->GetFrameElementInternal());
+          nsCOMPtr<nsINode> node = win->GetFrameElementInternal();
           if (node &&
               nsContentUtils::ContentIsDescendantOf(node, adoptedNode)) {
             rv.Throw(NS_ERROR_DOM_HIERARCHY_REQUEST_ERR);
@@ -9173,16 +9172,16 @@ nsIDocument::GetReadyState(nsAString& aReadyState) const
 {
   switch(mReadyState) {
   case READYSTATE_LOADING :
-    aReadyState.AssignLiteral("loading");
+    aReadyState.AssignLiteral(MOZ_UTF16("loading"));
     break;
   case READYSTATE_INTERACTIVE :
-    aReadyState.AssignLiteral("interactive");
+    aReadyState.AssignLiteral(MOZ_UTF16("interactive"));
     break;
   case READYSTATE_COMPLETE :
-    aReadyState.AssignLiteral("complete");
+    aReadyState.AssignLiteral(MOZ_UTF16("complete"));
     break;
   default:
-    aReadyState.AssignLiteral("uninitialized");
+    aReadyState.AssignLiteral(MOZ_UTF16("uninitialized"));
   }
 }
 
@@ -10986,7 +10985,7 @@ IsInActiveTab(nsIDocument* aDoc)
   if (!rootItem) {
     return false;
   }
-  nsCOMPtr<nsIDOMWindow> rootWin = do_GetInterface(rootItem);
+  nsCOMPtr<nsIDOMWindow> rootWin = rootItem->GetWindow();
   if (!rootWin) {
     return false;
   }

content/base/src/nsFrameLoader.cpp

@@ -653,9 +653,9 @@ static void
 FirePageHideEvent(nsIDocShellTreeItem* aItem,
                   EventTarget* aChromeEventHandler)
 {
-  nsCOMPtr<nsIDocument> internalDoc = do_GetInterface(aItem);
-  NS_ASSERTION(internalDoc, "What happened here?");
-  internalDoc->OnPageHide(true, aChromeEventHandler);
+  nsCOMPtr<nsIDocument> doc = aItem->GetDocument();
+  NS_ASSERTION(doc, "What happened here?");
+  doc->OnPageHide(true, aChromeEventHandler);
 
   int32_t childCount = 0;
   aItem->GetChildCount(&childCount);
@@ -695,10 +695,10 @@ FirePageShowEvent(nsIDocShellTreeItem* aItem,
     }
   }
 
-  nsCOMPtr<nsIDocument> internalDoc = do_GetInterface(aItem);
-  NS_ASSERTION(internalDoc, "What happened here?");
-  if (internalDoc->IsShowing() == aFireIfShowing) {
-    internalDoc->OnPageShow(true, aChromeEventHandler);
+  nsCOMPtr<nsIDocument> doc = aItem->GetDocument();
+  NS_ASSERTION(doc, "What happened here?");
+  if (doc->IsShowing() == aFireIfShowing) {
+    doc->OnPageShow(true, aChromeEventHandler);
   }
 }
 
@@ -1156,8 +1156,8 @@ nsFrameLoader::SwapWithOtherLoader(nsFrameLoader* aOther,
     return NS_ERROR_NOT_IMPLEMENTED;
   }
 
-  nsCOMPtr<nsPIDOMWindow> ourWindow = do_GetInterface(ourDocshell);
-  nsCOMPtr<nsPIDOMWindow> otherWindow = do_GetInterface(otherDocshell);
+  nsCOMPtr<nsPIDOMWindow> ourWindow = ourDocshell->GetWindow();
+  nsCOMPtr<nsPIDOMWindow> otherWindow = otherDocshell->GetWindow();
 
   nsCOMPtr<Element> ourFrameElement =
     ourWindow->GetFrameElementInternal();
@@ -1411,9 +1411,11 @@ nsFrameLoader::Destroy()
   }
   
   // Let our window know that we are gone
-  nsCOMPtr<nsPIDOMWindow> win_private(do_GetInterface(mDocShell));
-  if (win_private) {
-    win_private->SetFrameElementInternal(nullptr);
+  if (mDocShell) {
+    nsCOMPtr<nsPIDOMWindow> win_private(mDocShell->GetWindow());
+    if (win_private) {
+      win_private->SetFrameElementInternal(nullptr);
+    }
   }
 
   if ((mNeedsAsyncDestroy || !doc ||
@@ -1677,7 +1679,7 @@ nsFrameLoader::MaybeCreateDocShell()
 
   mDocShell->SetChromeEventHandler(chromeEventHandler);
 
-  // This is nasty, this code (the do_GetInterface(mDocShell) below)
+  // This is nasty, this code (the mDocShell->GetWindow() below)
   // *must* come *after* the above call to
   // mDocShell->SetChromeEventHandler() for the global window to get
   // the right chrome event handler.
@@ -1686,7 +1688,7 @@ nsFrameLoader::MaybeCreateDocShell()
   nsCOMPtr<Element> frame_element = mOwnerContent;
   NS_ASSERTION(frame_element, "frame loader owner element not a DOM element!");
 
-  nsCOMPtr<nsPIDOMWindow> win_private(do_GetInterface(mDocShell));
+  nsCOMPtr<nsPIDOMWindow> win_private(mDocShell->GetWindow());
   nsCOMPtr<nsIBaseWindow> base_win(do_QueryInterface(mDocShell));
   if (win_private) {
     win_private->SetFrameElementInternal(frame_element);
@@ -1878,14 +1880,15 @@ nsFrameLoader::GetWindowDimensions(nsRect& aRect)
     return NS_ERROR_FAILURE;
   }
 
-  nsCOMPtr<nsIWebNavigation> parentAsWebNav =
-    do_GetInterface(doc->GetWindow());
-
-  if (!parentAsWebNav) {
+  nsCOMPtr<nsPIDOMWindow> win = doc->GetWindow();
+  if (!win) {
     return NS_ERROR_FAILURE;
   }
 
-  nsCOMPtr<nsIDocShellTreeItem> parentAsItem(do_QueryInterface(parentAsWebNav));
+  nsCOMPtr<nsIDocShellTreeItem> parentAsItem(win->GetDocShell());
+  if (!parentAsItem) {
+    return NS_ERROR_FAILURE;
+  }
 
   nsCOMPtr<nsIDocShellTreeOwner> parentOwner;
   if (NS_FAILED(parentAsItem->GetTreeOwner(getter_AddRefs(parentOwner))) ||
@@ -2052,14 +2055,15 @@ nsFrameLoader::TryRemoteBrowser()
     return false;
   }
 
-  nsCOMPtr<nsIWebNavigation> parentAsWebNav =
-    do_GetInterface(doc->GetWindow());
-
-  if (!parentAsWebNav) {
+  nsCOMPtr<nsPIDOMWindow> parentWin = doc->GetWindow();
+  if (!parentWin) {
     return false;
   }
 
-  nsCOMPtr<nsIDocShellTreeItem> parentAsItem(do_QueryInterface(parentAsWebNav));
+  nsCOMPtr<nsIDocShellTreeItem> parentAsItem(parentWin->GetDocShell());
+  if (!parentAsItem) {
+    return false;
+  }
 
   // <iframe mozbrowser> gets to skip these checks.
   if (!OwnerIsBrowserOrAppFrame()) {
@@ -2127,7 +2131,7 @@ nsFrameLoader::TryRemoteBrowser()
     mChildID = mRemoteBrowser->Manager()->ChildID();
     nsCOMPtr<nsIDocShellTreeItem> rootItem;
     parentAsItem->GetRootTreeItem(getter_AddRefs(rootItem));
-    nsCOMPtr<nsIDOMWindow> rootWin = do_GetInterface(rootItem);
+    nsCOMPtr<nsIDOMWindow> rootWin = rootItem->GetWindow();
     nsCOMPtr<nsIDOMChromeWindow> rootChromeWin = do_QueryInterface(rootWin);
     NS_ABORT_IF_FALSE(rootChromeWin, "How did we not get a chrome window here?");
 
@@ -2222,15 +2226,18 @@ nsFrameLoader::CreateStaticClone(nsIFrameLoader* aDest)
   dest->MaybeCreateDocShell();
   NS_ENSURE_STATE(dest->mDocShell);
 
-  nsCOMPtr<nsIDocument> dummy = do_GetInterface(dest->mDocShell);
+  nsCOMPtr<nsIDocument> dummy = dest->mDocShell->GetDocument();
   nsCOMPtr<nsIContentViewer> viewer;
   dest->mDocShell->GetContentViewer(getter_AddRefs(viewer));
   NS_ENSURE_STATE(viewer);
 
   nsCOMPtr<nsIDocShell> origDocShell;
   GetDocShell(getter_AddRefs(origDocShell));
-  nsCOMPtr<nsIDocument> doc = do_GetInterface(origDocShell);
+  NS_ENSURE_STATE(origDocShell);
+
+  nsCOMPtr<nsIDocument> doc = origDocShell->GetDocument();
   NS_ENSURE_STATE(doc);
+
   nsCOMPtr<nsIDocument> clonedDoc = doc->CreateStaticClone(dest->mDocShell);
   nsCOMPtr<nsIDOMDocument> clonedDOMDoc = do_QueryInterface(clonedDoc);
 
@@ -2425,8 +2432,19 @@ nsFrameLoader::EnsureMessageManager()
   nsCOMPtr<nsIDOMChromeWindow> chromeWindow =
     do_QueryInterface(GetOwnerDoc()->GetWindow());
   nsCOMPtr<nsIMessageBroadcaster> parentManager;
+
   if (chromeWindow) {
-    chromeWindow->GetMessageManager(getter_AddRefs(parentManager));
+    nsAutoString messagemanagergroup;
+    if (mOwnerContent->IsXUL() &&
+        mOwnerContent->GetAttr(kNameSpaceID_None,
+                               nsGkAtoms::messagemanagergroup,
+                               messagemanagergroup)) {
+      chromeWindow->GetGroupMessageManager(messagemanagergroup, getter_AddRefs(parentManager));
+    }
+
+    if (!parentManager) {
+      chromeWindow->GetMessageManager(getter_AddRefs(parentManager));
+    }
   }
 
   if (ShouldUseRemoteProcess()) {

content/base/src/nsFrameMessageManager.cpp

@@ -431,7 +431,7 @@ nsFrameMessageManager::LoadFrameScript(const nsAString& aURL,
   aRunInGlobalScope = true;
 
   if (aAllowDelayedLoad) {
-    if (IsGlobal() || IsWindowLevel()) {
+    if (IsGlobal() || IsBroadcaster()) {
       // Cache for future windows or frames
       mPendingScripts.AppendElement(aURL);
       mPendingScriptsGlobalStates.AppendElement(aRunInGlobalScope);
@@ -481,7 +481,7 @@ nsFrameMessageManager::GetDelayedFrameScripts(JSContext* aCx, JS::MutableHandle<
 {
   // Frame message managers may return an incomplete list because scripts
   // that were loaded after it was connected are not added to the list.
-  if (!IsGlobal() && !IsWindowLevel()) {
+  if (!IsGlobal() && !IsBroadcaster()) {
     NS_WARNING("Cannot retrieve list of pending frame scripts for frame"
                "message managers as it may be incomplete");
     return NS_ERROR_NOT_IMPLEMENTED;
@@ -590,7 +590,7 @@ nsFrameMessageManager::SendMessage(const nsAString& aMessageName,
                                    bool aIsSync)
 {
   NS_ASSERTION(!IsGlobal(), "Should not call SendSyncMessage in chrome");
-  NS_ASSERTION(!IsWindowLevel(), "Should not call SendSyncMessage in chrome");
+  NS_ASSERTION(!IsBroadcaster(), "Should not call SendSyncMessage in chrome");
   NS_ASSERTION(!mParentManager, "Should not have parent manager in content!");
 
   aRetval.setUndefined();
@@ -1069,7 +1069,7 @@ nsFrameMessageManager::ReceiveMessage(nsISupports* aTarget,
           return NS_ERROR_UNEXPECTED;
         }
 
-        if (!JS_CallFunctionValue(cx, thisObject, funval, argv, &rval)) {
+        if (!JS_CallFunctionValue(cx, thisObject, funval, JS::HandleValueArray(argv), &rval)) {
           nsJSUtils::ReportPendingException(cx);
           continue;
         }
@@ -1099,19 +1099,26 @@ nsFrameMessageManager::AddChildManager(nsFrameMessageManager* aManager)
 
   nsRefPtr<nsFrameMessageManager> kungfuDeathGrip = this;
   nsRefPtr<nsFrameMessageManager> kungfuDeathGrip2 = aManager;
-  // We have parent manager if we're a window message manager.
-  // In that case we want to load the pending scripts from global
-  // message manager.
-  if (mParentManager) {
-    nsRefPtr<nsFrameMessageManager> globalMM = mParentManager;
-    for (uint32_t i = 0; i < globalMM->mPendingScripts.Length(); ++i) {
-      aManager->LoadFrameScript(globalMM->mPendingScripts[i], false,
-                                globalMM->mPendingScriptsGlobalStates[i]);
-    }
+
+  LoadPendingScripts(this, aManager);
+}
+
+void
+nsFrameMessageManager::LoadPendingScripts(nsFrameMessageManager* aManager,
+                                          nsFrameMessageManager* aChildMM)
+{
+  // We have parent manager if we're a message broadcaster.
+  // In that case we want to load the pending scripts from all parent
+  // message managers in the hierarchy. Process the parent first so
+  // that pending scripts higher up in the hierarchy are loaded before others.
+  if (aManager->mParentManager) {
+    LoadPendingScripts(aManager->mParentManager, aChildMM);
   }
-  for (uint32_t i = 0; i < mPendingScripts.Length(); ++i) {
-    aManager->LoadFrameScript(mPendingScripts[i], false,
-                              mPendingScriptsGlobalStates[i]);
+
+  for (uint32_t i = 0; i < aManager->mPendingScripts.Length(); ++i) {
+    aChildMM->LoadFrameScript(aManager->mPendingScripts[i],
+                              false,
+                              aManager->mPendingScriptsGlobalStates[i]);
   }
 }
 
@@ -1138,7 +1145,7 @@ nsFrameMessageManager::InitWithCallback(MessageManagerCallback* aCallback)
 
   SetCallback(aCallback);
 
-  // First load global scripts by adding this to parent manager.
+  // First load parent scripts by adding this to parent manager.
   if (mParentManager) {
     mParentManager->AddChildManager(this);
   }

content/base/src/nsFrameMessageManager.h

@@ -173,10 +173,10 @@ public:
     NS_ASSERTION(!mIsBroadcaster || !mCallback,
                  "Broadcasters cannot have callbacks!");
     // This is a bit hackish. When parent manager is global, we want
-    // to attach the window message manager to it immediately.
+    // to attach the message manager to it immediately.
     // Is it just the frame message manager which waits until the
     // content process is running.
-    if (mParentManager && (mCallback || IsWindowLevel())) {
+    if (mParentManager && (mCallback || IsBroadcaster())) {
       mParentManager->AddChildManager(this);
     }
     if (mOwnsCallback) {
@@ -258,7 +258,7 @@ public:
     mParentManager = aParent;
   }
   bool IsGlobal() { return mGlobal; }
-  bool IsWindowLevel() { return mParentManager && mParentManager->IsGlobal(); }
+  bool IsBroadcaster() { return mIsBroadcaster; }
 
   static nsFrameMessageManager* GetParentProcessManager()
   {
@@ -296,6 +296,9 @@ protected:
   nsFrameMessageManager* mParentManager;
   nsTArray<nsString> mPendingScripts;
   nsTArray<bool> mPendingScriptsGlobalStates;
+
+  void LoadPendingScripts(nsFrameMessageManager* aManager,
+                          nsFrameMessageManager* aChildMM);
 public:
   static nsFrameMessageManager* sParentProcessManager;
   static nsFrameMessageManager* sChildProcessManager;

content/base/src/nsGkAtomList.h

@@ -583,6 +583,7 @@ GK_ATOM(minpos, "minpos")
 GK_ATOM(minusSign, "minus-sign")
 GK_ATOM(minwidth, "minwidth")
 GK_ATOM(_mixed, "mixed")
+GK_ATOM(messagemanagergroup, "messagemanagergroup")
 GK_ATOM(mod, "mod")
 GK_ATOM(mode, "mode")
 GK_ATOM(modifiers, "modifiers")

content/base/src/nsHTMLContentSerializer.cpp

@@ -157,9 +157,9 @@ nsHTMLContentSerializer::SerializeHTMLAttributes(nsIContent* aContent,
     nsDependentAtomString nameStr(attrName);
     nsAutoString prefix;
     if (namespaceID == kNameSpaceID_XML) {
-      prefix.AssignLiteral("xml");
+      prefix.AssignLiteral(MOZ_UTF16("xml"));
     } else if (namespaceID == kNameSpaceID_XLink) {
-      prefix.AssignLiteral("xlink");
+      prefix.AssignLiteral(MOZ_UTF16("xlink"));
     }
 
     // Expand shorthand attribute.

content/base/src/nsInProcessTabChildGlobal.cpp

@@ -167,7 +167,11 @@ NS_IMETHODIMP
 nsInProcessTabChildGlobal::GetContent(nsIDOMWindow** aContent)
 {
   *aContent = nullptr;
-  nsCOMPtr<nsIDOMWindow> window = do_GetInterface(mDocShell);
+  if (!mDocShell) {
+    return NS_OK;
+  }
+
+  nsCOMPtr<nsIDOMWindow> window = mDocShell->GetWindow();
   window.swap(*aContent);
   return NS_OK;
 }
@@ -220,10 +224,12 @@ nsInProcessTabChildGlobal::DelayedDisconnect()
   DOMEventTargetHelper::DispatchTrustedEvent(NS_LITERAL_STRING("unload"));
 
   // Continue with the Disconnect cleanup
-  nsCOMPtr<nsPIDOMWindow> win = do_GetInterface(mDocShell);
-  if (win) {
-    MOZ_ASSERT(win->IsOuterWindow());
-    win->SetChromeEventHandler(win->GetChromeEventHandler());
+  if (mDocShell) {
+    nsCOMPtr<nsPIDOMWindow> win = mDocShell->GetWindow();
+    if (win) {
+      MOZ_ASSERT(win->IsOuterWindow());
+      win->SetChromeEventHandler(win->GetChromeEventHandler());
+    }
   }
   mDocShell = nullptr;
   mChromeMessageManager = nullptr;

content/base/src/nsObjectLoadingContent.cpp

@@ -1532,14 +1532,14 @@ nsObjectLoadingContent::UpdateObjectParameters(bool aJavaURI)
 
   if (isJava && hasCodebase && codebaseStr.IsEmpty()) {
     // Java treats codebase="" as "/"
-    codebaseStr.AssignLiteral("/");
+    codebaseStr.Assign('/');
     // XXX(johns): This doesn't cover the case of "https:" which java would
     //             interpret as "https:///" but we interpret as this document's
     //             URI but with a changed scheme.
   } else if (isJava && !hasCodebase) {
     // Java expects a directory as the codebase, or else it will construct
     // relative URIs incorrectly :(
-    codebaseStr.AssignLiteral(".");
+    codebaseStr.Assign('.');
   }
 
   if (!codebaseStr.IsEmpty()) {

content/base/src/nsPlainTextSerializer.cpp

@@ -1603,7 +1603,7 @@ nsPlainTextSerializer::Write(const nsAString& aStr)
         }
       }
 
-      mCurrentLine.AssignLiteral("");
+      mCurrentLine.Truncate();
       if (mFlags & nsIDocumentEncoder::OutputFormatFlowed) {
         if ((outputLineBreak || !spacesOnly) && // bugs 261467,125928
             !stringpart.EqualsLiteral("-- ") &&

content/base/src/nsXMLContentSerializer.cpp

@@ -98,10 +98,10 @@ nsXMLContentSerializer::Init(uint32_t aFlags, uint32_t aWrapColumn,
     mLineBreak.AssignLiteral("\r\n");
   }
   else if (mFlags & nsIDocumentEncoder::OutputCRLineBreak) { // Mac
-    mLineBreak.AssignLiteral("\r");
+    mLineBreak.Assign('\r');
   }
   else if (mFlags & nsIDocumentEncoder::OutputLFLineBreak) { // Unix/DOM
-    mLineBreak.AssignLiteral("\n");
+    mLineBreak.Assign('\n');
   }
   else {
     mLineBreak.AssignLiteral(NS_LINEBREAK);         // Platform/default
@@ -600,7 +600,7 @@ nsXMLContentSerializer::ConfirmPrefix(nsAString& aPrefix,
 void
 nsXMLContentSerializer::GenerateNewPrefix(nsAString& aPrefix)
 {
-  aPrefix.AssignLiteral("a");
+  aPrefix.Assign('a');
   char buf[128];
   PR_snprintf(buf, sizeof(buf), "%d", mPrefixIndex++);
   AppendASCIItoUTF16(buf, aPrefix);

content/base/test/browser_state_notifications.js

@@ -71,7 +71,7 @@ const isData = document => document.URL.startsWith("data:");
 
 const uri1 = "data:text/html;charset=utf-8,<h1>1</h1>";
 // For whatever reason going back on load event doesn't work so timeout it is :(
-const uri2 = "data:text/html;charset=utf-8,<h1>2</h1><script>setTimeout(back,100)</script>";
+const uri2 = "data:text/html;charset=utf-8,<h1>2</h1><script>setTimeout(SpecialPowers.wrap(window).back,100)</script>";
 const uri3 = "data:text/html;charset=utf-8,<h1>3</h1>";
 
 const uri4 = "chrome://browser/content/license.html";

content/base/test/chrome/chrome.ini

@@ -9,6 +9,11 @@ support-files =
   file_bug549682.xul
   file_bug616841.xul
   file_bug816340.xul
+  file_bug990812-1.xul
+  file_bug990812-2.xul
+  file_bug990812-3.xul
+  file_bug990812-4.xul
+  file_bug990812-5.xul
   fileconstructor_file.png
   frame_bug814638.xul
   host_bug814638.xul
@@ -45,6 +50,7 @@ support-files =
 [test_bug814638.xul]
 [test_bug816340.xul]
 [test_bug914381.html]
+[test_bug990812.xul]
 [test_cpows.xul]
 skip-if = toolkit == "cocoa"
 [test_document_register.xul]

content/base/test/chrome/file_bug990812-1.xul

@@ -0,0 +1,64 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css"
+                 type="text/css"?>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=990812
+-->
+<window title="Mozilla Bug 990812"
+  xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+  onload="start();">
+  <label value="Mozilla Bug 990812"/>
+  <!-- test code goes here -->
+  <script type="application/javascript"><![CDATA[
+
+    var FRAME_SCRIPT_GLOBAL = "data:,sendSyncMessage('test', 'global')";
+    var FRAME_SCRIPT_WINDOW = "data:,sendSyncMessage('test', 'window')";
+    var FRAME_SCRIPT_GROUP  = "data:,sendSyncMessage('test', 'group')";
+
+    var Cc = Components.classes;
+    var Ci = Components.interfaces;
+    var globalMM = Cc["@mozilla.org/globalmessagemanager;1"]
+                     .getService(Ci.nsIMessageListenerManager);
+
+    function is(val, exp, msg) {
+      opener.wrappedJSObject.is(val, exp, msg);
+    }
+
+    /**
+     * Ensures that delayed frame scripts are loaded in the expected order.
+     * Global frame scripts will be loaded before delayed frame scripts from
+     * window message managers. The latter will be loaded before group message
+     * manager frame scripts.
+     */
+    function start() {
+      globalMM.loadFrameScript(FRAME_SCRIPT_GLOBAL, true);
+      messageManager.loadFrameScript(FRAME_SCRIPT_WINDOW, true);
+      getGroupMessageManager("test").loadFrameScript(FRAME_SCRIPT_GROUP, true);
+
+      var order = ["global", "window", "group"];
+
+      messageManager.addMessageListener("test", function onMessage(msg) {
+        var next = order.shift();
+        opener.wrappedJSObject.is(msg.data, next, "received test:" + next);
+
+        if (order.length == 0) {
+          opener.setTimeout("next()");
+          window.close();
+        }
+      });
+
+      var browser = document.createElement("browser");
+      browser.setAttribute("messagemanagergroup", "test");
+      browser.setAttribute("src", "about:mozilla");
+      browser.setAttribute("type", "content-targetable");
+      document.documentElement.appendChild(browser);
+
+      globalMM.removeDelayedFrameScript(FRAME_SCRIPT_GLOBAL);
+      messageManager.removeDelayedFrameScript(FRAME_SCRIPT_WINDOW);
+      getGroupMessageManager("test").removeDelayedFrameScript(FRAME_SCRIPT_GROUP);
+    }
+
+  ]]></script>
+
+</window>

content/base/test/chrome/file_bug990812-2.xul

@@ -0,0 +1,59 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css"
+                 type="text/css"?>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=990812
+-->
+<window title="Mozilla Bug 990812"
+  xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+  onload="start();">
+  <label value="Mozilla Bug 990812"/>
+  <!-- test code goes here -->
+  <script type="application/javascript"><![CDATA[
+
+    var FRAME_SCRIPT = "data:,sendAsyncMessage('test')";
+    var order = ["group", "window", "global"];
+
+    var Cc = Components.classes;
+    var Ci = Components.interfaces;
+    var globalMM = Cc["@mozilla.org/globalmessagemanager;1"]
+                     .getService(Ci.nsIMessageListenerManager);
+
+    function is(val, exp, msg) {
+      opener.wrappedJSObject.is(val, exp, msg);
+    }
+
+    function promiseMessage(type, mm) {
+      return new Promise(function (resolve) {
+        mm.addMessageListener("test", function onMessage() {
+          mm.removeMessageListener("test", onMessage);
+          is(type, order.shift(), "correct type " + type);
+          resolve();
+        });
+      });
+    }
+
+    /**
+     * Tests that async messages sent by frame scripts bubble up as expected,
+     * passing the group, window, and global message managers in that order.
+     */
+    function start() {
+      var global = promiseMessage("global", globalMM);
+      var window = promiseMessage("window", messageManager);
+      var group = promiseMessage("group", getGroupMessageManager("test"));
+
+      var browser = document.querySelector("browser");
+      browser.messageManager.loadFrameScript(FRAME_SCRIPT, true);
+
+      Promise.all([global, window, group]).then(function () {
+        opener.setTimeout("next()");
+        window.close();
+      });
+    }
+
+  ]]></script>
+
+  <browser messagemanagergroup="test" type="content-targetable" src="about:mozilla" />
+
+</window>

