diff --git a/CLOBBER b/CLOBBER
index 42ce93bf5215..9ce28bea68ad 100644
--- a/CLOBBER
+++ b/CLOBBER
@@ -22,4 +22,4 @@
 # changes to stick? As of bug 928195, this shouldn't be necessary! Please
 # don't change CLOBBER for WebIDL changes any more.
 
-Bug 1004726 requires a clobber for B2G Emulator builds
+Bug 994964 apparently requires a clobber, unclear why
diff --git a/accessible/src/base/Logging.cpp b/accessible/src/base/Logging.cpp
index 249beace3a33..98a9456adc44 100644
--- a/accessible/src/base/Logging.cpp
+++ b/accessible/src/base/Logging.cpp
@@ -408,8 +408,7 @@ logging::DocLoad(const char* aMsg, nsIWebProgress* aWebProgress,
 
   LogDocInfo(documentNode, document);
 
-  nsCOMPtr<nsIWebNavigation> webNav(do_GetInterface(DOMWindow));
-  nsCOMPtr<nsIDocShell> docShell(do_QueryInterface(webNav));
+  nsCOMPtr<nsIDocShell> docShell = window->GetDocShell();
   printf("\n    ");
   LogShellLoadType(docShell);
   printf("\n");
diff --git a/accessible/src/jsat/Utils.jsm b/accessible/src/jsat/Utils.jsm
index 59775132b797..65f81877d6bf 100644
--- a/accessible/src/jsat/Utils.jsm
+++ b/accessible/src/jsat/Utils.jsm
@@ -151,8 +151,19 @@ this.Utils = {
   get AllMessageManagers() {
     let messageManagers = [];
 
-    for (let i = 0; i < this.win.messageManager.childCount; i++)
-      messageManagers.push(this.win.messageManager.getChildAt(i));
+    function collectLeafMessageManagers(mm) {
+      for (let i = 0; i < mm.childCount; i++) {
+        let childMM = mm.getChildAt(i);
+
+        if ("sendAsyncMessage" in childMM) {
+          messageManagers.push(childMM);
+        } else {
+          collectLeafMessageManagers(childMM);
+        }
+      }
+    }
+
+    collectLeafMessageManagers(this.win.messageManager);
 
     let document = this.CurrentContentDoc;
 
diff --git a/b2g/app/b2g.js b/b2g/app/b2g.js
index e8624958d1f5..a82c4721db5e 100644
--- a/b2g/app/b2g.js
+++ b/b2g/app/b2g.js
@@ -946,6 +946,11 @@ pref("apz.enlarge_displayport_when_clipped", true);
 pref("apz.axis_lock_mode", 2);
 pref("apz.subframe.enabled", true);
 
+// Overscroll-related settings
+pref("apz.overscroll.enabled", false);
+pref("apz.overscroll.snap_back_accel", "0.003");
+pref("apz.overscroll.snap_back_init_vel", "1");
+
 // This preference allows FirefoxOS apps (and content, I think) to force
 // the use of software (instead of hardware accelerated) 2D canvases by
 // creating a context like this:
diff --git a/b2g/chrome/content/settings.js b/b2g/chrome/content/settings.js
index 986563f51eb2..c0eee1993138 100644
--- a/b2g/chrome/content/settings.js
+++ b/b2g/chrome/content/settings.js
@@ -645,6 +645,7 @@ let settingsToObserve = {
     prefName: 'dom.browser_frames.useAsyncPanZoom',
     defaultValue: false
   },
+  'apz.overscroll.enabled': false,
   'debug.fps.enabled': {
     prefName: 'layers.acceleration.draw-fps',
     defaultValue: false
diff --git a/browser/base/content/browser-sets.inc b/browser/base/content/browser-sets.inc
index 07177c4bffeb..36cbd435be77 100644
--- a/browser/base/content/browser-sets.inc
+++ b/browser/base/content/browser-sets.inc
@@ -425,8 +425,8 @@
     <key id="key_sanitize" command="Tools:Sanitize" keycode="VK_DELETE" modifiers="accel,shift"/>
 #ifdef XP_MACOSX
     <key id="key_sanitize_mac" command="Tools:Sanitize" keycode="VK_BACK" modifiers="accel,shift"/>
-#endif
-#ifdef XP_UNIX
+    <key id="key_quitApplication" key="&quitApplicationCmdUnix.key;" modifiers="accel"/>
+#elifdef XP_UNIX
     <key id="key_quitApplication" key="&quitApplicationCmdUnix.key;" command="cmd_quitApplication" modifiers="accel"/>
 #endif
 
diff --git a/browser/components/shell/src/nsWindowsShellService.cpp b/browser/components/shell/src/nsWindowsShellService.cpp
index d3bb673cb68c..edbba2ddc8f0 100644
--- a/browser/components/shell/src/nsWindowsShellService.cpp
+++ b/browser/components/shell/src/nsWindowsShellService.cpp
@@ -915,24 +915,24 @@ nsWindowsShellService::SetDesktopBackground(nsIDOMElement* aElement,
     nsAutoString style;
     switch (aPosition) {
       case BACKGROUND_TILE:
-        style.AssignLiteral("0");
-        tile.AssignLiteral("1");
+        style.Assign('0');
+        tile.Assign('1');
         break;
       case BACKGROUND_CENTER:
-        style.AssignLiteral("0");
-        tile.AssignLiteral("0");
+        style.Assign('0');
+        tile.Assign('0');
         break;
       case BACKGROUND_STRETCH:
-        style.AssignLiteral("2");
-        tile.AssignLiteral("0");
+        style.Assign('2');
+        tile.Assign('0');
         break;
       case BACKGROUND_FILL:
         style.AssignLiteral("10");
-        tile.AssignLiteral("0");
+        tile.Assign('0');
         break;
       case BACKGROUND_FIT:
-        style.AssignLiteral("6");
-        tile.AssignLiteral("0");
+        style.Assign('6');
+        tile.Assign('0');
         break;
     }
 
@@ -990,7 +990,7 @@ nsWindowsShellService::OpenApplication(int32_t aApplication)
   ::RegCloseKey(theKey);
 
   // Find the "open" command
-  application.AppendLiteral("\\");
+  application.Append('\\');
   application.Append(buf);
   application.AppendLiteral("\\shell\\open\\command");
 
diff --git a/content/base/src/Element.cpp b/content/base/src/Element.cpp
index 724146d59098..707419957de6 100644
--- a/content/base/src/Element.cpp
+++ b/content/base/src/Element.cpp
@@ -2262,7 +2262,7 @@ Element::DescribeAttribute(uint32_t index, nsAString& aOutDescription) const
       value.Insert(char16_t('\\'), uint32_t(i));
   }
   aOutDescription.Append(value);
-  aOutDescription.AppendLiteral("\"");
+  aOutDescription.Append('"');
 }
 
 #ifdef DEBUG
diff --git a/content/base/src/WebSocket.cpp b/content/base/src/WebSocket.cpp
index 9ac2c1649b5e..7124bb2edfd8 100644
--- a/content/base/src/WebSocket.cpp
+++ b/content/base/src/WebSocket.cpp
@@ -992,7 +992,7 @@ WebSocket::ParseURL(const nsString& aURL)
   nsAutoCString filePath;
   rv = parsedURL->GetFilePath(filePath);
   if (filePath.IsEmpty()) {
-    filePath.AssignLiteral("/");
+    filePath.Assign('/');
   }
   NS_ENSURE_SUCCESS(rv, NS_ERROR_DOM_SYNTAX_ERR);
 
diff --git a/content/base/src/nsCCUncollectableMarker.cpp b/content/base/src/nsCCUncollectableMarker.cpp
index b677f4585a56..dac8dd961e05 100644
--- a/content/base/src/nsCCUncollectableMarker.cpp
+++ b/content/base/src/nsCCUncollectableMarker.cpp
@@ -93,6 +93,56 @@ MarkUserDataHandler(void* aNode, nsIAtom* aKey, void* aValue, void* aData)
   }
 }
 
+static void
+MarkChildMessageManagers(nsIMessageBroadcaster* aMM)
+{
+  aMM->MarkForCC();
+
+  uint32_t tabChildCount = 0;
+  aMM->GetChildCount(&tabChildCount);
+  for (uint32_t j = 0; j < tabChildCount; ++j) {
+    nsCOMPtr<nsIMessageListenerManager> childMM;
+    aMM->GetChildAt(j, getter_AddRefs(childMM));
+    if (!childMM) {
+      continue;
+    }
+
+    nsCOMPtr<nsIMessageBroadcaster> strongNonLeafMM = do_QueryInterface(childMM);
+    nsIMessageBroadcaster* nonLeafMM = strongNonLeafMM;
+
+    nsCOMPtr<nsIMessageSender> strongTabMM = do_QueryInterface(childMM);
+    nsIMessageSender* tabMM = strongTabMM;
+
+    strongNonLeafMM = nullptr;
+    strongTabMM = nullptr;
+    childMM = nullptr;
+
+    if (nonLeafMM) {
+      MarkChildMessageManagers(nonLeafMM);
+      continue;
+    }
+
+    tabMM->MarkForCC();
+
+    //XXX hack warning, but works, since we know that
+    //    callback is frameloader.
+    mozilla::dom::ipc::MessageManagerCallback* cb =
+      static_cast<nsFrameMessageManager*>(tabMM)->GetCallback();
+    if (cb) {
+      nsFrameLoader* fl = static_cast<nsFrameLoader*>(cb);
+      EventTarget* et = fl->GetTabChildGlobalAsEventTarget();
+      if (!et) {
+        continue;
+      }
+      static_cast<nsInProcessTabChildGlobal*>(et)->MarkForCC();
+      EventListenerManager* elm = et->GetExistingListenerManager();
+      if (elm) {
+        elm->MarkForCC();
+      }
+    }
+  }
+}
+
 static void
 MarkMessageManagers()
 {
@@ -107,52 +157,8 @@ MarkMessageManagers()
   }
   nsIMessageBroadcaster* globalMM = strongGlobalMM;
   strongGlobalMM = nullptr;
+  MarkChildMessageManagers(globalMM);
 
-  globalMM->MarkForCC();
-  uint32_t childCount = 0;
-  globalMM->GetChildCount(&childCount);
-  for (uint32_t i = 0; i < childCount; ++i) {
-    nsCOMPtr<nsIMessageListenerManager> childMM;
-    globalMM->GetChildAt(i, getter_AddRefs(childMM));
-    if (!childMM) {
-      continue;
-    }
-    nsCOMPtr<nsIMessageBroadcaster> strongWindowMM = do_QueryInterface(childMM);
-    nsIMessageBroadcaster* windowMM = strongWindowMM;
-    childMM = nullptr;
-    strongWindowMM = nullptr;
-    windowMM->MarkForCC();
-    uint32_t tabChildCount = 0;
-    windowMM->GetChildCount(&tabChildCount);
-    for (uint32_t j = 0; j < tabChildCount; ++j) {
-      nsCOMPtr<nsIMessageListenerManager> childMM;
-      windowMM->GetChildAt(j, getter_AddRefs(childMM));
-      if (!childMM) {
-        continue;
-      }
-      nsCOMPtr<nsIMessageSender> strongTabMM = do_QueryInterface(childMM);
-      nsIMessageSender* tabMM = strongTabMM;
-      childMM = nullptr;
-      strongTabMM = nullptr;
-      tabMM->MarkForCC();
-      //XXX hack warning, but works, since we know that
-      //    callback is frameloader.
-      mozilla::dom::ipc::MessageManagerCallback* cb =
-        static_cast<nsFrameMessageManager*>(tabMM)->GetCallback();
-      if (cb) {
-        nsFrameLoader* fl = static_cast<nsFrameLoader*>(cb);
-        EventTarget* et = fl->GetTabChildGlobalAsEventTarget();
-        if (!et) {
-          continue;
-        }
-        static_cast<nsInProcessTabChildGlobal*>(et)->MarkForCC();
-        EventListenerManager* elm = et->GetExistingListenerManager();
-        if (elm) {
-          elm->MarkForCC();
-        }
-      }
-    }
-  }
   if (nsFrameMessageManager::sParentProcessManager) {
     nsFrameMessageManager::sParentProcessManager->MarkForCC();
     uint32_t childCount = 0;
diff --git a/content/base/src/nsContentAreaDragDrop.cpp b/content/base/src/nsContentAreaDragDrop.cpp
index 259367d146c1..1e8719f4d7dd 100644
--- a/content/base/src/nsContentAreaDragDrop.cpp
+++ b/content/base/src/nsContentAreaDragDrop.cpp
@@ -406,8 +406,7 @@ DragDataProducer::Produce(DataTransfer* aDataTransfer,
   // if set, serialize the content under this node
   nsCOMPtr<nsIContent> nodeToSerialize;
 
-  nsCOMPtr<nsIWebNavigation> webnav = do_GetInterface(mWindow);
-  nsCOMPtr<nsIDocShellTreeItem> dsti = do_QueryInterface(webnav);
+  nsCOMPtr<nsIDocShellTreeItem> dsti = mWindow->GetDocShell();
   const bool isChromeShell =
     dsti && dsti->ItemType() == nsIDocShellTreeItem::typeChrome;
 
diff --git a/content/base/src/nsContentUtils.cpp b/content/base/src/nsContentUtils.cpp
index c701c7d21f6f..e0233caa8da4 100644
--- a/content/base/src/nsContentUtils.cpp
+++ b/content/base/src/nsContentUtils.cpp
@@ -5053,8 +5053,12 @@ nsContentUtils::CheckForSubFrameDrop(nsIDragSession* aDragSession,
   }
   
   nsIDocument* targetDoc = target->OwnerDoc();
-  nsCOMPtr<nsIWebNavigation> twebnav = do_GetInterface(targetDoc->GetWindow());
-  nsCOMPtr<nsIDocShellTreeItem> tdsti = do_QueryInterface(twebnav);
+  nsPIDOMWindow* targetWin = targetDoc->GetWindow();
+  if (!targetWin) {
+    return true;
+  }
+
+  nsCOMPtr<nsIDocShellTreeItem> tdsti = targetWin->GetDocShell();
   if (!tdsti) {
     return true;
   }
@@ -5896,7 +5900,7 @@ nsContentUtils::FlushLayoutForTree(nsIDOMWindow* aWindow)
         for (; i < i_end; ++i) {
             nsCOMPtr<nsIDocShellTreeItem> item;
             docShell->GetChildAt(i, getter_AddRefs(item));
-            nsCOMPtr<nsIDOMWindow> win = do_GetInterface(item);
+            nsCOMPtr<nsIDOMWindow> win = item->GetWindow();
             if (win) {
                 FlushLayoutForTree(win);
             }
diff --git a/content/base/src/nsCopySupport.cpp b/content/base/src/nsCopySupport.cpp
index cfa9d1dbbfa2..e0f4dfee37be 100644
--- a/content/base/src/nsCopySupport.cpp
+++ b/content/base/src/nsCopySupport.cpp
@@ -637,7 +637,7 @@ nsCopySupport::FireClipboardEvent(int32_t aType, int32_t aClipboardType, nsIPres
   if (!nsContentUtils::IsSafeToRunScript())
     return false;
 
-  nsCOMPtr<nsIDocShell> docShell = do_GetInterface(piWindow);
+  nsCOMPtr<nsIDocShell> docShell = piWindow->GetDocShell();
   const bool chromeShell =
     docShell && docShell->ItemType() == nsIDocShellTreeItem::typeChrome;
 
diff --git a/content/base/src/nsDocument.cpp b/content/base/src/nsDocument.cpp
index bcbacf773dfb..bb7f9de68257 100644
--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@@ -2970,7 +2970,7 @@ nsIDocument::GetLastModified(nsAString& aLastModified) const
   } else {
     // If we for whatever reason failed to find the last modified time
     // (or even the current time), fall back to what NS4.x returned.
-    aLastModified.AssignLiteral("01/01/1970 00:00:00");
+    aLastModified.AssignLiteral(MOZ_UTF16("01/01/1970 00:00:00"));
   }
 }
 