content/base/test/chrome/file_bug990812-3.xul

@@ -0,0 +1,71 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css"
+                 type="text/css"?>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=990812
+-->
+<window title="Mozilla Bug 990812"
+  xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+  onload="start();">
+  <label value="Mozilla Bug 990812"/>
+  <!-- test code goes here -->
+  <script type="application/javascript"><![CDATA[
+
+    var FRAME_SCRIPT = "data:,addMessageListener('test', function (msg) {" +
+                       "sendSyncMessage('test', msg.data)})";
+
+    var Cc = Components.classes;
+    var Ci = Components.interfaces;
+    var globalMM = Cc["@mozilla.org/globalmessagemanager;1"]
+                     .getService(Ci.nsIMessageListenerManager);
+
+    function is(val, exp, msg) {
+      opener.wrappedJSObject.is(val, exp, msg);
+    }
+
+    function promiseMessage(type, mm) {
+      var order = [type, "window", "global"];
+
+      return new Promise(function (resolve) {
+        mm.addMessageListener("test", function onMessage(msg) {
+          is(msg.data, order.shift(), "correct message " + msg.data);
+
+          if (order.length == 0) {
+            mm.removeMessageListener("test", onMessage);
+            resolve();
+          }
+        });
+      });
+    }
+
+    /**
+     * Ensures that broadcasting an async message does only reach descendants
+     * of a specific message manager and respects message manager groups.
+     */
+    function start() {
+      var mm1 = document.querySelector("browser").messageManager;
+      var promise1 = promiseMessage("group1", mm1);
+      mm1.loadFrameScript(FRAME_SCRIPT, true);
+
+      var mm2 = document.querySelector("browser + browser").messageManager;
+      var promise2 = promiseMessage("group2", mm2);
+      mm2.loadFrameScript(FRAME_SCRIPT, true);
+
+      getGroupMessageManager("test1").broadcastAsyncMessage("test", "group1");
+      getGroupMessageManager("test2").broadcastAsyncMessage("test", "group2");
+      messageManager.broadcastAsyncMessage("test", "window");
+      globalMM.broadcastAsyncMessage("test", "global");
+
+      Promise.all([promise1, promise2]).then(function () {
+        opener.setTimeout("next()");
+        window.close();
+      });
+    }
+
+  ]]></script>
+
+  <browser messagemanagergroup="test1" type="content-targetable" src="about:mozilla" />
+  <browser messagemanagergroup="test2" type="content-targetable" src="about:mozilla" />
+
+</window>

content/base/test/chrome/file_bug990812-4.xul

@@ -0,0 +1,68 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css"
+                 type="text/css"?>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=990812
+-->
+<window title="Mozilla Bug 990812"
+  xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+  onload="start();">
+  <label value="Mozilla Bug 990812"/>
+  <!-- test code goes here -->
+  <script type="application/javascript"><![CDATA[
+
+    var FRAME_SCRIPT1 = "data:,addMessageListener('test', function () {" +
+                        "sendSyncMessage('test', 'frame1')})";
+    var FRAME_SCRIPT2 = "data:,addMessageListener('test', function () {" +
+                        "sendSyncMessage('test', 'frame2')})";
+
+    var Cc = Components.classes;
+    var Ci = Components.interfaces;
+    var globalMM = Cc["@mozilla.org/globalmessagemanager;1"]
+                     .getService(Ci.nsIMessageListenerManager);
+
+    function is(val, exp, msg) {
+      opener.wrappedJSObject.is(val, exp, msg);
+    }
+
+    function promiseMessage(type, mm) {
+      return new Promise(function (resolve) {
+        mm.addMessageListener("test", function onMessage(msg) {
+          mm.removeMessageListener("test", onMessage);
+          is(msg.data, type, "correct message " + type);
+          resolve();
+        });
+      });
+    }
+
+    /**
+     * Tests that swapping docShells works as expected wrt to groups.
+     */
+    function start() {
+      var browser1 = document.querySelector("browser");
+      browser1.messageManager.loadFrameScript(FRAME_SCRIPT1, true);
+
+      var browser2 = document.querySelector("browser + browser");
+      browser2.messageManager.loadFrameScript(FRAME_SCRIPT2, true);
+
+      var promise1 = promiseMessage("frame2", getGroupMessageManager("test1"));
+      var promise2 = promiseMessage("frame1", getGroupMessageManager("test2"));
+
+      var flo1 = browser1.QueryInterface(Ci.nsIFrameLoaderOwner);
+      var flo2 = browser2.QueryInterface(Ci.nsIFrameLoaderOwner);
+      flo1.swapFrameLoaders(flo2);
+      messageManager.broadcastAsyncMessage("test");
+
+      Promise.all([promise1, promise2]).then(function () {
+        opener.setTimeout("next()");
+        window.close();
+      });
+    }
+
+  ]]></script>
+
+  <browser messagemanagergroup="test1" type="content-targetable" src="about:mozilla" />
+  <browser messagemanagergroup="test2" type="content-targetable" src="about:mozilla" />
+
+</window>

content/base/test/chrome/file_bug990812-5.xul

@@ -0,0 +1,77 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css"
+                 type="text/css"?>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=990812
+-->
+<window title="Mozilla Bug 990812"
+  xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+  onload="start();">
+  <label value="Mozilla Bug 990812"/>
+  <!-- test code goes here -->
+  <script type="application/javascript"><![CDATA[
+
+    var FRAME_SCRIPT1 = "data:,addMessageListener('test', function () {" +
+                        "sendSyncMessage('test', 'group1')})";
+    var FRAME_SCRIPT2 = "data:,addMessageListener('test', function () {" +
+                        "sendSyncMessage('test', 'group2')})";
+
+    var Cc = Components.classes;
+    var Ci = Components.interfaces;
+    var globalMM = Cc["@mozilla.org/globalmessagemanager;1"]
+                     .getService(Ci.nsIMessageListenerManager);
+
+    function is(val, exp, msg) {
+      opener.wrappedJSObject.is(val, exp, msg);
+    }
+
+    function promiseTwoMessages(type, mm) {
+      var numLeft = 2;
+
+      return new Promise(function (resolve) {
+        mm.addMessageListener("test", function onMessage(msg) {
+          is(msg.data, type, "correct message " + type);
+
+          if (--numLeft == 0) {
+            mm.removeMessageListener("test", onMessage);
+            resolve();
+          }
+        });
+      });
+    }
+
+    /**
+     * This test ensures that having multiple message manager groups with
+     * multiple frame loaders in those works as expected. For a specific
+     * group message manager, frame scripts should only be loaded by its
+     * descendants and messages should only be received by and from those
+     * child message managers.
+     */
+    function start() {
+      var gmm1 = getGroupMessageManager("test1");
+      gmm1.loadFrameScript(FRAME_SCRIPT1, true);
+
+      var gmm2 = getGroupMessageManager("test2");
+      gmm2.loadFrameScript(FRAME_SCRIPT2, true);
+
+      var promise1 = promiseTwoMessages("group1", gmm1);
+      var promise2 = promiseTwoMessages("group2", gmm2);
+
+      messageManager.broadcastAsyncMessage("test");
+
+      Promise.all([promise1, promise2]).then(function () {
+        opener.setTimeout("next()");
+        window.close();
+      });
+    }
+
+  ]]></script>
+
+  <browser messagemanagergroup="test1" type="content-targetable" src="about:mozilla" />
+  <browser messagemanagergroup="test1" type="content-targetable" src="about:mozilla" />
+
+  <browser messagemanagergroup="test2" type="content-targetable" src="about:mozilla" />
+  <browser messagemanagergroup="test2" type="content-targetable" src="about:mozilla" />
+
+</window>

content/base/test/chrome/file_bug990812.xul

@@ -0,0 +1,58 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css"
+                 type="text/css"?>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=990812
+-->
+<window title="Mozilla Bug 990812"
+  xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+  onload="start();">
+  <label value="Mozilla Bug 990812"/>
+  <!-- test code goes here -->
+  <script type="application/javascript"><![CDATA[
+
+    var FRAME_SCRIPT_GLOBAL = "data:,sendSyncMessage('test', 'global')";
+    var FRAME_SCRIPT_WINDOW = "data:,sendSyncMessage('test', 'window')";
+    var FRAME_SCRIPT_GROUP  = "data:,sendSyncMessage('test', 'group')";
+
+    var Cc = Components.classes;
+    var Ci = Components.interfaces;
+    var globalMM = Cc["@mozilla.org/globalmessagemanager;1"]
+                     .getService(Ci.nsIMessageListenerManager);
+
+    function is(val, exp, msg) {
+      opener.wrappedJSObject.is(val, exp, msg);
+    }
+
+    function start() {
+      globalMM.loadFrameScript(FRAME_SCRIPT_GLOBAL, true);
+      messageManager.loadFrameScript(FRAME_SCRIPT_WINDOW, true);
+      getGroupMessageManager("test").loadFrameScript(FRAME_SCRIPT_GROUP, true);
+
+      var order = ["global", "window", "group"];
+
+      messageManager.addMessageListener("test", function onMessage(msg) {
+        var next = order.shift();
+        opener.wrappedJSObject.is(msg.data, next, "received test:" + next);
+
+        if (order.length == 0) {
+          opener.setTimeout("next()");
+          window.close();
+        }
+      });
+
+      var browser = document.createElement("browser");
+      browser.setAttribute("messagemanagergroup", "test");
+      browser.setAttribute("src", "about:mozilla");
+      browser.setAttribute("type", "content-targetable");
+      document.documentElement.appendChild(browser);
+
+      globalMM.removeDelayedFrameScript(FRAME_SCRIPT_GLOBAL);
+      messageManager.removeDelayedFrameScript(FRAME_SCRIPT_WINDOW);
+      getGroupMessageManager("test").removeDelayedFrameScript(FRAME_SCRIPT_GROUP);
+    }
+
+  ]]></script>
+
+</window>

content/base/test/chrome/test_bug990812.xul

@@ -0,0 +1,43 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css"
+                 type="text/css"?>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=990812
+-->
+<window title="Mozilla Bug 990812"
+  xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <script type="application/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+
+  <!-- test results are displayed in the html:body -->
+  <body xmlns="http://www.w3.org/1999/xhtml">
+  <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=990812"
+     target="_blank">Mozilla Bug 990812</a>
+  </body>
+
+  <!-- test code goes here -->
+  <script type="application/javascript"><![CDATA[
+  SimpleTest.waitForExplicitFinish();
+
+  var tests = [
+    "file_bug990812-1.xul",
+    "file_bug990812-2.xul",
+    "file_bug990812-3.xul",
+    "file_bug990812-4.xul",
+    "file_bug990812-5.xul",
+  ];
+
+  function next() {
+    if (tests.length > 0) {
+      var file = tests.shift();
+      info("-- running " + file);
+      window.open(file, "", "chrome");
+    } else {
+      SimpleTest.finish();
+    }
+  }
+
+  addLoadEvent(next);
+  ]]></script>
+</window>

content/canvas/src/CanvasRenderingContext2D.cpp

@@ -2313,6 +2313,7 @@ CanvasRenderingContext2D::SetFont(const nsAString& font,
                      fontStyle->mFont.sizeAdjust,
                      fontStyle->mFont.systemFont,
                      printerFont,
+                     fontStyle->mFont.variant == NS_STYLE_FONT_VARIANT_SMALL_CAPS,
                      fontStyle->mFont.languageOverride);
 
   fontStyle->mFont.AddFontFeaturesToStyle(&style);
@@ -3726,8 +3727,13 @@ CanvasRenderingContext2D::AsyncDrawXULElement(nsXULElement& elem,
 
   PBrowserParent *child = frameloader->GetRemoteBrowser();
   if (!child) {
-    nsCOMPtr<nsIDOMWindow> window =
-      do_GetInterface(frameloader->GetExistingDocShell());
+    nsIDocShell* docShell = frameLoader->GetExistingDocShell();
+    if (!docShell) {
+      error.Throw(NS_ERROR_FAILURE);
+      return;
+    }
+
+    nsCOMPtr<nsIDOMWindow> window = docShell->GetWindow();
     if (!window) {
       error.Throw(NS_ERROR_FAILURE);
       return;

content/html/content/src/HTMLInputElement.cpp

@@ -7277,44 +7277,6 @@ HTMLInputElement::SetFilePickerFiltersFromAccept(nsIFilePicker* filePicker)
   }
 }
 
-int32_t
-HTMLInputElement::GetFilterFromAccept()
-{
-  NS_ASSERTION(HasAttr(kNameSpaceID_None, nsGkAtoms::accept),
-               "You should not call GetFileFiltersFromAccept if the element"
-               " has no accept attribute!");
-
-  int32_t filter = 0;
-  nsAutoString accept;
-  GetAttr(kNameSpaceID_None, nsGkAtoms::accept, accept);
-
-  HTMLSplitOnSpacesTokenizer tokenizer(accept, ',');
-
-  while (tokenizer.hasMoreTokens()) {
-    const nsDependentSubstring token = tokenizer.nextToken();
-
-    int32_t tokenFilter = 0;
-    if (token.EqualsLiteral("image/*")) {
-      tokenFilter = nsIFilePicker::filterImages;
-    } else if (token.EqualsLiteral("audio/*")) {
-      tokenFilter = nsIFilePicker::filterAudio;
-    } else if (token.EqualsLiteral("video/*")) {
-      tokenFilter = nsIFilePicker::filterVideo;
-    }
-
-    if (tokenFilter) {
-      // We do not want to set more than one filter so if we found two different
-      // kwown tokens, we will return 0 (no filter).
-      if (filter && filter != tokenFilter) {
-        return 0;
-      }
-      filter = tokenFilter;
-    }
-  }
-
-  return filter;
-}
-
 Decimal
 HTMLInputElement::GetStepScaleFactor() const
 {

content/html/content/src/HTMLInputElement.h

@@ -303,21 +303,6 @@ public:
    */
   void SetFilePickerFiltersFromAccept(nsIFilePicker* filePicker);
 
-  /**
-   * Returns the filter which should be used for the file picker according to
-   * the accept attribute value.
-   *
-   * See:
-   * http://dev.w3.org/html5/spec/forms.html#attr-input-accept
-   *
-   * @return Filter to use on the file picker with AppendFilters, 0 if none.
-   *
-   * @note You should not call this function if the element has no @accept.
-   * @note This will only filter for one type of file. If more than one filter
-   * is specified by the accept attribute they will *all* be ignored.
-   */
-  int32_t GetFilterFromAccept();
-
   /**
    * The form might need to request an update of the UI bits
    * (BF_CAN_SHOW_INVALID_UI and BF_CAN_SHOW_VALID_UI) when an invalid form

content/media/webrtc/MediaEngineDefault.cpp

@@ -51,14 +51,14 @@ MediaEngineDefaultVideoSource::~MediaEngineDefaultVideoSource()
 void
 MediaEngineDefaultVideoSource::GetName(nsAString& aName)
 {
-  aName.AssignLiteral("Default Video Device");
+  aName.AssignLiteral(MOZ_UTF16("Default Video Device"));
   return;
 }
 
 void
 MediaEngineDefaultVideoSource::GetUUID(nsAString& aUUID)
 {
-  aUUID.AssignLiteral("1041FCBD-3F12-4F7B-9E9B-1EC556DD5676");
+  aUUID.AssignLiteral(MOZ_UTF16("1041FCBD-3F12-4F7B-9E9B-1EC556DD5676"));
   return;
 }
 
@@ -362,14 +362,14 @@ MediaEngineDefaultAudioSource::~MediaEngineDefaultAudioSource()
 void
 MediaEngineDefaultAudioSource::GetName(nsAString& aName)
 {
-  aName.AssignLiteral("Default Audio Device");
+  aName.AssignLiteral(MOZ_UTF16("Default Audio Device"));
   return;
 }
 
 void
 MediaEngineDefaultAudioSource::GetUUID(nsAString& aUUID)
 {
-  aUUID.AssignLiteral("B7CBD7C1-53EF-42F9-8353-73F61C70C092");
+  aUUID.AssignLiteral(MOZ_UTF16("B7CBD7C1-53EF-42F9-8353-73F61C70C092"));
   return;
 }
 

content/media/webrtc/MediaEngineTabVideoSource.cpp

@@ -109,13 +109,13 @@ MediaEngineTabVideoSource::InitRunnable::Run()
 void
 MediaEngineTabVideoSource::GetName(nsAString_internal& aName)
 {
-  aName.AssignLiteral("&getUserMedia.videoDevice.tabShare;");
+  aName.AssignLiteral(MOZ_UTF16("&getUserMedia.videoDevice.tabShare;"));
 }
 
 void
 MediaEngineTabVideoSource::GetUUID(nsAString_internal& aUuid)
 {
-  aUuid.AssignLiteral("uuid");
+  aUuid.AssignLiteral(MOZ_UTF16("uuid"));
 }
 
 nsresult

content/svg/content/src/SVGAnimatedPathSegList.cpp

@@ -203,4 +203,14 @@ SVGAnimatedPathSegList::SMILAnimatedPathSegList::ClearAnimValue()
   }
 }
 
+size_t
+SVGAnimatedPathSegList::SizeOfExcludingThis(MallocSizeOf aMallocSizeOf) const
+{
+  size_t total = mBaseVal.SizeOfExcludingThis(aMallocSizeOf);
+  if (mAnimVal) {
+    mAnimVal->SizeOfIncludingThis(aMallocSizeOf);
+  }
+  return total;
+}
+
 } // namespace mozilla

content/svg/content/src/SVGAnimatedPathSegList.h

@@ -7,6 +7,7 @@
 #define MOZILLA_SVGANIMATEDPATHSEGLIST_H__
 
 #include "mozilla/Attributes.h"
+#include "mozilla/MemoryReporting.h"
 #include "nsAutoPtr.h"
 #include "nsISMILAttr.h"
 #include "SVGPathData.h"
@@ -35,7 +36,7 @@ class SVGAnimationElement;
  * DOMSVGPathSegList::InternalListWillChangeTo) and frees consumers from having
  * to know or worry about wrappers (or forget about them!) for the most part.
  */
-class SVGAnimatedPathSegList
+class SVGAnimatedPathSegList MOZ_FINAL
 {
   // friends so that they can get write access to mBaseVal and mAnimVal
   friend class DOMSVGPathSeg;
@@ -88,6 +89,8 @@ public:
   /// Callers own the returned nsISMILAttr
   nsISMILAttr* ToSMILAttr(nsSVGElement* aElement);
 
+  size_t SizeOfExcludingThis(MallocSizeOf aMallocSizeOf) const;
+
 private:
 
   // mAnimVal is a pointer to allow us to determine if we're being animated or

content/svg/content/src/SVGPathData.cpp

@@ -1164,3 +1164,15 @@ SVGPathData::GetMarkerPositioningData(nsTArray<nsSVGMark> *aMarks) const
   }
 }
 
+size_t
+SVGPathData::SizeOfExcludingThis(MallocSizeOf aMallocSizeOf) const
+{
+  return mData.SizeOfExcludingThis(aMallocSizeOf);
+}
+
+size_t
+SVGPathData::SizeOfIncludingThis(MallocSizeOf aMallocSizeOf) const
+{
+  return aMallocSizeOf(this) + SizeOfExcludingThis(aMallocSizeOf);
+}
+

content/svg/content/src/SVGPathData.h

@@ -13,6 +13,7 @@
 #include "nsIWeakReferenceUtils.h"
 #include "mozilla/gfx/2D.h"
 #include "mozilla/gfx/Types.h"
+#include "mozilla/MemoryReporting.h"
 #include "mozilla/RefPtr.h"
 #include "nsSVGElement.h"
 #include "nsTArray.h"
@@ -173,6 +174,10 @@ public:
   const_iterator begin() const { return mData.Elements(); }
   const_iterator end() const { return mData.Elements() + mData.Length(); }
 
+  // memory reporting methods
+  size_t SizeOfExcludingThis(mozilla::MallocSizeOf aMallocSizeOf) const;
+  size_t SizeOfIncludingThis(mozilla::MallocSizeOf aMallocSizeOf) const;
+
   // Access to methods that can modify objects of this type is deliberately
   // limited. This is to reduce the chances of someone modifying objects of
   // this type without taking the necessary steps to keep DOM wrappers in sync.
@@ -232,7 +237,7 @@ protected:
  * sync, so we can safely expose any protected base class methods required by
  * the SMIL code.
  */
-class SVGPathDataAndInfo : public SVGPathData
+class SVGPathDataAndInfo MOZ_FINAL : public SVGPathData
 {
 public:
   SVGPathDataAndInfo(nsSVGElement *aElement = nullptr)

content/svg/content/src/SVGPathElement.cpp

@@ -46,6 +46,16 @@ SVGPathElement::SVGPathElement(already_AddRefed<nsINodeInfo>& aNodeInfo)
 {
 }
 
+//----------------------------------------------------------------------
+// memory reporting methods
+
+size_t
+SVGPathElement::SizeOfExcludingThis(mozilla::MallocSizeOf aMallocSizeOf) const
+{
+  return SVGPathElementBase::SizeOfExcludingThis(aMallocSizeOf) +
+         mD.SizeOfExcludingThis(aMallocSizeOf);
+}
+
 //----------------------------------------------------------------------
 // nsIDOMNode methods
 

content/svg/content/src/SVGPathElement.h

@@ -39,6 +39,9 @@ protected:
   SVGPathElement(already_AddRefed<nsINodeInfo>& aNodeInfo);
 
 public:
+  // DOM memory reporter participant
+  NS_DECL_SIZEOF_EXCLUDING_THIS
+
   // nsIContent interface
   NS_IMETHOD_(bool) IsAttributeMapped(const nsIAtom* name) const MOZ_OVERRIDE;
 

content/xul/document/src/XULDocument.cpp

@@ -4249,7 +4249,7 @@ XULDocument::BroadcasterHookup::~BroadcasterHookup()
         }
         else {
             mObservesElement->GetAttr(kNameSpaceID_None, nsGkAtoms::observes, broadcasterID);
-            attribute.AssignLiteral("*");
+            attribute.Assign('*');
         }
 
         nsAutoCString attributeC,broadcasteridC;
@@ -4398,7 +4398,7 @@ XULDocument::FindBroadcaster(Element* aElement,
         *aListener = aElement;
         NS_ADDREF(*aListener);
 
-        aAttribute.AssignLiteral("*");
+        aAttribute.Assign('*');
     }
 
     // Make sure we got a valid listener.
@@ -4700,9 +4700,11 @@ XULDocument::ParserObserver::OnStopRequest(nsIRequest *request,
 already_AddRefed<nsPIWindowRoot>
 XULDocument::GetWindowRoot()
 {
-    nsCOMPtr<nsIInterfaceRequestor> ir(mDocumentContainer);
-    nsCOMPtr<nsIDOMWindow> window(do_GetInterface(ir));
-    nsCOMPtr<nsPIDOMWindow> piWin(do_QueryInterface(window));
+  if (!mDocumentContainer) {
+    return nullptr;
+  }
+
+    nsCOMPtr<nsPIDOMWindow> piWin = mDocumentContainer->GetWindow();
     return piWin ? piWin->GetTopWindowRoot() : nullptr;
 }
 

content/xul/templates/src/nsXULContentUtils.cpp

@@ -438,13 +438,13 @@ nsXULContentUtils::SetCommandUpdater(nsIDocument* aDocument, nsIContent* aElemen
     nsAutoString events;
     aElement->GetAttr(kNameSpaceID_None, nsGkAtoms::events, events);
     if (events.IsEmpty())
-        events.AssignLiteral("*");
+        events.Assign('*');
 
     nsAutoString targets;
     aElement->GetAttr(kNameSpaceID_None, nsGkAtoms::targets, targets);
 
     if (targets.IsEmpty())
-        targets.AssignLiteral("*");
+        targets.Assign('*');
 
     nsCOMPtr<nsIDOMElement> domelement = do_QueryInterface(aElement);
     NS_ASSERTION(domelement != nullptr, "not a DOM element");

content/xul/templates/src/nsXULTemplateQueryProcessorXML.cpp

@@ -251,7 +251,7 @@ nsXULTemplateQueryProcessorXML::CompileQuery(nsIXULTemplateBuilder* aBuilder,
     // if an expression is not specified, then the default is to
     // just take all of the children
     if (expr.IsEmpty())
-        expr.AssignLiteral("*");
+        expr.Assign('*');
 
     nsCOMPtr<nsIDOMXPathExpression> compiledexpr;
     rv = CreateExpression(expr, aQueryNode, getter_AddRefs(compiledexpr));

docshell/base/nsDSURIContentListener.cpp

@@ -134,7 +134,8 @@ nsDSURIContentListener::DoContent(const char* aContentType,
     }
 
     if (loadFlags & nsIChannel::LOAD_RETARGETED_DOCUMENT_URI) {
-        nsCOMPtr<nsIDOMWindow> domWindow = do_GetInterface(static_cast<nsIDocShell*>(mDocShell));
+        nsCOMPtr<nsIDOMWindow> domWindow = mDocShell ? mDocShell->GetWindow()
+          : nullptr;
         NS_ENSURE_TRUE(domWindow, NS_ERROR_FAILURE);
         domWindow->Focus();
     }
@@ -286,7 +287,7 @@ bool nsDSURIContentListener::CheckOneFrameOptionsPolicy(nsIHttpChannel *httpChan
     // window, if we're not the top.  X-F-O: SAMEORIGIN requires that the
     // document must be same-origin with top window.  X-F-O: DENY requires that
     // the document must never be framed.
-    nsCOMPtr<nsIDOMWindow> thisWindow = do_GetInterface(static_cast<nsIDocShell*>(mDocShell));
+    nsCOMPtr<nsIDOMWindow> thisWindow = mDocShell->GetWindow();
     // If we don't have DOMWindow there is no risk of clickjacking
     if (!thisWindow)
         return true;
@@ -328,7 +329,7 @@ bool nsDSURIContentListener::CheckOneFrameOptionsPolicy(nsIHttpChannel *httpChan
         }
 
         bool system = false;
-        topDoc = do_GetInterface(parentDocShellItem);
+        topDoc = parentDocShellItem->GetDocument();
         if (topDoc) {
             if (NS_SUCCEEDED(ssm->IsSystemPrincipal(topDoc->NodePrincipal(),
                                                     &system)) && system) {
@@ -355,7 +356,7 @@ bool nsDSURIContentListener::CheckOneFrameOptionsPolicy(nsIHttpChannel *httpChan
         return false;
     }
 
-    topDoc = do_GetInterface(curDocShellItem);
+    topDoc = curDocShellItem->GetDocument();
     nsCOMPtr<nsIURI> topUri;
     topDoc->NodePrincipal()->GetURI(getter_AddRefs(topUri));
 
@@ -452,9 +453,9 @@ nsDSURIContentListener::ReportXFOViolation(nsIDocShellTreeItem* aTopDocShellItem
                                            nsIURI* aThisURI,
                                            XFOHeader aHeader)
 {
-    nsresult rv = NS_OK;
+  MOZ_ASSERT(aTopDocShellItem, "Need a top docshell");
 
-    nsCOMPtr<nsPIDOMWindow> topOuterWindow = do_GetInterface(aTopDocShellItem);
+    nsCOMPtr<nsPIDOMWindow> topOuterWindow = aTopDocShellItem->GetWindow();
     if (!topOuterWindow)
         return;
 
@@ -465,10 +466,8 @@ nsDSURIContentListener::ReportXFOViolation(nsIDocShellTreeItem* aTopDocShellItem
 
     nsCOMPtr<nsIURI> topURI;
 
-    nsCOMPtr<nsIDocument> document;
-
-    document = do_GetInterface(aTopDocShellItem);
-    rv = document->NodePrincipal()->GetURI(getter_AddRefs(topURI));
+    nsCOMPtr<nsIDocument> document = aTopDocShellItem->GetDocument();
+    nsresult rv = document->NodePrincipal()->GetURI(getter_AddRefs(topURI));
     if (NS_FAILED(rv))
         return;
 

docshell/base/nsDocShell.cpp

@@ -1125,8 +1125,7 @@ NS_IMETHODIMP nsDocShell::GetInterface(const nsIID & aIID, void **aSink)
         tabChild->
           GetMessageManager(getter_AddRefs(mm));
       } else {
-        nsCOMPtr<nsPIDOMWindow> win =
-          do_GetInterface(static_cast<nsIDocShell*>(this));
+        nsCOMPtr<nsPIDOMWindow> win = GetWindow();
         if (win) {
           mm = do_QueryInterface(win->GetParentTarget());
         }
@@ -1748,12 +1747,14 @@ nsDocShell::ValidateOrigin(nsIDocShellTreeItem* aOriginTreeItem,
         return true;
     }
 
+    MOZ_ASSERT(aOriginTreeItem && aTargetTreeItem, "need two docshells");
+
     // Get origin document principal
-    nsCOMPtr<nsIDocument> originDocument(do_GetInterface(aOriginTreeItem));
+    nsCOMPtr<nsIDocument> originDocument = aOriginTreeItem->GetDocument();
     NS_ENSURE_TRUE(originDocument, false);
 
     // Get target principal
-    nsCOMPtr<nsIDocument> targetDocument(do_GetInterface(aTargetTreeItem));
+    nsCOMPtr<nsIDocument> targetDocument = aTargetTreeItem->GetDocument();
     NS_ENSURE_TRUE(targetDocument, false);
 
     bool equal;
@@ -2093,7 +2094,7 @@ nsDocShell::GetChannelIsUnsafe(bool *aUnsafe)
 NS_IMETHODIMP
 nsDocShell::GetHasMixedActiveContentLoaded(bool* aHasMixedActiveContentLoaded)
 {
-    nsCOMPtr<nsIDocument> doc(do_GetInterface(GetAsSupports(this)));
+    nsCOMPtr<nsIDocument> doc(GetDocument());
     *aHasMixedActiveContentLoaded = doc && doc->GetHasMixedActiveContentLoaded();
     return NS_OK;
 }
@@ -2101,7 +2102,7 @@ nsDocShell::GetHasMixedActiveContentLoaded(bool* aHasMixedActiveContentLoaded)
 NS_IMETHODIMP
 nsDocShell::GetHasMixedActiveContentBlocked(bool* aHasMixedActiveContentBlocked)
 {
-    nsCOMPtr<nsIDocument> doc(do_GetInterface(GetAsSupports(this)));
+    nsCOMPtr<nsIDocument> doc(GetDocument());
     *aHasMixedActiveContentBlocked = doc && doc->GetHasMixedActiveContentBlocked();
     return NS_OK;
 }
@@ -2109,7 +2110,7 @@ nsDocShell::GetHasMixedActiveContentBlocked(bool* aHasMixedActiveContentBlocked)
 NS_IMETHODIMP
 nsDocShell::GetHasMixedDisplayContentLoaded(bool* aHasMixedDisplayContentLoaded)
 {
-    nsCOMPtr<nsIDocument> doc(do_GetInterface(GetAsSupports(this)));
+    nsCOMPtr<nsIDocument> doc(GetDocument());
     *aHasMixedDisplayContentLoaded = doc && doc->GetHasMixedDisplayContentLoaded();
     return NS_OK;
 }
@@ -2117,7 +2118,7 @@ nsDocShell::GetHasMixedDisplayContentLoaded(bool* aHasMixedDisplayContentLoaded)
 NS_IMETHODIMP
 nsDocShell::GetHasMixedDisplayContentBlocked(bool* aHasMixedDisplayContentBlocked)
 {
-    nsCOMPtr<nsIDocument> doc(do_GetInterface(GetAsSupports(this)));
+    nsCOMPtr<nsIDocument> doc(GetDocument());
     *aHasMixedDisplayContentBlocked = doc && doc->GetHasMixedDisplayContentBlocked();
     return NS_OK;
 }
@@ -2451,11 +2452,11 @@ nsDocShell::GetFullscreenAllowed(bool* aFullscreenAllowed)
     // has the allowfullscreen attribute set to true. If any ancestor
     // iframe does not have mozallowfullscreen=true, then fullscreen is
     // prohibited.
-    nsCOMPtr<nsPIDOMWindow> win = do_GetInterface(GetAsSupports(this));
+    nsCOMPtr<nsPIDOMWindow> win = GetWindow();
     if (!win) {
         return NS_OK;
     }
-    nsCOMPtr<nsIContent> frameElement = do_QueryInterface(win->GetFrameElementInternal());
+    nsCOMPtr<Element> frameElement = win->GetFrameElementInternal();
     if (frameElement &&
         frameElement->IsHTML(nsGkAtoms::iframe) &&
         !frameElement->HasAttr(kNameSpaceID_None, nsGkAtoms::allowfullscreen) &&
@@ -2466,11 +2467,8 @@ nsDocShell::GetFullscreenAllowed(bool* aFullscreenAllowed)
     // If we have no parent then we're the root docshell; no ancestor of the
     // original docshell doesn't have a allowfullscreen attribute, so
     // report fullscreen as allowed.
-    nsCOMPtr<nsIDocShellTreeItem> dsti = do_GetInterface(GetAsSupports(this));
-    NS_ENSURE_TRUE(dsti, NS_OK);
-
     nsCOMPtr<nsIDocShellTreeItem> parentTreeItem;
-    dsti->GetParent(getter_AddRefs(parentTreeItem));
+    GetParent(getter_AddRefs(parentTreeItem));
     if (!parentTreeItem) {
         *aFullscreenAllowed = true;
         return NS_OK;
@@ -3248,7 +3246,7 @@ nsDocShell::CanAccessItem(nsIDocShellTreeItem* aTargetItem,
         return false;
     }
 
-    nsCOMPtr<nsIDOMWindow> targetWindow = do_GetInterface(aTargetItem);
+    nsCOMPtr<nsIDOMWindow> targetWindow = aTargetItem->GetWindow();
     if (!targetWindow) {
         NS_ERROR("This should not happen, really");
         return false;
@@ -3269,7 +3267,7 @@ nsDocShell::CanAccessItem(nsIDocShellTreeItem* aTargetItem,
 static bool
 ItemIsActive(nsIDocShellTreeItem *aItem)
 {
-    nsCOMPtr<nsIDOMWindow> window(do_GetInterface(aItem));
+    nsCOMPtr<nsIDOMWindow> window = aItem->GetWindow();
 
     if (window) {
         bool isClosed;
@@ -4126,6 +4124,20 @@ nsDocShell::GetScriptGlobalObject()
     return mScriptGlobal;
 }
 
+nsIDocument*
+nsDocShell::GetDocument()
+{
+  NS_ENSURE_SUCCESS(EnsureContentViewer(), nullptr);
+  return mContentViewer->GetDocument();
+}
+
+nsPIDOMWindow*
+nsDocShell::GetWindow()
+{
+  NS_ENSURE_SUCCESS(EnsureScriptEnvironment(), nullptr);
+  return mScriptGlobal;
+}
+
 NS_IMETHODIMP
 nsDocShell::SetDeviceSizeIsPageSize(bool aValue)
 {
@@ -4612,7 +4624,7 @@ nsDocShell::DisplayLoadError(nsresult aError, nsIURI *aURI,
       // If the page doesn't have a title, we will use a blank space which will be trimmed
       // and thus treated as empty by the front-end.
       if (messageStr.IsEmpty()) {
-        messageStr.Assign(' ');
+        messageStr.AssignLiteral(MOZ_UTF16(" "));
       }
     }
     else {
@@ -4699,7 +4711,7 @@ nsDocShell::DisplayLoadError(nsresult aError, nsIURI *aURI,
             if (aURI) {
                 aURI->GetHostPort(hostport);
             } else {
-                hostport.AssignLiteral("?");
+                hostport.Assign('?');
             }
             CopyUTF8toUTF16(hostport, formatStrs[formatStrCount++]);
         }
@@ -4725,7 +4737,7 @@ nsDocShell::DisplayLoadError(nsresult aError, nsIURI *aURI,
                 rv = textToSubURI->UnEscapeURIForUI(charset, spec, formatStrs[formatStrCount]);
             }
         } else {
-            spec.AssignLiteral("?");
+            spec.Assign('?');
         }
         if (NS_FAILED(rv))
             CopyUTF8toUTF16(spec, formatStrs[formatStrCount]);
@@ -4925,7 +4937,7 @@ nsDocShell::Reload(uint32_t aReloadFlags)
         rv = LoadHistoryEntry(mLSHE, loadType);
     }
     else {
-        nsCOMPtr<nsIDocument> doc(do_GetInterface(GetAsSupports(this)));
+        nsCOMPtr<nsIDocument> doc(GetDocument());
 
         // Do not inherit owner from document
         uint32_t flags = INTERNAL_LOAD_FLAGS_NONE;
@@ -5769,7 +5781,7 @@ nsDocShell::GetAllowMixedContentAndConnectionData(bool* aRootHasSecureConnection
   *aIsRootDocShell = sameTypeRoot.get() == static_cast<nsIDocShellTreeItem *>(this);
 
   // now get the document from sameTypeRoot
-  nsCOMPtr<nsIDocument> rootDoc = do_GetInterface(sameTypeRoot);
+  nsCOMPtr<nsIDocument> rootDoc = sameTypeRoot->GetDocument();
   if (rootDoc) {
     nsCOMPtr<nsIPrincipal> rootPrincipal = rootDoc->NodePrincipal();
 
@@ -7215,12 +7227,12 @@ nsDocShell::EnsureContentViewer()
     nsCOMPtr<nsIDocShellTreeItem> parentItem;
     GetSameTypeParent(getter_AddRefs(parentItem));
     if (parentItem) {
-        nsCOMPtr<nsPIDOMWindow> domWin = do_GetInterface(GetAsSupports(this));
+        nsCOMPtr<nsPIDOMWindow> domWin = GetWindow();
         if (domWin) {
-            nsCOMPtr<nsIContent> parentContent =
-                do_QueryInterface(domWin->GetFrameElementInternal());
-            if (parentContent) {
-                baseURI = parentContent->GetBaseURI();
+            nsCOMPtr<Element> parentElement =
+                domWin->GetFrameElementInternal();
+            if (parentElement) {
+                baseURI = parentElement->GetBaseURI();
             }
         }
     }
@@ -7228,7 +7240,7 @@ nsDocShell::EnsureContentViewer()
     nsresult rv = CreateAboutBlankContentViewer(principal, baseURI);
 
     if (NS_SUCCEEDED(rv)) {
-        nsCOMPtr<nsIDocument> doc(do_GetInterface(GetAsSupports(this)));
+        nsCOMPtr<nsIDocument> doc(GetDocument());
         NS_ASSERTION(doc,
                      "Should have doc if CreateAboutBlankContentViewer "
                      "succeeded!");
@@ -7618,7 +7630,7 @@ nsDocShell::FinishRestore()
       ReattachEditorToWindow(mOSHE);
     }
 
-    nsCOMPtr<nsIDocument> doc = do_GetInterface(GetAsSupports(this));
+    nsCOMPtr<nsIDocument> doc = GetDocument();
     if (doc) {
         // Finally, we remove the request from the loadgroup.  This will
         // cause onStateChange(STATE_STOP) to fire, which will fire the
@@ -7981,8 +7993,9 @@ nsDocShell::RestoreFromHistory()
     if (document) {
         nsCOMPtr<nsIDocShellTreeItem> parent;
         GetParent(getter_AddRefs(parent));
-        nsCOMPtr<nsIDocument> d = do_GetInterface(parent);
-        if (d) {
+        if (parent) {
+          nsCOMPtr<nsIDocument> d = parent->GetDocument();
+          if (d) {
             if (d->EventHandlingSuppressed()) {
                 document->SuppressEventHandling(nsIDocument::eEvents,
                                                 d->EventHandlingSuppressed());
@@ -7996,8 +8009,9 @@ nsDocShell::RestoreFromHistory()
 
             nsCOMPtr<nsPIDOMWindow> parentWindow = d->GetWindow();
             if (parentWindow) {
-                parentSuspendCount = parentWindow->TimeoutSuspendCount();
+              parentSuspendCount = parentWindow->TimeoutSuspendCount();
             }
+          }
         }
 
         // Use the uri from the mLSHE we had when we entered this function
@@ -8013,8 +8027,7 @@ nsDocShell::RestoreFromHistory()
     // This is the end of our CreateContentViewer() replacement.
     // Now we simulate a load.  First, we restore the state of the javascript
     // window object.
-    nsCOMPtr<nsPIDOMWindow> privWin =
-        do_GetInterface(static_cast<nsIInterfaceRequestor*>(this));
+    nsCOMPtr<nsPIDOMWindow> privWin = GetWindow();
     NS_ASSERTION(privWin, "could not get nsPIDOMWindow interface");
 
     rv = privWin->RestoreWindowState(windowState);
@@ -8604,7 +8617,7 @@ nsDocShell::SetupNewViewer(nsIContentViewer * aNewViewer)
 nsresult
 nsDocShell::SetDocCurrentStateObj(nsISHEntry *shEntry)
 {
-    nsCOMPtr<nsIDocument> document = do_GetInterface(GetAsSupports(this));
+    nsCOMPtr<nsIDocument> document = GetDocument();
     NS_ENSURE_TRUE(document, NS_ERROR_FAILURE);
 
     nsCOMPtr<nsIStructuredCloneContainer> scContainer;
@@ -8650,7 +8663,7 @@ nsDocShell::CheckLoadingPermissions()
     // or any of its ancestors.
     nsCOMPtr<nsIDocShellTreeItem> item(this);
     do {
-        nsCOMPtr<nsIScriptGlobalObject> sgo(do_GetInterface(item));
+        nsCOMPtr<nsIScriptGlobalObject> sgo = do_GetInterface(item);
         nsCOMPtr<nsIScriptObjectPrincipal> sop(do_QueryInterface(sgo));
 
         nsIPrincipal *p;
@@ -9037,8 +9050,7 @@ nsDocShell::InternalLoad(nsIURI * aURI,
                 }
             }
 
-            nsCOMPtr<nsPIDOMWindow> win =
-                do_GetInterface(GetAsSupports(this));
+            nsCOMPtr<nsPIDOMWindow> win = GetWindow();
             NS_ENSURE_TRUE(win, NS_ERROR_NOT_AVAILABLE);
 
             nsDependentString name(aWindowTarget);
@@ -9099,8 +9111,7 @@ nsDocShell::InternalLoad(nsIURI * aURI,
                     // So, the best we can do, is to tear down the new window
                     // that was just created!
                     //
-                    nsCOMPtr<nsIDOMWindow> domWin =
-                        do_GetInterface(targetDocShell);
+                    nsCOMPtr<nsIDOMWindow> domWin = targetDocShell->GetWindow();
                     if (domWin) {
                         domWin->Close();
                     }
@@ -9411,8 +9422,7 @@ nsDocShell::InternalLoad(nsIURI * aURI,
             }
 
             // Set the doc's URI according to the new history entry's URI.
-            nsCOMPtr<nsIDocument> doc =
-              do_GetInterface(GetAsSupports(this));
+            nsCOMPtr<nsIDocument> doc = GetDocument();
             NS_ENSURE_TRUE(doc, NS_ERROR_FAILURE);
             doc->SetDocumentURI(aURI);
 
@@ -9623,7 +9633,7 @@ nsDocShell::GetInheritedPrincipal(bool aConsiderCurrentDocument)
         nsCOMPtr<nsIDocShellTreeItem> parentItem;
         GetSameTypeParent(getter_AddRefs(parentItem));
         if (parentItem) {
-            document = do_GetInterface(parentItem);
+            document = parentItem->GetDocument();
         }
     }
 
@@ -9710,15 +9720,17 @@ nsDocShell::DoURILoad(nsIURI * aURI,
         nsCOMPtr<nsIContentSecurityPolicy> csp;
         nsCOMPtr<nsIDocShellTreeItem> parentItem;
         GetSameTypeParent(getter_AddRefs(parentItem));
-        nsCOMPtr<nsIDocument> doc = do_GetInterface(parentItem);
-        if (doc) {
+        if (parentItem) {
+          nsCOMPtr<nsIDocument> doc = parentItem->GetDocument();
+          if (doc) {
             rv = doc->NodePrincipal()->GetCsp(getter_AddRefs(csp));
             NS_ENSURE_SUCCESS(rv, rv);
             if (csp) {
-                channelPolicy = do_CreateInstance("@mozilla.org/nschannelpolicy;1");
-                channelPolicy->SetContentSecurityPolicy(csp);
-                channelPolicy->SetLoadType(nsIContentPolicy::TYPE_SUBDOCUMENT);
+              channelPolicy = do_CreateInstance("@mozilla.org/nschannelpolicy;1");
+              channelPolicy->SetContentSecurityPolicy(csp);
+              channelPolicy->SetLoadType(nsIContentPolicy::TYPE_SUBDOCUMENT);
             }
+          }
         }
 
         // Only allow view-source scheme in top-level docshells. view-source is
@@ -10631,7 +10643,7 @@ nsDocShell::AddState(JS::Handle<JS::Value> aData, const nsAString& aTitle,
         aReplace = true;
     }
 
-    nsCOMPtr<nsIDocument> document = do_GetInterface(GetAsSupports(this));
+    nsCOMPtr<nsIDocument> document = GetDocument();
     NS_ENSURE_TRUE(document, NS_ERROR_FAILURE);
 
     // Step 1: Serialize aData using structured clone.
@@ -10642,8 +10654,7 @@ nsDocShell::AddState(JS::Handle<JS::Value> aData, const nsAString& aTitle,
     // 634834)  To protect against this, we abort if our principal changes due
     // to the InitFromJSVal() call.
     {
-        nsCOMPtr<nsIDocument> origDocument =
-            do_GetInterface(GetAsSupports(this));
+        nsCOMPtr<nsIDocument> origDocument = GetDocument();
         if (!origDocument)
             return NS_ERROR_DOM_SECURITY_ERR;
         nsCOMPtr<nsIPrincipal> origPrincipal = origDocument->NodePrincipal();
@@ -10664,8 +10675,7 @@ nsDocShell::AddState(JS::Handle<JS::Value> aData, const nsAString& aTitle,
         }
         NS_ENSURE_SUCCESS(rv, rv);
 
-        nsCOMPtr<nsIDocument> newDocument =
-            do_GetInterface(GetAsSupports(this));
+        nsCOMPtr<nsIDocument> newDocument = GetDocument();
         if (!newDocument)
             return NS_ERROR_DOM_SECURITY_ERR;
         nsCOMPtr<nsIPrincipal> newPrincipal = newDocument->NodePrincipal();
@@ -12216,7 +12226,7 @@ nsDocShell::GetAssociatedWindow(nsIDOMWindow** aWindow)
 NS_IMETHODIMP
 nsDocShell::GetTopWindow(nsIDOMWindow** aWindow)
 {
-    nsCOMPtr<nsIDOMWindow> win = do_GetInterface(GetAsSupports(this));
+    nsCOMPtr<nsIDOMWindow> win = GetWindow();
     if (win) {
         win->GetTop(aWindow);
     }
@@ -12227,7 +12237,7 @@ NS_IMETHODIMP
 nsDocShell::GetTopFrameElement(nsIDOMElement** aElement)
 {
     *aElement = nullptr;
-    nsCOMPtr<nsIDOMWindow> win = do_GetInterface(GetAsSupports(this));
+    nsCOMPtr<nsIDOMWindow> win = GetWindow();
     if (!win) {
         return NS_OK;
     }
@@ -12345,9 +12355,7 @@ nsDocShell::EnsureCommandHandler()
       do_CreateInstance("@mozilla.org/embedcomp/command-manager;1");
     if (!commandUpdater) return NS_ERROR_OUT_OF_MEMORY;
     
-    nsCOMPtr<nsIDOMWindow> domWindow =
-      do_GetInterface(static_cast<nsIInterfaceRequestor *>(this));
-
+    nsCOMPtr<nsIDOMWindow> domWindow = GetWindow();
     nsresult rv = commandUpdater->Init(domWindow);
     if (NS_SUCCEEDED(rv))
       mCommandManager = do_QueryInterface(commandUpdater);

docshell/base/nsDocShellEditorData.cpp

@@ -8,7 +8,7 @@
 #include "nsDocShellEditorData.h"
 #include "nsIInterfaceRequestorUtils.h"
 #include "nsComponentManagerUtils.h"
-#include "nsIDOMWindow.h"
+#include "nsPIDOMWindow.h"
 #include "nsIDOMDocument.h"
 #include "nsIEditor.h"
 #include "nsIEditingSession.h"
@@ -102,8 +102,9 @@ nsDocShellEditorData::CreateEditor()
   nsCOMPtr<nsIEditingSession>   editingSession;    
   nsresult rv = GetEditingSession(getter_AddRefs(editingSession));
   if (NS_FAILED(rv)) return rv;
-  
-  nsCOMPtr<nsIDOMWindow>    domWindow = do_GetInterface(mDocShell);
+ 
+  nsCOMPtr<nsIDOMWindow>    domWindow =
+    mDocShell ? mDocShell->GetWindow() : nullptr;
   rv = editingSession->SetupEditorOnWindow(domWindow);
   if (NS_FAILED(rv)) return rv;
   
@@ -201,7 +202,8 @@ nsDocShellEditorData::DetachFromWindow()
   NS_ASSERTION(mEditingSession,
                "Can't detach when we don't have a session to detach!");
   
-  nsCOMPtr<nsIDOMWindow> domWindow = do_GetInterface(mDocShell);
+  nsCOMPtr<nsIDOMWindow> domWindow =
+    mDocShell ? mDocShell->GetWindow() : nullptr;
   nsresult rv = mEditingSession->DetachFromWindow(domWindow);
   NS_ENSURE_SUCCESS(rv, rv);
 
@@ -225,7 +227,8 @@ nsDocShellEditorData::ReattachToWindow(nsIDocShell* aDocShell)
 {
   mDocShell = aDocShell;
 
-  nsCOMPtr<nsIDOMWindow> domWindow = do_GetInterface(mDocShell);
+  nsCOMPtr<nsIDOMWindow> domWindow =
+    mDocShell ? mDocShell->GetWindow() : nullptr;
   nsresult rv = mEditingSession->ReattachToWindow(domWindow);
   NS_ENSURE_SUCCESS(rv, rv);
 

docshell/base/nsIDocShell.idl

@@ -45,7 +45,7 @@ interface nsIScrollObserver;
 
 typedef unsigned long nsLoadFlags;
 
-[scriptable, builtinclass, uuid(e46d924d-c20f-4add-8cf5-1e1c817b2181)]
+[scriptable, builtinclass, uuid(3ca96c12-b69d-4b54-83c5-25a18d32a22b)]
 interface nsIDocShell : nsIDocShellTreeItem
 {
   /**

docshell/base/nsIDocShellTreeItem.idl

@@ -7,6 +7,8 @@
 #include "nsISupports.idl"
 
 interface nsIDocShellTreeOwner;
+interface nsIDocument;
+interface nsPIDOMWindow;
 
 
 /**
@@ -15,7 +17,7 @@ interface nsIDocShellTreeOwner;
  * node or a leaf. 
  */
 
-[scriptable, uuid(f897f4af-f67e-4115-9d37-ce09f71122e2)]
+[scriptable, uuid(edb99640-8378-4106-8673-e701a086eb1c)]
 interface nsIDocShellTreeItem : nsISupports
 {
 	/*
@@ -175,5 +177,8 @@ interface nsIDocShellTreeItem : nsISupports
 	                                      in boolean aSameType,
 	                                      in nsIDocShellTreeItem aRequestor,
 	                                      in nsIDocShellTreeItem aOriginalRequestor);
+
+  [noscript,nostdcall,notxpcom] nsIDocument getDocument();
+  [noscript,nostdcall,notxpcom] nsPIDOMWindow getWindow();
 };
 

docshell/test/test_bug669671.html

@@ -91,7 +91,7 @@ function test()
   // Step 5 - Go back.  This should result in another onload (because the file is
   // not in bfcache) and should be the fourth time we've requested the sjs file.
   checkPopupLoadCount();
-  popup.back();
+  SpecialPowers.wrap(popup).back();
   yield undefined;
 
   // This is the check which was failing before we fixed the bug.
@@ -110,7 +110,7 @@ function test()
   popup.location = 'file_bug669671.sjs?navigated-2';
   yield undefined;
   checkPopupLoadCount();
-  popup.back();
+  SpecialPowers.wrap(popup).back();
   yield undefined;
   checkPopupLoadCount();
   popup.close();
@@ -124,7 +124,7 @@ function test()
   popup.location = 'file_bug669671.sjs?navigated-3';
   yield undefined;
   checkPopupLoadCount();
-  popup.back();
+  SpecialPowers.wrap(popup).back();
   yield undefined;
   is(popup.document.body.innerHTML, initialCount + '',
      'Load count (should be cached)');

dom/base/nsDOMWindowList.cpp

@@ -91,7 +91,7 @@ nsDOMWindowList::IndexedGetter(uint32_t aIndex, bool& aFound)
     return nullptr;
   }
 
-  nsCOMPtr<nsIDOMWindow> window = do_GetInterface(item);
+  nsCOMPtr<nsIDOMWindow> window = item->GetWindow();
   MOZ_ASSERT(window);
 
   aFound = true;

dom/base/nsFocusManager.cpp

@@ -377,12 +377,11 @@ NS_IMETHODIMP nsFocusManager::SetFocusedWindow(nsIDOMWindow* aWindowToFocus)
 
   windowToFocus = windowToFocus->GetOuterWindow();
 
-  nsCOMPtr<nsIContent> frameContent =
-    do_QueryInterface(windowToFocus->GetFrameElementInternal());
-  if (frameContent) {
+  nsCOMPtr<Element> frameElement = windowToFocus->GetFrameElementInternal();
+  if (frameElement) {
     // pass false for aFocusChanged so that the caret does not get updated
     // and scrolling does not occur.
-    SetFocusInner(frameContent, 0, false, true);
+    SetFocusInner(frameElement, 0, false, true);
   }
   else {
     // this is a top-level window. If the window has a child frame focused,
@@ -662,8 +661,7 @@ nsFocusManager::WindowRaised(nsIDOMWindow* aWindow)
   if (mActiveWindow)
     WindowLowered(mActiveWindow);
 
-  nsCOMPtr<nsIWebNavigation> webnav(do_GetInterface(aWindow));
-  nsCOMPtr<nsIDocShellTreeItem> docShellAsItem(do_QueryInterface(webnav));
+  nsCOMPtr<nsIDocShellTreeItem> docShellAsItem = window->GetDocShell();
   // If there's no docShellAsItem, this window must have been closed,
   // in that case there is no tree owner.
   NS_ENSURE_TRUE(docShellAsItem, NS_OK);
@@ -805,10 +803,12 @@ nsFocusManager::ContentRemoved(nsIDocument* aDocument, nsIContent* aContent)
       // so that no element is focused.
       nsIDocument* subdoc = aDocument->GetSubDocumentFor(content);
       if (subdoc) {
-        nsCOMPtr<nsISupports> container = subdoc->GetContainer();
-        nsCOMPtr<nsPIDOMWindow> childWindow = do_GetInterface(container);
-        if (childWindow && IsSameOrAncestor(childWindow, mFocusedWindow)) {
-          ClearFocus(mActiveWindow);
+        nsCOMPtr<nsIDocShell> docShell = subdoc->GetDocShell();
+        if (docShell) {
+          nsCOMPtr<nsPIDOMWindow> childWindow = docShell->GetWindow();
+          if (childWindow && IsSameOrAncestor(childWindow, mFocusedWindow)) {
+            ClearFocus(mActiveWindow);
+          }
         }
       }
     }
@@ -968,14 +968,16 @@ nsFocusManager::WindowHidden(nsIDOMWindow* aWindow)
   // ensures that the focused window isn't in a chain of frames that doesn't
   // exist any more.
   if (window != mFocusedWindow) {
-    nsCOMPtr<nsIWebNavigation> webnav(do_GetInterface(mFocusedWindow));
-    nsCOMPtr<nsIDocShellTreeItem> dsti = do_QueryInterface(webnav);
+    nsCOMPtr<nsIDocShellTreeItem> dsti =
+      mFocusedWindow ? mFocusedWindow->GetDocShell() : nullptr;
     if (dsti) {
       nsCOMPtr<nsIDocShellTreeItem> parentDsti;
       dsti->GetParent(getter_AddRefs(parentDsti));
-      nsCOMPtr<nsPIDOMWindow> parentWindow = do_GetInterface(parentDsti);
-      if (parentWindow)
-        parentWindow->SetFocusedNode(nullptr);
+      if (parentDsti) {
+        nsCOMPtr<nsPIDOMWindow> parentWindow = parentDsti->GetWindow();
+        if (parentWindow)
+          parentWindow->SetFocusedNode(nullptr);
+      }
     }
 