@@ -4572,10 +4572,10 @@ nsDocument::GetWindowInternal() const
   // the docshell, the outer window might be still obtainable from the it.
   nsCOMPtr<nsPIDOMWindow> win;
   if (mRemovedFromDocShell) {
-    nsCOMPtr<nsIInterfaceRequestor> requestor(mDocumentContainer);
-    if (requestor) {
-      // The docshell returns the outer window we are done.
-      win = do_GetInterface(requestor);
+    // The docshell returns the outer window we are done.
+    nsCOMPtr<nsIDocShell> kungfuDeathGrip(mDocumentContainer);
+    if (mDocumentContainer) {
+      win = mDocumentContainer->GetWindow();
     }
   } else {
     win = do_QueryInterface(mScriptGlobalObject);
@@ -7362,8 +7362,7 @@ nsIDocument::AdoptNode(nsINode& aAdoptedNode, ErrorResult& rv)
       do {
         nsPIDOMWindow *win = doc->GetWindow();
         if (win) {
-          nsCOMPtr<nsINode> node =
-            do_QueryInterface(win->GetFrameElementInternal());
+          nsCOMPtr<nsINode> node = win->GetFrameElementInternal();
           if (node &&
               nsContentUtils::ContentIsDescendantOf(node, adoptedNode)) {
             rv.Throw(NS_ERROR_DOM_HIERARCHY_REQUEST_ERR);
@@ -9173,16 +9172,16 @@ nsIDocument::GetReadyState(nsAString& aReadyState) const
 {
   switch(mReadyState) {
   case READYSTATE_LOADING :
-    aReadyState.AssignLiteral("loading");
+    aReadyState.AssignLiteral(MOZ_UTF16("loading"));
     break;
   case READYSTATE_INTERACTIVE :
-    aReadyState.AssignLiteral("interactive");
+    aReadyState.AssignLiteral(MOZ_UTF16("interactive"));
     break;
   case READYSTATE_COMPLETE :
-    aReadyState.AssignLiteral("complete");
+    aReadyState.AssignLiteral(MOZ_UTF16("complete"));
     break;
   default:
-    aReadyState.AssignLiteral("uninitialized");
+    aReadyState.AssignLiteral(MOZ_UTF16("uninitialized"));
   }
 }
 
@@ -10986,7 +10985,7 @@ IsInActiveTab(nsIDocument* aDoc)
   if (!rootItem) {
     return false;
   }
-  nsCOMPtr<nsIDOMWindow> rootWin = do_GetInterface(rootItem);
+  nsCOMPtr<nsIDOMWindow> rootWin = rootItem->GetWindow();
   if (!rootWin) {
     return false;
   }
diff --git a/content/base/src/nsFrameLoader.cpp b/content/base/src/nsFrameLoader.cpp
index 64da57c2e147..224bdd45411b 100644
--- a/content/base/src/nsFrameLoader.cpp
+++ b/content/base/src/nsFrameLoader.cpp
@@ -653,9 +653,9 @@ static void
 FirePageHideEvent(nsIDocShellTreeItem* aItem,
                   EventTarget* aChromeEventHandler)
 {
-  nsCOMPtr<nsIDocument> internalDoc = do_GetInterface(aItem);
-  NS_ASSERTION(internalDoc, "What happened here?");
-  internalDoc->OnPageHide(true, aChromeEventHandler);
+  nsCOMPtr<nsIDocument> doc = aItem->GetDocument();
+  NS_ASSERTION(doc, "What happened here?");
+  doc->OnPageHide(true, aChromeEventHandler);
 
   int32_t childCount = 0;
   aItem->GetChildCount(&childCount);
@@ -695,10 +695,10 @@ FirePageShowEvent(nsIDocShellTreeItem* aItem,
     }
   }
 
-  nsCOMPtr<nsIDocument> internalDoc = do_GetInterface(aItem);
-  NS_ASSERTION(internalDoc, "What happened here?");
-  if (internalDoc->IsShowing() == aFireIfShowing) {
-    internalDoc->OnPageShow(true, aChromeEventHandler);
+  nsCOMPtr<nsIDocument> doc = aItem->GetDocument();
+  NS_ASSERTION(doc, "What happened here?");
+  if (doc->IsShowing() == aFireIfShowing) {
+    doc->OnPageShow(true, aChromeEventHandler);
   }
 }
 
@@ -1156,8 +1156,8 @@ nsFrameLoader::SwapWithOtherLoader(nsFrameLoader* aOther,
     return NS_ERROR_NOT_IMPLEMENTED;
   }
 
-  nsCOMPtr<nsPIDOMWindow> ourWindow = do_GetInterface(ourDocshell);
-  nsCOMPtr<nsPIDOMWindow> otherWindow = do_GetInterface(otherDocshell);
+  nsCOMPtr<nsPIDOMWindow> ourWindow = ourDocshell->GetWindow();
+  nsCOMPtr<nsPIDOMWindow> otherWindow = otherDocshell->GetWindow();
 
   nsCOMPtr<Element> ourFrameElement =
     ourWindow->GetFrameElementInternal();
@@ -1411,9 +1411,11 @@ nsFrameLoader::Destroy()
   }
   
   // Let our window know that we are gone
-  nsCOMPtr<nsPIDOMWindow> win_private(do_GetInterface(mDocShell));
-  if (win_private) {
-    win_private->SetFrameElementInternal(nullptr);
+  if (mDocShell) {
+    nsCOMPtr<nsPIDOMWindow> win_private(mDocShell->GetWindow());
+    if (win_private) {
+      win_private->SetFrameElementInternal(nullptr);
+    }
   }
 
   if ((mNeedsAsyncDestroy || !doc ||
@@ -1677,7 +1679,7 @@ nsFrameLoader::MaybeCreateDocShell()
 
   mDocShell->SetChromeEventHandler(chromeEventHandler);
 
-  // This is nasty, this code (the do_GetInterface(mDocShell) below)
+  // This is nasty, this code (the mDocShell->GetWindow() below)
   // *must* come *after* the above call to
   // mDocShell->SetChromeEventHandler() for the global window to get
   // the right chrome event handler.
@@ -1686,7 +1688,7 @@ nsFrameLoader::MaybeCreateDocShell()
   nsCOMPtr<Element> frame_element = mOwnerContent;
   NS_ASSERTION(frame_element, "frame loader owner element not a DOM element!");
 
-  nsCOMPtr<nsPIDOMWindow> win_private(do_GetInterface(mDocShell));
+  nsCOMPtr<nsPIDOMWindow> win_private(mDocShell->GetWindow());
   nsCOMPtr<nsIBaseWindow> base_win(do_QueryInterface(mDocShell));
   if (win_private) {
     win_private->SetFrameElementInternal(frame_element);
@@ -1878,14 +1880,15 @@ nsFrameLoader::GetWindowDimensions(nsRect& aRect)
     return NS_ERROR_FAILURE;
   }
 
-  nsCOMPtr<nsIWebNavigation> parentAsWebNav =
-    do_GetInterface(doc->GetWindow());
-
-  if (!parentAsWebNav) {
+  nsCOMPtr<nsPIDOMWindow> win = doc->GetWindow();
+  if (!win) {
     return NS_ERROR_FAILURE;
   }
 
-  nsCOMPtr<nsIDocShellTreeItem> parentAsItem(do_QueryInterface(parentAsWebNav));
+  nsCOMPtr<nsIDocShellTreeItem> parentAsItem(win->GetDocShell());
+  if (!parentAsItem) {
+    return NS_ERROR_FAILURE;
+  }
 
   nsCOMPtr<nsIDocShellTreeOwner> parentOwner;
   if (NS_FAILED(parentAsItem->GetTreeOwner(getter_AddRefs(parentOwner))) ||
@@ -2052,14 +2055,15 @@ nsFrameLoader::TryRemoteBrowser()
     return false;
   }
 
-  nsCOMPtr<nsIWebNavigation> parentAsWebNav =
-    do_GetInterface(doc->GetWindow());
-
-  if (!parentAsWebNav) {
+  nsCOMPtr<nsPIDOMWindow> parentWin = doc->GetWindow();
+  if (!parentWin) {
     return false;
   }
 
-  nsCOMPtr<nsIDocShellTreeItem> parentAsItem(do_QueryInterface(parentAsWebNav));
+  nsCOMPtr<nsIDocShellTreeItem> parentAsItem(parentWin->GetDocShell());
+  if (!parentAsItem) {
+    return false;
+  }
 
   // <iframe mozbrowser> gets to skip these checks.
   if (!OwnerIsBrowserOrAppFrame()) {
@@ -2127,7 +2131,7 @@ nsFrameLoader::TryRemoteBrowser()
     mChildID = mRemoteBrowser->Manager()->ChildID();
     nsCOMPtr<nsIDocShellTreeItem> rootItem;
     parentAsItem->GetRootTreeItem(getter_AddRefs(rootItem));
-    nsCOMPtr<nsIDOMWindow> rootWin = do_GetInterface(rootItem);
+    nsCOMPtr<nsIDOMWindow> rootWin = rootItem->GetWindow();
     nsCOMPtr<nsIDOMChromeWindow> rootChromeWin = do_QueryInterface(rootWin);
     NS_ABORT_IF_FALSE(rootChromeWin, "How did we not get a chrome window here?");
 
@@ -2222,15 +2226,18 @@ nsFrameLoader::CreateStaticClone(nsIFrameLoader* aDest)
   dest->MaybeCreateDocShell();
   NS_ENSURE_STATE(dest->mDocShell);
 
-  nsCOMPtr<nsIDocument> dummy = do_GetInterface(dest->mDocShell);
+  nsCOMPtr<nsIDocument> dummy = dest->mDocShell->GetDocument();
   nsCOMPtr<nsIContentViewer> viewer;
   dest->mDocShell->GetContentViewer(getter_AddRefs(viewer));
   NS_ENSURE_STATE(viewer);
 
   nsCOMPtr<nsIDocShell> origDocShell;
   GetDocShell(getter_AddRefs(origDocShell));
-  nsCOMPtr<nsIDocument> doc = do_GetInterface(origDocShell);
+  NS_ENSURE_STATE(origDocShell);
+
+  nsCOMPtr<nsIDocument> doc = origDocShell->GetDocument();
   NS_ENSURE_STATE(doc);
+
   nsCOMPtr<nsIDocument> clonedDoc = doc->CreateStaticClone(dest->mDocShell);
   nsCOMPtr<nsIDOMDocument> clonedDOMDoc = do_QueryInterface(clonedDoc);
 
@@ -2425,8 +2432,19 @@ nsFrameLoader::EnsureMessageManager()
   nsCOMPtr<nsIDOMChromeWindow> chromeWindow =
     do_QueryInterface(GetOwnerDoc()->GetWindow());
   nsCOMPtr<nsIMessageBroadcaster> parentManager;
+
   if (chromeWindow) {
-    chromeWindow->GetMessageManager(getter_AddRefs(parentManager));
+    nsAutoString messagemanagergroup;
+    if (mOwnerContent->IsXUL() &&
+        mOwnerContent->GetAttr(kNameSpaceID_None,
+                               nsGkAtoms::messagemanagergroup,
+                               messagemanagergroup)) {
+      chromeWindow->GetGroupMessageManager(messagemanagergroup, getter_AddRefs(parentManager));
+    }
+
+    if (!parentManager) {
+      chromeWindow->GetMessageManager(getter_AddRefs(parentManager));
+    }
   }
 
   if (ShouldUseRemoteProcess()) {
diff --git a/content/base/src/nsFrameMessageManager.cpp b/content/base/src/nsFrameMessageManager.cpp
index 97636bc8120f..4ca2361269b9 100644
--- a/content/base/src/nsFrameMessageManager.cpp
+++ b/content/base/src/nsFrameMessageManager.cpp
@@ -431,7 +431,7 @@ nsFrameMessageManager::LoadFrameScript(const nsAString& aURL,
   aRunInGlobalScope = true;
 
   if (aAllowDelayedLoad) {
-    if (IsGlobal() || IsWindowLevel()) {
+    if (IsGlobal() || IsBroadcaster()) {
       // Cache for future windows or frames
       mPendingScripts.AppendElement(aURL);
       mPendingScriptsGlobalStates.AppendElement(aRunInGlobalScope);
@@ -481,7 +481,7 @@ nsFrameMessageManager::GetDelayedFrameScripts(JSContext* aCx, JS::MutableHandle<
 {
   // Frame message managers may return an incomplete list because scripts
   // that were loaded after it was connected are not added to the list.
-  if (!IsGlobal() && !IsWindowLevel()) {
+  if (!IsGlobal() && !IsBroadcaster()) {
     NS_WARNING("Cannot retrieve list of pending frame scripts for frame"
                "message managers as it may be incomplete");
     return NS_ERROR_NOT_IMPLEMENTED;
@@ -590,7 +590,7 @@ nsFrameMessageManager::SendMessage(const nsAString& aMessageName,
                                    bool aIsSync)
 {
   NS_ASSERTION(!IsGlobal(), "Should not call SendSyncMessage in chrome");
-  NS_ASSERTION(!IsWindowLevel(), "Should not call SendSyncMessage in chrome");
+  NS_ASSERTION(!IsBroadcaster(), "Should not call SendSyncMessage in chrome");
   NS_ASSERTION(!mParentManager, "Should not have parent manager in content!");
 
   aRetval.setUndefined();
@@ -1069,7 +1069,7 @@ nsFrameMessageManager::ReceiveMessage(nsISupports* aTarget,
           return NS_ERROR_UNEXPECTED;
         }
 
-        if (!JS_CallFunctionValue(cx, thisObject, funval, argv, &rval)) {
+        if (!JS_CallFunctionValue(cx, thisObject, funval, JS::HandleValueArray(argv), &rval)) {
           nsJSUtils::ReportPendingException(cx);
           continue;
         }
@@ -1099,19 +1099,26 @@ nsFrameMessageManager::AddChildManager(nsFrameMessageManager* aManager)
 
   nsRefPtr<nsFrameMessageManager> kungfuDeathGrip = this;
   nsRefPtr<nsFrameMessageManager> kungfuDeathGrip2 = aManager;
-  // We have parent manager if we're a window message manager.
-  // In that case we want to load the pending scripts from global
-  // message manager.
-  if (mParentManager) {
-    nsRefPtr<nsFrameMessageManager> globalMM = mParentManager;
-    for (uint32_t i = 0; i < globalMM->mPendingScripts.Length(); ++i) {
-      aManager->LoadFrameScript(globalMM->mPendingScripts[i], false,
-                                globalMM->mPendingScriptsGlobalStates[i]);
-    }
+
+  LoadPendingScripts(this, aManager);
+}
+
+void
+nsFrameMessageManager::LoadPendingScripts(nsFrameMessageManager* aManager,
+                                          nsFrameMessageManager* aChildMM)
+{
+  // We have parent manager if we're a message broadcaster.
+  // In that case we want to load the pending scripts from all parent
+  // message managers in the hierarchy. Process the parent first so
+  // that pending scripts higher up in the hierarchy are loaded before others.
+  if (aManager->mParentManager) {
+    LoadPendingScripts(aManager->mParentManager, aChildMM);
   }
-  for (uint32_t i = 0; i < mPendingScripts.Length(); ++i) {
-    aManager->LoadFrameScript(mPendingScripts[i], false,
-                              mPendingScriptsGlobalStates[i]);
+
+  for (uint32_t i = 0; i < aManager->mPendingScripts.Length(); ++i) {
+    aChildMM->LoadFrameScript(aManager->mPendingScripts[i],
+                              false,
+                              aManager->mPendingScriptsGlobalStates[i]);
   }
 }
 