     SetFocusedWindowInternal(window);
@@ -1144,13 +1146,12 @@ nsFocusManager::SetFocusInner(nsIContent* aNewContent, int32_t aFlags,
   // new root docshell for the new element with the active window's docshell.
   bool isElementInActiveWindow = false;
 
-  nsCOMPtr<nsIWebNavigation> webnav = do_GetInterface(newWindow);
-  nsCOMPtr<nsIDocShellTreeItem> dsti = do_QueryInterface(webnav);
+  nsCOMPtr<nsIDocShellTreeItem> dsti = newWindow->GetDocShell();
   nsCOMPtr<nsPIDOMWindow> newRootWindow;
   if (dsti) {
     nsCOMPtr<nsIDocShellTreeItem> root;
     dsti->GetRootTreeItem(getter_AddRefs(root));
-    newRootWindow = do_GetInterface(root);
+    newRootWindow = root ? root->GetWindow() : nullptr;
 
     isElementInActiveWindow = (mActiveWindow && newRootWindow == mActiveWindow);
   }
@@ -1276,11 +1277,12 @@ bool
 nsFocusManager::IsSameOrAncestor(nsPIDOMWindow* aPossibleAncestor,
                                  nsPIDOMWindow* aWindow)
 {
-  nsCOMPtr<nsIWebNavigation> awebnav(do_GetInterface(aPossibleAncestor));
-  nsCOMPtr<nsIDocShellTreeItem> ancestordsti = do_QueryInterface(awebnav);
+  if (!aWindow || !aPossibleAncestor) {
+    return false;
+  }
 
-  nsCOMPtr<nsIWebNavigation> fwebnav(do_GetInterface(aWindow));
-  nsCOMPtr<nsIDocShellTreeItem> dsti = do_QueryInterface(fwebnav);
+  nsCOMPtr<nsIDocShellTreeItem> ancestordsti = aPossibleAncestor->GetDocShell();
+  nsCOMPtr<nsIDocShellTreeItem> dsti = aWindow->GetDocShell();
   while (dsti) {
     if (dsti == ancestordsti)
       return true;
@@ -1296,12 +1298,12 @@ already_AddRefed<nsPIDOMWindow>
 nsFocusManager::GetCommonAncestor(nsPIDOMWindow* aWindow1,
                                   nsPIDOMWindow* aWindow2)
 {
-  nsCOMPtr<nsIWebNavigation> webnav(do_GetInterface(aWindow1));
-  nsCOMPtr<nsIDocShellTreeItem> dsti1 = do_QueryInterface(webnav);
+  NS_ENSURE_TRUE(aWindow1 && aWindow2, nullptr);
+
+  nsCOMPtr<nsIDocShellTreeItem> dsti1 = aWindow1->GetDocShell();
   NS_ENSURE_TRUE(dsti1, nullptr);
 
-  webnav = do_GetInterface(aWindow2);
-  nsCOMPtr<nsIDocShellTreeItem> dsti2 = do_QueryInterface(webnav);
+  nsCOMPtr<nsIDocShellTreeItem> dsti2 = aWindow2->GetDocShell();
   NS_ENSURE_TRUE(dsti2, nullptr);
 
   nsAutoTArray<nsIDocShellTreeItem*, 30> parents1, parents2;
@@ -1331,7 +1333,7 @@ nsFocusManager::GetCommonAncestor(nsPIDOMWindow* aWindow1,
     parent = child1;
   }
 
-  nsCOMPtr<nsPIDOMWindow> window = do_GetInterface(parent);
+  nsCOMPtr<nsPIDOMWindow> window = parent ? parent->GetWindow() : nullptr;
   return window.forget();
 }
 
@@ -1345,17 +1347,18 @@ nsFocusManager::AdjustWindowFocus(nsPIDOMWindow* aWindow,
   while (window) {
     // get the containing <iframe> or equivalent element so that it can be
     // focused below.
-    nsCOMPtr<nsIContent> frameContent =
-      do_QueryInterface(window->GetFrameElementInternal());
+    nsCOMPtr<Element> frameElement = window->GetFrameElementInternal();
 
-    nsCOMPtr<nsIWebNavigation> webnav(do_GetInterface(window));
-    nsCOMPtr<nsIDocShellTreeItem> dsti = do_QueryInterface(webnav);
+    nsCOMPtr<nsIDocShellTreeItem> dsti = window->GetDocShell();
     if (!dsti) 
       return;
     nsCOMPtr<nsIDocShellTreeItem> parentDsti;
     dsti->GetParent(getter_AddRefs(parentDsti));
+    if (!parentDsti) {
+      return;
+    }
 
-    window = do_GetInterface(parentDsti);
+    window = parentDsti->GetWindow();
     if (window) {
       // if the parent window is visible but aWindow was not, then we have
       // likely moved up and out from a hidden tab to the browser window, or a
@@ -1369,7 +1372,7 @@ nsFocusManager::AdjustWindowFocus(nsPIDOMWindow* aWindow,
       if (aCheckPermission && !nsContentUtils::CanCallerAccess(window))
         break;
 
-      window->SetFocusedNode(frameContent);
+      window->SetFocusedNode(frameElement);
     }
   }
 }
@@ -2005,8 +2008,8 @@ nsFocusManager::RaiseWindow(nsPIDOMWindow* aWindow)
       widget->SetFocus(true);
   }
 #else
-  nsCOMPtr<nsIWebNavigation> webnav = do_GetInterface(aWindow);
-  nsCOMPtr<nsIBaseWindow> treeOwnerAsWin = do_QueryInterface(webnav);
+  nsCOMPtr<nsIBaseWindow> treeOwnerAsWin =
+    do_QueryInterface(aWindow->GetDocShell());
   if (treeOwnerAsWin) {
     nsCOMPtr<nsIWidget> widget;
     treeOwnerAsWin->GetMainWidget(getter_AddRefs(widget));
@@ -2079,10 +2082,10 @@ nsFocusManager::UpdateCaret(bool aMoveCaretToFocus,
   // on the nearest ancestor frame which is a chrome frame. But this is
   // what the existing code does, so just leave it for now.
   if (!browseWithCaret) {
-    nsCOMPtr<nsIContent> docContent =
-      do_QueryInterface(mFocusedWindow->GetFrameElementInternal());
-    if (docContent)
-      browseWithCaret = docContent->AttrValueIs(kNameSpaceID_None,
+    nsCOMPtr<Element> docElement =
+      mFocusedWindow->GetFrameElementInternal();
+    if (docElement)
+      browseWithCaret = docElement->AttrValueIs(kNameSpaceID_None,
                                                 nsGkAtoms::showcaret,
                                                 NS_LITERAL_STRING("true"),
                                                 eCaseMatters);
@@ -2581,14 +2584,14 @@ nsFocusManager::DetermineElementToMoveFocus(nsPIDOMWindow* aWindow,
       // move up to the parent shell and try again from there.
 
       // first, get the frame element this window is inside.
-      nsCOMPtr<nsPIDOMWindow> piWindow = do_GetInterface(docShell);
+      nsCOMPtr<nsPIDOMWindow> piWindow = docShell->GetWindow();
       NS_ENSURE_TRUE(piWindow, NS_ERROR_FAILURE);
 
       // Next, retrieve the parent docshell, document and presshell.
       docShell = do_QueryInterface(docShellParent);
       NS_ENSURE_TRUE(docShell, NS_ERROR_FAILURE);
 
-      nsCOMPtr<nsPIDOMWindow> piParentWindow = do_GetInterface(docShellParent);
+      nsCOMPtr<nsPIDOMWindow> piParentWindow = docShellParent->GetWindow();
       NS_ENSURE_TRUE(piParentWindow, NS_ERROR_FAILURE);
       doc = piParentWindow->GetExtantDoc();
       NS_ENSURE_TRUE(doc, NS_ERROR_FAILURE);
@@ -2596,7 +2599,7 @@ nsFocusManager::DetermineElementToMoveFocus(nsPIDOMWindow* aWindow,
       presShell = doc->GetShell();
 
       rootContent = doc->GetRootElement();
-      startContent = do_QueryInterface(piWindow->GetFrameElementInternal());
+      startContent = piWindow->GetFrameElementInternal();
       if (startContent) {
         nsIFrame* frame = startContent->GetPrimaryFrame();
         if (!frame)
@@ -2632,7 +2635,7 @@ nsFocusManager::DetermineElementToMoveFocus(nsPIDOMWindow* aWindow,
       docShell->TabToTreeOwner(forward, &tookFocus);
       // if the tree owner, took the focus, blur the current content
       if (tookFocus) {
-        nsCOMPtr<nsPIDOMWindow> window = do_GetInterface(docShell);
+        nsCOMPtr<nsPIDOMWindow> window = docShell->GetWindow();
         if (window->GetFocusedNode() == mFocusedContent)
           Blur(mFocusedWindow, nullptr, true, true);
         else
@@ -2975,14 +2978,13 @@ nsFocusManager::GetRootForFocus(nsPIDOMWindow* aWindow,
   // the root element's canvas may be focused as long as the document is in a
   // a non-chrome shell and does not contain a frameset.
   if (aIsForDocNavigation) {
-    nsCOMPtr<nsIContent> docContent =
-      do_QueryInterface(aWindow->GetFrameElementInternal());
+    nsCOMPtr<Element> docElement = aWindow->GetFrameElementInternal();
     // document navigation skips iframes and frames that are specifically non-focusable
-    if (docContent) {
-      if (docContent->Tag() == nsGkAtoms::iframe)
+    if (docElement) {
+      if (docElement->Tag() == nsGkAtoms::iframe)
         return nullptr;
 
-      nsIFrame* frame = docContent->GetPrimaryFrame();
+      nsIFrame* frame = docElement->GetPrimaryFrame();
       if (!frame || !frame->IsFocusable(nullptr, 0))
         return nullptr;
     }
@@ -3184,14 +3186,9 @@ nsFocusManager::GetNextTabbableDocument(nsIContent* aStartContent, bool aForward
   else if (mFocusedWindow) {
     startDocShell = mFocusedWindow->GetDocShell();
     doc = mFocusedWindow->GetExtantDoc();
-  }
-  else {
-    nsCOMPtr<nsIWebNavigation> webnav = do_GetInterface(mActiveWindow);
-    startDocShell = do_QueryInterface(webnav);
-
-    if (mActiveWindow) {
-      doc = mActiveWindow->GetExtantDoc();
-    }
+  } else if (mActiveWindow) {
+    startDocShell = mActiveWindow->GetDocShell();
+    doc = mActiveWindow->GetExtantDoc();
   }
 
   if (!startDocShell)
@@ -3251,7 +3248,7 @@ nsFocusManager::GetNextTabbableDocument(nsIContent* aStartContent, bool aForward
       }
 
       curItem = nextItem;
-      nextFrame = do_GetInterface(nextItem);
+      nextFrame = nextItem ? nextItem->GetWindow() : nullptr;
     }
 
     if (!nextFrame)

dom/base/nsGlobalWindow.cpp

@@ -3378,7 +3378,7 @@ nsPIDOMWindow::MaybeCreateDoc()
     // Note that |document| here is the same thing as our mDoc, but we
     // don't have to explicitly set the member variable because the docshell
     // has already called SetNewDocument().
-    nsCOMPtr<nsIDocument> document = do_GetInterface(docShell);
+    nsCOMPtr<nsIDocument> document = docShell->GetDocument();
   }
 }
 
@@ -3801,9 +3801,8 @@ nsGlobalWindow::GetRealParent(nsIDOMWindow** aParent)
   mDocShell->GetSameTypeParentIgnoreBrowserAndAppBoundaries(getter_AddRefs(parent));
 
   if (parent) {
-    nsCOMPtr<nsIScriptGlobalObject> globalObject(do_GetInterface(parent));
-    NS_ENSURE_SUCCESS(CallQueryInterface(globalObject.get(), aParent),
-                      NS_ERROR_FAILURE);
+    nsCOMPtr<nsPIDOMWindow> win = parent->GetWindow();
+    win.forget(aParent);
   }
   else {
     *aParent = static_cast<nsIDOMWindow*>(this);
@@ -3968,7 +3967,11 @@ nsGlobalWindow::GetContentInternal(ErrorResult& aError)
     treeOwner->GetPrimaryContentShell(getter_AddRefs(primaryContent));
   }
 
-  domWindow = do_GetInterface(primaryContent);
+  if (!primaryContent) {
+    return nullptr;
+  }
+
+  domWindow = primaryContent->GetWindow();
   return domWindow.forget();
 }
 
@@ -5709,7 +5712,7 @@ nsGlobalWindow::GetLength(uint32_t* aLength)
   return NS_OK;
 }
 
-already_AddRefed<nsIDOMWindow>
+nsPIDOMWindow*
 nsGlobalWindow::GetChildWindow(const nsAString& aName)
 {
   nsCOMPtr<nsIDocShell> docShell(GetDocShell());
@@ -5720,8 +5723,7 @@ nsGlobalWindow::GetChildWindow(const nsAString& aName)
                               false, true, nullptr, nullptr,
                               getter_AddRefs(child));
 
-  nsCOMPtr<nsIDOMWindow> child_win(do_GetInterface(child));
-  return child_win.forget();
+  return child ? child->GetWindow() : nullptr;
 }
 
 bool
@@ -5888,7 +5890,7 @@ nsGlobalWindow::SetFullScreenInternal(bool aFullScreen, bool aRequireTrust)
   // call SetFullScreen on that window instead.
   nsCOMPtr<nsIDocShellTreeItem> rootItem;
   mDocShell->GetRootTreeItem(getter_AddRefs(rootItem));
-  nsCOMPtr<nsPIDOMWindow> window = do_GetInterface(rootItem);
+  nsCOMPtr<nsPIDOMWindow> window = rootItem ? rootItem->GetWindow() : nullptr;
   if (!window)
     return NS_ERROR_FAILURE;
   if (rootItem != mDocShell)
@@ -5972,7 +5974,7 @@ nsGlobalWindow::GetFullScreen(ErrorResult& aError)
     nsCOMPtr<nsIDocShellTreeItem> rootItem;
     mDocShell->GetRootTreeItem(getter_AddRefs(rootItem));
     if (rootItem != mDocShell) {
-      nsCOMPtr<nsIDOMWindow> window = do_GetInterface(rootItem);
+      nsCOMPtr<nsIDOMWindow> window = rootItem->GetWindow();
       if (window) {
         bool fullScreen = false;
         aError = window->GetFullScreen(&fullScreen);
@@ -6445,7 +6447,7 @@ nsGlobalWindow::Focus(ErrorResult& aError)
 
   nsCOMPtr<nsIDocShellTreeItem> rootItem;
   mDocShell->GetRootTreeItem(getter_AddRefs(rootItem));
-  nsCOMPtr<nsIDOMWindow> rootWin = do_GetInterface(rootItem);
+  nsCOMPtr<nsIDOMWindow> rootWin = rootItem ? rootItem->GetWindow() : nullptr;
   bool isActive = (rootWin == activeWindow);
 
   nsCOMPtr<nsIBaseWindow> treeOwnerAsWin = GetTreeOwnerWindow();
@@ -6488,7 +6490,8 @@ nsGlobalWindow::Focus(ErrorResult& aError)
   mDocShell->GetParent(getter_AddRefs(parentDsti));
 
   // set the parent's current focus to the frame containing this window.
-  nsCOMPtr<nsPIDOMWindow> parent = do_GetInterface(parentDsti);
+  nsCOMPtr<nsPIDOMWindow> parent =
+    parentDsti ? parentDsti->GetWindow() : nullptr;
   if (parent) {
     nsCOMPtr<nsIDocument> parentdoc = parent->GetDoc();
     if (!parentdoc) {
@@ -8419,7 +8422,8 @@ nsGlobalWindow::ReallyCloseWindow()
       nsCOMPtr<nsIBrowserDOMWindow> bwin;
       nsCOMPtr<nsIDocShellTreeItem> rootItem;
       mDocShell->GetRootTreeItem(getter_AddRefs(rootItem));
-      nsCOMPtr<nsIDOMWindow> rootWin(do_GetInterface(rootItem));
+      nsCOMPtr<nsIDOMWindow> rootWin =
+       rootItem ? rootItem->GetWindow() : nullptr;
       nsCOMPtr<nsIDOMChromeWindow> chromeWin(do_QueryInterface(rootWin));
       if (chromeWin)
         chromeWin->GetBrowserDOMWindow(getter_AddRefs(bwin));
@@ -9784,7 +9788,11 @@ nsGlobalWindow::SetKeyboardIndicators(UIStateChangeType aShowAccelerators,
     for (int32_t i = 0; i < childCount; ++i) {
       nsCOMPtr<nsIDocShellTreeItem> childShell;
       docShell->GetChildAt(i, getter_AddRefs(childShell));
-      nsCOMPtr<nsPIDOMWindow> childWindow = do_GetInterface(childShell);
+      if (!childShell) {
+        continue;
+      }
+
+      nsCOMPtr<nsPIDOMWindow> childWindow = childShell->GetWindow();
       if (childWindow) {
         childWindow->SetKeyboardIndicators(aShowAccelerators, aShowFocusRings);
       }
@@ -11378,7 +11386,7 @@ nsGlobalWindow::FireDelayedDOMEvents()
       docShell->GetChildAt(i, getter_AddRefs(childShell));
       NS_ASSERTION(childShell, "null child shell");
 
-      nsCOMPtr<nsPIDOMWindow> pWin = do_GetInterface(childShell);
+      nsCOMPtr<nsPIDOMWindow> pWin = childShell->GetWindow();
       if (pWin) {
         nsGlobalWindow *win =
           static_cast<nsGlobalWindow*>
@@ -12748,7 +12756,7 @@ nsGlobalWindow::SuspendTimeouts(uint32_t aIncrease,
       docShell->GetChildAt(i, getter_AddRefs(childShell));
       NS_ASSERTION(childShell, "null child shell");
 
-      nsCOMPtr<nsPIDOMWindow> pWin = do_GetInterface(childShell);
+      nsCOMPtr<nsPIDOMWindow> pWin = childShell->GetWindow();
       if (pWin) {
         nsGlobalWindow *win =
           static_cast<nsGlobalWindow*>
@@ -12856,7 +12864,7 @@ nsGlobalWindow::ResumeTimeouts(bool aThawChildren)
       docShell->GetChildAt(i, getter_AddRefs(childShell));
       NS_ASSERTION(childShell, "null child shell");
 
-      nsCOMPtr<nsPIDOMWindow> pWin = do_GetInterface(childShell);
+      nsCOMPtr<nsPIDOMWindow> pWin = childShell->GetWindow();
       if (pWin) {
         nsGlobalWindow *win =
           static_cast<nsGlobalWindow*>
@@ -13115,6 +13123,7 @@ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(nsGlobalChromeWindow,
                                                   nsGlobalWindow)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mBrowserDOMWindow)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mMessageManager)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mGroupMessageManagers)
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
 
@@ -13126,6 +13135,10 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(nsGlobalChromeWindow,
       tmp->mMessageManager.get())->Disconnect();
     NS_IMPL_CYCLE_COLLECTION_UNLINK(mMessageManager)
   }
+
+  tmp->mGroupMessageManagers.EnumerateRead(DisconnectGroupMessageManager, nullptr);
+  tmp->mGroupMessageManagers.Clear();
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mGroupMessageManagers)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 DOMCI_DATA(ChromeWindow, nsGlobalChromeWindow)
@@ -13494,6 +13507,39 @@ nsGlobalWindow::GetMessageManager(ErrorResult& aError)
   return myself->mMessageManager;
 }
 
+NS_IMETHODIMP
+nsGlobalChromeWindow::GetGroupMessageManager(const nsAString& aGroup,
+                                             nsIMessageBroadcaster** aManager)
+{
+  ErrorResult rv;
+  NS_IF_ADDREF(*aManager = GetGroupMessageManager(aGroup, rv));
+  return rv.ErrorCode();
+}
+
+nsIMessageBroadcaster*
+nsGlobalWindow::GetGroupMessageManager(const nsAString& aGroup,
+                                       ErrorResult& aError)
+{
+  FORWARD_TO_INNER_OR_THROW(GetGroupMessageManager, (aGroup, aError), aError, nullptr);
+  MOZ_ASSERT(IsChromeWindow());
+
+  nsGlobalChromeWindow* myself = static_cast<nsGlobalChromeWindow*>(this);
+  nsCOMPtr<nsIMessageBroadcaster> messageManager =
+    myself->mGroupMessageManagers.Get(aGroup);
+
+  if (!messageManager) {
+    nsFrameMessageManager* parent =
+      static_cast<nsFrameMessageManager*>(GetMessageManager(aError));
+
+    messageManager = new nsFrameMessageManager(nullptr,
+                                               parent,
+                                               MM_CHROME | MM_BROADCASTER);
+    myself->mGroupMessageManagers.Put(aGroup, messageManager);
+  }
+
+  return messageManager;
+}
+
 // nsGlobalModalWindow implementation
 
 // QueryInterface implementation for nsGlobalModalWindow

dom/base/nsGlobalWindow.h

@@ -12,6 +12,7 @@
 #include "nsTHashtable.h"
 #include "nsHashKeys.h"
 #include "nsRefPtrHashtable.h"
+#include "nsInterfaceHashtable.h"
 
 // Local Includes
 // Helper Classes
@@ -546,7 +547,7 @@ public:
     return static_cast<nsGlobalWindow *>(top.get());
   }
 
-  already_AddRefed<nsIDOMWindow> GetChildWindow(const nsAString& aName);
+  nsPIDOMWindow* GetChildWindow(const nsAString& aName);
 
   // These return true if we've reached the state in this top level window
   // where we ask the user if further dialogs should be blocked.
@@ -1007,6 +1008,8 @@ public:
   void NotifyDefaultButtonLoaded(mozilla::dom::Element& aDefaultButton,
                                  mozilla::ErrorResult& aError);
   nsIMessageBroadcaster* GetMessageManager(mozilla::ErrorResult& aError);
+  nsIMessageBroadcaster* GetGroupMessageManager(const nsAString& aGroup,
+                                                mozilla::ErrorResult& aError);
   void BeginWindowMove(mozilla::dom::Event& aMouseDownEvent,
                        mozilla::dom::Element* aPanel,
                        mozilla::ErrorResult& aError);
@@ -1622,16 +1625,32 @@ public:
   NS_DECL_NSIDOMCHROMEWINDOW
 
   nsGlobalChromeWindow(nsGlobalWindow *aOuterWindow)
-    : nsGlobalWindow(aOuterWindow)
+    : nsGlobalWindow(aOuterWindow),
+      mGroupMessageManagers(1)
   {
     mIsChrome = true;
     mCleanMessageManager = true;
   }
 
+  static PLDHashOperator
+  DisconnectGroupMessageManager(const nsAString& aKey,
+                                nsIMessageBroadcaster* aMM,
+                                void* aUserArg)
+  {
+    if (aMM) {
+      static_cast<nsFrameMessageManager*>(aMM)->Disconnect();
+    }
+    return PL_DHASH_NEXT;
+  }
+
   ~nsGlobalChromeWindow()
   {
     NS_ABORT_IF_FALSE(mCleanMessageManager,
                       "chrome windows may always disconnect the msg manager");
+
+    mGroupMessageManagers.EnumerateRead(DisconnectGroupMessageManager, nullptr);
+    mGroupMessageManagers.Clear();
+
     if (mMessageManager) {
       static_cast<nsFrameMessageManager *>(
         mMessageManager.get())->Disconnect();
@@ -1653,10 +1672,12 @@ public:
   using nsGlobalWindow::Restore;
   using nsGlobalWindow::NotifyDefaultButtonLoaded;
   using nsGlobalWindow::GetMessageManager;
+  using nsGlobalWindow::GetGroupMessageManager;
   using nsGlobalWindow::BeginWindowMove;
 
   nsCOMPtr<nsIBrowserDOMWindow> mBrowserDOMWindow;
   nsCOMPtr<nsIMessageBroadcaster> mMessageManager;
+  nsInterfaceHashtable<nsStringHashKey, nsIMessageBroadcaster> mGroupMessageManagers;
 };
 
 /*

dom/base/nsHistory.cpp

@@ -153,7 +153,10 @@ nsHistory::Go(int32_t aDelta, ErrorResult& aRv)
   }
 
   if (!aDelta) {
-    nsCOMPtr<nsPIDOMWindow> window(do_GetInterface(GetDocShell()));
+    nsCOMPtr<nsPIDOMWindow> window;
+    if (nsIDocShell* docShell = GetDocShell()) {
+      window = docShell->GetWindow();
+    }
 
     if (window && window->IsHandlingResizeEvent()) {
       // history.go(0) (aka location.reload()) was called on a window

dom/base/nsLocation.cpp

@@ -54,8 +54,10 @@ GetDocumentCharacterSetForURI(const nsAString& aHref, nsACString& aCharset)
 
 nsLocation::nsLocation(nsIDocShell *aDocShell)
 {
+  MOZ_ASSERT(aDocShell);
+
   mDocShell = do_GetWeakReference(aDocShell);
-  nsCOMPtr<nsIDOMWindow> outer = do_GetInterface(aDocShell);
+  nsCOMPtr<nsIDOMWindow> outer = aDocShell->GetWindow();
   mOuter = do_GetWeakReference(outer);
 }
 