@@ -1138,7 +1145,7 @@ nsFrameMessageManager::InitWithCallback(MessageManagerCallback* aCallback)
 
   SetCallback(aCallback);
 
-  // First load global scripts by adding this to parent manager.
+  // First load parent scripts by adding this to parent manager.
   if (mParentManager) {
     mParentManager->AddChildManager(this);
   }
diff --git a/content/base/src/nsFrameMessageManager.h b/content/base/src/nsFrameMessageManager.h
index 722258b2a34e..f8510959e924 100644
--- a/content/base/src/nsFrameMessageManager.h
+++ b/content/base/src/nsFrameMessageManager.h
@@ -173,10 +173,10 @@ public:
     NS_ASSERTION(!mIsBroadcaster || !mCallback,
                  "Broadcasters cannot have callbacks!");
     // This is a bit hackish. When parent manager is global, we want
-    // to attach the window message manager to it immediately.
+    // to attach the message manager to it immediately.
     // Is it just the frame message manager which waits until the
     // content process is running.
-    if (mParentManager && (mCallback || IsWindowLevel())) {
+    if (mParentManager && (mCallback || IsBroadcaster())) {
       mParentManager->AddChildManager(this);
     }
     if (mOwnsCallback) {
@@ -258,7 +258,7 @@ public:
     mParentManager = aParent;
   }
   bool IsGlobal() { return mGlobal; }
-  bool IsWindowLevel() { return mParentManager && mParentManager->IsGlobal(); }
+  bool IsBroadcaster() { return mIsBroadcaster; }
 
   static nsFrameMessageManager* GetParentProcessManager()
   {
@@ -296,6 +296,9 @@ protected:
   nsFrameMessageManager* mParentManager;
   nsTArray<nsString> mPendingScripts;
   nsTArray<bool> mPendingScriptsGlobalStates;
+
+  void LoadPendingScripts(nsFrameMessageManager* aManager,
+                          nsFrameMessageManager* aChildMM);
 public:
   static nsFrameMessageManager* sParentProcessManager;
   static nsFrameMessageManager* sChildProcessManager;
diff --git a/content/base/src/nsGkAtomList.h b/content/base/src/nsGkAtomList.h
index bdfa1ccef981..b60df14a2bc2 100644
--- a/content/base/src/nsGkAtomList.h
+++ b/content/base/src/nsGkAtomList.h
@@ -583,6 +583,7 @@ GK_ATOM(minpos, "minpos")
 GK_ATOM(minusSign, "minus-sign")
 GK_ATOM(minwidth, "minwidth")
 GK_ATOM(_mixed, "mixed")
+GK_ATOM(messagemanagergroup, "messagemanagergroup")
 GK_ATOM(mod, "mod")
 GK_ATOM(mode, "mode")
 GK_ATOM(modifiers, "modifiers")
diff --git a/content/base/src/nsHTMLContentSerializer.cpp b/content/base/src/nsHTMLContentSerializer.cpp
index 4ff425a7d987..12653950ca3c 100644
--- a/content/base/src/nsHTMLContentSerializer.cpp
+++ b/content/base/src/nsHTMLContentSerializer.cpp
@@ -157,9 +157,9 @@ nsHTMLContentSerializer::SerializeHTMLAttributes(nsIContent* aContent,
     nsDependentAtomString nameStr(attrName);
     nsAutoString prefix;
     if (namespaceID == kNameSpaceID_XML) {
-      prefix.AssignLiteral("xml");
+      prefix.AssignLiteral(MOZ_UTF16("xml"));
     } else if (namespaceID == kNameSpaceID_XLink) {
-      prefix.AssignLiteral("xlink");
+      prefix.AssignLiteral(MOZ_UTF16("xlink"));
     }
 
     // Expand shorthand attribute.
diff --git a/content/base/src/nsInProcessTabChildGlobal.cpp b/content/base/src/nsInProcessTabChildGlobal.cpp
index c340d1128614..8907570518a9 100644
--- a/content/base/src/nsInProcessTabChildGlobal.cpp
+++ b/content/base/src/nsInProcessTabChildGlobal.cpp
@@ -167,7 +167,11 @@ NS_IMETHODIMP
 nsInProcessTabChildGlobal::GetContent(nsIDOMWindow** aContent)
 {
   *aContent = nullptr;
-  nsCOMPtr<nsIDOMWindow> window = do_GetInterface(mDocShell);
+  if (!mDocShell) {
+    return NS_OK;
+  }
+
+  nsCOMPtr<nsIDOMWindow> window = mDocShell->GetWindow();
   window.swap(*aContent);
   return NS_OK;
 }
@@ -220,10 +224,12 @@ nsInProcessTabChildGlobal::DelayedDisconnect()
   DOMEventTargetHelper::DispatchTrustedEvent(NS_LITERAL_STRING("unload"));
 
   // Continue with the Disconnect cleanup
-  nsCOMPtr<nsPIDOMWindow> win = do_GetInterface(mDocShell);
-  if (win) {
-    MOZ_ASSERT(win->IsOuterWindow());
-    win->SetChromeEventHandler(win->GetChromeEventHandler());
+  if (mDocShell) {
+    nsCOMPtr<nsPIDOMWindow> win = mDocShell->GetWindow();
+    if (win) {
+      MOZ_ASSERT(win->IsOuterWindow());
+      win->SetChromeEventHandler(win->GetChromeEventHandler());
+    }
   }
   mDocShell = nullptr;
   mChromeMessageManager = nullptr;
diff --git a/content/base/src/nsObjectLoadingContent.cpp b/content/base/src/nsObjectLoadingContent.cpp
index 16663c4c6bca..16d895549c38 100644
--- a/content/base/src/nsObjectLoadingContent.cpp
+++ b/content/base/src/nsObjectLoadingContent.cpp
@@ -1532,14 +1532,14 @@ nsObjectLoadingContent::UpdateObjectParameters(bool aJavaURI)
 
   if (isJava && hasCodebase && codebaseStr.IsEmpty()) {
     // Java treats codebase="" as "/"
-    codebaseStr.AssignLiteral("/");
+    codebaseStr.Assign('/');
     // XXX(johns): This doesn't cover the case of "https:" which java would
     //             interpret as "https:///" but we interpret as this document's
     //             URI but with a changed scheme.
   } else if (isJava && !hasCodebase) {
     // Java expects a directory as the codebase, or else it will construct
     // relative URIs incorrectly :(
-    codebaseStr.AssignLiteral(".");
+    codebaseStr.Assign('.');
   }
 
   if (!codebaseStr.IsEmpty()) {
diff --git a/content/base/src/nsPlainTextSerializer.cpp b/content/base/src/nsPlainTextSerializer.cpp
index 354c58f68fb7..b16d492f9491 100644
--- a/content/base/src/nsPlainTextSerializer.cpp
+++ b/content/base/src/nsPlainTextSerializer.cpp
@@ -1603,7 +1603,7 @@ nsPlainTextSerializer::Write(const nsAString& aStr)
         }
       }
 
-      mCurrentLine.AssignLiteral("");
+      mCurrentLine.Truncate();
       if (mFlags & nsIDocumentEncoder::OutputFormatFlowed) {
         if ((outputLineBreak || !spacesOnly) && // bugs 261467,125928
             !stringpart.EqualsLiteral("-- ") &&
diff --git a/content/base/src/nsXMLContentSerializer.cpp b/content/base/src/nsXMLContentSerializer.cpp
index e1325423b93e..7eba9aeb9371 100644
--- a/content/base/src/nsXMLContentSerializer.cpp
+++ b/content/base/src/nsXMLContentSerializer.cpp
@@ -98,10 +98,10 @@ nsXMLContentSerializer::Init(uint32_t aFlags, uint32_t aWrapColumn,
     mLineBreak.AssignLiteral("\r\n");
   }
   else if (mFlags & nsIDocumentEncoder::OutputCRLineBreak) { // Mac
-    mLineBreak.AssignLiteral("\r");
+    mLineBreak.Assign('\r');
   }
   else if (mFlags & nsIDocumentEncoder::OutputLFLineBreak) { // Unix/DOM
-    mLineBreak.AssignLiteral("\n");
+    mLineBreak.Assign('\n');
   }
   else {
     mLineBreak.AssignLiteral(NS_LINEBREAK);         // Platform/default
@@ -600,7 +600,7 @@ nsXMLContentSerializer::ConfirmPrefix(nsAString& aPrefix,
 void
 nsXMLContentSerializer::GenerateNewPrefix(nsAString& aPrefix)
 {
-  aPrefix.AssignLiteral("a");
+  aPrefix.Assign('a');
   char buf[128];
   PR_snprintf(buf, sizeof(buf), "%d", mPrefixIndex++);
   AppendASCIItoUTF16(buf, aPrefix);
diff --git a/content/base/test/browser_state_notifications.js b/content/base/test/browser_state_notifications.js
index ab1eb88d4abe..b66086ae7ad5 100644
--- a/content/base/test/browser_state_notifications.js
+++ b/content/base/test/browser_state_notifications.js
@@ -71,7 +71,7 @@ const isData = document => document.URL.startsWith("data:");
 
 const uri1 = "data:text/html;charset=utf-8,<h1>1</h1>";
 // For whatever reason going back on load event doesn't work so timeout it is :(
-const uri2 = "data:text/html;charset=utf-8,<h1>2</h1><script>setTimeout(back,100)</script>";
+const uri2 = "data:text/html;charset=utf-8,<h1>2</h1><script>setTimeout(SpecialPowers.wrap(window).back,100)</script>";
 const uri3 = "data:text/html;charset=utf-8,<h1>3</h1>";
 
 const uri4 = "chrome://browser/content/license.html";
diff --git a/content/base/test/chrome/chrome.ini b/content/base/test/chrome/chrome.ini
index 2767a1ed3e99..3159db9858e8 100644
--- a/content/base/test/chrome/chrome.ini
+++ b/content/base/test/chrome/chrome.ini
@@ -9,6 +9,11 @@ support-files =
   file_bug549682.xul
   file_bug616841.xul
   file_bug816340.xul
+  file_bug990812-1.xul
+  file_bug990812-2.xul
+  file_bug990812-3.xul
+  file_bug990812-4.xul
+  file_bug990812-5.xul
   fileconstructor_file.png
   frame_bug814638.xul
   host_bug814638.xul
@@ -45,6 +50,7 @@ support-files =
 [test_bug814638.xul]
 [test_bug816340.xul]
 [test_bug914381.html]
+[test_bug990812.xul]
 [test_cpows.xul]
 skip-if = toolkit == "cocoa"
 [test_document_register.xul]
diff --git a/content/base/test/chrome/file_bug990812-1.xul b/content/base/test/chrome/file_bug990812-1.xul
new file mode 100644
index 000000000000..1e085e76a2c4
--- /dev/null
+++ b/content/base/test/chrome/file_bug990812-1.xul
@@ -0,0 +1,64 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css"
+                 type="text/css"?>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=990812
+-->
+<window title="Mozilla Bug 990812"
+  xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+  onload="start();">
+  <label value="Mozilla Bug 990812"/>
+  <!-- test code goes here -->
+  <script type="application/javascript"><![CDATA[
+
+    var FRAME_SCRIPT_GLOBAL = "data:,sendSyncMessage('test', 'global')";
+    var FRAME_SCRIPT_WINDOW = "data:,sendSyncMessage('test', 'window')";
+    var FRAME_SCRIPT_GROUP  = "data:,sendSyncMessage('test', 'group')";
+
+    var Cc = Components.classes;
+    var Ci = Components.interfaces;
+    var globalMM = Cc["@mozilla.org/globalmessagemanager;1"]
+                     .getService(Ci.nsIMessageListenerManager);
+
+    function is(val, exp, msg) {
+      opener.wrappedJSObject.is(val, exp, msg);
+    }
+
+    /**
+     * Ensures that delayed frame scripts are loaded in the expected order.
+     * Global frame scripts will be loaded before delayed frame scripts from
+     * window message managers. The latter will be loaded before group message
+     * manager frame scripts.
+     */
+    function start() {
+      globalMM.loadFrameScript(FRAME_SCRIPT_GLOBAL, true);
+      messageManager.loadFrameScript(FRAME_SCRIPT_WINDOW, true);
+      getGroupMessageManager("test").loadFrameScript(FRAME_SCRIPT_GROUP, true);
+
+      var order = ["global", "window", "group"];
+
+      messageManager.addMessageListener("test", function onMessage(msg) {
+        var next = order.shift();
+        opener.wrappedJSObject.is(msg.data, next, "received test:" + next);
+
+        if (order.length == 0) {
+          opener.setTimeout("next()");
+          window.close();
+        }
+      });
+
+      var browser = document.createElement("browser");
+      browser.setAttribute("messagemanagergroup", "test");
+      browser.setAttribute("src", "about:mozilla");
+      browser.setAttribute("type", "content-targetable");
+      document.documentElement.appendChild(browser);
+
+      globalMM.removeDelayedFrameScript(FRAME_SCRIPT_GLOBAL);
+      messageManager.removeDelayedFrameScript(FRAME_SCRIPT_WINDOW);
+      getGroupMessageManager("test").removeDelayedFrameScript(FRAME_SCRIPT_GROUP);
+    }
+
+  ]]></script>
+
+</window>
diff --git a/content/base/test/chrome/file_bug990812-2.xul b/content/base/test/chrome/file_bug990812-2.xul
new file mode 100644
index 000000000000..ad4f0307a330
--- /dev/null
+++ b/content/base/test/chrome/file_bug990812-2.xul
@@ -0,0 +1,59 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css"
+                 type="text/css"?>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=990812
+-->
+<window title="Mozilla Bug 990812"
+  xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+  onload="start();">
+  <label value="Mozilla Bug 990812"/>
+  <!-- test code goes here -->
+  <script type="application/javascript"><![CDATA[
+
+    var FRAME_SCRIPT = "data:,sendAsyncMessage('test')";
+    var order = ["group", "window", "global"];
+
+    var Cc = Components.classes;
+    var Ci = Components.interfaces;
+    var globalMM = Cc["@mozilla.org/globalmessagemanager;1"]
+                     .getService(Ci.nsIMessageListenerManager);
+
+    function is(val, exp, msg) {
+      opener.wrappedJSObject.is(val, exp, msg);
+    }
+
+    function promiseMessage(type, mm) {
+      return new Promise(function (resolve) {
+        mm.addMessageListener("test", function onMessage() {
+          mm.removeMessageListener("test", onMessage);
+          is(type, order.shift(), "correct type " + type);
+          resolve();
+        });
+      });
+    }
+
+    /**
+     * Tests that async messages sent by frame scripts bubble up as expected,
+     * passing the group, window, and global message managers in that order.
+     */
+    function start() {
+      var global = promiseMessage("global", globalMM);
+      var window = promiseMessage("window", messageManager);
+      var group = promiseMessage("group", getGroupMessageManager("test"));
+
+      var browser = document.querySelector("browser");
+      browser.messageManager.loadFrameScript(FRAME_SCRIPT, true);
+
+      Promise.all([global, window, group]).then(function () {
+        opener.setTimeout("next()");
+        window.close();
+      });
+    }
+
+  ]]></script>
+
+  <browser messagemanagergroup="test" type="content-targetable" src="about:mozilla" />
+
+</window>
diff --git a/content/base/test/chrome/file_bug990812-3.xul b/content/base/test/chrome/file_bug990812-3.xul
new file mode 100644
index 000000000000..6dc25c9bbf62
--- /dev/null
+++ b/content/base/test/chrome/file_bug990812-3.xul
@@ -0,0 +1,71 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css"
+                 type="text/css"?>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=990812
+-->
+<window title="Mozilla Bug 990812"
+  xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+  onload="start();">
+  <label value="Mozilla Bug 990812"/>
+  <!-- test code goes here -->
+  <script type="application/javascript"><![CDATA[
+
+    var FRAME_SCRIPT = "data:,addMessageListener('test', function (msg) {" +
+                       "sendSyncMessage('test', msg.data)})";
+
+    var Cc = Components.classes;
+    var Ci = Components.interfaces;
+    var globalMM = Cc["@mozilla.org/globalmessagemanager;1"]
+                     .getService(Ci.nsIMessageListenerManager);
+
+    function is(val, exp, msg) {
+      opener.wrappedJSObject.is(val, exp, msg);
+    }
+
+    function promiseMessage(type, mm) {
+      var order = [type, "window", "global"];
+
+      return new Promise(function (resolve) {
+        mm.addMessageListener("test", function onMessage(msg) {
+          is(msg.data, order.shift(), "correct message " + msg.data);
+
+          if (order.length == 0) {
+            mm.removeMessageListener("test", onMessage);
+            resolve();
+          }
+        });
+      });
+    }
+
+    /**
+     * Ensures that broadcasting an async message does only reach descendants
+     * of a specific message manager and respects message manager groups.
+     */
+    function start() {
+      var mm1 = document.querySelector("browser").messageManager;
+      var promise1 = promiseMessage("group1", mm1);
+      mm1.loadFrameScript(FRAME_SCRIPT, true);
+
+      var mm2 = document.querySelector("browser + browser").messageManager;
+      var promise2 = promiseMessage("group2", mm2);
+      mm2.loadFrameScript(FRAME_SCRIPT, true);
+
+      getGroupMessageManager("test1").broadcastAsyncMessage("test", "group1");
+      getGroupMessageManager("test2").broadcastAsyncMessage("test", "group2");
+      messageManager.broadcastAsyncMessage("test", "window");
+      globalMM.broadcastAsyncMessage("test", "global");
+
+      Promise.all([promise1, promise2]).then(function () {
+        opener.setTimeout("next()");
+        window.close();
+      });
+    }
+
+  ]]></script>
+
+  <browser messagemanagergroup="test1" type="content-targetable" src="about:mozilla" />
+  <browser messagemanagergroup="test2" type="content-targetable" src="about:mozilla" />
+
+</window>
diff --git a/content/base/test/chrome/file_bug990812-4.xul b/content/base/test/chrome/file_bug990812-4.xul
new file mode 100644
index 000000000000..c6d2c04e9e04
--- /dev/null
+++ b/content/base/test/chrome/file_bug990812-4.xul
@@ -0,0 +1,68 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css"
+                 type="text/css"?>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=990812
+-->
+<window title="Mozilla Bug 990812"
+  xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+  onload="start();">
+  <label value="Mozilla Bug 990812"/>
+  <!-- test code goes here -->
+  <script type="application/javascript"><![CDATA[
+
+    var FRAME_SCRIPT1 = "data:,addMessageListener('test', function () {" +
+                        "sendSyncMessage('test', 'frame1')})";
+    var FRAME_SCRIPT2 = "data:,addMessageListener('test', function () {" +
+                        "sendSyncMessage('test', 'frame2')})";
+
+    var Cc = Components.classes;
+    var Ci = Components.interfaces;
+    var globalMM = Cc["@mozilla.org/globalmessagemanager;1"]
+                     .getService(Ci.nsIMessageListenerManager);
+
+    function is(val, exp, msg) {
+      opener.wrappedJSObject.is(val, exp, msg);
+    }
+
+    function promiseMessage(type, mm) {
+      return new Promise(function (resolve) {
+        mm.addMessageListener("test", function onMessage(msg) {
+          mm.removeMessageListener("test", onMessage);
+          is(msg.data, type, "correct message " + type);
+          resolve();
+        });
+      });
+    }
+
+    /**
+     * Tests that swapping docShells works as expected wrt to groups.
+     */
+    function start() {
+      var browser1 = document.querySelector("browser");
+      browser1.messageManager.loadFrameScript(FRAME_SCRIPT1, true);
+
+      var browser2 = document.querySelector("browser + browser");
+      browser2.messageManager.loadFrameScript(FRAME_SCRIPT2, true);
+
+      var promise1 = promiseMessage("frame2", getGroupMessageManager("test1"));
+      var promise2 = promiseMessage("frame1", getGroupMessageManager("test2"));
+
+      var flo1 = browser1.QueryInterface(Ci.nsIFrameLoaderOwner);
+      var flo2 = browser2.QueryInterface(Ci.nsIFrameLoaderOwner);
+      flo1.swapFrameLoaders(flo2);
+      messageManager.broadcastAsyncMessage("test");
+
+      Promise.all([promise1, promise2]).then(function () {
+        opener.setTimeout("next()");
+        window.close();
+      });
+    }
+
+  ]]></script>
+
+  <browser messagemanagergroup="test1" type="content-targetable" src="about:mozilla" />
+  <browser messagemanagergroup="test2" type="content-targetable" src="about:mozilla" />
+
+</window>
diff --git a/content/base/test/chrome/file_bug990812-5.xul b/content/base/test/chrome/file_bug990812-5.xul
new file mode 100644
index 000000000000..b00e05bc5b76
--- /dev/null
+++ b/content/base/test/chrome/file_bug990812-5.xul
@@ -0,0 +1,77 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css"
+                 type="text/css"?>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=990812
+-->
+<window title="Mozilla Bug 990812"
+  xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+  onload="start();">
+  <label value="Mozilla Bug 990812"/>
+  <!-- test code goes here -->
+  <script type="application/javascript"><![CDATA[
+
+    var FRAME_SCRIPT1 = "data:,addMessageListener('test', function () {" +
+                        "sendSyncMessage('test', 'group1')})";
+    var FRAME_SCRIPT2 = "data:,addMessageListener('test', function () {" +
+                        "sendSyncMessage('test', 'group2')})";
+
+    var Cc = Components.classes;
+    var Ci = Components.interfaces;
+    var globalMM = Cc["@mozilla.org/globalmessagemanager;1"]
+                     .getService(Ci.nsIMessageListenerManager);
+
+    function is(val, exp, msg) {
+      opener.wrappedJSObject.is(val, exp, msg);
+    }
+
+    function promiseTwoMessages(type, mm) {
+      var numLeft = 2;
+
+      return new Promise(function (resolve) {
+        mm.addMessageListener("test", function onMessage(msg) {
+          is(msg.data, type, "correct message " + type);
+
+          if (--numLeft == 0) {
+            mm.removeMessageListener("test", onMessage);
+            resolve();
+          }
+        });
+      });
+    }
+
+    /**
+     * This test ensures that having multiple message manager groups with
+     * multiple frame loaders in those works as expected. For a specific
+     * group message manager, frame scripts should only be loaded by its
+     * descendants and messages should only be received by and from those
+     * child message managers.
+     */
+    function start() {
+      var gmm1 = getGroupMessageManager("test1");
+      gmm1.loadFrameScript(FRAME_SCRIPT1, true);
+
+      var gmm2 = getGroupMessageManager("test2");
+      gmm2.loadFrameScript(FRAME_SCRIPT2, true);
+
+      var promise1 = promiseTwoMessages("group1", gmm1);
+      var promise2 = promiseTwoMessages("group2", gmm2);
+
+      messageManager.broadcastAsyncMessage("test");
+
+      Promise.all([promise1, promise2]).then(function () {
+        opener.setTimeout("next()");
+        window.close();
+      });
+    }
+
+  ]]></script>
+
+  <browser messagemanagergroup="test1" type="content-targetable" src="about:mozilla" />
+  <browser messagemanagergroup="test1" type="content-targetable" src="about:mozilla" />
+
+  <browser messagemanagergroup="test2" type="content-targetable" src="about:mozilla" />
+  <browser messagemanagergroup="test2" type="content-targetable" src="about:mozilla" />
+
+</window>
diff --git a/content/base/test/chrome/file_bug990812.xul b/content/base/test/chrome/file_bug990812.xul
new file mode 100644
index 000000000000..e14661fe9a6a
--- /dev/null
+++ b/content/base/test/chrome/file_bug990812.xul
@@ -0,0 +1,58 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css"
+                 type="text/css"?>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=990812
+-->
+<window title="Mozilla Bug 990812"
+  xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+  onload="start();">
+  <label value="Mozilla Bug 990812"/>
+  <!-- test code goes here -->
+  <script type="application/javascript"><![CDATA[
+
+    var FRAME_SCRIPT_GLOBAL = "data:,sendSyncMessage('test', 'global')";
+    var FRAME_SCRIPT_WINDOW = "data:,sendSyncMessage('test', 'window')";
+    var FRAME_SCRIPT_GROUP  = "data:,sendSyncMessage('test', 'group')";
+
+    var Cc = Components.classes;
+    var Ci = Components.interfaces;
+    var globalMM = Cc["@mozilla.org/globalmessagemanager;1"]
+                     .getService(Ci.nsIMessageListenerManager);
+
+    function is(val, exp, msg) {
+      opener.wrappedJSObject.is(val, exp, msg);
+    }
+
+    function start() {
+      globalMM.loadFrameScript(FRAME_SCRIPT_GLOBAL, true);
+      messageManager.loadFrameScript(FRAME_SCRIPT_WINDOW, true);
+      getGroupMessageManager("test").loadFrameScript(FRAME_SCRIPT_GROUP, true);
+
+      var order = ["global", "window", "group"];
+
+      messageManager.addMessageListener("test", function onMessage(msg) {
+        var next = order.shift();
+        opener.wrappedJSObject.is(msg.data, next, "received test:" + next);
+
+        if (order.length == 0) {
+          opener.setTimeout("next()");
+          window.close();
+        }
+      });
+
+      var browser = document.createElement("browser");
+      browser.setAttribute("messagemanagergroup", "test");
+      browser.setAttribute("src", "about:mozilla");
+      browser.setAttribute("type", "content-targetable");
+      document.documentElement.appendChild(browser);
+
+      globalMM.removeDelayedFrameScript(FRAME_SCRIPT_GLOBAL);
+      messageManager.removeDelayedFrameScript(FRAME_SCRIPT_WINDOW);
+      getGroupMessageManager("test").removeDelayedFrameScript(FRAME_SCRIPT_GROUP);
+    }
+
+  ]]></script>
+
+</window>
diff --git a/content/base/test/chrome/test_bug990812.xul b/content/base/test/chrome/test_bug990812.xul
new file mode 100644
index 000000000000..4be1734291a3
--- /dev/null
+++ b/content/base/test/chrome/test_bug990812.xul
@@ -0,0 +1,43 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css"
+                 type="text/css"?>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=990812
+-->
+<window title="Mozilla Bug 990812"
+  xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <script type="application/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+
+  <!-- test results are displayed in the html:body -->
+  <body xmlns="http://www.w3.org/1999/xhtml">
+  <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=990812"
+     target="_blank">Mozilla Bug 990812</a>
+  </body>
+
+  <!-- test code goes here -->
+  <script type="application/javascript"><![CDATA[
+  SimpleTest.waitForExplicitFinish();
+
+  var tests = [
+    "file_bug990812-1.xul",
+    "file_bug990812-2.xul",
+    "file_bug990812-3.xul",
+    "file_bug990812-4.xul",
+    "file_bug990812-5.xul",
+  ];
+
+  function next() {
+    if (tests.length > 0) {
+      var file = tests.shift();
+      info("-- running " + file);
+      window.open(file, "", "chrome");
+    } else {
+      SimpleTest.finish();
+    }
+  }
+
+  addLoadEvent(next);
+  ]]></script>
+</window>
diff --git a/content/canvas/src/CanvasRenderingContext2D.cpp b/content/canvas/src/CanvasRenderingContext2D.cpp
index 2d091fb7cd96..f081cfcde97e 100644
--- a/content/canvas/src/CanvasRenderingContext2D.cpp
+++ b/content/canvas/src/CanvasRenderingContext2D.cpp
@@ -2313,6 +2313,7 @@ CanvasRenderingContext2D::SetFont(const nsAString& font,
                      fontStyle->mFont.sizeAdjust,
                      fontStyle->mFont.systemFont,
                      printerFont,
+                     fontStyle->mFont.variant == NS_STYLE_FONT_VARIANT_SMALL_CAPS,
                      fontStyle->mFont.languageOverride);
 
   fontStyle->mFont.AddFontFeaturesToStyle(&style);
@@ -3726,8 +3727,13 @@ CanvasRenderingContext2D::AsyncDrawXULElement(nsXULElement& elem,
 
   PBrowserParent *child = frameloader->GetRemoteBrowser();
   if (!child) {
-    nsCOMPtr<nsIDOMWindow> window =
-      do_GetInterface(frameloader->GetExistingDocShell());
+    nsIDocShell* docShell = frameLoader->GetExistingDocShell();
+    if (!docShell) {
+      error.Throw(NS_ERROR_FAILURE);
+      return;
+    }
+
+    nsCOMPtr<nsIDOMWindow> window = docShell->GetWindow();
     if (!window) {
       error.Throw(NS_ERROR_FAILURE);
       return;
diff --git a/content/html/content/src/HTMLInputElement.cpp b/content/html/content/src/HTMLInputElement.cpp
index 1a348f9a81c0..215dbffc0c27 100644
--- a/content/html/content/src/HTMLInputElement.cpp
+++ b/content/html/content/src/HTMLInputElement.cpp
@@ -7277,44 +7277,6 @@ HTMLInputElement::SetFilePickerFiltersFromAccept(nsIFilePicker* filePicker)
   }
 }
 
-int32_t
-HTMLInputElement::GetFilterFromAccept()
-{
-  NS_ASSERTION(HasAttr(kNameSpaceID_None, nsGkAtoms::accept),
-               "You should not call GetFileFiltersFromAccept if the element"
-               " has no accept attribute!");
-
-  int32_t filter = 0;
-  nsAutoString accept;
-  GetAttr(kNameSpaceID_None, nsGkAtoms::accept, accept);
-
-  HTMLSplitOnSpacesTokenizer tokenizer(accept, ',');
-
-  while (tokenizer.hasMoreTokens()) {
-    const nsDependentSubstring token = tokenizer.nextToken();
-
-    int32_t tokenFilter = 0;
-    if (token.EqualsLiteral("image/*")) {
-      tokenFilter = nsIFilePicker::filterImages;
-    } else if (token.EqualsLiteral("audio/*")) {
-      tokenFilter = nsIFilePicker::filterAudio;
-    } else if (token.EqualsLiteral("video/*")) {
-      tokenFilter = nsIFilePicker::filterVideo;
-    }
-
-    if (tokenFilter) {
-      // We do not want to set more than one filter so if we found two different
-      // kwown tokens, we will return 0 (no filter).
-      if (filter && filter != tokenFilter) {
-        return 0;
-      }
-      filter = tokenFilter;
-    }
-  }
-
-  return filter;
-}
-
 Decimal
 HTMLInputElement::GetStepScaleFactor() const
 {
diff --git a/content/html/content/src/HTMLInputElement.h b/content/html/content/src/HTMLInputElement.h
index c66a45ed6fe7..750896e26252 100644
--- a/content/html/content/src/HTMLInputElement.h
+++ b/content/html/content/src/HTMLInputElement.h
@@ -303,21 +303,6 @@ public:
    */
   void SetFilePickerFiltersFromAccept(nsIFilePicker* filePicker);
 