@@ -535,7 +537,8 @@ nsLocation::SetHrefWithBase(const nsAString& aHref, nsIURI* aBase,
           // Now check to make sure that the script is running in our window,
           // since we only want to replace if the location is set by a
           // <script> tag in the same window.  See bug 178729.
-          nsCOMPtr<nsIScriptGlobalObject> ourGlobal(do_GetInterface(docShell));
+          nsCOMPtr<nsIScriptGlobalObject> ourGlobal =
+            docShell ? docShell->GetScriptGlobalObject() : nullptr;
           inScriptTag = (ourGlobal == scriptContext->GetGlobalObject());
         }
       }  
@@ -786,7 +789,7 @@ nsLocation::Reload(bool aForceget)
   nsresult rv;
   nsCOMPtr<nsIDocShell> docShell(do_QueryReferent(mDocShell));
   nsCOMPtr<nsIWebNavigation> webNav(do_QueryInterface(docShell));
-  nsCOMPtr<nsPIDOMWindow> window(do_GetInterface(docShell));
+  nsCOMPtr<nsPIDOMWindow> window = docShell ? docShell->GetWindow() : nullptr;
 
   if (window && window->IsHandlingResizeEvent()) {
     // location.reload() was called on a window that is handling a
@@ -901,7 +904,7 @@ nsLocation::GetSourceBaseURL(JSContext* cx, nsIURI** sourceURL)
   // the docshell. If that fails, just return null and hope that the caller passed
   // an absolute URI.
   if (!sgo && GetDocShell()) {
-    sgo = do_GetInterface(GetDocShell());
+    sgo = GetDocShell()->GetScriptGlobalObject();
   }
   NS_ENSURE_TRUE(sgo, NS_OK);
   nsCOMPtr<nsPIDOMWindow> window = do_QueryInterface(sgo);

dom/base/nsPluginArray.cpp

@@ -270,7 +270,7 @@ nsPluginArray::Observe(nsISupports *aSubject, const char *aTopic,
 bool
 nsPluginArray::AllowPlugins() const
 {
-  nsCOMPtr<nsIDocShell> docShell = do_GetInterface(mWindow);
+  nsCOMPtr<nsIDocShell> docShell = mWindow ? mWindow->GetDocShell() : nullptr;
 
   return docShell && docShell->PluginsAllowedInCurrentDoc();
 }

dom/base/test/test_openDialogChromeOnly.html

@@ -16,11 +16,8 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=931768
     openDialog("chrome://browser/content/browser.xul");
     ok(false, "Calling openDialog from unprivileged script should throw.");
   } catch (e) {
-    // FIXME e should be a ReferenceError once we switch Window to new WebIDL bindings
-    ok(e.name == "SecurityError",
-       "openDialog shouldn't be callable to unprivileged script.");
-    todo(e instanceof ReferenceError,
-         "openDialog shouldn't be available to unprivileged script.");
+    ok(e instanceof ReferenceError,
+       "openDialog shouldn't be available to unprivileged script.");
   }
 </script>
 </body>

dom/bindings/Bindings.conf

@@ -214,7 +214,6 @@ DOMInterfaces = {
 
 'ChromeWindow': {
     'concrete': False,
-    'register': False,
 },
 
 'ChromeWorker': {
@@ -1565,10 +1564,7 @@ DOMInterfaces = {
 
 'Window': {
     'nativeType': 'nsGlobalWindow',
-    # When turning on Window, remember to drop the "'register': False"
-    # from ChromeWindow.
     'hasXPConnectImpls': True,
-    'register': False,
     'binaryNames': {
         'postMessage': 'postMessageMoz',
     },

dom/bluetooth/BluetoothManager.cpp

@@ -107,7 +107,7 @@ BluetoothManager::BluetoothManager(nsPIDOMWindow *aWindow)
   MOZ_ASSERT(aWindow);
   MOZ_ASSERT(IsDOMBinding());
 
-  mPath.AssignLiteral("/");
+  mPath.Assign('/');
 
   BluetoothService* bs = BluetoothService::Get();
   NS_ENSURE_TRUE_VOID(bs);

dom/bluetooth/bluez/BluetoothHfpManager.cpp

@@ -811,7 +811,7 @@ BluetoothHfpManager::ReceiveSocketData(BluetoothSocket* aSocket,
     message.AppendInt(mNetworkSelectionMode);
     message.AppendLiteral(",0,\"");
     message.Append(NS_ConvertUTF16toUTF8(mOperatorName));
-    message.AppendLiteral("\"");
+    message.Append('"');
     SendLine(message.get());
   } else if (msg.Find("AT+VTS=") != -1) {
     ParseAtCommand(msg, 7, atCommandValues);
@@ -1529,7 +1529,7 @@ BluetoothHfpManager::HandleCallStateChanged(uint32_t aCallIndex,
 
         nsAutoString number(aNumber);
         if (!mCLIP) {
-          number.AssignLiteral("");
+          number.Truncate();
         }
 
         MessageLoop::current()->PostDelayedTask(

dom/bluetooth2/BluetoothManager.cpp

@@ -107,7 +107,7 @@ BluetoothManager::BluetoothManager(nsPIDOMWindow *aWindow)
   MOZ_ASSERT(aWindow);
   MOZ_ASSERT(IsDOMBinding());
 
-  mPath.AssignLiteral("/");
+  mPath.Assign('/');
 
   BluetoothService* bs = BluetoothService::Get();
   NS_ENSURE_TRUE_VOID(bs);

dom/bluetooth2/bluedroid/BluetoothOppManager.cpp

@@ -716,7 +716,7 @@ BluetoothOppManager::RetrieveSentFileName()
                                      EmptyCString(),
                                      extension);
       if (NS_SUCCEEDED(rv)) {
-        mFileName.AppendLiteral(".");
+        mFileName.Append('.');
         AppendUTF8toUTF16(extension, mFileName);
       }
     }

dom/bluetooth2/bluez/BluetoothHfpManager.cpp

@@ -811,7 +811,7 @@ BluetoothHfpManager::ReceiveSocketData(BluetoothSocket* aSocket,
     message.AppendInt(mNetworkSelectionMode);
     message.AppendLiteral(",0,\"");
     message.Append(NS_ConvertUTF16toUTF8(mOperatorName));
-    message.AppendLiteral("\"");
+    message.Append('"');
     SendLine(message.get());
   } else if (msg.Find("AT+VTS=") != -1) {
     ParseAtCommand(msg, 7, atCommandValues);
@@ -1211,9 +1211,9 @@ BluetoothHfpManager::SendCLCC(const Call& aCall, int aIndex)
 
   nsAutoCString message(RESPONSE_CLCC);
   message.AppendInt(aIndex);
-  message.AppendLiteral(",");
+  message.Append(',');
   message.AppendInt(aCall.mDirection);
-  message.AppendLiteral(",");
+  message.Append(',');
 
   int status = 0;
   switch (aCall.mState) {
@@ -1290,7 +1290,7 @@ BluetoothHfpManager::SendCommand(const char* aCommand, uint32_t aValue)
     }
 
     message.AppendInt(aValue);
-    message.AppendLiteral(",");
+    message.Append(',');
     message.AppendInt(sCINDItems[aValue].value);
   } else if (!strcmp(aCommand, RESPONSE_CIND)) {
     if (!aValue) {
@@ -1300,9 +1300,9 @@ BluetoothHfpManager::SendCommand(const char* aCommand, uint32_t aValue)
         message.Append(sCINDItems[i].name);
         message.AppendLiteral("\",(");
         message.Append(sCINDItems[i].range);
-        message.AppendLiteral(")");
+        message.Append(')');
         if (i == (ArrayLength(sCINDItems) - 1)) {
-          message.AppendLiteral(")");
+          message.Append(')');
           break;
         }
         message.AppendLiteral("),");
@@ -1314,7 +1314,7 @@ BluetoothHfpManager::SendCommand(const char* aCommand, uint32_t aValue)
         if (i == (ArrayLength(sCINDItems) - 1)) {
           break;
         }
-        message.AppendLiteral(",");
+        message.Append(',');
       }
     }
 #ifdef MOZ_B2G_RIL
@@ -1529,7 +1529,7 @@ BluetoothHfpManager::HandleCallStateChanged(uint32_t aCallIndex,
 
         nsAutoString number(aNumber);
         if (!mCLIP) {
-          number.AssignLiteral("");
+          number.Truncate();
         }
 
         MessageLoop::current()->PostDelayedTask(

dom/bluetooth2/bluez/BluetoothOppManager.cpp

@@ -738,7 +738,7 @@ BluetoothOppManager::RetrieveSentFileName()
                                      EmptyCString(),
                                      extension);
       if (NS_SUCCEEDED(rv)) {
-        mFileName.AppendLiteral(".");
+        mFileName.Append('.');
         AppendUTF8toUTF16(extension, mFileName);
       }
     }

dom/browser-element/BrowserElementParent.cpp

@@ -283,7 +283,7 @@ BrowserElementParent::OpenWindowInProcess(nsIDOMWindow* aOpenerWindow,
   frameLoader->GetDocShell(getter_AddRefs(docshell));
   NS_ENSURE_TRUE(docshell, BrowserElementParent::OPEN_WINDOW_IGNORED);
 
-  nsCOMPtr<nsIDOMWindow> window = do_GetInterface(docshell);
+  nsCOMPtr<nsIDOMWindow> window = docshell->GetWindow();
   window.forget(aReturnWindow);
 
   return !!*aReturnWindow ? opened : BrowserElementParent::OPEN_WINDOW_CANCELLED;

dom/crypto/CryptoBuffer.cpp

@@ -19,6 +19,7 @@ CryptoBuffer::Assign(const uint8_t* aData, uint32_t aLength)
 uint8_t*
 CryptoBuffer::Assign(const SECItem* aItem)
 {
+  MOZ_ASSERT(aItem);
   return Assign(aItem->data, aItem->len);
 }
 

dom/crypto/CryptoBuffer.h

@@ -20,24 +20,6 @@ class OwningArrayBufferViewOrArrayBuffer;
 class CryptoBuffer : public FallibleTArray<uint8_t>
 {
 public:
-  CryptoBuffer()
-    : FallibleTArray<uint8_t>()
-  {}
-
-  template<class T>
-  explicit CryptoBuffer(const T& aData)
-    : FallibleTArray<uint8_t>()
-  {
-    Assign(aData);
-  }
-
-  template<class T>
-  CryptoBuffer& operator=(const T& aData)
-  {
-    Assign(aData);
-    return *this;
-  }
-
   uint8_t* Assign(const uint8_t* aData, uint32_t aLength);
   uint8_t* Assign(const SECItem* aItem);
   uint8_t* Assign(const ArrayBuffer& aData);
@@ -45,6 +27,14 @@ public:
   uint8_t* Assign(const ArrayBufferViewOrArrayBuffer& aData);
   uint8_t* Assign(const OwningArrayBufferViewOrArrayBuffer& aData);
 
+  template<typename T,
+         JSObject* UnboxArray(JSObject*, uint32_t*, T**)>
+  uint8_t* Assign(const TypedArray_base<T, UnboxArray>& aData)
+  {
+    return Assign(aData.Data(), aData.Length());
+  }
+
+
   SECItem* ToSECItem();
 
   bool GetBigIntValue(unsigned long& aRetVal);

dom/crypto/Key.cpp

@@ -22,6 +22,31 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(Key)
   NS_INTERFACE_MAP_ENTRY(nsISupports)
 NS_INTERFACE_MAP_END
 
+nsresult
+StringToUsage(const nsString& aUsage, Key::KeyUsage& aUsageOut)
+{
+  if (aUsage.EqualsLiteral(WEBCRYPTO_KEY_USAGE_ENCRYPT)) {
+    aUsageOut = Key::ENCRYPT;
+  } else if (aUsage.EqualsLiteral(WEBCRYPTO_KEY_USAGE_DECRYPT)) {
+    aUsageOut = Key::DECRYPT;
+  } else if (aUsage.EqualsLiteral(WEBCRYPTO_KEY_USAGE_SIGN)) {
+    aUsageOut = Key::SIGN;
+  } else if (aUsage.EqualsLiteral(WEBCRYPTO_KEY_USAGE_VERIFY)) {
+    aUsageOut = Key::VERIFY;
+  } else if (aUsage.EqualsLiteral(WEBCRYPTO_KEY_USAGE_DERIVEKEY)) {
+    aUsageOut = Key::DERIVEKEY;
+  } else if (aUsage.EqualsLiteral(WEBCRYPTO_KEY_USAGE_DERIVEBITS)) {
+    aUsageOut = Key::DERIVEBITS;
+  } else if (aUsage.EqualsLiteral(WEBCRYPTO_KEY_USAGE_WRAPKEY)) {
+    aUsageOut = Key::WRAPKEY;
+  } else if (aUsage.EqualsLiteral(WEBCRYPTO_KEY_USAGE_UNWRAPKEY)) {
+    aUsageOut = Key::UNWRAPKEY;
+  } else {
+    return NS_ERROR_DOM_SYNTAX_ERR;
+  }
+  return NS_OK;
+}
+
 Key::Key(nsIGlobalObject* aGlobal)
   : mGlobal(aGlobal)
   , mAttributes(0)
@@ -155,26 +180,22 @@ Key::ClearUsages()
 nsresult
 Key::AddUsage(const nsString& aUsage)
 {
-  if (aUsage.EqualsLiteral(WEBCRYPTO_KEY_USAGE_ENCRYPT)) {
-    mAttributes |= ENCRYPT;
-  } else if (aUsage.EqualsLiteral(WEBCRYPTO_KEY_USAGE_DECRYPT)) {
-    mAttributes |= DECRYPT;
-  } else if (aUsage.EqualsLiteral(WEBCRYPTO_KEY_USAGE_SIGN)) {
-    mAttributes |= SIGN;
-  } else if (aUsage.EqualsLiteral(WEBCRYPTO_KEY_USAGE_VERIFY)) {
-    mAttributes |= VERIFY;
-  } else if (aUsage.EqualsLiteral(WEBCRYPTO_KEY_USAGE_DERIVEKEY)) {
-    mAttributes |= DERIVEKEY;
-  } else if (aUsage.EqualsLiteral(WEBCRYPTO_KEY_USAGE_DERIVEBITS)) {
-    mAttributes |= DERIVEBITS;
-  } else if (aUsage.EqualsLiteral(WEBCRYPTO_KEY_USAGE_WRAPKEY)) {
-    mAttributes |= WRAPKEY;
-  } else if (aUsage.EqualsLiteral(WEBCRYPTO_KEY_USAGE_UNWRAPKEY)) {
-    mAttributes |= UNWRAPKEY;
-  } else {
+  return AddUsageIntersecting(aUsage, USAGES_MASK);
+}
+
+nsresult
+Key::AddUsageIntersecting(const nsString& aUsage, uint32_t aUsageMask)
+{
+  KeyUsage usage;
+  if (NS_FAILED(StringToUsage(aUsage, usage))) {
     return NS_ERROR_DOM_SYNTAX_ERR;
   }
 
+  if (usage & aUsageMask) {
+    AddUsage(usage);
+    return NS_OK;
+  }
+
   return NS_OK;
 }
 

dom/crypto/Key.h

@@ -113,6 +113,7 @@ public:
   void SetAlgorithm(KeyAlgorithm* aAlgorithm);
   void ClearUsages();
   nsresult AddUsage(const nsString& aUsage);
+  nsresult AddUsageIntersecting(const nsString& aUsage, uint32_t aUsageMask);
   void AddUsage(KeyUsage aUsage);
   bool HasUsage(KeyUsage aUsage);
   bool HasUsageOtherThan(uint32_t aUsages);

dom/crypto/KeyPair.cpp

@@ -0,0 +1,31 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "mozilla/dom/KeyPair.h"
+#include "mozilla/dom/SubtleCryptoBinding.h"
+#include "nsContentUtils.h"
+
+namespace mozilla {
+namespace dom {
+
+
+NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE(KeyPair, mGlobal, mPublicKey, mPrivateKey)
+NS_IMPL_CYCLE_COLLECTING_ADDREF(KeyPair)
+NS_IMPL_CYCLE_COLLECTING_RELEASE(KeyPair)
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(KeyPair)
+  NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
+  NS_INTERFACE_MAP_ENTRY(nsISupports)
+NS_INTERFACE_MAP_END
+
+JSObject*
+KeyPair::WrapObject(JSContext* aCx)
+{
+  return KeyPairBinding::Wrap(aCx, this);
+}
+
+
+} // namespace dom
+} // namespace mozilla

dom/crypto/KeyPair.h

@@ -0,0 +1,63 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_KeyPair_h
+#define mozilla_dom_KeyPair_h
+
+#include "nsCycleCollectionParticipant.h"
+#include "nsWrapperCache.h"
+#include "nsIGlobalObject.h"
+#include "mozilla/dom/Key.h"
+#include "js/TypeDecls.h"
+
+namespace mozilla {
+namespace dom {
+
+class KeyPair MOZ_FINAL : public nsISupports,
+                          public nsWrapperCache
+{
+public:
+  NS_DECL_CYCLE_COLLECTING_ISUPPORTS
+  NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(KeyPair)
+
+public:
+  KeyPair(nsIGlobalObject* aGlobal)
+    : mGlobal(aGlobal)
+    , mPublicKey(new Key(aGlobal))
+    , mPrivateKey(new Key(aGlobal))
+  {
+    SetIsDOMBinding();
+  }
+
+  ~KeyPair() {}
+
+  nsIGlobalObject* GetParentObject() const
+  {
+    return mGlobal;
+  }
+
+  virtual JSObject* WrapObject(JSContext* aCx) MOZ_OVERRIDE;
+
+  Key* PublicKey() const
+  {
+    return mPublicKey;
+  }
+
+  Key* PrivateKey() const
+  {
+    return mPrivateKey;
+  }
+
+private:
+  nsRefPtr<nsIGlobalObject> mGlobal;
+  nsRefPtr<Key> mPublicKey;
+  nsRefPtr<Key> mPrivateKey;
+};
+
+} // namespace dom
+} // namespace mozilla
+
+#endif // mozilla_dom_KeyPair_h

dom/crypto/WebCryptoCommon.h

@@ -74,10 +74,9 @@ ReadString(JSStructuredCloneReader* aReader, nsString& aString)
     return false;
   }
 
-  aString.SetCapacity(nameLength+1);
+  aString.SetLength(nameLength);
   size_t charSize = sizeof(nsString::char_type);
   read = JS_ReadBytes(aReader, (void*) aString.BeginWriting(), nameLength * charSize);
-  aString.SetCharAt('\0', nameLength);
   if (!read) {
     return false;
   }

dom/crypto/WebCryptoTask.cpp

@@ -6,12 +6,14 @@
 
 #include "pk11pub.h"
 #include "cryptohi.h"
+#include "secerr.h"
 #include "ScopedNSSTypes.h"
 
 #include "mozilla/dom/WebCryptoTask.h"
 #include "mozilla/dom/TypedArray.h"
 #include "mozilla/dom/Key.h"
 #include "mozilla/dom/KeyAlgorithm.h"
+#include "mozilla/dom/KeyPair.h"
 #include "mozilla/dom/AesKeyAlgorithm.h"
 #include "mozilla/dom/HmacKeyAlgorithm.h"
 #include "mozilla/dom/RsaKeyAlgorithm.h"
@@ -24,6 +26,26 @@ namespace dom {
 
 // Convenience functions for extracting / converting information
 
+// OOM-safe CryptoBuffer initialization, suitable for constructors
+#define ATTEMPT_BUFFER_INIT(dst, src) \
+  if (!dst.Assign(src)) { \
+    mEarlyRv = NS_ERROR_DOM_UNKNOWN_ERR; \
+    return; \
+  }
+
+// OOM-safe CryptoBuffer-to-SECItem copy, suitable for DoCrypto
+#define ATTEMPT_BUFFER_TO_SECITEM(dst, src) \
+  dst = src.ToSECItem(); \
+  if (!dst) { \
+    return NS_ERROR_DOM_UNKNOWN_ERR; \
+  }
+
+// OOM-safe CryptoBuffer copy, suitable for DoCrypto
+#define ATTEMPT_BUFFER_ASSIGN(dst, src) \
+  if (!dst.Assign(src)) { \
+    return NS_ERROR_DOM_UNKNOWN_ERR; \
+  }
+
 class ClearException
 {
 public:
@@ -107,6 +129,450 @@ private:
   }
 };
 
+class AesTask : public ReturnArrayBufferViewTask
+{
+public:
+  AesTask(JSContext* aCx, const ObjectOrString& aAlgorithm,
+          mozilla::dom::Key& aKey, const CryptoOperationData& aData,
+          bool aEncrypt)
+    : mSymKey(aKey.GetSymKey())
+    , mEncrypt(aEncrypt)
+  {
+    ATTEMPT_BUFFER_INIT(mData, aData);
+
+    nsString algName;
+    mEarlyRv = GetAlgorithmName(aCx, aAlgorithm, algName);
+    if (NS_FAILED(mEarlyRv)) {
+      return;
+    }
+
+    // Check that we got a reasonable key
+    if ((mSymKey.Length() != 16) &&
+        (mSymKey.Length() != 24) &&
+        (mSymKey.Length() != 32))
+    {
+      mEarlyRv = NS_ERROR_DOM_DATA_ERR;
+      return;
+    }
+
+    // Cache parameters depending on the specific algorithm
+    if (algName.EqualsLiteral(WEBCRYPTO_ALG_AES_CBC)) {
+      mMechanism = CKM_AES_CBC_PAD;
+      AesCbcParams params;
+      nsresult rv = Coerce(aCx, params, aAlgorithm);
+      if (NS_FAILED(rv) || !params.mIv.WasPassed()) {
+        mEarlyRv = NS_ERROR_DOM_INVALID_ACCESS_ERR;
+        return;
+      }
+
+      ATTEMPT_BUFFER_INIT(mIv, params.mIv.Value())
+    } else if (algName.EqualsLiteral(WEBCRYPTO_ALG_AES_CTR)) {
+      mMechanism = CKM_AES_CTR;
+      AesCtrParams params;
+      nsresult rv = Coerce(aCx, params, aAlgorithm);
+      if (NS_FAILED(rv) || !params.mCounter.WasPassed() ||
+          !params.mLength.WasPassed()) {
+        mEarlyRv = NS_ERROR_DOM_SYNTAX_ERR;
+        return;
+      }
+
+      ATTEMPT_BUFFER_INIT(mIv, params.mCounter.Value())
+      if (mIv.Length() != 16) {
+        mEarlyRv = NS_ERROR_DOM_DATA_ERR;
+        return;
+      }
+
+      mCounterLength = params.mLength.Value();
+    } else if (algName.EqualsLiteral(WEBCRYPTO_ALG_AES_GCM)) {
+      mMechanism = CKM_AES_GCM;
+      AesGcmParams params;
+      nsresult rv = Coerce(aCx, params, aAlgorithm);
+      if (NS_FAILED(rv) || !params.mIv.WasPassed()) {
+        mEarlyRv = NS_ERROR_DOM_SYNTAX_ERR;
+        return;
+      }
+
+      ATTEMPT_BUFFER_INIT(mIv, params.mIv.Value())
+
+      if (params.mAdditionalData.WasPassed()) {
+        ATTEMPT_BUFFER_INIT(mAad, params.mAdditionalData.Value())
+      }
+
+      // 32, 64, 96, 104, 112, 120 or 128
+      mTagLength = 128;
+      if (params.mTagLength.WasPassed()) {
+        mTagLength = params.mTagLength.Value();
+        if ((mTagLength > 128) ||
+            !(mTagLength == 32 || mTagLength == 64 ||
+              (mTagLength >= 96 && mTagLength % 8 == 0))) {
+          mEarlyRv = NS_ERROR_DOM_SYNTAX_ERR;
+          return;
+        }
+      }
+    } else {
+      mEarlyRv = NS_ERROR_DOM_NOT_SUPPORTED_ERR;
+      return;
+    }
+  }
+
+private:
+  CK_MECHANISM_TYPE mMechanism;
+  CryptoBuffer mSymKey;
+  CryptoBuffer mIv;   // Initialization vector
+  CryptoBuffer mData;
+  CryptoBuffer mAad;  // Additional Authenticated Data
+  uint8_t mTagLength;
+  uint8_t mCounterLength;
+  bool mEncrypt;
+
+  virtual nsresult DoCrypto() MOZ_OVERRIDE
+  {
+    nsresult rv;
+
+    // Construct the parameters object depending on algorithm
+    SECItem param;
+    ScopedSECItem cbcParam;
+    CK_AES_CTR_PARAMS ctrParams;
+    CK_GCM_PARAMS gcmParams;
+    switch (mMechanism) {
+      case CKM_AES_CBC_PAD:
+        ATTEMPT_BUFFER_TO_SECITEM(cbcParam, mIv);
+        param = *cbcParam;
+        break;
+      case CKM_AES_CTR:
+        ctrParams.ulCounterBits = mCounterLength;
+        MOZ_ASSERT(mIv.Length() == 16);
+        memcpy(&ctrParams.cb, mIv.Elements(), 16);
+        param.type = siBuffer;
+        param.data = (unsigned char*) &ctrParams;
+        param.len  = sizeof(ctrParams);
+        break;
+      case CKM_AES_GCM:
+        gcmParams.pIv = mIv.Elements();
+        gcmParams.ulIvLen = mIv.Length();
+        gcmParams.pAAD = mAad.Elements();
+        gcmParams.ulAADLen = mAad.Length();
+        gcmParams.ulTagBits = mTagLength;
+        param.type = siBuffer;
+        param.data = (unsigned char*) &gcmParams;
+        param.len  = sizeof(gcmParams);
+        break;
+      default:
+        return NS_ERROR_DOM_NOT_SUPPORTED_ERR;
+    }
+
+    // Import the key
+    ScopedSECItem keyItem;
+    ATTEMPT_BUFFER_TO_SECITEM(keyItem, mSymKey);
+    ScopedPK11SlotInfo slot(PK11_GetInternalSlot());
+    MOZ_ASSERT(slot.get());
+    ScopedPK11SymKey symKey(PK11_ImportSymKey(slot, mMechanism, PK11_OriginUnwrap,
+                                              CKA_ENCRYPT, keyItem.get(), nullptr));
+    if (!symKey) {
+      return NS_ERROR_DOM_INVALID_ACCESS_ERR;
+    }
+
+    // Initialize the output buffer (enough space for padding / a full tag)
+    uint32_t dataLen = mData.Length();
+    uint32_t maxLen = dataLen + 16;
+    if (!mResult.SetLength(maxLen)) {
+      return NS_ERROR_DOM_UNKNOWN_ERR;
+    }
+    uint32_t outLen = 0;
+
+    // Perform the encryption/decryption
+    if (mEncrypt) {
+      rv = MapSECStatus(PK11_Encrypt(symKey.get(), mMechanism, &param,
+                                     mResult.Elements(), &outLen, maxLen,
+                                     mData.Elements(), mData.Length()));
+    } else {
+      rv = MapSECStatus(PK11_Decrypt(symKey.get(), mMechanism, &param,
+                                     mResult.Elements(), &outLen, maxLen,
+                                     mData.Elements(), mData.Length()));
+    }
+    NS_ENSURE_SUCCESS(rv, NS_ERROR_DOM_OPERATION_ERR);
+
+    mResult.SetLength(outLen);
+    return rv;
+  }
+};
+
+class RsaesPkcs1Task : public ReturnArrayBufferViewTask
+{
+public:
+  RsaesPkcs1Task(JSContext* aCx, const ObjectOrString& aAlgorithm,
+                 mozilla::dom::Key& aKey, const CryptoOperationData& aData,
+                 bool aEncrypt)
+    : mPrivKey(aKey.GetPrivateKey())
+    , mPubKey(aKey.GetPublicKey())
+    , mEncrypt(aEncrypt)
+  {
+    ATTEMPT_BUFFER_INIT(mData, aData);
+
+    if (mEncrypt) {
+      if (!mPubKey) {
+        mEarlyRv = NS_ERROR_DOM_INVALID_ACCESS_ERR;
+        return;
+      }
+      mStrength = SECKEY_PublicKeyStrength(mPubKey);
+
+      // Verify that the data input is not too big
+      // (as required by PKCS#1 / RFC 3447)
+      if (mData.Length() > mStrength - 11) {
+        mEarlyRv = NS_ERROR_DOM_DATA_ERR;
+        return;
+      }
+    } else {
+      if (!mPrivKey) {
+        mEarlyRv = NS_ERROR_DOM_INVALID_ACCESS_ERR;
+        return;
+      }
+      mStrength = PK11_GetPrivateModulusLen(mPrivKey);
+    }
+  }
+
+private:
+  ScopedSECKEYPrivateKey mPrivKey;
+  ScopedSECKEYPublicKey mPubKey;
+  CryptoBuffer mData;
+  uint32_t mStrength;
+  bool mEncrypt;
+
+  virtual nsresult DoCrypto() MOZ_OVERRIDE
+  {
+    nsresult rv;
+
+    // Ciphertext is an integer mod the modulus, so it will be
+    // no longer than mStrength octets
+    if (!mResult.SetLength(mStrength)) {
+      return NS_ERROR_DOM_UNKNOWN_ERR;
+    }
+
+    if (mEncrypt) {
+      rv = MapSECStatus(PK11_PubEncryptPKCS1(
+              mPubKey.get(), mResult.Elements(),
+              mData.Elements(), mData.Length(),
+              nullptr));
+    } else {
+      uint32_t outLen;
+      rv = MapSECStatus(PK11_PrivDecryptPKCS1(
+              mPrivKey.get(), mResult.Elements(),
+              &outLen, mResult.Length(),
+              mData.Elements(), mData.Length()));
+      mResult.SetLength(outLen);
+    }
+
+    NS_ENSURE_SUCCESS(rv, NS_ERROR_DOM_OPERATION_ERR);
+    return NS_OK;
+  }
+};
+
+class HmacTask : public WebCryptoTask
+{
+public:
+  HmacTask(JSContext* aCx, const ObjectOrString& aAlgorithm,
+           mozilla::dom::Key& aKey,
+           const CryptoOperationData& aSignature,
+           const CryptoOperationData& aData,
+           bool aSign)
+    : mMechanism(aKey.Algorithm()->Mechanism())
+    , mSymKey(aKey.GetSymKey())
+    , mSign(aSign)
+  {
+    ATTEMPT_BUFFER_INIT(mData, aData);
+    if (!aSign) {
+      ATTEMPT_BUFFER_INIT(mSignature, aSignature);
+    }
+
+    // Check that we got a symmetric key
+    if (mSymKey.Length() == 0) {
+      mEarlyRv = NS_ERROR_DOM_DATA_ERR;
+      return;
+    }
+  }
+
+private:
+  CK_MECHANISM_TYPE mMechanism;
+  CryptoBuffer mSymKey;
+  CryptoBuffer mData;
+  CryptoBuffer mSignature;
+  CryptoBuffer mResult;
+  bool mSign;
+
+  virtual nsresult DoCrypto() MOZ_OVERRIDE
+  {
+    // Initialize the output buffer
+    if (!mResult.SetLength(HASH_LENGTH_MAX)) {
+      return NS_ERROR_DOM_UNKNOWN_ERR;
+    }
+    uint32_t outLen;
+
+    // Import the key
+    ScopedSECItem keyItem;
+    ATTEMPT_BUFFER_TO_SECITEM(keyItem, mSymKey);
+    ScopedPK11SlotInfo slot(PK11_GetInternalSlot());
+    MOZ_ASSERT(slot.get());
+    ScopedPK11SymKey symKey(PK11_ImportSymKey(slot, mMechanism, PK11_OriginUnwrap,
+                                              CKA_SIGN, keyItem.get(), nullptr));
+    if (!symKey) {
+      return NS_ERROR_DOM_INVALID_ACCESS_ERR;
+    }
+
+    // Compute the MAC
+    SECItem param = { siBuffer, nullptr, 0 };
+    ScopedPK11Context ctx(PK11_CreateContextBySymKey(mMechanism, CKA_SIGN,
+                                                     symKey.get(), &param));
+    if (!ctx.get()) {
+      return NS_ERROR_DOM_OPERATION_ERR;
+    }
+    nsresult rv = MapSECStatus(PK11_DigestBegin(ctx.get()));
+    NS_ENSURE_SUCCESS(rv, NS_ERROR_DOM_OPERATION_ERR);
+    rv = MapSECStatus(PK11_DigestOp(ctx.get(), mData.Elements(), mData.Length()));
+    NS_ENSURE_SUCCESS(rv, NS_ERROR_DOM_OPERATION_ERR);
+    rv = MapSECStatus(PK11_DigestFinal(ctx.get(), mResult.Elements(),
+                                       &outLen, HASH_LENGTH_MAX));
+    NS_ENSURE_SUCCESS(rv, NS_ERROR_DOM_OPERATION_ERR);
+
+    mResult.SetLength(outLen);
+    return rv;
+  }
+
+  // Returns mResult as an ArrayBufferView, or an error
+  virtual void Resolve() MOZ_OVERRIDE
+  {
+    if (mSign) {
+      // Return the computed MAC
+      TypedArrayCreator<Uint8Array> ret(mResult);
+      mResultPromise->MaybeResolve(ret);
+    } else {
+      // Compare the MAC to the provided signature
+      // No truncation allowed
+      bool equal = (mResult.Length() == mSignature.Length());
+      int cmp = NSS_SecureMemcmp(mSignature.Elements(),
+                                 mResult.Elements(),
+                                 mSignature.Length());
+      equal = equal && (cmp == 0);
+      mResultPromise->MaybeResolve(equal);
+    }
+  }
+};
+
+class RsassaPkcs1Task : public WebCryptoTask
+{
+public:
+  RsassaPkcs1Task(JSContext* aCx, const ObjectOrString& aAlgorithm,
+                  mozilla::dom::Key& aKey,
+                  const CryptoOperationData& aSignature,
+                  const CryptoOperationData& aData,
+                  bool aSign)
+    : mOidTag(SEC_OID_UNKNOWN)
+    , mPrivKey(aKey.GetPrivateKey())
+    , mPubKey(aKey.GetPublicKey())
+    , mSign(aSign)
+    , mVerified(false)
+  {
+    ATTEMPT_BUFFER_INIT(mData, aData);
+    if (!aSign) {
+      ATTEMPT_BUFFER_INIT(mSignature, aSignature);
+    }
+
+    // Look up the SECOidTag based on the KeyAlgorithm
+    // static_cast is safe because we only get here if the algorithm name
+    // is RSASSA-PKCS1-v1_5, and that only happens if we've constructed
+    // an RsaHashedKeyAlgorithm
+    nsRefPtr<RsaHashedKeyAlgorithm> rsaAlg = static_cast<RsaHashedKeyAlgorithm*>(aKey.Algorithm());
+    nsRefPtr<KeyAlgorithm> hashAlg = rsaAlg->Hash();
+
+    switch (hashAlg->Mechanism()) {
+      case CKM_SHA_1:
+        mOidTag = SEC_OID_PKCS1_SHA1_WITH_RSA_ENCRYPTION; break;
+      case CKM_SHA224:
+        mOidTag = SEC_OID_PKCS1_SHA224_WITH_RSA_ENCRYPTION; break;
+      case CKM_SHA256:
+        mOidTag = SEC_OID_PKCS1_SHA256_WITH_RSA_ENCRYPTION; break;
+      case CKM_SHA384:
+        mOidTag = SEC_OID_PKCS1_SHA384_WITH_RSA_ENCRYPTION; break;
+      case CKM_SHA512:
+        mOidTag = SEC_OID_PKCS1_SHA512_WITH_RSA_ENCRYPTION; break;
+      default: {
+        mEarlyRv = NS_ERROR_DOM_NOT_SUPPORTED_ERR;
+        return;
+      }
+    }
+
+    // Check that we have the appropriate key
+    if ((mSign && !mPrivKey) || (!mSign && !mPubKey)) {
+      mEarlyRv = NS_ERROR_DOM_INVALID_ACCESS_ERR;
+      return;
+    }
+  }
+
+private:
+  SECOidTag mOidTag;
+  ScopedSECKEYPrivateKey mPrivKey;
+  ScopedSECKEYPublicKey mPubKey;
+  CryptoBuffer mSignature;
+  CryptoBuffer mData;
+  bool mSign;
+  bool mVerified;
+
+  virtual nsresult DoCrypto() MOZ_OVERRIDE
+  {
+    nsresult rv;
+    if (mSign) {
+      ScopedSECItem signature((SECItem*) PORT_Alloc(sizeof(SECItem)));
+      ScopedSGNContext ctx(SGN_NewContext(mOidTag, mPrivKey));
+      if (!ctx) {
+        return NS_ERROR_DOM_OPERATION_ERR;
+      }
+
+      rv = MapSECStatus(SGN_Begin(ctx));
+      NS_ENSURE_SUCCESS(rv, NS_ERROR_DOM_OPERATION_ERR);
+
+      rv = MapSECStatus(SGN_Update(ctx, mData.Elements(), mData.Length()));
+      NS_ENSURE_SUCCESS(rv, NS_ERROR_DOM_OPERATION_ERR);
+
+      rv = MapSECStatus(SGN_End(ctx, signature));
+      NS_ENSURE_SUCCESS(rv, NS_ERROR_DOM_OPERATION_ERR);
+
+      mSignature.Assign(signature);
+    } else {
+      ScopedSECItem signature(mSignature.ToSECItem());
+      ScopedVFYContext ctx(VFY_CreateContext(mPubKey, signature,
+                                             mOidTag, nullptr));
+      if (!ctx) {
+        int err = PORT_GetError();
+        if (err == SEC_ERROR_BAD_SIGNATURE) {
+          mVerified = false;
+          return NS_OK;
+        }
+        return NS_ERROR_DOM_OPERATION_ERR;
+      }
+
+      rv = MapSECStatus(VFY_Begin(ctx));
+      NS_ENSURE_SUCCESS(rv, NS_ERROR_DOM_OPERATION_ERR);
+
+      rv = MapSECStatus(VFY_Update(ctx, mData.Elements(), mData.Length()));
+      NS_ENSURE_SUCCESS(rv, NS_ERROR_DOM_OPERATION_ERR);
+
+      rv = MapSECStatus(VFY_End(ctx));
+      mVerified = NS_SUCCEEDED(rv);
+    }
+
+    return NS_OK;
+  }
+
+  virtual void Resolve() MOZ_OVERRIDE
+  {
+    if (mSign) {
+      TypedArrayCreator<Uint8Array> ret(mSignature);
+      mResultPromise->MaybeResolve(ret);
+    } else {
+      mResultPromise->MaybeResolve(mVerified);
+    }
+  }
+};
+
 class SimpleDigestTask : public ReturnArrayBufferViewTask
 {
 public:
@@ -114,10 +580,7 @@ public:
                    const ObjectOrString& aAlgorithm,
                    const CryptoOperationData& aData)
   {
-    if (!mData.Assign(aData)) {
-      mEarlyRv = NS_ERROR_DOM_UNKNOWN_ERR;
-      return;
-    }
+    ATTEMPT_BUFFER_INIT(mData, aData);
 
     nsString algName;
     mEarlyRv = GetAlgorithmName(aCx, aAlgorithm, algName);
@@ -503,6 +966,307 @@ private:
   }
 };
 
+class GenerateSymmetricKeyTask : public WebCryptoTask
+{
+public:
+  GenerateSymmetricKeyTask(JSContext* aCx,
+      const ObjectOrString& aAlgorithm, bool aExtractable,
+      const Sequence<nsString>& aKeyUsages)
+  {
+    nsIGlobalObject* global = xpc::GetNativeForGlobal(JS::CurrentGlobalOrNull(aCx));
+    if (!global) {
+      mEarlyRv = NS_ERROR_DOM_UNKNOWN_ERR;
+      return;
+    }
+
+    // Create an empty key and set easy attributes
+    mKey = new Key(global);
+    mKey->SetExtractable(aExtractable);
+    mKey->SetType(Key::SECRET);
+
+    // Extract algorithm name
+    nsString algName;
+    mEarlyRv = GetAlgorithmName(aCx, aAlgorithm, algName);
+    if (NS_FAILED(mEarlyRv)) {
+      return;
+    }
+
+    // Construct an appropriate KeyAlorithm
+    nsRefPtr<KeyAlgorithm> algorithm;
+    uint32_t allowedUsages = 0;
+    if (algName.EqualsLiteral(WEBCRYPTO_ALG_AES_CBC) ||
+        algName.EqualsLiteral(WEBCRYPTO_ALG_AES_CTR) ||
+        algName.EqualsLiteral(WEBCRYPTO_ALG_AES_GCM)) {
+      RootedDictionary<AesKeyGenParams> params(aCx);
+      mEarlyRv = Coerce(aCx, params, aAlgorithm);
+      if (NS_FAILED(mEarlyRv) || !params.mLength.WasPassed()) {
+        mEarlyRv = NS_ERROR_DOM_SYNTAX_ERR;
+      }
+
+      mLength = params.mLength.Value();
+      if (mLength != 128 && mLength != 192 && mLength != 256) {
+        mEarlyRv = NS_ERROR_DOM_DATA_ERR;
+        return;
+      }
+      algorithm = new AesKeyAlgorithm(global, algName, mLength);
+      allowedUsages = Key::ENCRYPT | Key::DECRYPT;
+    } else if (algName.EqualsLiteral(WEBCRYPTO_ALG_HMAC)) {
+      RootedDictionary<HmacKeyGenParams> params(aCx);
+      mEarlyRv = Coerce(aCx, params, aAlgorithm);
+      if (NS_FAILED(mEarlyRv) || !params.mLength.WasPassed() ||
+          !params.mHash.WasPassed()) {
+        mEarlyRv = NS_ERROR_DOM_SYNTAX_ERR;
+        return;
+      }
+
+      nsString hashName;
+      if (params.mHash.Value().IsString()) {
+        hashName.Assign(params.mHash.Value().GetAsString());
+      } else {
+        Algorithm hashAlg;
+        mEarlyRv = Coerce(aCx, hashAlg, params.mHash.Value());
+        if (NS_FAILED(mEarlyRv) || !hashAlg.mName.WasPassed()) {
+          return;
+        }
+        hashName.Assign(hashAlg.mName.Value());
+      }
+
+      mLength = params.mLength.Value();
+      algorithm = new HmacKeyAlgorithm(global, algName, mLength, hashName);
+      allowedUsages = Key::SIGN | Key::VERIFY;
+    } else {
+      mEarlyRv = NS_ERROR_DOM_NOT_SUPPORTED_ERR;
+      return;
+    }
+
+    // Add key usages
+    mKey->ClearUsages();
+    for (uint32_t i = 0; i < aKeyUsages.Length(); ++i) {
+      mEarlyRv = mKey->AddUsageIntersecting(aKeyUsages[i], allowedUsages);
+      if (NS_FAILED(mEarlyRv)) {
+        return;
+      }
+    }
+
+    mLength = mLength >> 3; // bits to bytes
+    mMechanism = algorithm->Mechanism();
+    mKey->SetAlgorithm(algorithm);
+    // SetSymKey done in Resolve, after we've done the keygen
+
+    return;
+  }
+
+private:
+  nsRefPtr<Key> mKey;
+  size_t mLength;
+  CK_MECHANISM_TYPE mMechanism;
+  CryptoBuffer mKeyData;
+
+  virtual nsresult DoCrypto() MOZ_OVERRIDE
+  {
+    ScopedPK11SlotInfo slot(PK11_GetInternalSlot());
+    MOZ_ASSERT(slot.get());
+
+    ScopedPK11SymKey symKey(PK11_KeyGen(slot.get(), mMechanism, nullptr,
+                                        mLength, nullptr));
+    if (!symKey) {
+      return NS_ERROR_DOM_UNKNOWN_ERR;
+    }
+
+    nsresult rv = MapSECStatus(PK11_ExtractKeyValue(symKey));
+    if (NS_FAILED(rv)) {
+      return NS_ERROR_DOM_UNKNOWN_ERR;
+    }
+
+    // This doesn't leak, because the SECItem* returned by PK11_GetKeyData
+    // just refers to a buffer managed by symKey.  The assignment copies the
+    // data, so mKeyData manages one copy, while symKey manages another.
+    ATTEMPT_BUFFER_ASSIGN(mKeyData, PK11_GetKeyData(symKey));
+    return NS_OK;
+  }
+
+  virtual void Resolve() {
+    mKey->SetSymKey(mKeyData);
+    mResultPromise->MaybeResolve(mKey);
+  }
+
+  virtual void Cleanup() {
+    mKey = nullptr;
+  }
+};
+
+class GenerateAsymmetricKeyTask : public WebCryptoTask
+{
+public:
+  GenerateAsymmetricKeyTask(JSContext* aCx,
+      const ObjectOrString& aAlgorithm, bool aExtractable,
+      const Sequence<nsString>& aKeyUsages)
+  {
+    nsIGlobalObject* global = xpc::GetNativeForGlobal(JS::CurrentGlobalOrNull(aCx));
+    if (!global) {
+      mEarlyRv = NS_ERROR_DOM_UNKNOWN_ERR;
+      return;
+    }
+
+    // Create an empty key and set easy attributes
+    mKeyPair = new KeyPair(global);
+
+    // Extract algorithm name
+    nsString algName;
+    mEarlyRv = GetAlgorithmName(aCx, aAlgorithm, algName);
+    if (NS_FAILED(mEarlyRv)) {
+      return;
+    }
+
+    // Construct an appropriate KeyAlorithm
+    KeyAlgorithm* algorithm;
+    uint32_t privateAllowedUsages = 0, publicAllowedUsages = 0;
+    if (algName.EqualsLiteral(WEBCRYPTO_ALG_RSASSA_PKCS1)) {
+      RootedDictionary<RsaHashedKeyGenParams> params(aCx);
+      mEarlyRv = Coerce(aCx, params, aAlgorithm);
+      if (NS_FAILED(mEarlyRv) || !params.mModulusLength.WasPassed() ||
+          !params.mPublicExponent.WasPassed() ||
+          !params.mHash.WasPassed()) {
+        // TODO fix error and handle default values
+        mEarlyRv = NS_ERROR_DOM_SYNTAX_ERR;
+      }
+
+      // Pull relevant info
+      uint32_t modulusLength = params.mModulusLength.Value();
+      CryptoBuffer publicExponent;
+      ATTEMPT_BUFFER_INIT(publicExponent, params.mPublicExponent.Value());
+      nsString hashName;
+      mEarlyRv = GetAlgorithmName(aCx, params.mHash.Value(), hashName);
+      if (NS_FAILED(mEarlyRv)) {
+        return;
+      }
+
+      // Create algorithm
+      algorithm = new RsaHashedKeyAlgorithm(global, algName, modulusLength,
+                                            publicExponent, hashName);
+      mKeyPair->PublicKey()->SetAlgorithm(algorithm);
+      mKeyPair->PrivateKey()->SetAlgorithm(algorithm);
+      mMechanism = CKM_RSA_PKCS_KEY_PAIR_GEN;
+
+      // Set up params struct
+      mRsaParams.keySizeInBits = modulusLength;
+      bool converted = publicExponent.GetBigIntValue(mRsaParams.pe);
+      if (!converted) {
+        mEarlyRv = NS_ERROR_DOM_INVALID_ACCESS_ERR;
+        return;
+      }
+
+      privateAllowedUsages = Key::SIGN;
+      publicAllowedUsages = Key::VERIFY;
+    } else if (algName.EqualsLiteral(WEBCRYPTO_ALG_RSAES_PKCS1)) {
+      RootedDictionary<RsaKeyGenParams> params(aCx);
+      mEarlyRv = Coerce(aCx, params, aAlgorithm);
+      if (NS_FAILED(mEarlyRv) || !params.mModulusLength.WasPassed() ||
+          !params.mPublicExponent.WasPassed()) {
+        // TODO fix error and handle default values
+        mEarlyRv = NS_ERROR_DOM_SYNTAX_ERR;
+      }
+
+      // Pull relevant info
+      uint32_t modulusLength = params.mModulusLength.Value();
+      CryptoBuffer publicExponent;
+      ATTEMPT_BUFFER_INIT(publicExponent, params.mPublicExponent.Value());
+
+      // Create algorithm and note the mechanism
+      algorithm = new RsaKeyAlgorithm(global, algName, modulusLength,
+                                      publicExponent);
+      mKeyPair->PublicKey()->SetAlgorithm(algorithm);
+      mKeyPair->PrivateKey()->SetAlgorithm(algorithm);
+      mMechanism = CKM_RSA_PKCS_KEY_PAIR_GEN;
+
+      // Set up params struct
+      mRsaParams.keySizeInBits = modulusLength;
+      bool converted = publicExponent.GetBigIntValue(mRsaParams.pe);
+      if (!converted) {
+        mEarlyRv = NS_ERROR_DOM_INVALID_ACCESS_ERR;
+        return;
+      }
+
+      privateAllowedUsages = Key::DECRYPT | Key::UNWRAPKEY;
+      publicAllowedUsages = Key::ENCRYPT | Key::WRAPKEY;
+    } else {
+      mEarlyRv = NS_ERROR_DOM_NOT_SUPPORTED_ERR;
+      return;
+    }
+
+    mKeyPair->PrivateKey()->SetExtractable(aExtractable);
+    mKeyPair->PrivateKey()->SetType(Key::PRIVATE);
+
+    mKeyPair->PublicKey()->SetExtractable(true);
+    mKeyPair->PublicKey()->SetType(Key::PUBLIC);
+
+    mKeyPair->PrivateKey()->ClearUsages();
+    mKeyPair->PublicKey()->ClearUsages();
+    for (uint32_t i=0; i < aKeyUsages.Length(); ++i) {
+      mEarlyRv = mKeyPair->PrivateKey()->AddUsageIntersecting(aKeyUsages[i],
+                                                              privateAllowedUsages);
+      if (NS_FAILED(mEarlyRv)) {
+        return;
+      }
+
+      mEarlyRv = mKeyPair->PublicKey()->AddUsageIntersecting(aKeyUsages[i],
+                                                             publicAllowedUsages);
+      if (NS_FAILED(mEarlyRv)) {
+        return;
+      }
+    }
+
+    return;
+  }
+
+private:
+  nsRefPtr<KeyPair> mKeyPair;
+  CK_MECHANISM_TYPE mMechanism;
+  PK11RSAGenParams mRsaParams;
+  ScopedSECKEYPublicKey mPublicKey;
+  ScopedSECKEYPrivateKey mPrivateKey;
+
+  virtual void ReleaseNSSResources() MOZ_OVERRIDE
+  {
+    mPublicKey.dispose();
+    mPrivateKey.dispose();
+  }
+
+  virtual nsresult DoCrypto() MOZ_OVERRIDE
+  {
+    ScopedPK11SlotInfo slot(PK11_GetInternalSlot());
+    MOZ_ASSERT(slot.get());
+
+    void* param;
+    switch (mMechanism) {
+      case CKM_RSA_PKCS_KEY_PAIR_GEN: param = &mRsaParams; break;
+      default: return NS_ERROR_DOM_NOT_SUPPORTED_ERR;
+    }
+
+    SECKEYPublicKey* pubKey;
+    mPrivateKey = PK11_GenerateKeyPair(slot.get(), mMechanism, param, &pubKey,
+                                       PR_FALSE, PR_FALSE, nullptr);
+    mPublicKey = pubKey;
+    if (!mPrivateKey.get() || !mPublicKey.get()) {
+      return NS_ERROR_DOM_UNKNOWN_ERR;
+    }
+
+    mKeyPair->PrivateKey()->SetPrivateKey(mPrivateKey);
+    mKeyPair->PublicKey()->SetPublicKey(mPublicKey);
+    return NS_OK;
+  }
+
+  virtual void Resolve() MOZ_OVERRIDE
+  {
+    mResultPromise->MaybeResolve(mKeyPair);
+  }
+
+  virtual void Cleanup() MOZ_OVERRIDE
+  {
+    mKeyPair = nullptr;
+  }
+};
+
 
 // Task creation methods for WebCryptoTask
 
@@ -513,6 +1277,26 @@ WebCryptoTask::EncryptDecryptTask(JSContext* aCx,
                                   const CryptoOperationData& aData,
                                   bool aEncrypt)
 {
+  nsString algName;
+  nsresult rv = GetAlgorithmName(aCx, aAlgorithm, algName);
+  if (NS_FAILED(rv)) {
+    return new FailureTask(rv);
+  }
+
+  // Ensure key is usable for this operation
+  if ((aEncrypt  && !aKey.HasUsage(Key::ENCRYPT)) ||
+      (!aEncrypt && !aKey.HasUsage(Key::DECRYPT))) {
+    return new FailureTask(NS_ERROR_DOM_INVALID_ACCESS_ERR);
+  }
+
+  if (algName.EqualsLiteral(WEBCRYPTO_ALG_AES_CBC) ||
+      algName.EqualsLiteral(WEBCRYPTO_ALG_AES_CTR) ||
+      algName.EqualsLiteral(WEBCRYPTO_ALG_AES_GCM)) {
+    return new AesTask(aCx, aAlgorithm, aKey, aData, aEncrypt);
+  } else if (algName.EqualsLiteral(WEBCRYPTO_ALG_RSAES_PKCS1)) {
+    return new RsaesPkcs1Task(aCx, aAlgorithm, aKey, aData, aEncrypt);
+  }
+
   return new FailureTask(NS_ERROR_DOM_NOT_SUPPORTED_ERR);
 }
 
@@ -524,6 +1308,24 @@ WebCryptoTask::SignVerifyTask(JSContext* aCx,
                               const CryptoOperationData& aData,
                               bool aSign)
 {
+  nsString algName;
+  nsresult rv = GetAlgorithmName(aCx, aAlgorithm, algName);
+  if (NS_FAILED(rv)) {
+    return new FailureTask(rv);
+  }
+
+  // Ensure key is usable for this operation
+  if ((aSign  && !aKey.HasUsage(Key::SIGN)) ||
+      (!aSign && !aKey.HasUsage(Key::VERIFY))) {
+    return new FailureTask(NS_ERROR_DOM_INVALID_ACCESS_ERR);
+  }
+
+  if (algName.EqualsLiteral(WEBCRYPTO_ALG_HMAC)) {
+    return new HmacTask(aCx, aAlgorithm, aKey, aSignature, aData, aSign);
+  } else if (algName.EqualsLiteral(WEBCRYPTO_ALG_RSASSA_PKCS1)) {
+    return new RsassaPkcs1Task(aCx, aAlgorithm, aKey, aSignature, aData, aSign);
+  }
+
   return new FailureTask(NS_ERROR_DOM_NOT_SUPPORTED_ERR);
 }
 
@@ -581,7 +1383,23 @@ WebCryptoTask::GenerateKeyTask(JSContext* aCx,
                                bool aExtractable,
                                const Sequence<nsString>& aKeyUsages)
 {
-  return new FailureTask(NS_ERROR_DOM_NOT_SUPPORTED_ERR);
+  nsString algName;
+  nsresult rv = GetAlgorithmName(aCx, aAlgorithm, algName);
+  if (NS_FAILED(rv)) {
+    return new FailureTask(rv);
+  }
+
+  if (algName.EqualsASCII(WEBCRYPTO_ALG_AES_CBC) ||
+      algName.EqualsASCII(WEBCRYPTO_ALG_AES_CTR) ||
+      algName.EqualsASCII(WEBCRYPTO_ALG_AES_GCM) ||
+      algName.EqualsASCII(WEBCRYPTO_ALG_HMAC)) {
+    return new GenerateSymmetricKeyTask(aCx, aAlgorithm, aExtractable, aKeyUsages);
+  } else if (algName.EqualsASCII(WEBCRYPTO_ALG_RSAES_PKCS1) ||
+             algName.EqualsASCII(WEBCRYPTO_ALG_RSASSA_PKCS1)) {
+    return new GenerateAsymmetricKeyTask(aCx, aAlgorithm, aExtractable, aKeyUsages);
+  } else {
+    return new FailureTask(NS_ERROR_DOM_NOT_SUPPORTED_ERR);
+  }
 }
 