-  /**
-   * Returns the filter which should be used for the file picker according to
-   * the accept attribute value.
-   *
-   * See:
-   * http://dev.w3.org/html5/spec/forms.html#attr-input-accept
-   *
-   * @return Filter to use on the file picker with AppendFilters, 0 if none.
-   *
-   * @note You should not call this function if the element has no @accept.
-   * @note This will only filter for one type of file. If more than one filter
-   * is specified by the accept attribute they will *all* be ignored.
-   */
-  int32_t GetFilterFromAccept();
-
   /**
    * The form might need to request an update of the UI bits
    * (BF_CAN_SHOW_INVALID_UI and BF_CAN_SHOW_VALID_UI) when an invalid form
diff --git a/content/media/webrtc/MediaEngineDefault.cpp b/content/media/webrtc/MediaEngineDefault.cpp
index 8051f5559910..9e5dc909aca3 100644
--- a/content/media/webrtc/MediaEngineDefault.cpp
+++ b/content/media/webrtc/MediaEngineDefault.cpp
@@ -51,14 +51,14 @@ MediaEngineDefaultVideoSource::~MediaEngineDefaultVideoSource()
 void
 MediaEngineDefaultVideoSource::GetName(nsAString& aName)
 {
-  aName.AssignLiteral("Default Video Device");
+  aName.AssignLiteral(MOZ_UTF16("Default Video Device"));
   return;
 }
 
 void
 MediaEngineDefaultVideoSource::GetUUID(nsAString& aUUID)
 {
-  aUUID.AssignLiteral("1041FCBD-3F12-4F7B-9E9B-1EC556DD5676");
+  aUUID.AssignLiteral(MOZ_UTF16("1041FCBD-3F12-4F7B-9E9B-1EC556DD5676"));
   return;
 }
 
@@ -362,14 +362,14 @@ MediaEngineDefaultAudioSource::~MediaEngineDefaultAudioSource()
 void
 MediaEngineDefaultAudioSource::GetName(nsAString& aName)
 {
-  aName.AssignLiteral("Default Audio Device");
+  aName.AssignLiteral(MOZ_UTF16("Default Audio Device"));
   return;
 }
 
 void
 MediaEngineDefaultAudioSource::GetUUID(nsAString& aUUID)
 {
-  aUUID.AssignLiteral("B7CBD7C1-53EF-42F9-8353-73F61C70C092");
+  aUUID.AssignLiteral(MOZ_UTF16("B7CBD7C1-53EF-42F9-8353-73F61C70C092"));
   return;
 }
 
diff --git a/content/media/webrtc/MediaEngineTabVideoSource.cpp b/content/media/webrtc/MediaEngineTabVideoSource.cpp
index 7fbc81c22d95..fb3e44140117 100644
--- a/content/media/webrtc/MediaEngineTabVideoSource.cpp
+++ b/content/media/webrtc/MediaEngineTabVideoSource.cpp
@@ -109,13 +109,13 @@ MediaEngineTabVideoSource::InitRunnable::Run()
 void
 MediaEngineTabVideoSource::GetName(nsAString_internal& aName)
 {
-  aName.AssignLiteral("&getUserMedia.videoDevice.tabShare;");
+  aName.AssignLiteral(MOZ_UTF16("&getUserMedia.videoDevice.tabShare;"));
 }
 
 void
 MediaEngineTabVideoSource::GetUUID(nsAString_internal& aUuid)
 {
-  aUuid.AssignLiteral("uuid");
+  aUuid.AssignLiteral(MOZ_UTF16("uuid"));
 }
 
 nsresult
diff --git a/content/svg/content/src/SVGAnimatedPathSegList.cpp b/content/svg/content/src/SVGAnimatedPathSegList.cpp
index ceedff65e1e8..81db5ef1ad88 100644
--- a/content/svg/content/src/SVGAnimatedPathSegList.cpp
+++ b/content/svg/content/src/SVGAnimatedPathSegList.cpp
@@ -203,4 +203,14 @@ SVGAnimatedPathSegList::SMILAnimatedPathSegList::ClearAnimValue()
   }
 }
 
+size_t
+SVGAnimatedPathSegList::SizeOfExcludingThis(MallocSizeOf aMallocSizeOf) const
+{
+  size_t total = mBaseVal.SizeOfExcludingThis(aMallocSizeOf);
+  if (mAnimVal) {
+    mAnimVal->SizeOfIncludingThis(aMallocSizeOf);
+  }
+  return total;
+}
+
 } // namespace mozilla
diff --git a/content/svg/content/src/SVGAnimatedPathSegList.h b/content/svg/content/src/SVGAnimatedPathSegList.h
index 003f9777ca83..fb89c467c593 100644
--- a/content/svg/content/src/SVGAnimatedPathSegList.h
+++ b/content/svg/content/src/SVGAnimatedPathSegList.h
@@ -7,6 +7,7 @@
 #define MOZILLA_SVGANIMATEDPATHSEGLIST_H__
 
 #include "mozilla/Attributes.h"
+#include "mozilla/MemoryReporting.h"
 #include "nsAutoPtr.h"
 #include "nsISMILAttr.h"
 #include "SVGPathData.h"
@@ -35,7 +36,7 @@ class SVGAnimationElement;
  * DOMSVGPathSegList::InternalListWillChangeTo) and frees consumers from having
  * to know or worry about wrappers (or forget about them!) for the most part.
  */
-class SVGAnimatedPathSegList
+class SVGAnimatedPathSegList MOZ_FINAL
 {
   // friends so that they can get write access to mBaseVal and mAnimVal
   friend class DOMSVGPathSeg;
@@ -88,6 +89,8 @@ public:
   /// Callers own the returned nsISMILAttr
   nsISMILAttr* ToSMILAttr(nsSVGElement* aElement);
 
+  size_t SizeOfExcludingThis(MallocSizeOf aMallocSizeOf) const;
+
 private:
 
   // mAnimVal is a pointer to allow us to determine if we're being animated or
diff --git a/content/svg/content/src/SVGPathData.cpp b/content/svg/content/src/SVGPathData.cpp
index 0b1c7e7c4ba1..a11b0c91e47c 100644
--- a/content/svg/content/src/SVGPathData.cpp
+++ b/content/svg/content/src/SVGPathData.cpp
@@ -1164,3 +1164,15 @@ SVGPathData::GetMarkerPositioningData(nsTArray<nsSVGMark> *aMarks) const
   }
 }
 
+size_t
+SVGPathData::SizeOfExcludingThis(MallocSizeOf aMallocSizeOf) const
+{
+  return mData.SizeOfExcludingThis(aMallocSizeOf);
+}
+
+size_t
+SVGPathData::SizeOfIncludingThis(MallocSizeOf aMallocSizeOf) const
+{
+  return aMallocSizeOf(this) + SizeOfExcludingThis(aMallocSizeOf);
+}
+
diff --git a/content/svg/content/src/SVGPathData.h b/content/svg/content/src/SVGPathData.h
index 004a0f707018..206b37965905 100644
--- a/content/svg/content/src/SVGPathData.h
+++ b/content/svg/content/src/SVGPathData.h
@@ -13,6 +13,7 @@
 #include "nsIWeakReferenceUtils.h"
 #include "mozilla/gfx/2D.h"
 #include "mozilla/gfx/Types.h"
+#include "mozilla/MemoryReporting.h"
 #include "mozilla/RefPtr.h"
 #include "nsSVGElement.h"
 #include "nsTArray.h"
@@ -173,6 +174,10 @@ public:
   const_iterator begin() const { return mData.Elements(); }
   const_iterator end() const { return mData.Elements() + mData.Length(); }
 
+  // memory reporting methods
+  size_t SizeOfExcludingThis(mozilla::MallocSizeOf aMallocSizeOf) const;
+  size_t SizeOfIncludingThis(mozilla::MallocSizeOf aMallocSizeOf) const;
+
   // Access to methods that can modify objects of this type is deliberately
   // limited. This is to reduce the chances of someone modifying objects of
   // this type without taking the necessary steps to keep DOM wrappers in sync.
@@ -232,7 +237,7 @@ protected:
  * sync, so we can safely expose any protected base class methods required by
  * the SMIL code.
  */
-class SVGPathDataAndInfo : public SVGPathData
+class SVGPathDataAndInfo MOZ_FINAL : public SVGPathData
 {
 public:
   SVGPathDataAndInfo(nsSVGElement *aElement = nullptr)
diff --git a/content/svg/content/src/SVGPathElement.cpp b/content/svg/content/src/SVGPathElement.cpp
index 1da3ed9a211e..f7d509d5978f 100644
--- a/content/svg/content/src/SVGPathElement.cpp
+++ b/content/svg/content/src/SVGPathElement.cpp
@@ -46,6 +46,16 @@ SVGPathElement::SVGPathElement(already_AddRefed<nsINodeInfo>& aNodeInfo)
 {
 }
 
+//----------------------------------------------------------------------
+// memory reporting methods
+
+size_t
+SVGPathElement::SizeOfExcludingThis(mozilla::MallocSizeOf aMallocSizeOf) const
+{
+  return SVGPathElementBase::SizeOfExcludingThis(aMallocSizeOf) +
+         mD.SizeOfExcludingThis(aMallocSizeOf);
+}
+
 //----------------------------------------------------------------------
 // nsIDOMNode methods
 
diff --git a/content/svg/content/src/SVGPathElement.h b/content/svg/content/src/SVGPathElement.h
index 3a8369b9014a..fce61bc1892d 100644
--- a/content/svg/content/src/SVGPathElement.h
+++ b/content/svg/content/src/SVGPathElement.h
@@ -39,6 +39,9 @@ protected:
   SVGPathElement(already_AddRefed<nsINodeInfo>& aNodeInfo);
 
 public:
+  // DOM memory reporter participant
+  NS_DECL_SIZEOF_EXCLUDING_THIS
+
   // nsIContent interface
   NS_IMETHOD_(bool) IsAttributeMapped(const nsIAtom* name) const MOZ_OVERRIDE;
 
diff --git a/content/xul/document/src/XULDocument.cpp b/content/xul/document/src/XULDocument.cpp
index 3b98ec9dd035..9bb645a0bfda 100644
--- a/content/xul/document/src/XULDocument.cpp
+++ b/content/xul/document/src/XULDocument.cpp
@@ -4249,7 +4249,7 @@ XULDocument::BroadcasterHookup::~BroadcasterHookup()
         }
         else {
             mObservesElement->GetAttr(kNameSpaceID_None, nsGkAtoms::observes, broadcasterID);
-            attribute.AssignLiteral("*");
+            attribute.Assign('*');
         }
 
         nsAutoCString attributeC,broadcasteridC;
@@ -4398,7 +4398,7 @@ XULDocument::FindBroadcaster(Element* aElement,
         *aListener = aElement;
         NS_ADDREF(*aListener);
 
-        aAttribute.AssignLiteral("*");
+        aAttribute.Assign('*');
     }
 
     // Make sure we got a valid listener.
@@ -4700,9 +4700,11 @@ XULDocument::ParserObserver::OnStopRequest(nsIRequest *request,
 already_AddRefed<nsPIWindowRoot>
 XULDocument::GetWindowRoot()
 {
-    nsCOMPtr<nsIInterfaceRequestor> ir(mDocumentContainer);
-    nsCOMPtr<nsIDOMWindow> window(do_GetInterface(ir));
-    nsCOMPtr<nsPIDOMWindow> piWin(do_QueryInterface(window));
+  if (!mDocumentContainer) {
+    return nullptr;
+  }
+
+    nsCOMPtr<nsPIDOMWindow> piWin = mDocumentContainer->GetWindow();
     return piWin ? piWin->GetTopWindowRoot() : nullptr;
 }
 
diff --git a/content/xul/templates/src/nsXULContentUtils.cpp b/content/xul/templates/src/nsXULContentUtils.cpp
index 7e4c29e717ee..490044d788ff 100644
--- a/content/xul/templates/src/nsXULContentUtils.cpp
+++ b/content/xul/templates/src/nsXULContentUtils.cpp
@@ -438,13 +438,13 @@ nsXULContentUtils::SetCommandUpdater(nsIDocument* aDocument, nsIContent* aElemen
     nsAutoString events;
     aElement->GetAttr(kNameSpaceID_None, nsGkAtoms::events, events);
     if (events.IsEmpty())
-        events.AssignLiteral("*");
+        events.Assign('*');
 
     nsAutoString targets;
     aElement->GetAttr(kNameSpaceID_None, nsGkAtoms::targets, targets);
 
     if (targets.IsEmpty())
-        targets.AssignLiteral("*");
+        targets.Assign('*');
 
     nsCOMPtr<nsIDOMElement> domelement = do_QueryInterface(aElement);
     NS_ASSERTION(domelement != nullptr, "not a DOM element");
diff --git a/content/xul/templates/src/nsXULTemplateQueryProcessorXML.cpp b/content/xul/templates/src/nsXULTemplateQueryProcessorXML.cpp
index 39c369643334..60b1c9c77549 100644
--- a/content/xul/templates/src/nsXULTemplateQueryProcessorXML.cpp
+++ b/content/xul/templates/src/nsXULTemplateQueryProcessorXML.cpp
@@ -251,7 +251,7 @@ nsXULTemplateQueryProcessorXML::CompileQuery(nsIXULTemplateBuilder* aBuilder,
     // if an expression is not specified, then the default is to
     // just take all of the children
     if (expr.IsEmpty())
-        expr.AssignLiteral("*");
+        expr.Assign('*');
 
     nsCOMPtr<nsIDOMXPathExpression> compiledexpr;
     rv = CreateExpression(expr, aQueryNode, getter_AddRefs(compiledexpr));
diff --git a/docshell/base/nsDSURIContentListener.cpp b/docshell/base/nsDSURIContentListener.cpp
index 4f1839470416..10e3564bdd59 100644
--- a/docshell/base/nsDSURIContentListener.cpp
+++ b/docshell/base/nsDSURIContentListener.cpp
@@ -134,7 +134,8 @@ nsDSURIContentListener::DoContent(const char* aContentType,
     }
 
     if (loadFlags & nsIChannel::LOAD_RETARGETED_DOCUMENT_URI) {
-        nsCOMPtr<nsIDOMWindow> domWindow = do_GetInterface(static_cast<nsIDocShell*>(mDocShell));
+        nsCOMPtr<nsIDOMWindow> domWindow = mDocShell ? mDocShell->GetWindow()
+          : nullptr;
         NS_ENSURE_TRUE(domWindow, NS_ERROR_FAILURE);
         domWindow->Focus();
     }
@@ -286,7 +287,7 @@ bool nsDSURIContentListener::CheckOneFrameOptionsPolicy(nsIHttpChannel *httpChan
     // window, if we're not the top.  X-F-O: SAMEORIGIN requires that the
     // document must be same-origin with top window.  X-F-O: DENY requires that
     // the document must never be framed.
-    nsCOMPtr<nsIDOMWindow> thisWindow = do_GetInterface(static_cast<nsIDocShell*>(mDocShell));
+    nsCOMPtr<nsIDOMWindow> thisWindow = mDocShell->GetWindow();
     // If we don't have DOMWindow there is no risk of clickjacking
     if (!thisWindow)
         return true;
@@ -328,7 +329,7 @@ bool nsDSURIContentListener::CheckOneFrameOptionsPolicy(nsIHttpChannel *httpChan
         }
 
         bool system = false;
-        topDoc = do_GetInterface(parentDocShellItem);
+        topDoc = parentDocShellItem->GetDocument();
         if (topDoc) {
             if (NS_SUCCEEDED(ssm->IsSystemPrincipal(topDoc->NodePrincipal(),
                                                     &system)) && system) {
@@ -355,7 +356,7 @@ bool nsDSURIContentListener::CheckOneFrameOptionsPolicy(nsIHttpChannel *httpChan
         return false;
     }
 
-    topDoc = do_GetInterface(curDocShellItem);
+    topDoc = curDocShellItem->GetDocument();
     nsCOMPtr<nsIURI> topUri;
     topDoc->NodePrincipal()->GetURI(getter_AddRefs(topUri));
 
@@ -452,9 +453,9 @@ nsDSURIContentListener::ReportXFOViolation(nsIDocShellTreeItem* aTopDocShellItem
                                            nsIURI* aThisURI,
                                            XFOHeader aHeader)
 {
-    nsresult rv = NS_OK;
+  MOZ_ASSERT(aTopDocShellItem, "Need a top docshell");
 
-    nsCOMPtr<nsPIDOMWindow> topOuterWindow = do_GetInterface(aTopDocShellItem);
+    nsCOMPtr<nsPIDOMWindow> topOuterWindow = aTopDocShellItem->GetWindow();
     if (!topOuterWindow)
         return;
 
@@ -465,10 +466,8 @@ nsDSURIContentListener::ReportXFOViolation(nsIDocShellTreeItem* aTopDocShellItem
 
     nsCOMPtr<nsIURI> topURI;
 
-    nsCOMPtr<nsIDocument> document;
-
-    document = do_GetInterface(aTopDocShellItem);
-    rv = document->NodePrincipal()->GetURI(getter_AddRefs(topURI));
+    nsCOMPtr<nsIDocument> document = aTopDocShellItem->GetDocument();
+    nsresult rv = document->NodePrincipal()->GetURI(getter_AddRefs(topURI));
     if (NS_FAILED(rv))
         return;
 
diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
index 68b7717709d4..aaf40c776526 100644
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -1125,8 +1125,7 @@ NS_IMETHODIMP nsDocShell::GetInterface(const nsIID & aIID, void **aSink)
         tabChild->
           GetMessageManager(getter_AddRefs(mm));
       } else {
-        nsCOMPtr<nsPIDOMWindow> win =
-          do_GetInterface(static_cast<nsIDocShell*>(this));
+        nsCOMPtr<nsPIDOMWindow> win = GetWindow();
         if (win) {
           mm = do_QueryInterface(win->GetParentTarget());
         }
@@ -1748,12 +1747,14 @@ nsDocShell::ValidateOrigin(nsIDocShellTreeItem* aOriginTreeItem,
         return true;
     }
 
+    MOZ_ASSERT(aOriginTreeItem && aTargetTreeItem, "need two docshells");
+
     // Get origin document principal
-    nsCOMPtr<nsIDocument> originDocument(do_GetInterface(aOriginTreeItem));
+    nsCOMPtr<nsIDocument> originDocument = aOriginTreeItem->GetDocument();
     NS_ENSURE_TRUE(originDocument, false);
 
     // Get target principal
-    nsCOMPtr<nsIDocument> targetDocument(do_GetInterface(aTargetTreeItem));
+    nsCOMPtr<nsIDocument> targetDocument = aTargetTreeItem->GetDocument();
     NS_ENSURE_TRUE(targetDocument, false);
 
     bool equal;
@@ -2093,7 +2094,7 @@ nsDocShell::GetChannelIsUnsafe(bool *aUnsafe)
 NS_IMETHODIMP
 nsDocShell::GetHasMixedActiveContentLoaded(bool* aHasMixedActiveContentLoaded)
 {
-    nsCOMPtr<nsIDocument> doc(do_GetInterface(GetAsSupports(this)));
+    nsCOMPtr<nsIDocument> doc(GetDocument());
     *aHasMixedActiveContentLoaded = doc && doc->GetHasMixedActiveContentLoaded();
     return NS_OK;
 }
@@ -2101,7 +2102,7 @@ nsDocShell::GetHasMixedActiveContentLoaded(bool* aHasMixedActiveContentLoaded)
 NS_IMETHODIMP
 nsDocShell::GetHasMixedActiveContentBlocked(bool* aHasMixedActiveContentBlocked)
 {
-    nsCOMPtr<nsIDocument> doc(do_GetInterface(GetAsSupports(this)));
+    nsCOMPtr<nsIDocument> doc(GetDocument());
     *aHasMixedActiveContentBlocked = doc && doc->GetHasMixedActiveContentBlocked();
     return NS_OK;
 }
@@ -2109,7 +2110,7 @@ nsDocShell::GetHasMixedActiveContentBlocked(bool* aHasMixedActiveContentBlocked)
 NS_IMETHODIMP
 nsDocShell::GetHasMixedDisplayContentLoaded(bool* aHasMixedDisplayContentLoaded)
 {
-    nsCOMPtr<nsIDocument> doc(do_GetInterface(GetAsSupports(this)));
+    nsCOMPtr<nsIDocument> doc(GetDocument());
     *aHasMixedDisplayContentLoaded = doc && doc->GetHasMixedDisplayContentLoaded();
     return NS_OK;
 }
@@ -2117,7 +2118,7 @@ nsDocShell::GetHasMixedDisplayContentLoaded(bool* aHasMixedDisplayContentLoaded)
 NS_IMETHODIMP
 nsDocShell::GetHasMixedDisplayContentBlocked(bool* aHasMixedDisplayContentBlocked)
 {
-    nsCOMPtr<nsIDocument> doc(do_GetInterface(GetAsSupports(this)));
+    nsCOMPtr<nsIDocument> doc(GetDocument());
     *aHasMixedDisplayContentBlocked = doc && doc->GetHasMixedDisplayContentBlocked();
     return NS_OK;
 }
@@ -2451,11 +2452,11 @@ nsDocShell::GetFullscreenAllowed(bool* aFullscreenAllowed)
     // has the allowfullscreen attribute set to true. If any ancestor
     // iframe does not have mozallowfullscreen=true, then fullscreen is
     // prohibited.
-    nsCOMPtr<nsPIDOMWindow> win = do_GetInterface(GetAsSupports(this));
+    nsCOMPtr<nsPIDOMWindow> win = GetWindow();
     if (!win) {
         return NS_OK;
     }
-    nsCOMPtr<nsIContent> frameElement = do_QueryInterface(win->GetFrameElementInternal());
+    nsCOMPtr<Element> frameElement = win->GetFrameElementInternal();
     if (frameElement &&
         frameElement->IsHTML(nsGkAtoms::iframe) &&
         !frameElement->HasAttr(kNameSpaceID_None, nsGkAtoms::allowfullscreen) &&
@@ -2466,11 +2467,8 @@ nsDocShell::GetFullscreenAllowed(bool* aFullscreenAllowed)
     // If we have no parent then we're the root docshell; no ancestor of the
     // original docshell doesn't have a allowfullscreen attribute, so
     // report fullscreen as allowed.
-    nsCOMPtr<nsIDocShellTreeItem> dsti = do_GetInterface(GetAsSupports(this));
-    NS_ENSURE_TRUE(dsti, NS_OK);
-
     nsCOMPtr<nsIDocShellTreeItem> parentTreeItem;
-    dsti->GetParent(getter_AddRefs(parentTreeItem));
+    GetParent(getter_AddRefs(parentTreeItem));
     if (!parentTreeItem) {
         *aFullscreenAllowed = true;
         return NS_OK;
@@ -3248,7 +3246,7 @@ nsDocShell::CanAccessItem(nsIDocShellTreeItem* aTargetItem,
         return false;
     }
 
-    nsCOMPtr<nsIDOMWindow> targetWindow = do_GetInterface(aTargetItem);
+    nsCOMPtr<nsIDOMWindow> targetWindow = aTargetItem->GetWindow();
     if (!targetWindow) {
         NS_ERROR("This should not happen, really");
         return false;
@@ -3269,7 +3267,7 @@ nsDocShell::CanAccessItem(nsIDocShellTreeItem* aTargetItem,
 static bool
 ItemIsActive(nsIDocShellTreeItem *aItem)
 {
-    nsCOMPtr<nsIDOMWindow> window(do_GetInterface(aItem));
+    nsCOMPtr<nsIDOMWindow> window = aItem->GetWindow();
 
     if (window) {
         bool isClosed;
@@ -4126,6 +4124,20 @@ nsDocShell::GetScriptGlobalObject()
     return mScriptGlobal;
 }
 
+nsIDocument*
+nsDocShell::GetDocument()
+{
+  NS_ENSURE_SUCCESS(EnsureContentViewer(), nullptr);
+  return mContentViewer->GetDocument();
+}
+
+nsPIDOMWindow*
+nsDocShell::GetWindow()
+{
+  NS_ENSURE_SUCCESS(EnsureScriptEnvironment(), nullptr);
+  return mScriptGlobal;
+}
+
 NS_IMETHODIMP
 nsDocShell::SetDeviceSizeIsPageSize(bool aValue)
 {
@@ -4612,7 +4624,7 @@ nsDocShell::DisplayLoadError(nsresult aError, nsIURI *aURI,
       // If the page doesn't have a title, we will use a blank space which will be trimmed
       // and thus treated as empty by the front-end.
       if (messageStr.IsEmpty()) {
-        messageStr.Assign(' ');
+        messageStr.AssignLiteral(MOZ_UTF16(" "));
       }
     }
     else {
@@ -4699,7 +4711,7 @@ nsDocShell::DisplayLoadError(nsresult aError, nsIURI *aURI,
             if (aURI) {
                 aURI->GetHostPort(hostport);
             } else {
-                hostport.AssignLiteral("?");
+                hostport.Assign('?');
             }
             CopyUTF8toUTF16(hostport, formatStrs[formatStrCount++]);
         }
@@ -4725,7 +4737,7 @@ nsDocShell::DisplayLoadError(nsresult aError, nsIURI *aURI,
                 rv = textToSubURI->UnEscapeURIForUI(charset, spec, formatStrs[formatStrCount]);
             }
         } else {
-            spec.AssignLiteral("?");
+            spec.Assign('?');
         }
         if (NS_FAILED(rv))
             CopyUTF8toUTF16(spec, formatStrs[formatStrCount]);
@@ -4925,7 +4937,7 @@ nsDocShell::Reload(uint32_t aReloadFlags)
         rv = LoadHistoryEntry(mLSHE, loadType);
     }
     else {
-        nsCOMPtr<nsIDocument> doc(do_GetInterface(GetAsSupports(this)));
+        nsCOMPtr<nsIDocument> doc(GetDocument());
 
         // Do not inherit owner from document
         uint32_t flags = INTERNAL_LOAD_FLAGS_NONE;
@@ -5769,7 +5781,7 @@ nsDocShell::GetAllowMixedContentAndConnectionData(bool* aRootHasSecureConnection
   *aIsRootDocShell = sameTypeRoot.get() == static_cast<nsIDocShellTreeItem *>(this);
 
   // now get the document from sameTypeRoot
-  nsCOMPtr<nsIDocument> rootDoc = do_GetInterface(sameTypeRoot);
+  nsCOMPtr<nsIDocument> rootDoc = sameTypeRoot->GetDocument();
   if (rootDoc) {
     nsCOMPtr<nsIPrincipal> rootPrincipal = rootDoc->NodePrincipal();
 
@@ -7215,12 +7227,12 @@ nsDocShell::EnsureContentViewer()
     nsCOMPtr<nsIDocShellTreeItem> parentItem;
     GetSameTypeParent(getter_AddRefs(parentItem));
     if (parentItem) {
-        nsCOMPtr<nsPIDOMWindow> domWin = do_GetInterface(GetAsSupports(this));
+        nsCOMPtr<nsPIDOMWindow> domWin = GetWindow();
         if (domWin) {
-            nsCOMPtr<nsIContent> parentContent =
-                do_QueryInterface(domWin->GetFrameElementInternal());
-            if (parentContent) {
-                baseURI = parentContent->GetBaseURI();
+            nsCOMPtr<Element> parentElement =
+                domWin->GetFrameElementInternal();
+            if (parentElement) {
+                baseURI = parentElement->GetBaseURI();
             }
         }
     }
@@ -7228,7 +7240,7 @@ nsDocShell::EnsureContentViewer()
     nsresult rv = CreateAboutBlankContentViewer(principal, baseURI);
 
     if (NS_SUCCEEDED(rv)) {
-        nsCOMPtr<nsIDocument> doc(do_GetInterface(GetAsSupports(this)));
+        nsCOMPtr<nsIDocument> doc(GetDocument());
         NS_ASSERTION(doc,
                      "Should have doc if CreateAboutBlankContentViewer "
                      "succeeded!");
@@ -7618,7 +7630,7 @@ nsDocShell::FinishRestore()
       ReattachEditorToWindow(mOSHE);
     }
 
-    nsCOMPtr<nsIDocument> doc = do_GetInterface(GetAsSupports(this));
+    nsCOMPtr<nsIDocument> doc = GetDocument();
     if (doc) {
         // Finally, we remove the request from the loadgroup.  This will
         // cause onStateChange(STATE_STOP) to fire, which will fire the
@@ -7981,8 +7993,9 @@ nsDocShell::RestoreFromHistory()
     if (document) {
         nsCOMPtr<nsIDocShellTreeItem> parent;
         GetParent(getter_AddRefs(parent));
-        nsCOMPtr<nsIDocument> d = do_GetInterface(parent);
-        if (d) {
+        if (parent) {
+          nsCOMPtr<nsIDocument> d = parent->GetDocument();
+          if (d) {
             if (d->EventHandlingSuppressed()) {
                 document->SuppressEventHandling(nsIDocument::eEvents,
                                                 d->EventHandlingSuppressed());
@@ -7996,8 +8009,9 @@ nsDocShell::RestoreFromHistory()
 
             nsCOMPtr<nsPIDOMWindow> parentWindow = d->GetWindow();
             if (parentWindow) {
-                parentSuspendCount = parentWindow->TimeoutSuspendCount();
+              parentSuspendCount = parentWindow->TimeoutSuspendCount();
             }
+          }
         }
 
         // Use the uri from the mLSHE we had when we entered this function
@@ -8013,8 +8027,7 @@ nsDocShell::RestoreFromHistory()
     // This is the end of our CreateContentViewer() replacement.
     // Now we simulate a load.  First, we restore the state of the javascript
     // window object.
-    nsCOMPtr<nsPIDOMWindow> privWin =
-        do_GetInterface(static_cast<nsIInterfaceRequestor*>(this));
+    nsCOMPtr<nsPIDOMWindow> privWin = GetWindow();
     NS_ASSERTION(privWin, "could not get nsPIDOMWindow interface");
 
     rv = privWin->RestoreWindowState(windowState);
@@ -8604,7 +8617,7 @@ nsDocShell::SetupNewViewer(nsIContentViewer * aNewViewer)
 nsresult
 nsDocShell::SetDocCurrentStateObj(nsISHEntry *shEntry)
 {
-    nsCOMPtr<nsIDocument> document = do_GetInterface(GetAsSupports(this));
+    nsCOMPtr<nsIDocument> document = GetDocument();
     NS_ENSURE_TRUE(document, NS_ERROR_FAILURE);
 
     nsCOMPtr<nsIStructuredCloneContainer> scContainer;
@@ -8650,7 +8663,7 @@ nsDocShell::CheckLoadingPermissions()
     // or any of its ancestors.
     nsCOMPtr<nsIDocShellTreeItem> item(this);
     do {
-        nsCOMPtr<nsIScriptGlobalObject> sgo(do_GetInterface(item));
+        nsCOMPtr<nsIScriptGlobalObject> sgo = do_GetInterface(item);
         nsCOMPtr<nsIScriptObjectPrincipal> sop(do_QueryInterface(sgo));
 
         nsIPrincipal *p;
@@ -9037,8 +9050,7 @@ nsDocShell::InternalLoad(nsIURI * aURI,
                 }
             }
 