 WebCryptoTask*

dom/crypto/WebCryptoTask.h

@@ -121,6 +121,7 @@ public:
                           const CryptoOperationData& aData)
   {
     CryptoOperationData dummy;
+    dummy.SetAsArrayBuffer(aCx);
     return SignVerifyTask(aCx, aAlgorithm, aKey, dummy, aData, true);
   }
 

dom/crypto/moz.build

@@ -12,6 +12,7 @@ EXPORTS.mozilla.dom += [
     'HmacKeyAlgorithm.h',
     'Key.h',
     'KeyAlgorithm.h',
+    'KeyPair.h',
     'RsaHashedKeyAlgorithm.h',
     'RsaKeyAlgorithm.h',
     'WebCryptoCommon.h',
@@ -24,6 +25,7 @@ UNIFIED_SOURCES += [
     'HmacKeyAlgorithm.cpp',
     'Key.cpp',
     'KeyAlgorithm.cpp',
+    'KeyPair.cpp',
     'RsaHashedKeyAlgorithm.cpp',
     'RsaKeyAlgorithm.cpp',
     'WebCryptoTask.cpp',

dom/crypto/test/test-vectors.js

@@ -50,4 +50,264 @@ tv = {
     result: util.hex2abv("248D6A61D20638B8E5C026930C3E6039A33CE45964F" +
                          "F2167F6ECEDD419DB06C1"),
   },
+
+  // Test vector 2 from:
+  // <https://github.com/geertj/bluepass/blob/master/tests/vectors/aes-cbc-pkcs7.txt>
+  aes_cbc_enc: {
+    /*
+    key: util.hex2abv("893123f2d57b6e2c39e2f10d3ff818d1"),
+    iv: util.hex2abv("64be1b06ea7453ed2df9a79319d5edc5"),
+    data: util.hex2abv("44afb9a64ac896c2"),
+    result: util.hex2abv("7067c4cb6dfc69df949c2f39903c9310"),
+    */
+    key: util.hex2abv("893123f2d57b6e2c39e2f10d3ff818d1"),
+    iv: util.hex2abv("64be1b06ea7453ed2df9a79319d5edc5"),
+    data: util.hex2abv("44afb9a64ac896c2"),
+    result: util.hex2abv("7067c4cb6dfc69df949c2f39903c9310"),
+  },
+
+  // Test vector 11 from:
+  // <https://github.com/geertj/bluepass/blob/master/tests/vectors/aes-cbc-pkcs7.txt>
+  aes_cbc_dec: {
+    key: util.hex2abv("04952c3fcf497a4d449c41e8730c5d9a"),
+    iv: util.hex2abv("53549bf7d5553b727458c1abaf0ba167"),
+    data: util.hex2abv("7fa290322ca7a1a04b61a1147ff20fe6" +
+                       "6fde58510a1d0289d11c0ddf6f4decfd"),
+    result: util.hex2abv("c9a44f6f75e98ddbca7332167f5c45e3"),
+  },
+
+  // Test vector 2 from:
+  // <http://tools.ietf.org/html/rfc3686#section-6>
+  aes_ctr_enc: {
+    key: util.hex2abv("7E24067817FAE0D743D6CE1F32539163"),
+    iv: util.hex2abv("006CB6DBC0543B59DA48D90B00000001"),
+    data: util.hex2abv("000102030405060708090A0B0C0D0E0F" +
+                       "101112131415161718191A1B1C1D1E1F"),
+    result: util.hex2abv("5104A106168A72D9790D41EE8EDAD3" +
+                         "88EB2E1EFC46DA57C8FCE630DF9141BE28"),
+  },
+
+  // Test vector 3 from:
+  // <http://tools.ietf.org/html/rfc3686#section-6>
+  aes_ctr_dec: {
+    key: util.hex2abv("7691BE035E5020A8AC6E618529F9A0DC"),
+    iv: util.hex2abv("00E0017B27777F3F4A1786F000000001"),
+    data: util.hex2abv("000102030405060708090A0B0C0D0E0F" +
+                       "101112131415161718191A1B1C1D1E1F20212223"),
+    result: util.hex2abv("C1CF48A89F2FFDD9CF4652E9EFDB72D7" +
+                         "4540A42BDE6D7836D59A5CEAAEF3105325B2072F"),
+  },
+
+  // Test case #18 from McGrew and Viega
+  // <http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/gcm/gcm-revised-spec.pdf>
+  aes_gcm_enc: {
+    key: util.hex2abv("feffe9928665731c6d6a8f9467308308" +
+                      "feffe9928665731c6d6a8f9467308308"),
+    iv: util.hex2abv("9313225df88406e555909c5aff5269aa" +
+                     "6a7a9538534f7da1e4c303d2a318a728" +
+                     "c3c0c95156809539fcf0e2429a6b5254" +
+                     "16aedbf5a0de6a57a637b39b"),
+    adata: util.hex2abv("feedfacedeadbeeffeedfacedeadbeefabaddad2"),
+    data: util.hex2abv("d9313225f88406e5a55909c5aff5269a" +
+                       "86a7a9531534f7da2e4c303d8a318a72" +
+                       "1c3c0c95956809532fcf0e2449a6b525" +
+                       "b16aedf5aa0de657ba637b39"),
+    result: util.hex2abv("5a8def2f0c9e53f1f75d7853659e2a20" +
+                         "eeb2b22aafde6419a058ab4f6f746bf4" +
+                         "0fc0c3b780f244452da3ebf1c5d82cde" +
+                         "a2418997200ef82e44ae7e3f" +
+                         "a44a8266ee1c8eb0c8b5d4cf5ae9f19a"),
+  },
+
+
+  // Test case #17 from McGrew and Viega
+  // <http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/gcm/gcm-revised-spec.pdf>
+  aes_gcm_dec: {
+    key: util.hex2abv("feffe9928665731c6d6a8f9467308308" +
+                      "feffe9928665731c6d6a8f9467308308"),
+    iv: util.hex2abv("cafebabefacedbad"),
+    adata: util.hex2abv("feedfacedeadbeeffeedfacedeadbeefabaddad2"),
+    data: util.hex2abv("c3762df1ca787d32ae47c13bf19844cb" +
+                       "af1ae14d0b976afac52ff7d79bba9de0" +
+                       "feb582d33934a4f0954cc2363bc73f78" +
+                       "62ac430e64abe499f47c9b1f" +
+                       "3a337dbf46a792c45e454913fe2ea8f2"),
+    result: util.hex2abv("d9313225f88406e5a55909c5aff5269a" +
+                       "86a7a9531534f7da2e4c303d8a318a72" +
+                       "1c3c0c95956809532fcf0e2449a6b525" +
+                       "b16aedf5aa0de657ba637b39"),
+  },
+
+  // Test case #17 from McGrew and Viega
+  // ... but with part of the authentication tag zeroed
+  // <http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/gcm/gcm-revised-spec.pdf>
+  aes_gcm_dec_fail: {
+    key: util.hex2abv("feffe9928665731c6d6a8f9467308308" +
+                      "feffe9928665731c6d6a8f9467308308"),
+    iv: util.hex2abv("cafebabefacedbad"),
+    adata: util.hex2abv("feedfacedeadbeeffeedfacedeadbeefabaddad2"),
+    data: util.hex2abv("c3762df1ca787d32ae47c13bf19844cb" +
+                       "af1ae14d0b976afac52ff7d79bba9de0" +
+                       "feb582d33934a4f0954cc2363bc73f78" +
+                       "62ac430e64abe499f47c9b1f" +
+                       "00000000000000005e454913fe2ea8f2"),
+    result: util.hex2abv("d9313225f88406e5a55909c5aff5269a" +
+                       "86a7a9531534f7da2e4c303d8a318a72" +
+                       "1c3c0c95956809532fcf0e2449a6b525" +
+                       "b16aedf5aa0de657ba637b39"),
+  },
+
+  // RFC 4231 <http://tools.ietf.org/html/rfc4231>, Test Case 7
+  hmac_sign: {
+    key: util.hex2abv("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" +
+                      "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" +
+                      "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" +
+                      "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" +
+                      "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" +
+                      "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" +
+                      "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" +
+                      "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" +
+                      "aaaaaa"),
+    data: util.hex2abv("54686973206973206120746573742075" +
+                       "73696e672061206c6172676572207468" +
+                       "616e20626c6f636b2d73697a65206b65" +
+                       "7920616e642061206c61726765722074" +
+                       "68616e20626c6f636b2d73697a652064" +
+                       "6174612e20546865206b6579206e6565" +
+                       "647320746f2062652068617368656420" +
+                       "6265666f7265206265696e6720757365" +
+                       "642062792074686520484d414320616c" +
+                       "676f726974686d2e"),
+    result: util.hex2abv("9b09ffa71b942fcb27635fbcd5b0e944" +
+                         "bfdc63644f0713938a7f51535c3a35e2"),
+  },
+
+  // RFC 4231 <http://tools.ietf.org/html/rfc4231>, Test Case 6
+  hmac_verify: {
+    key: util.hex2abv("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" +
+                      "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" +
+                      "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" +
+                      "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" +
+                      "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" +
+                      "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" +
+                      "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" +
+                      "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" +
+                      "aaaaaa"),
+    data: util.hex2abv("54657374205573696e67204c61726765" +
+                       "72205468616e20426c6f636b2d53697a" +
+                       "65204b6579202d2048617368204b6579" +
+                       "204669727374"),
+    sig: util.hex2abv("60e431591ee0b67f0d8a26aacbf5b77f" +
+                      "8e0bc6213728c5140546040f0ee37f54"),
+    sig_fail: util.hex2abv("000000001ee0b67f0d8a26aacbf5b77f" +
+                           "8e0bc6213728c5140546040f0ee37f54"),
+  },
+
+  // RSA test vectors, Example 1.3
+  // <ftp://ftp.rsa.com/pub/rsalabs/tmp/pkcs1v15crypt-vectors.txt>
+  rsaes: {
+    pkcs8: util.hex2abv(
+      "30820276020100300d06092a864886f70d0101010500048202603082025c0201" +
+      "0002818100a8b3b284af8eb50b387034a860f146c4919f318763cd6c5598c8ae" +
+      "4811a1e0abc4c7e0b082d693a5e7fced675cf4668512772c0cbc64a742c6c630" +
+      "f533c8cc72f62ae833c40bf25842e984bb78bdbf97c0107d55bdb662f5c4e0fa" +
+      "b9845cb5148ef7392dd3aaff93ae1e6b667bb3d4247616d4f5ba10d4cfd226de" +
+      "88d39f16fb020301000102818053339cfdb79fc8466a655c7316aca85c55fd8f" +
+      "6dd898fdaf119517ef4f52e8fd8e258df93fee180fa0e4ab29693cd83b152a55" +
+      "3d4ac4d1812b8b9fa5af0e7f55fe7304df41570926f3311f15c4d65a732c4831" +
+      "16ee3d3d2d0af3549ad9bf7cbfb78ad884f84d5beb04724dc7369b31def37d0c" +
+      "f539e9cfcdd3de653729ead5d1024100cc8853d1d54da630fac004f471f281c7" +
+      "b8982d8224a490edbeb33d3e3d5cc93c4765703d1dd791642f1f116a0dd852be" +
+      "2419b2af72bfe9a030e860b0288b5d77024100d32737e7267ffe1341b2d5c0d1" +
+      "50a81b586fb3132bed2f8d5262864a9cb9f30af38be448598d413a172efb802c" +
+      "21acf1c11c520c2f26a471dcad212eac7ca39d02410095297b0f95a2fa67d007" +
+      "07d609dfd4fc05c89dafc2ef6d6ea55bec771ea333734d9251e79082ecda866e" +
+      "fef13c459e1a631386b7e354c899f5f112ca85d7158302400e12bf1718e9cef5" +
+      "599ba1c3882fe8046a90874eefce8f2ccc20e4f2741fb0a33a3848aec9c9305f" +
+      "becbd2d76819967d4671acc6431e4037968db37878e695c102407fbf3360826f" +
+      "c125dceac9bf8d38b6cad8ccc8b4f867bfea02dcbf5df008258ee9902ea07e28" +
+      "7770df660328c81e906184b6aa2239868775204d098fc846c669"
+    ),
+    spki: util.hex2abv(
+      "30819f300d06092a864886f70d010101050003818d0030818902818100a8b3b2" +
+      "84af8eb50b387034a860f146c4919f318763cd6c5598c8ae4811a1e0abc4c7e0" +
+      "b082d693a5e7fced675cf4668512772c0cbc64a742c6c630f533c8cc72f62ae8" +
+      "33c40bf25842e984bb78bdbf97c0107d55bdb662f5c4e0fab9845cb5148ef739" +
+      "2dd3aaff93ae1e6b667bb3d4247616d4f5ba10d4cfd226de88d39f16fb020301" +
+      "0001"
+    ),
+    data: util.hex2abv(
+      "d94ae0832e6445ce42331cb06d531a82b1db4baad30f746dc916df24d4e3c245" +
+      "1fff59a6423eb0e1d02d4fe646cf699dfd818c6e97b051"
+    ),
+    result: util.hex2abv(
+      "709c7d2d4598c96065b6588da2f89fa87f062d7241ef6595898f637ada57eae9" +
+      "0173f0fb4bf6a91ebd96506907c853dacf208494be94d313a04185d474a90741" +
+      "2effc3e024d07e4d09aa245fbcb130219bfa5de02d4f7e2ec9e62e8ad32dee5f" +
+      "f4d8e4cfecbc5033a1c2c61c5233ae16192a481d0075bfc7ce028212cd27bebe"
+    ),
+  },
+
+  // RSA test vectors, Example 1.3 (sig256 generated with PyCrypto)
+  // <ftp://ftp.rsa.com/pub/rsalabs/tmp/pkcs1v15sign-vectors.txt>
+  rsassa: {
+    pkcs8: util.hex2abv(
+      "30820275020100300d06092a864886f70d01010105000482025f3082025b0201" +
+      "0002818100a56e4a0e701017589a5187dc7ea841d156f2ec0e36ad52a44dfeb1" +
+      "e61f7ad991d8c51056ffedb162b4c0f283a12a88a394dff526ab7291cbb307ce" +
+      "abfce0b1dfd5cd9508096d5b2b8b6df5d671ef6377c0921cb23c270a70e2598e" +
+      "6ff89d19f105acc2d3f0cb35f29280e1386b6f64c4ef22e1e1f20d0ce8cffb22" +
+      "49bd9a2137020301000102818033a5042a90b27d4f5451ca9bbbd0b44771a101" +
+      "af884340aef9885f2a4bbe92e894a724ac3c568c8f97853ad07c0266c8c6a3ca" +
+      "0929f1e8f11231884429fc4d9ae55fee896a10ce707c3ed7e734e44727a39574" +
+      "501a532683109c2abacaba283c31b4bd2f53c3ee37e352cee34f9e503bd80c06" +
+      "22ad79c6dcee883547c6a3b325024100e7e8942720a877517273a356053ea2a1" +
+      "bc0c94aa72d55c6e86296b2dfc967948c0a72cbccca7eacb35706e09a1df55a1" +
+      "535bd9b3cc34160b3b6dcd3eda8e6443024100b69dca1cf7d4d7ec81e75b90fc" +
+      "ca874abcde123fd2700180aa90479b6e48de8d67ed24f9f19d85ba275874f542" +
+      "cd20dc723e6963364a1f9425452b269a6799fd024028fa13938655be1f8a159c" +
+      "baca5a72ea190c30089e19cd274a556f36c4f6e19f554b34c077790427bbdd8d" +
+      "d3ede2448328f385d81b30e8e43b2fffa02786197902401a8b38f398fa712049" +
+      "898d7fb79ee0a77668791299cdfa09efc0e507acb21ed74301ef5bfd48be455e" +
+      "aeb6e1678255827580a8e4e8e14151d1510a82a3f2e729024027156aba4126d2" +
+      "4a81f3a528cbfb27f56886f840a9f6e86e17a44b94fe9319584b8e22fdde1e5a" +
+      "2e3bd8aa5ba8d8584194eb2190acf832b847f13a3d24a79f4d"
+    ),
+    spki: util.hex2abv(
+      "30819f300d06092a864886f70d010101050003818d0030818902818100a56e4a" +
+      "0e701017589a5187dc7ea841d156f2ec0e36ad52a44dfeb1e61f7ad991d8c510" +
+      "56ffedb162b4c0f283a12a88a394dff526ab7291cbb307ceabfce0b1dfd5cd95" +
+      "08096d5b2b8b6df5d671ef6377c0921cb23c270a70e2598e6ff89d19f105acc2" +
+      "d3f0cb35f29280e1386b6f64c4ef22e1e1f20d0ce8cffb2249bd9a2137020301" +
+      "0001"
+    ),
+    data: util.hex2abv(
+      "a4b159941761c40c6a82f2b80d1b94f5aa2654fd17e12d588864679b54cd04ef" +
+      "8bd03012be8dc37f4b83af7963faff0dfa225477437c48017ff2be8191cf3955" +
+      "fc07356eab3f322f7f620e21d254e5db4324279fe067e0910e2e81ca2cab31c7" +
+      "45e67a54058eb50d993cdb9ed0b4d029c06d21a94ca661c3ce27fae1d6cb20f4" +
+      "564d66ce4767583d0e5f060215b59017be85ea848939127bd8c9c4d47b51056c" +
+      "031cf336f17c9980f3b8f5b9b6878e8b797aa43b882684333e17893fe9caa6aa" +
+      "299f7ed1a18ee2c54864b7b2b99b72618fb02574d139ef50f019c9eef4169713" +
+      "38e7d470"
+    ),
+    sig1: util.hex2abv(
+      "0b1f2e5180e5c7b4b5e672929f664c4896e50c35134b6de4d5a934252a3a245f" +
+      "f48340920e1034b7d5a5b524eb0e1cf12befef49b27b732d2c19e1c43217d6e1" +
+      "417381111a1d36de6375cf455b3c9812639dbc27600c751994fb61799ecf7da6" +
+      "bcf51540afd0174db4033188556675b1d763360af46feeca5b60f882829ee7b2"
+    ),
+    sig256: util.hex2abv(
+      "558af496a9900ec497a51723a0bf1be167a3fdd0e40c95764575bcc93d35d415" +
+      "94aef08cd8d339272387339fe5faa5635a1c4ad6c9b622f8c38edce6b26d9b76" +
+      "e3fec5b567e5b996624c4aeef74191c4349e5ac9e29b848c54bcfa538fec58d5" +
+      "9368253f0ff9a7ba0637918dd16b2c95f8c73ad7484482ba4387655f2f7d4b00"
+    ),
+    sig_fail: util.hex2abv(
+      "8000000080e5c7b4b5e672929f664c4896e50c35134b6de4d5a934252a3a245f" +
+      "f48340920e1034b7d5a5b524eb0e1cf12befef49b27b732d2c19e1c43217d6e1" +
+      "417381111a1d36de6375cf455b3c9812639dbc27600c751994fb61799ecf7da6" +
+      "bcf51540afd0174db4033188556675b1d763360af46feeca5b60f882829ee7b2"
+    ),
+  },
 }

dom/crypto/test/tests.js

@@ -309,6 +309,53 @@ TestArray.addTest(
   }
 );
 
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "Generate a 192-bit AES key",
+  function() {
+    var that = this;
+    var alg = { name: "AES-GCM", length: 192 };
+    crypto.subtle.generateKey(alg, true, ["encrypt"]).then(
+      complete(that, function(x) {
+        return hasKeyFields(x);
+      }),
+      error(that)
+    );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "Generate a 1024-bit RSA key",
+  function() {
+    var that = this;
+    var alg = {
+      name: "RSAES-PKCS1-v1_5",
+      modulusLength: 1024,
+      publicExponent: new Uint8Array([0x01, 0x00, 0x01])
+    };
+    crypto.subtle.generateKey(alg, false, ["encrypt", "decrypt"]).then(
+      complete(that, function(x) {
+        return exists(x.publicKey) &&
+               (x.publicKey.algorithm.name == alg.name) &&
+               (x.publicKey.algorithm.modulusLength == alg.modulusLength) &&
+               (x.publicKey.type == "public") &&
+               x.publicKey.extractable &&
+               (x.publicKey.usages.length == 1) &&
+               (x.publicKey.usages[0] == "encrypt") &&
+               exists(x.privateKey) &&
+               (x.privateKey.algorithm.name == alg.name) &&
+               (x.privateKey.algorithm.modulusLength == alg.modulusLength) &&
+               (x.privateKey.type == "private") &&
+               !x.privateKey.extractable &&
+               (x.privateKey.usages.length == 1) &&
+               (x.privateKey.usages[0] == "decrypt");
+      }),
+      error(that)
+    );
+  }
+);
+
 // -----------------------------------------------------------------------------
 TestArray.addTest(
   "SHA-256 digest",
@@ -332,3 +379,439 @@ TestArray.addTest(
     );
   }
 );
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "AES-CBC encrypt",
+  function () {
+    var that = this;
+
+    function doEncrypt(x) {
+      console.log(x);
+      return crypto.subtle.encrypt(
+        { name: "AES-CBC", iv: tv.aes_cbc_enc.iv },
+        x, tv.aes_cbc_enc.data);
+    }
+
+    crypto.subtle.importKey("raw", tv.aes_cbc_enc.key, "AES-CBC", false, ['encrypt'])
+      .then(doEncrypt)
+      .then(
+        memcmp_complete(that, tv.aes_cbc_enc.result),
+        error(that)
+      );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "AES-CBC decrypt",
+  function () {
+    var that = this;
+
+    function doDecrypt(x) {
+      return crypto.subtle.decrypt(
+        { name: "AES-CBC", iv: tv.aes_cbc_dec.iv },
+        x, tv.aes_cbc_dec.data);
+    }
+
+    crypto.subtle.importKey("raw", tv.aes_cbc_dec.key, "AES-CBC", false, ['decrypt'])
+      .then(doDecrypt)
+      .then(
+        memcmp_complete(that, tv.aes_cbc_dec.result),
+        error(that)
+      );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "AES-CTR encryption",
+  function () {
+    var that = this;
+
+    function doEncrypt(x) {
+      return crypto.subtle.encrypt(
+        { name: "AES-CTR", counter: tv.aes_ctr_enc.iv, length: 32 },
+        x, tv.aes_ctr_enc.data);
+    }
+
+    crypto.subtle.importKey("raw", tv.aes_ctr_enc.key, "AES-CTR", false, ['encrypt'])
+      .then(doEncrypt)
+      .then(
+        memcmp_complete(that, tv.aes_ctr_enc.result),
+        error(that)
+      );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "AES-CTR decryption",
+  function () {
+    var that = this;
+
+    function doDecrypt(x) {
+      return crypto.subtle.decrypt(
+        { name: "AES-CTR", counter: tv.aes_ctr_dec.iv, length: 32 },
+        x, tv.aes_ctr_dec.data);
+    }
+
+    crypto.subtle.importKey("raw", tv.aes_ctr_dec.key, "AES-CTR", false, ['decrypt'])
+      .then(doDecrypt)
+      .then(
+        memcmp_complete(that, tv.aes_ctr_dec.result),
+        error(that)
+      );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "AES-GCM encryption",
+  function () {
+    var that = this;
+
+    function doEncrypt(x) {
+      return crypto.subtle.encrypt(
+        {
+          name: "AES-GCM",
+          iv: tv.aes_gcm_enc.iv,
+          additionalData: tv.aes_gcm_enc.adata,
+          tagLength: 128
+        },
+        x, tv.aes_gcm_enc.data);
+    }
+
+    crypto.subtle.importKey("raw", tv.aes_gcm_enc.key, "AES-GCM", false, ['encrypt'])
+      .then(doEncrypt)
+      .then(
+        memcmp_complete(that, tv.aes_gcm_enc.result),
+        error(that)
+      );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "AES-GCM decryption",
+  function () {
+    var that = this;
+
+    function doDecrypt(x) {
+      return crypto.subtle.decrypt(
+        {
+          name: "AES-GCM",
+          iv: tv.aes_gcm_dec.iv,
+          additionalData: tv.aes_gcm_dec.adata,
+          tagLength: 128
+        },
+        x, tv.aes_gcm_dec.data);
+    }
+
+    crypto.subtle.importKey("raw", tv.aes_gcm_dec.key, "AES-GCM", false, ['decrypt'])
+      .then(doDecrypt)
+      .then(
+        memcmp_complete(that, tv.aes_gcm_dec.result),
+        error(that)
+      );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "AES-GCM decryption, failing authentication check",
+  function () {
+    var that = this;
+
+    function doDecrypt(x) {
+      return crypto.subtle.decrypt(
+        {
+          name: "AES-GCM",
+          iv: tv.aes_gcm_dec_fail.iv,
+          additionalData: tv.aes_gcm_dec_fail.adata,
+          tagLength: 128
+        },
+        x, tv.aes_gcm_dec_fail.data);
+    }
+
+    crypto.subtle.importKey("raw", tv.aes_gcm_dec_fail.key, "AES-GCM", false, ['decrypt'])
+      .then(doDecrypt)
+      .then(
+        error(that),
+        complete(that)
+      );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "HMAC SHA-256 sign",
+  function() {
+    var that = this;
+    var alg = {
+      name: "HMAC",
+      hash: "SHA-256"
+    }
+
+    function doSign(x) {
+      return crypto.subtle.sign("HMAC", x, tv.hmac_sign.data);
+    }
+
+    crypto.subtle.importKey("raw", tv.hmac_sign.key, alg, false, ['sign'])
+      .then(doSign)
+      .then(
+        memcmp_complete(that, tv.hmac_sign.result),
+        error(that)
+      );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "HMAC SHA-256 verify",
+  function() {
+    var that = this;
+    var alg = {
+      name: "HMAC",
+      hash: "SHA-256"
+    }
+
+    function doVerify(x) {
+      return crypto.subtle.verify("HMAC", x, tv.hmac_verify.sig, tv.hmac_verify.data);
+    }
+
+    crypto.subtle.importKey("raw", tv.hmac_verify.key, alg, false, ['verify'])
+      .then(doVerify)
+      .then(
+        complete(that, function(x) { return !!x; }),
+        error(that)
+      );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "HMAC SHA-256, failing verification due to bad signature",
+  function() {
+    var that = this;
+    var alg = {
+      name: "HMAC",
+      hash: "SHA-256"
+    }
+
+    function doVerify(x) {
+      return crypto.subtle.verify("HMAC", x, tv.hmac_verify.sig_fail,
+                                             tv.hmac_verify.data);
+    }
+
+    crypto.subtle.importKey("raw", tv.hmac_verify.key, alg, false, ['verify'])
+      .then(doVerify)
+      .then(
+        complete(that, function(x) { return !x; }),
+        error(that)
+      );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "HMAC SHA-256, failing verification due to key usage restriction",
+  function() {
+    var that = this;
+    var alg = {
+      name: "HMAC",
+      hash: "SHA-256"
+    }
+
+    function doVerify(x) {
+      return crypto.subtle.verify("HMAC", x, tv.hmac_verify.sig,
+                                             tv.hmac_verify.data);
+    }
+
+    crypto.subtle.importKey("raw", tv.hmac_verify.key, alg, false, ['encrypt'])
+      .then(doVerify)
+      .then(
+        error(that),
+        complete(that, function(x) { return true; })
+      );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "RSAES-PKCS#1 encrypt/decrypt round-trip",
+  function () {
+    var that = this;
+    var privKey, pubKey;
+    var alg = {name:"RSAES-PKCS1-v1_5"};
+
+    var privKey, pubKey, data, ct, pt;
+    function setPriv(x) { privKey = x; }
+    function setPub(x) { pubKey = x; }
+    function doEncrypt() {
+      return crypto.subtle.encrypt(alg.name, pubKey, tv.rsaes.data);
+    }
+    function doDecrypt(x) {
+      return crypto.subtle.decrypt(alg.name, privKey, x);
+    }
+
+    function fail() { error(that); }
+
+    Promise.all([
+      crypto.subtle.importKey("pkcs8", tv.rsaes.pkcs8, alg, false, ['decrypt'])
+          .then(setPriv, error(that)),
+      crypto.subtle.importKey("spki", tv.rsaes.spki, alg, false, ['encrypt'])
+          .then(setPub, error(that))
+    ]).then(doEncrypt, error(that))
+      .then(doDecrypt, error(that))
+      .then(
+        memcmp_complete(that, tv.rsaes.data),
+        error(that)
+      );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "RSAES-PKCS#1 decryption known answer",
+  function () {
+    var that = this;
+    var alg = {name:"RSAES-PKCS1-v1_5"};
+
+    function doDecrypt(x) {
+      return crypto.subtle.decrypt(alg.name, x, tv.rsaes.result);
+    }
+    function fail() { error(that); }
+
+    crypto.subtle.importKey("pkcs8", tv.rsaes.pkcs8, alg, false, ['decrypt'])
+      .then( doDecrypt, fail )
+      .then( memcmp_complete(that, tv.rsaes.data), fail );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "RSASSA/SHA-1 signature",
+  function () {
+    var that = this;
+    var alg = { name: "RSASSA-PKCS1-v1_5", hash: "SHA-1" };
+
+    function doSign(x) {
+      console.log("sign");
+      console.log(x);
+      return crypto.subtle.sign(alg.name, x, tv.rsassa.data);
+    }
+    function fail() { console.log("fail"); error(that); }
+
+    crypto.subtle.importKey("pkcs8", tv.rsassa.pkcs8, alg, false, ['sign'])
+      .then( doSign, fail )
+      .then( memcmp_complete(that, tv.rsassa.sig1), fail );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "RSASSA verification (SHA-1)",
+  function () {
+    var that = this;
+    var alg = { name: "RSASSA-PKCS1-v1_5", hash: "SHA-1" };
+
+    function doVerify(x) {
+      return crypto.subtle.verify(alg.name, x, tv.rsassa.sig1, tv.rsassa.data);
+    }
+    function fail(x) { error(that); }
+
+    crypto.subtle.importKey("spki", tv.rsassa.spki, alg, false, ['verify'])
+      .then( doVerify, fail )
+      .then(
+        complete(that, function(x) { return x; }),
+        fail
+      );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "RSASSA verification (SHA-1), failing verification",
+  function () {
+    var that = this;
+    var alg = { name: "RSASSA-PKCS1-v1_5", hash: "SHA-1" };
+
+    function doVerify(x) {
+      return crypto.subtle.verify(alg.name, x, tv.rsassa.sig_fail, tv.rsassa.data);
+    }
+    function fail(x) { error(that); }
+
+    crypto.subtle.importKey("spki", tv.rsassa.spki, alg, false, ['verify'])
+      .then( doVerify, fail )
+      .then(
+        complete(that, function(x) { return !x; }),
+        fail
+      );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "RSASSA/SHA-256 signature",
+  function () {
+    var that = this;
+    var alg = { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" };
+
+    function doSign(x) {
+      return crypto.subtle.sign(alg.name, x, tv.rsassa.data);
+    }
+    function fail(x) { console.log(x); error(that); }
+
+    crypto.subtle.importKey("pkcs8", tv.rsassa.pkcs8, alg, false, ['sign'])
+      .then( doSign, fail )
+      .then( memcmp_complete(that, tv.rsassa.sig256), fail );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "RSASSA verification (SHA-256)",
+  function () {
+    var that = this;
+    var alg = { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" };
+
+    function doVerify(x) {
+      return crypto.subtle.verify(alg.name, x, tv.rsassa.sig256, tv.rsassa.data);
+    }
+    function fail(x) { error(that); }
+
+    crypto.subtle.importKey("spki", tv.rsassa.spki, alg, false, ['verify'])
+      .then( doVerify, fail )
+      .then(
+        complete(that, function(x) { return x; }),
+        fail
+      );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "RSASSA verification (SHA-256), failing verification",
+  function () {
+    var that = this;
+    var alg = { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" };
+    var use = ['sign', 'verify'];
+
+    function doVerify(x) {
+      console.log("verifying")
+      return crypto.subtle.verify(alg.name, x, tv.rsassa.sig_fail, tv.rsassa.data);
+    }
+    function fail(x) { console.log("failing"); error(that)(x); }
+
+    console.log("running")
+    crypto.subtle.importKey("spki", tv.rsassa.spki, alg, false, ['verify'])
+      .then( doVerify, fail )
+      .then(
+        complete(that, function(x) { return !x; }),
+        fail
+      );
+  }
+);
+
+

dom/devicestorage/nsDeviceStorage.cpp

@@ -315,7 +315,7 @@ DeviceStorageTypeChecker::Check(const nsAString& aType, nsIFile* aFile)
   }
 
   nsAutoString extensionMatch;
-  extensionMatch.AssignLiteral("*");
+  extensionMatch.Assign('*');
   extensionMatch.Append(Substring(path, dotIdx));
   extensionMatch.Append(';');
 
@@ -358,7 +358,7 @@ DeviceStorageTypeChecker::GetTypeFromFileName(const nsAString& aFileName,
   }
 
   nsAutoString extensionMatch;
-  extensionMatch.AssignLiteral("*");
+  extensionMatch.Assign('*');
   extensionMatch.Append(Substring(aFileName, dotIdx));
   extensionMatch.Append(';');
 

dom/events/PointerEvent.cpp

@@ -104,7 +104,7 @@ PointerEvent::GetPointerType(nsAString& aPointerType)
       aPointerType.AssignLiteral("touch");
       break;
     case nsIDOMMouseEvent::MOZ_SOURCE_UNKNOWN:
-      aPointerType.AssignLiteral("");
+      aPointerType.Truncate();
       break;
   }
 }

dom/events/UIEvent.cpp

@@ -15,6 +15,7 @@
 #include "nsContentUtils.h"
 #include "nsIContent.h"
 #include "nsIInterfaceRequestorUtils.h"
+#include "nsIDocShell.h"
 #include "nsIDOMWindow.h"
 #include "nsIDOMNode.h"
 #include "nsIFrame.h"
@@ -68,12 +69,10 @@ UIEvent::UIEvent(EventTarget* aOwner,
   mView = nullptr;
   if (mPresContext)
   {
-    nsISupports* container = mPresContext->GetContainerWeak();
-    if (container)
+    nsIDocShell* docShell = mPresContext->GetDocShell();
+    if (docShell)
     {
-       nsCOMPtr<nsIDOMWindow> window = do_GetInterface(container);
-       if (window)
-          mView = do_QueryInterface(window);
+       mView = docShell->GetWindow();
     }
   }
 }

dom/imptests/failures/html/html/browsers/the-window-object/mochitest.ini

@@ -7,4 +7,3 @@ support-files =
 [test_window-named-properties.html.json]
 skip-if = true # bug 859075
 [test_window-properties.html.json]
-[test_window-prototype-chain.html.json]

dom/imptests/failures/html/html/browsers/the-window-object/test_window-properties.html.json

@@ -2,29 +2,6 @@
   "EventTarget method: addEventListener": true,
   "EventTarget method: removeEventListener": true,
   "EventTarget method: dispatchEvent": true,
-  "Window method: close": true,
-  "Window method: stop": true,
-  "Window method: focus": true,
-  "Window method: blur": true,
-  "Window method: open": true,
-  "Window method: alert": true,
-  "Window method: confirm": true,
-  "Window method: prompt": true,
-  "Window method: print": true,
-  "Window method: showModalDialog": true,
-  "Window method: postMessage": true,
-  "Window method: btoa": true,
-  "Window method: atob": true,
-  "Window method: setTimeout": true,
-  "Window method: clearTimeout": true,
-  "Window method: setInterval": true,
-  "Window method: clearInterval": true,
-  "Window method: getSelection": true,
-  "Window method: getComputedStyle": true,
-  "Window method: matchMedia": true,
-  "Window method: scroll": true,
-  "Window method: scrollTo": true,
-  "Window method: scrollBy": true,
   "Window readonly attribute: history": true,
   "Window readonly attribute: parent": true,
   "Window readonly attribute: frameElement": true,
@@ -44,93 +21,12 @@
   "Window readonly attribute: screenY": true,
   "Window readonly attribute: outerWidth": true,
   "Window readonly attribute: outerHeight": true,
-  "Window attribute: name": true,
-  "Window attribute: status": true,
-  "Window attribute: opener": true,
-  "Window attribute: onabort": true,
-  "Window attribute: onafterprint": true,
-  "Window attribute: onbeforeprint": true,
-  "Window attribute: onbeforeunload": true,
-  "Window attribute: onblur": true,
-  "Window attribute: oncancel": true,
-  "Window attribute: oncanplay": true,
-  "Window attribute: oncanplaythrough": true,
-  "Window attribute: onchange": true,
-  "Window attribute: onclick": true,
-  "Window attribute: onclose": true,
-  "Window attribute: oncontextmenu": true,
-  "Window attribute: oncuechange": true,
-  "Window attribute: ondblclick": true,
-  "Window attribute: ondrag": true,
-  "Window attribute: ondragend": true,
-  "Window attribute: ondragenter": true,
-  "Window attribute: ondragleave": true,
-  "Window attribute: ondragover": true,
-  "Window attribute: ondragstart": true,
-  "Window attribute: ondrop": true,
-  "Window attribute: ondurationchange": true,
-  "Window attribute: onemptied": true,
-  "Window attribute: onended": true,
-  "Window attribute: onerror": true,
-  "Window attribute: onfocus": true,
-  "Window attribute: onhashchange": true,
-  "Window attribute: oninput": true,
-  "Window attribute: oninvalid": true,
-  "Window attribute: onkeydown": true,
-  "Window attribute: onkeypress": true,
-  "Window attribute: onkeyup": true,
   "Window attribute: oncancel": true,
   "Window attribute: onclose": true,
   "Window attribute: oncuechange": true,
   "Window attribute: onmousewheel": true,
-  "Window attribute: onload": true,
-  "Window attribute: onloadeddata": true,
-  "Window attribute: onloadedmetadata": true,
-  "Window attribute: onloadstart": true,
-  "Window attribute: onmessage": true,
-  "Window attribute: onmousedown": true,
-  "Window attribute: onmousemove": true,
-  "Window attribute: onmouseout": true,
-  "Window attribute: onmouseover": true,
-  "Window attribute: onmouseup": true,
-  "Window attribute: onmousewheel": true,
-  "Window attribute: onoffline": true,
-  "Window attribute: ononline": true,
-  "Window attribute: onpause": true,
-  "Window attribute: onplay": true,
-  "Window attribute: onplaying": true,
-  "Window attribute: onpagehide": true,
-  "Window attribute: onpageshow": true,
-  "Window attribute: onpopstate": true,
-  "Window attribute: onprogress": true,
-  "Window attribute: onratechange": true,
-  "Window attribute: onreset": true,
-  "Window attribute: onresize": true,
-  "Window attribute: onscroll": true,
-  "Window attribute: onseeked": true,
-  "Window attribute: onseeking": true,
-  "Window attribute: onselect": true,
-  "Window attribute: onshow": true,
-  "Window attribute: onstalled": true,
   "Window attribute: onstorage": true,
-  "Window attribute: onsubmit": true,
-  "Window attribute: onsuspend": true,
-  "Window attribute: ontimeupdate": true,
-  "Window attribute: onunload": true,
-  "Window attribute: onvolumechange": true,
-  "Window attribute: onwaiting": true,
   "Window unforgeable attribute: window": true,
   "Window unforgeable attribute: document": true,
-  "Window unforgeable attribute: location": true,
-  "Window unforgeable attribute: top": true,
-  "Window replaceable attribute: self": true,
-  "Window replaceable attribute: locationbar": true,
-  "Window replaceable attribute: menubar": true,
-  "Window replaceable attribute: personalbar": true,
-  "Window replaceable attribute: scrollbars": true,
-  "Window replaceable attribute: statusbar": true,
-  "Window replaceable attribute: toolbar": true,
-  "Window replaceable attribute: frames": true,
-  "Window replaceable attribute: length": true,
-  "constructor": true
+  "Window unforgeable attribute: top": true
 }

dom/imptests/failures/html/html/browsers/the-window-object/test_window-prototype-chain.html.json

@@ -1,5 +0,0 @@
-{
-  "Window.prototype": true,
-  "EventTarget.prototype": true,
-  "Object.prototype": true
-}

dom/interfaces/base/nsIDOMChromeWindow.idl

@@ -10,7 +10,7 @@ interface nsIDOMElement;
 interface nsIDOMEvent;
 interface nsIMessageBroadcaster;
 
-[scriptable, uuid(0c10226f-8abb-4345-aa6b-2780a6f4687e)]
+[scriptable, uuid(78bdcb41-1efa-409f-aaba-70842213f80f)]
 interface nsIDOMChromeWindow : nsISupports
 {
   const unsigned short STATE_MAXIMIZED = 1;
@@ -45,6 +45,12 @@ interface nsIDOMChromeWindow : nsISupports
 
   readonly attribute nsIMessageBroadcaster messageManager;
 
+  /**
+   * Returns the message manager identified by the given group name that
+   * manages all frame loaders belonging to that group.
+   */
+  nsIMessageBroadcaster getGroupMessageManager(in AString group);
+
   /**
    * On some operating systems, we must allow the window manager to
    * handle window dragging. This function tells the window manager to

dom/ipc/TabParent.cpp

@@ -722,8 +722,9 @@ bool TabParent::SendRealMouseEvent(WidgetMouseEvent& event)
   if (mIsDestroyed) {
     return false;
   }
-  MaybeForwardEventToRenderFrame(event, nullptr);
-  if (!MapEventCoordinatesForChildProcess(&event)) {
+  nsEventStatus status = MaybeForwardEventToRenderFrame(event, nullptr);
+  if (status == nsEventStatus_eConsumeNoDefault ||
+      !MapEventCoordinatesForChildProcess(&event)) {
     return false;
   }
   return PBrowserParent::SendRealMouseEvent(event);
@@ -789,8 +790,9 @@ bool TabParent::SendMouseWheelEvent(WidgetWheelEvent& event)
   if (mIsDestroyed) {
     return false;
   }
-  MaybeForwardEventToRenderFrame(event, nullptr);
-  if (!MapEventCoordinatesForChildProcess(&event)) {
+  nsEventStatus status = MaybeForwardEventToRenderFrame(event, nullptr);
+  if (status == nsEventStatus_eConsumeNoDefault ||
+      !MapEventCoordinatesForChildProcess(&event)) {
     return false;
   }
   return PBrowserParent::SendMouseWheelEvent(event);
@@ -910,9 +912,9 @@ bool TabParent::SendRealTouchEvent(WidgetTouchEvent& event)
   }
 
   ScrollableLayerGuid guid;
-  MaybeForwardEventToRenderFrame(event, &guid);
+  nsEventStatus status = MaybeForwardEventToRenderFrame(event, &guid);
 
-  if (mIsDestroyed) {
+  if (status == nsEventStatus_eConsumeNoDefault || mIsDestroyed) {
     return false;
   }
 
@@ -1889,13 +1891,14 @@ TabParent::UseAsyncPanZoom()
           GetScrollingBehavior() == ASYNC_PAN_ZOOM);
 }
 
-void
+nsEventStatus
 TabParent::MaybeForwardEventToRenderFrame(WidgetInputEvent& aEvent,
                                           ScrollableLayerGuid* aOutTargetGuid)
 {
   if (RenderFrameParent* rfp = GetRenderFrame()) {
-    rfp->NotifyInputEvent(aEvent, aOutTargetGuid);
+    return rfp->NotifyInputEvent(aEvent, aOutTargetGuid);
   }
+  return nsEventStatus_eIgnore;
 }
 
 bool

dom/ipc/TabParent.h

@@ -381,8 +381,8 @@ private:
     // |aOutTargetGuid| will contain the identifier
     // of the APZC instance that handled the event. aOutTargetGuid may be
     // null.
-    void MaybeForwardEventToRenderFrame(WidgetInputEvent& aEvent,
-                                        ScrollableLayerGuid* aOutTargetGuid);
+    nsEventStatus MaybeForwardEventToRenderFrame(WidgetInputEvent& aEvent,
+                                                 ScrollableLayerGuid* aOutTargetGuid);
     // The offset for the child process which is sampled at touch start. This
     // means that the touch events are relative to where the frame was at the
     // start of the touch. We need to look for a better solution to this

dom/media/MediaManager.cpp

@@ -331,14 +331,14 @@ MediaDevice::GetType(nsAString& aType)
 NS_IMETHODIMP
 VideoDevice::GetType(nsAString& aType)
 {
-  aType.AssignLiteral("video");
+  aType.AssignLiteral(MOZ_UTF16("video"));
   return NS_OK;
 }
 
 NS_IMETHODIMP
 AudioDevice::GetType(nsAString& aType)
 {
-  aType.AssignLiteral("audio");
+  aType.AssignLiteral(MOZ_UTF16("audio"));
   return NS_OK;
 }
 
@@ -1834,7 +1834,7 @@ MediaManager::Observe(nsISupports* aSubject, const char* aTopic,
       MOZ_ASSERT(msg);
       msg->GetData(errorMessage);
       if (errorMessage.IsEmpty())
-        errorMessage.AssignLiteral("UNKNOWN_ERROR");
+        errorMessage.AssignLiteral(MOZ_UTF16("UNKNOWN_ERROR"));
     }
 
     nsString key(aData);
@@ -1986,7 +1986,7 @@ MediaManager::MediaCaptureWindowStateInternal(nsIDOMWindow* aWindow, bool* aVide
       for (i = 0; i < count; ++i) {
         nsCOMPtr<nsIDocShellTreeItem> item;
         docShell->GetChildAt(i, getter_AddRefs(item));
-        nsCOMPtr<nsPIDOMWindow> win = do_GetInterface(item);
+        nsCOMPtr<nsPIDOMWindow> win = item ? item->GetWindow() : nullptr;
 
         MediaCaptureWindowStateInternal(win, aVideo, aAudio);
         if (*aAudio && *aVideo) {

dom/plugins/base/nsJSNPRuntime.cpp

@@ -65,6 +65,10 @@ typedef js::HashMap<nsJSObjWrapperKey,
                     js::SystemAllocPolicy> JSObjWrapperTable;
 static JSObjWrapperTable sJSObjWrappers;
 
+// Whether it's safe to iterate sJSObjWrappers.  Set to true when sJSObjWrappers
+// has been initialized and is not currently being enumerated.
+static bool sJSObjWrappersAccessible = false;
+
 // Hash of NPObject wrappers that wrap NPObjects as JSObjects.
 static PLDHashTable sNPObjWrappers;
 
@@ -258,12 +262,13 @@ OnWrapperDestroyed()
   NS_ASSERTION(sWrapperCount, "Whaaa, unbalanced created/destroyed calls!");
 
   if (--sWrapperCount == 0) {
-    if (sJSObjWrappers.initialized()) {
+    if (sJSObjWrappersAccessible) {
       MOZ_ASSERT(sJSObjWrappers.count() == 0);
 
       // No more wrappers, and our hash was initialized. Finish the
       // hash to prevent leaking it.
       sJSObjWrappers.finish();
+      sJSObjWrappersAccessible = false;
     }
 
     if (sNPObjWrappers.ops) {
@@ -513,12 +518,6 @@ nsJSObjWrapper::~nsJSObjWrapper()
   OnWrapperDestroyed();
 }
 
-void
-nsJSObjWrapper::ClearJSObject() {
-  // Forget our reference to the JSObject.
-  mJSObj = nullptr;
-}
-
 // static
 NPObject *
 nsJSObjWrapper::NP_Allocate(NPP npp, NPClass *aClass)
@@ -545,12 +544,16 @@ nsJSObjWrapper::NP_Invalidate(NPObject *npobj)
 
   if (jsnpobj && jsnpobj->mJSObj) {
 
-    // Remove the wrapper from the hash
-    MOZ_ASSERT(sJSObjWrappers.initialized());
-    nsJSObjWrapperKey key(jsnpobj->mJSObj, jsnpobj->mNpp);
-    sJSObjWrappers.remove(key);
+    if (sJSObjWrappersAccessible) {
+      // Remove the wrapper from the hash
+      nsJSObjWrapperKey key(jsnpobj->mJSObj, jsnpobj->mNpp);
+      JSObjWrapperTable::Ptr ptr = sJSObjWrappers.lookup(key);
+      MOZ_ASSERT(ptr.found());
+      sJSObjWrappers.remove(ptr);
+    }
 
-    jsnpobj->ClearJSObject();
+    // Forget our reference to the JSObject.
+    jsnpobj->mJSObj = nullptr;
   }
 }
 
@@ -932,6 +935,7 @@ nsJSObjWrapper::NP_Construct(NPObject *npobj, const NPVariant *args,
 static void
 JSObjWrapperKeyMarkCallback(JSTracer *trc, JSObject *obj, void *data) {
   NPP npp = static_cast<NPP>(data);
+  MOZ_ASSERT(sJSObjWrappersAccessible);
   if (!sJSObjWrappers.initialized())
     return;
 
@@ -1000,7 +1004,9 @@ nsJSObjWrapper::GetNewOrUsed(NPP npp, JSContext *cx, JS::Handle<JSObject*> obj)
 
       return nullptr;
     }
+    sJSObjWrappersAccessible = true;
   }
+  MOZ_ASSERT(sJSObjWrappersAccessible);
 
   JSObjWrapperTable::Ptr p = sJSObjWrappers.lookupForAdd(nsJSObjWrapperKey(obj, npp));
   if (p) {
@@ -1849,16 +1855,26 @@ NPObjWrapperPluginDestroyedCallback(PLDHashTable *table, PLDHashEntryHdr *hdr,
 void
 nsJSNPRuntime::OnPluginDestroy(NPP npp)
 {
-  if (sJSObjWrappers.initialized()) {
+  if (sJSObjWrappersAccessible) {
+
+    // Prevent modification of sJSObjWrappers table if we go reentrant.
+    sJSObjWrappersAccessible = false;
+
     for (JSObjWrapperTable::Enum e(sJSObjWrappers); !e.empty(); e.popFront()) {
       nsJSObjWrapper *npobj = e.front().value();
       MOZ_ASSERT(npobj->_class == &nsJSObjWrapper::sJSObjWrapperNPClass);
       if (npobj->mNpp == npp) {
-        npobj->ClearJSObject();
+        if (npobj->_class && npobj->_class->invalidate) {
+          npobj->_class->invalidate(npobj);
+        }
+
         _releaseobject(npobj);
+
         e.removeFront();
       }
     }
+
+    sJSObjWrappersAccessible = true;
   }
 
   // Use the safe JSContext here as we're not always able to find the

dom/plugins/base/nsJSNPRuntime.h

@@ -47,8 +47,6 @@ public:
   static NPObject *GetNewOrUsed(NPP npp, JSContext *cx,
                                 JS::Handle<JSObject*> obj);
 
-  void ClearJSObject();
-
 protected:
   nsJSObjWrapper(NPP npp);
   ~nsJSObjWrapper();

dom/smil/TimeEvent.cpp

@@ -5,6 +5,7 @@
 
 #include "mozilla/dom/TimeEvent.h"
 #include "mozilla/BasicEvents.h"
+#include "nsIDocShell.h"
 #include "nsIInterfaceRequestorUtils.h"
 #include "nsPresContext.h"
 
@@ -34,12 +35,9 @@ TimeEvent::TimeEvent(EventTarget* aOwner,
   mEvent->mFlags.mCancelable = false;
 
   if (mPresContext) {
-    nsISupports* container = mPresContext->GetContainerWeak();
-    if (container) {
-      nsCOMPtr<nsIDOMWindow> window = do_GetInterface(container);
-      if (window) {
-        mView = do_QueryInterface(window);
-      }
+    nsCOMPtr<nsIDocShell> docShell = mPresContext->GetDocShell();
+    if (docShell) {
+      mView = docShell->GetWindow();
     }
   }
 }

dom/tests/mochitest/chrome/window_focus.xul

@@ -1566,7 +1566,7 @@ function doFrameHistoryTests()
   }, true);
 
   // make sure that loading a new page and then going back maintains the focus
-  gChildWindow.location = "data:text/html,<script>window.onload=function() {setTimeout(function () {window.back();}, 0);}</script>";
+  gChildWindow.location = "data:text/html,<script>window.onload=function() {setTimeout(function () {SpecialPowers.wrap(window).back();}, 0);}</script>";
 }
 
 function addFrameSwitchingListeners(frame)

dom/tests/mochitest/general/test_interfaces.html

@@ -576,6 +576,8 @@ var interfaceNamesInGlobalScope =
     {name: "Key", pref: "dom.webcrypto.enabled"},
 // IMPORTANT: Do not change this list without review from a DOM peer!
     "KeyEvent",
+// IMPORTANT: Do not change this list without review from a DOM peer!
+    {name: "KeyPair", pref: "dom.webcrypto.enabled"},
 // IMPORTANT: Do not change this list without review from a DOM peer!
     "KeyboardEvent",
 // IMPORTANT: Do not change this list without review from a DOM peer!

dom/webidl/HTMLLinkElement.webidl

@@ -31,7 +31,6 @@ interface HTMLLinkElement : HTMLElement {
   [PutForwards=value] readonly attribute DOMSettableTokenList sizes;
 };
 HTMLLinkElement implements LinkStyle;
-HTMLLinkElement implements LinkImport;
 
 // http://www.whatwg.org/specs/web-apps/current-work/#other-elements,-attributes-and-apis
 partial interface HTMLLinkElement {
@@ -42,3 +41,9 @@ partial interface HTMLLinkElement {
   [SetterThrows, Pure]
            attribute DOMString target;
 };
+
+// http://w3c.github.io/webcomponents/spec/imports/#interface-import
+partial interface HTMLLinkElement {
+    readonly attribute Document? import;
+};
+

dom/webidl/InstallTrigger.webidl

@@ -10,6 +10,12 @@
  */
 callback InstallTriggerCallback = void(DOMString url, short status);
 
+dictionary InstallTriggerData {
+  DOMString URL;
+  DOMString? IconURL;
+  DOMString? Hash;
+};
+
 /**
  * The interface for the InstallTrigger object available to all websites.
  */
@@ -51,7 +57,8 @@ interface InstallTriggerImpl {
    *         A callback to call as each installation succeeds or fails
    * @return true if the installations were successfully started
    */
-  boolean install(object installs, optional InstallTriggerCallback callback);
+  boolean install(MozMap<(DOMString or InstallTriggerData)> installs,
+                  optional InstallTriggerCallback callback);
 
   /**
    * Starts installing a new add-on.

dom/webidl/LinkImport.webidl

@@ -1,13 +0,0 @@
-/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this file,
- * You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * The origin of this IDL file is
- * http://www.w3.org/TR/2013/WD-html-imports-20130514/
- */
-
-[NoInterfaceObject]
-interface LinkImport {
-    readonly attribute Document? import;
-};

dom/webidl/SubtleCrypto.webidl

@@ -108,6 +108,12 @@ interface Key {
   [Cached, Constant, Frozen] readonly attribute sequence<KeyUsage> usages;
 };
 
+[Pref="dom.webcrypto.enabled"]
+interface KeyPair {
+  readonly attribute Key publicKey;
+  readonly attribute Key privateKey;
+};
+
 typedef DOMString KeyFormat;
 typedef (ArrayBufferView or ArrayBuffer) CryptoOperationData;
 typedef (ArrayBufferView or ArrayBuffer) KeyData;

dom/webidl/Window.webidl

@@ -433,6 +433,13 @@ interface ChromeWindow {
   [Throws, Func="nsGlobalWindow::IsChromeWindow"]
   readonly attribute nsIMessageBroadcaster messageManager;
 
+  /**
+   * Returns the message manager identified by the given group name that
+   * manages all frame loaders belonging to that group.
+   */
+  [Throws, Func="nsGlobalWindow::IsChromeWindow"]
+  nsIMessageBroadcaster getGroupMessageManager(DOMString aGroup);
+
   /**
    * On some operating systems, we must allow the window manager to
    * handle window dragging. This function tells the window manager to