-            nsCOMPtr<nsPIDOMWindow> win =
-                do_GetInterface(GetAsSupports(this));
+            nsCOMPtr<nsPIDOMWindow> win = GetWindow();
             NS_ENSURE_TRUE(win, NS_ERROR_NOT_AVAILABLE);
 
             nsDependentString name(aWindowTarget);
@@ -9099,8 +9111,7 @@ nsDocShell::InternalLoad(nsIURI * aURI,
                     // So, the best we can do, is to tear down the new window
                     // that was just created!
                     //
-                    nsCOMPtr<nsIDOMWindow> domWin =
-                        do_GetInterface(targetDocShell);
+                    nsCOMPtr<nsIDOMWindow> domWin = targetDocShell->GetWindow();
                     if (domWin) {
                         domWin->Close();
                     }
@@ -9411,8 +9422,7 @@ nsDocShell::InternalLoad(nsIURI * aURI,
             }
 
             // Set the doc's URI according to the new history entry's URI.
-            nsCOMPtr<nsIDocument> doc =
-              do_GetInterface(GetAsSupports(this));
+            nsCOMPtr<nsIDocument> doc = GetDocument();
             NS_ENSURE_TRUE(doc, NS_ERROR_FAILURE);
             doc->SetDocumentURI(aURI);
 
@@ -9623,7 +9633,7 @@ nsDocShell::GetInheritedPrincipal(bool aConsiderCurrentDocument)
         nsCOMPtr<nsIDocShellTreeItem> parentItem;
         GetSameTypeParent(getter_AddRefs(parentItem));
         if (parentItem) {
-            document = do_GetInterface(parentItem);
+            document = parentItem->GetDocument();
         }
     }
 
@@ -9710,15 +9720,17 @@ nsDocShell::DoURILoad(nsIURI * aURI,
         nsCOMPtr<nsIContentSecurityPolicy> csp;
         nsCOMPtr<nsIDocShellTreeItem> parentItem;
         GetSameTypeParent(getter_AddRefs(parentItem));
-        nsCOMPtr<nsIDocument> doc = do_GetInterface(parentItem);
-        if (doc) {
+        if (parentItem) {
+          nsCOMPtr<nsIDocument> doc = parentItem->GetDocument();
+          if (doc) {
             rv = doc->NodePrincipal()->GetCsp(getter_AddRefs(csp));
             NS_ENSURE_SUCCESS(rv, rv);
             if (csp) {
-                channelPolicy = do_CreateInstance("@mozilla.org/nschannelpolicy;1");
-                channelPolicy->SetContentSecurityPolicy(csp);
-                channelPolicy->SetLoadType(nsIContentPolicy::TYPE_SUBDOCUMENT);
+              channelPolicy = do_CreateInstance("@mozilla.org/nschannelpolicy;1");
+              channelPolicy->SetContentSecurityPolicy(csp);
+              channelPolicy->SetLoadType(nsIContentPolicy::TYPE_SUBDOCUMENT);
             }
+          }
         }
 
         // Only allow view-source scheme in top-level docshells. view-source is
@@ -10631,7 +10643,7 @@ nsDocShell::AddState(JS::Handle<JS::Value> aData, const nsAString& aTitle,
         aReplace = true;
     }
 
-    nsCOMPtr<nsIDocument> document = do_GetInterface(GetAsSupports(this));
+    nsCOMPtr<nsIDocument> document = GetDocument();
     NS_ENSURE_TRUE(document, NS_ERROR_FAILURE);
 
     // Step 1: Serialize aData using structured clone.
@@ -10642,8 +10654,7 @@ nsDocShell::AddState(JS::Handle<JS::Value> aData, const nsAString& aTitle,
     // 634834)  To protect against this, we abort if our principal changes due
     // to the InitFromJSVal() call.
     {
-        nsCOMPtr<nsIDocument> origDocument =
-            do_GetInterface(GetAsSupports(this));
+        nsCOMPtr<nsIDocument> origDocument = GetDocument();
         if (!origDocument)
             return NS_ERROR_DOM_SECURITY_ERR;
         nsCOMPtr<nsIPrincipal> origPrincipal = origDocument->NodePrincipal();
@@ -10664,8 +10675,7 @@ nsDocShell::AddState(JS::Handle<JS::Value> aData, const nsAString& aTitle,
         }
         NS_ENSURE_SUCCESS(rv, rv);
 
-        nsCOMPtr<nsIDocument> newDocument =
-            do_GetInterface(GetAsSupports(this));
+        nsCOMPtr<nsIDocument> newDocument = GetDocument();
         if (!newDocument)
             return NS_ERROR_DOM_SECURITY_ERR;
         nsCOMPtr<nsIPrincipal> newPrincipal = newDocument->NodePrincipal();
@@ -12216,7 +12226,7 @@ nsDocShell::GetAssociatedWindow(nsIDOMWindow** aWindow)
 NS_IMETHODIMP
 nsDocShell::GetTopWindow(nsIDOMWindow** aWindow)
 {
-    nsCOMPtr<nsIDOMWindow> win = do_GetInterface(GetAsSupports(this));
+    nsCOMPtr<nsIDOMWindow> win = GetWindow();
     if (win) {
         win->GetTop(aWindow);
     }
@@ -12227,7 +12237,7 @@ NS_IMETHODIMP
 nsDocShell::GetTopFrameElement(nsIDOMElement** aElement)
 {
     *aElement = nullptr;
-    nsCOMPtr<nsIDOMWindow> win = do_GetInterface(GetAsSupports(this));
+    nsCOMPtr<nsIDOMWindow> win = GetWindow();
     if (!win) {
         return NS_OK;
     }
@@ -12345,9 +12355,7 @@ nsDocShell::EnsureCommandHandler()
       do_CreateInstance("@mozilla.org/embedcomp/command-manager;1");
     if (!commandUpdater) return NS_ERROR_OUT_OF_MEMORY;
     
-    nsCOMPtr<nsIDOMWindow> domWindow =
-      do_GetInterface(static_cast<nsIInterfaceRequestor *>(this));
-
+    nsCOMPtr<nsIDOMWindow> domWindow = GetWindow();
     nsresult rv = commandUpdater->Init(domWindow);
     if (NS_SUCCEEDED(rv))
       mCommandManager = do_QueryInterface(commandUpdater);
diff --git a/docshell/base/nsDocShellEditorData.cpp b/docshell/base/nsDocShellEditorData.cpp
index 15879c005e3c..67391c4d4a1f 100644
--- a/docshell/base/nsDocShellEditorData.cpp
+++ b/docshell/base/nsDocShellEditorData.cpp
@@ -8,7 +8,7 @@
 #include "nsDocShellEditorData.h"
 #include "nsIInterfaceRequestorUtils.h"
 #include "nsComponentManagerUtils.h"
-#include "nsIDOMWindow.h"
+#include "nsPIDOMWindow.h"
 #include "nsIDOMDocument.h"
 #include "nsIEditor.h"
 #include "nsIEditingSession.h"
@@ -102,8 +102,9 @@ nsDocShellEditorData::CreateEditor()
   nsCOMPtr<nsIEditingSession>   editingSession;    
   nsresult rv = GetEditingSession(getter_AddRefs(editingSession));
   if (NS_FAILED(rv)) return rv;
-  
-  nsCOMPtr<nsIDOMWindow>    domWindow = do_GetInterface(mDocShell);
+ 
+  nsCOMPtr<nsIDOMWindow>    domWindow =
+    mDocShell ? mDocShell->GetWindow() : nullptr;
   rv = editingSession->SetupEditorOnWindow(domWindow);
   if (NS_FAILED(rv)) return rv;
   
@@ -201,7 +202,8 @@ nsDocShellEditorData::DetachFromWindow()
   NS_ASSERTION(mEditingSession,
                "Can't detach when we don't have a session to detach!");
   
-  nsCOMPtr<nsIDOMWindow> domWindow = do_GetInterface(mDocShell);
+  nsCOMPtr<nsIDOMWindow> domWindow =
+    mDocShell ? mDocShell->GetWindow() : nullptr;
   nsresult rv = mEditingSession->DetachFromWindow(domWindow);
   NS_ENSURE_SUCCESS(rv, rv);
 
@@ -225,7 +227,8 @@ nsDocShellEditorData::ReattachToWindow(nsIDocShell* aDocShell)
 {
   mDocShell = aDocShell;
 
-  nsCOMPtr<nsIDOMWindow> domWindow = do_GetInterface(mDocShell);
+  nsCOMPtr<nsIDOMWindow> domWindow =
+    mDocShell ? mDocShell->GetWindow() : nullptr;
   nsresult rv = mEditingSession->ReattachToWindow(domWindow);
   NS_ENSURE_SUCCESS(rv, rv);
 
diff --git a/docshell/base/nsIDocShell.idl b/docshell/base/nsIDocShell.idl
index ed323c903d65..30c540fa102b 100644
--- a/docshell/base/nsIDocShell.idl
+++ b/docshell/base/nsIDocShell.idl
@@ -45,7 +45,7 @@ interface nsIScrollObserver;
 
 typedef unsigned long nsLoadFlags;
 
-[scriptable, builtinclass, uuid(e46d924d-c20f-4add-8cf5-1e1c817b2181)]
+[scriptable, builtinclass, uuid(3ca96c12-b69d-4b54-83c5-25a18d32a22b)]
 interface nsIDocShell : nsIDocShellTreeItem
 {
   /**
diff --git a/docshell/base/nsIDocShellTreeItem.idl b/docshell/base/nsIDocShellTreeItem.idl
index 2dbaa29d8e25..fd0eb42a9d61 100644
--- a/docshell/base/nsIDocShellTreeItem.idl
+++ b/docshell/base/nsIDocShellTreeItem.idl
@@ -7,6 +7,8 @@
 #include "nsISupports.idl"
 
 interface nsIDocShellTreeOwner;
+interface nsIDocument;
+interface nsPIDOMWindow;
 
 
 /**
@@ -15,7 +17,7 @@ interface nsIDocShellTreeOwner;
  * node or a leaf. 
  */
 
-[scriptable, uuid(f897f4af-f67e-4115-9d37-ce09f71122e2)]
+[scriptable, uuid(edb99640-8378-4106-8673-e701a086eb1c)]
 interface nsIDocShellTreeItem : nsISupports
 {
 	/*
@@ -175,5 +177,8 @@ interface nsIDocShellTreeItem : nsISupports
 	                                      in boolean aSameType,
 	                                      in nsIDocShellTreeItem aRequestor,
 	                                      in nsIDocShellTreeItem aOriginalRequestor);
+
+  [noscript,nostdcall,notxpcom] nsIDocument getDocument();
+  [noscript,nostdcall,notxpcom] nsPIDOMWindow getWindow();
 };
 
diff --git a/docshell/test/test_bug669671.html b/docshell/test/test_bug669671.html
index ef670fffb759..a7f85bd78c10 100644
--- a/docshell/test/test_bug669671.html
+++ b/docshell/test/test_bug669671.html
@@ -91,7 +91,7 @@ function test()
   // Step 5 - Go back.  This should result in another onload (because the file is
   // not in bfcache) and should be the fourth time we've requested the sjs file.
   checkPopupLoadCount();
-  popup.back();
+  SpecialPowers.wrap(popup).back();
   yield undefined;
 
   // This is the check which was failing before we fixed the bug.
@@ -110,7 +110,7 @@ function test()
   popup.location = 'file_bug669671.sjs?navigated-2';
   yield undefined;
   checkPopupLoadCount();
-  popup.back();
+  SpecialPowers.wrap(popup).back();
   yield undefined;
   checkPopupLoadCount();
   popup.close();
@@ -124,7 +124,7 @@ function test()
   popup.location = 'file_bug669671.sjs?navigated-3';
   yield undefined;
   checkPopupLoadCount();
-  popup.back();
+  SpecialPowers.wrap(popup).back();
   yield undefined;
   is(popup.document.body.innerHTML, initialCount + '',
      'Load count (should be cached)');
diff --git a/dom/base/nsDOMWindowList.cpp b/dom/base/nsDOMWindowList.cpp
index 8906e3aa55ae..e346632edea5 100644
--- a/dom/base/nsDOMWindowList.cpp
+++ b/dom/base/nsDOMWindowList.cpp
@@ -91,7 +91,7 @@ nsDOMWindowList::IndexedGetter(uint32_t aIndex, bool& aFound)
     return nullptr;
   }
 
-  nsCOMPtr<nsIDOMWindow> window = do_GetInterface(item);
+  nsCOMPtr<nsIDOMWindow> window = item->GetWindow();
   MOZ_ASSERT(window);
 
   aFound = true;
diff --git a/dom/base/nsFocusManager.cpp b/dom/base/nsFocusManager.cpp
index d2a8dcc2690b..74b7076cdde3 100644
--- a/dom/base/nsFocusManager.cpp
+++ b/dom/base/nsFocusManager.cpp
@@ -377,12 +377,11 @@ NS_IMETHODIMP nsFocusManager::SetFocusedWindow(nsIDOMWindow* aWindowToFocus)
 
   windowToFocus = windowToFocus->GetOuterWindow();
 
-  nsCOMPtr<nsIContent> frameContent =
-    do_QueryInterface(windowToFocus->GetFrameElementInternal());
-  if (frameContent) {
+  nsCOMPtr<Element> frameElement = windowToFocus->GetFrameElementInternal();
+  if (frameElement) {
     // pass false for aFocusChanged so that the caret does not get updated
     // and scrolling does not occur.
-    SetFocusInner(frameContent, 0, false, true);
+    SetFocusInner(frameElement, 0, false, true);
   }
   else {
     // this is a top-level window. If the window has a child frame focused,
@@ -662,8 +661,7 @@ nsFocusManager::WindowRaised(nsIDOMWindow* aWindow)
   if (mActiveWindow)
     WindowLowered(mActiveWindow);
 
-  nsCOMPtr<nsIWebNavigation> webnav(do_GetInterface(aWindow));
-  nsCOMPtr<nsIDocShellTreeItem> docShellAsItem(do_QueryInterface(webnav));
+  nsCOMPtr<nsIDocShellTreeItem> docShellAsItem = window->GetDocShell();
   // If there's no docShellAsItem, this window must have been closed,
   // in that case there is no tree owner.
   NS_ENSURE_TRUE(docShellAsItem, NS_OK);
@@ -805,10 +803,12 @@ nsFocusManager::ContentRemoved(nsIDocument* aDocument, nsIContent* aContent)
       // so that no element is focused.
       nsIDocument* subdoc = aDocument->GetSubDocumentFor(content);
       if (subdoc) {
-        nsCOMPtr<nsISupports> container = subdoc->GetContainer();
-        nsCOMPtr<nsPIDOMWindow> childWindow = do_GetInterface(container);
-        if (childWindow && IsSameOrAncestor(childWindow, mFocusedWindow)) {
-          ClearFocus(mActiveWindow);
+        nsCOMPtr<nsIDocShell> docShell = subdoc->GetDocShell();
+        if (docShell) {
+          nsCOMPtr<nsPIDOMWindow> childWindow = docShell->GetWindow();
+          if (childWindow && IsSameOrAncestor(childWindow, mFocusedWindow)) {
+            ClearFocus(mActiveWindow);
+          }
         }
       }
     }
@@ -968,14 +968,16 @@ nsFocusManager::WindowHidden(nsIDOMWindow* aWindow)
   // ensures that the focused window isn't in a chain of frames that doesn't
   // exist any more.
   if (window != mFocusedWindow) {
-    nsCOMPtr<nsIWebNavigation> webnav(do_GetInterface(mFocusedWindow));
-    nsCOMPtr<nsIDocShellTreeItem> dsti = do_QueryInterface(webnav);
+    nsCOMPtr<nsIDocShellTreeItem> dsti =
+      mFocusedWindow ? mFocusedWindow->GetDocShell() : nullptr;
     if (dsti) {
       nsCOMPtr<nsIDocShellTreeItem> parentDsti;
       dsti->GetParent(getter_AddRefs(parentDsti));
-      nsCOMPtr<nsPIDOMWindow> parentWindow = do_GetInterface(parentDsti);
-      if (parentWindow)
-        parentWindow->SetFocusedNode(nullptr);
+      if (parentDsti) {
+        nsCOMPtr<nsPIDOMWindow> parentWindow = parentDsti->GetWindow();
+        if (parentWindow)
+          parentWindow->SetFocusedNode(nullptr);
+      }
     }
 
     SetFocusedWindowInternal(window);
@@ -1144,13 +1146,12 @@ nsFocusManager::SetFocusInner(nsIContent* aNewContent, int32_t aFlags,
   // new root docshell for the new element with the active window's docshell.
   bool isElementInActiveWindow = false;
 
-  nsCOMPtr<nsIWebNavigation> webnav = do_GetInterface(newWindow);
-  nsCOMPtr<nsIDocShellTreeItem> dsti = do_QueryInterface(webnav);
+  nsCOMPtr<nsIDocShellTreeItem> dsti = newWindow->GetDocShell();
   nsCOMPtr<nsPIDOMWindow> newRootWindow;
   if (dsti) {
     nsCOMPtr<nsIDocShellTreeItem> root;
     dsti->GetRootTreeItem(getter_AddRefs(root));
-    newRootWindow = do_GetInterface(root);
+    newRootWindow = root ? root->GetWindow() : nullptr;
 
     isElementInActiveWindow = (mActiveWindow && newRootWindow == mActiveWindow);
   }
@@ -1276,11 +1277,12 @@ bool
 nsFocusManager::IsSameOrAncestor(nsPIDOMWindow* aPossibleAncestor,
                                  nsPIDOMWindow* aWindow)
 {
-  nsCOMPtr<nsIWebNavigation> awebnav(do_GetInterface(aPossibleAncestor));
-  nsCOMPtr<nsIDocShellTreeItem> ancestordsti = do_QueryInterface(awebnav);
+  if (!aWindow || !aPossibleAncestor) {
+    return false;
+  }
 
-  nsCOMPtr<nsIWebNavigation> fwebnav(do_GetInterface(aWindow));
-  nsCOMPtr<nsIDocShellTreeItem> dsti = do_QueryInterface(fwebnav);
+  nsCOMPtr<nsIDocShellTreeItem> ancestordsti = aPossibleAncestor->GetDocShell();
+  nsCOMPtr<nsIDocShellTreeItem> dsti = aWindow->GetDocShell();
   while (dsti) {
     if (dsti == ancestordsti)
       return true;
@@ -1296,12 +1298,12 @@ already_AddRefed<nsPIDOMWindow>
 nsFocusManager::GetCommonAncestor(nsPIDOMWindow* aWindow1,
                                   nsPIDOMWindow* aWindow2)
 {
-  nsCOMPtr<nsIWebNavigation> webnav(do_GetInterface(aWindow1));
-  nsCOMPtr<nsIDocShellTreeItem> dsti1 = do_QueryInterface(webnav);
+  NS_ENSURE_TRUE(aWindow1 && aWindow2, nullptr);
+
+  nsCOMPtr<nsIDocShellTreeItem> dsti1 = aWindow1->GetDocShell();
   NS_ENSURE_TRUE(dsti1, nullptr);
 
-  webnav = do_GetInterface(aWindow2);
-  nsCOMPtr<nsIDocShellTreeItem> dsti2 = do_QueryInterface(webnav);
+  nsCOMPtr<nsIDocShellTreeItem> dsti2 = aWindow2->GetDocShell();
   NS_ENSURE_TRUE(dsti2, nullptr);
 
   nsAutoTArray<nsIDocShellTreeItem*, 30> parents1, parents2;
@@ -1331,7 +1333,7 @@ nsFocusManager::GetCommonAncestor(nsPIDOMWindow* aWindow1,
     parent = child1;
   }
 
-  nsCOMPtr<nsPIDOMWindow> window = do_GetInterface(parent);
+  nsCOMPtr<nsPIDOMWindow> window = parent ? parent->GetWindow() : nullptr;
   return window.forget();
 }
 
@@ -1345,17 +1347,18 @@ nsFocusManager::AdjustWindowFocus(nsPIDOMWindow* aWindow,
   while (window) {
     // get the containing <iframe> or equivalent element so that it can be
     // focused below.
-    nsCOMPtr<nsIContent> frameContent =
-      do_QueryInterface(window->GetFrameElementInternal());
+    nsCOMPtr<Element> frameElement = window->GetFrameElementInternal();
 
-    nsCOMPtr<nsIWebNavigation> webnav(do_GetInterface(window));
-    nsCOMPtr<nsIDocShellTreeItem> dsti = do_QueryInterface(webnav);
+    nsCOMPtr<nsIDocShellTreeItem> dsti = window->GetDocShell();
     if (!dsti) 
       return;
     nsCOMPtr<nsIDocShellTreeItem> parentDsti;
     dsti->GetParent(getter_AddRefs(parentDsti));
+    if (!parentDsti) {
+      return;
+    }
 
-    window = do_GetInterface(parentDsti);
+    window = parentDsti->GetWindow();
     if (window) {
       // if the parent window is visible but aWindow was not, then we have
       // likely moved up and out from a hidden tab to the browser window, or a
@@ -1369,7 +1372,7 @@ nsFocusManager::AdjustWindowFocus(nsPIDOMWindow* aWindow,
       if (aCheckPermission && !nsContentUtils::CanCallerAccess(window))
         break;
 
-      window->SetFocusedNode(frameContent);
+      window->SetFocusedNode(frameElement);
     }
   }
 }
@@ -2005,8 +2008,8 @@ nsFocusManager::RaiseWindow(nsPIDOMWindow* aWindow)
       widget->SetFocus(true);
   }
 #else
-  nsCOMPtr<nsIWebNavigation> webnav = do_GetInterface(aWindow);
-  nsCOMPtr<nsIBaseWindow> treeOwnerAsWin = do_QueryInterface(webnav);
+  nsCOMPtr<nsIBaseWindow> treeOwnerAsWin =
+    do_QueryInterface(aWindow->GetDocShell());
   if (treeOwnerAsWin) {
     nsCOMPtr<nsIWidget> widget;
     treeOwnerAsWin->GetMainWidget(getter_AddRefs(widget));
@@ -2079,10 +2082,10 @@ nsFocusManager::UpdateCaret(bool aMoveCaretToFocus,
   // on the nearest ancestor frame which is a chrome frame. But this is
   // what the existing code does, so just leave it for now.
   if (!browseWithCaret) {
-    nsCOMPtr<nsIContent> docContent =
-      do_QueryInterface(mFocusedWindow->GetFrameElementInternal());
-    if (docContent)
-      browseWithCaret = docContent->AttrValueIs(kNameSpaceID_None,
+    nsCOMPtr<Element> docElement =
+      mFocusedWindow->GetFrameElementInternal();
+    if (docElement)
+      browseWithCaret = docElement->AttrValueIs(kNameSpaceID_None,
                                                 nsGkAtoms::showcaret,
                                                 NS_LITERAL_STRING("true"),
                                                 eCaseMatters);
@@ -2581,14 +2584,14 @@ nsFocusManager::DetermineElementToMoveFocus(nsPIDOMWindow* aWindow,
       // move up to the parent shell and try again from there.
 
       // first, get the frame element this window is inside.
-      nsCOMPtr<nsPIDOMWindow> piWindow = do_GetInterface(docShell);
+      nsCOMPtr<nsPIDOMWindow> piWindow = docShell->GetWindow();
       NS_ENSURE_TRUE(piWindow, NS_ERROR_FAILURE);
 
       // Next, retrieve the parent docshell, document and presshell.
       docShell = do_QueryInterface(docShellParent);
       NS_ENSURE_TRUE(docShell, NS_ERROR_FAILURE);
 
-      nsCOMPtr<nsPIDOMWindow> piParentWindow = do_GetInterface(docShellParent);
+      nsCOMPtr<nsPIDOMWindow> piParentWindow = docShellParent->GetWindow();
       NS_ENSURE_TRUE(piParentWindow, NS_ERROR_FAILURE);
       doc = piParentWindow->GetExtantDoc();
       NS_ENSURE_TRUE(doc, NS_ERROR_FAILURE);
@@ -2596,7 +2599,7 @@ nsFocusManager::DetermineElementToMoveFocus(nsPIDOMWindow* aWindow,
       presShell = doc->GetShell();
 
       rootContent = doc->GetRootElement();
-      startContent = do_QueryInterface(piWindow->GetFrameElementInternal());
+      startContent = piWindow->GetFrameElementInternal();
       if (startContent) {
         nsIFrame* frame = startContent->GetPrimaryFrame();
         if (!frame)
@@ -2632,7 +2635,7 @@ nsFocusManager::DetermineElementToMoveFocus(nsPIDOMWindow* aWindow,
       docShell->TabToTreeOwner(forward, &tookFocus);
       // if the tree owner, took the focus, blur the current content
       if (tookFocus) {
-        nsCOMPtr<nsPIDOMWindow> window = do_GetInterface(docShell);
+        nsCOMPtr<nsPIDOMWindow> window = docShell->GetWindow();
         if (window->GetFocusedNode() == mFocusedContent)
           Blur(mFocusedWindow, nullptr, true, true);
         else
@@ -2975,14 +2978,13 @@ nsFocusManager::GetRootForFocus(nsPIDOMWindow* aWindow,
   // the root element's canvas may be focused as long as the document is in a
   // a non-chrome shell and does not contain a frameset.
   if (aIsForDocNavigation) {
-    nsCOMPtr<nsIContent> docContent =
-      do_QueryInterface(aWindow->GetFrameElementInternal());
+    nsCOMPtr<Element> docElement = aWindow->GetFrameElementInternal();
     // document navigation skips iframes and frames that are specifically non-focusable
-    if (docContent) {
-      if (docContent->Tag() == nsGkAtoms::iframe)
+    if (docElement) {
+      if (docElement->Tag() == nsGkAtoms::iframe)
         return nullptr;
 
-      nsIFrame* frame = docContent->GetPrimaryFrame();
+      nsIFrame* frame = docElement->GetPrimaryFrame();
       if (!frame || !frame->IsFocusable(nullptr, 0))
         return nullptr;
     }
@@ -3184,14 +3186,9 @@ nsFocusManager::GetNextTabbableDocument(nsIContent* aStartContent, bool aForward
   else if (mFocusedWindow) {
     startDocShell = mFocusedWindow->GetDocShell();
     doc = mFocusedWindow->GetExtantDoc();
-  }
-  else {
-    nsCOMPtr<nsIWebNavigation> webnav = do_GetInterface(mActiveWindow);
-    startDocShell = do_QueryInterface(webnav);
-
-    if (mActiveWindow) {
-      doc = mActiveWindow->GetExtantDoc();
-    }
+  } else if (mActiveWindow) {
+    startDocShell = mActiveWindow->GetDocShell();
+    doc = mActiveWindow->GetExtantDoc();
   }
 
   if (!startDocShell)
@@ -3251,7 +3248,7 @@ nsFocusManager::GetNextTabbableDocument(nsIContent* aStartContent, bool aForward
       }
 
       curItem = nextItem;
-      nextFrame = do_GetInterface(nextItem);
+      nextFrame = nextItem ? nextItem->GetWindow() : nullptr;
     }
 
     if (!nextFrame)
diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
index aab6b2ba6ce9..fb294bd2c237 100644
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -3378,7 +3378,7 @@ nsPIDOMWindow::MaybeCreateDoc()
     // Note that |document| here is the same thing as our mDoc, but we
     // don't have to explicitly set the member variable because the docshell
     // has already called SetNewDocument().
-    nsCOMPtr<nsIDocument> document = do_GetInterface(docShell);
+    nsCOMPtr<nsIDocument> document = docShell->GetDocument();
   }
 }
 
@@ -3801,9 +3801,8 @@ nsGlobalWindow::GetRealParent(nsIDOMWindow** aParent)
   mDocShell->GetSameTypeParentIgnoreBrowserAndAppBoundaries(getter_AddRefs(parent));
 
   if (parent) {
-    nsCOMPtr<nsIScriptGlobalObject> globalObject(do_GetInterface(parent));
-    NS_ENSURE_SUCCESS(CallQueryInterface(globalObject.get(), aParent),
-                      NS_ERROR_FAILURE);
+    nsCOMPtr<nsPIDOMWindow> win = parent->GetWindow();
+    win.forget(aParent);
   }
   else {
     *aParent = static_cast<nsIDOMWindow*>(this);
@@ -3968,7 +3967,11 @@ nsGlobalWindow::GetContentInternal(ErrorResult& aError)
     treeOwner->GetPrimaryContentShell(getter_AddRefs(primaryContent));
   }
 
-  domWindow = do_GetInterface(primaryContent);
+  if (!primaryContent) {
+    return nullptr;
+  }
+
+  domWindow = primaryContent->GetWindow();
   return domWindow.forget();
 }
 
@@ -5709,7 +5712,7 @@ nsGlobalWindow::GetLength(uint32_t* aLength)
   return NS_OK;
 }
 
-already_AddRefed<nsIDOMWindow>
+nsPIDOMWindow*
 nsGlobalWindow::GetChildWindow(const nsAString& aName)
 {
   nsCOMPtr<nsIDocShell> docShell(GetDocShell());
@@ -5720,8 +5723,7 @@ nsGlobalWindow::GetChildWindow(const nsAString& aName)
                               false, true, nullptr, nullptr,
                               getter_AddRefs(child));
 
-  nsCOMPtr<nsIDOMWindow> child_win(do_GetInterface(child));
-  return child_win.forget();
+  return child ? child->GetWindow() : nullptr;
 }
 
 bool
@@ -5888,7 +5890,7 @@ nsGlobalWindow::SetFullScreenInternal(bool aFullScreen, bool aRequireTrust)
   // call SetFullScreen on that window instead.
   nsCOMPtr<nsIDocShellTreeItem> rootItem;
   mDocShell->GetRootTreeItem(getter_AddRefs(rootItem));
-  nsCOMPtr<nsPIDOMWindow> window = do_GetInterface(rootItem);
+  nsCOMPtr<nsPIDOMWindow> window = rootItem ? rootItem->GetWindow() : nullptr;
   if (!window)
     return NS_ERROR_FAILURE;
   if (rootItem != mDocShell)
@@ -5972,7 +5974,7 @@ nsGlobalWindow::GetFullScreen(ErrorResult& aError)
     nsCOMPtr<nsIDocShellTreeItem> rootItem;
     mDocShell->GetRootTreeItem(getter_AddRefs(rootItem));
     if (rootItem != mDocShell) {
-      nsCOMPtr<nsIDOMWindow> window = do_GetInterface(rootItem);
+      nsCOMPtr<nsIDOMWindow> window = rootItem->GetWindow();
       if (window) {
         bool fullScreen = false;
         aError = window->GetFullScreen(&fullScreen);
@@ -6445,7 +6447,7 @@ nsGlobalWindow::Focus(ErrorResult& aError)
 
   nsCOMPtr<nsIDocShellTreeItem> rootItem;
   mDocShell->GetRootTreeItem(getter_AddRefs(rootItem));
-  nsCOMPtr<nsIDOMWindow> rootWin = do_GetInterface(rootItem);
+  nsCOMPtr<nsIDOMWindow> rootWin = rootItem ? rootItem->GetWindow() : nullptr;
   bool isActive = (rootWin == activeWindow);
 
   nsCOMPtr<nsIBaseWindow> treeOwnerAsWin = GetTreeOwnerWindow();
@@ -6488,7 +6490,8 @@ nsGlobalWindow::Focus(ErrorResult& aError)
   mDocShell->GetParent(getter_AddRefs(parentDsti));
 
   // set the parent's current focus to the frame containing this window.
-  nsCOMPtr<nsPIDOMWindow> parent = do_GetInterface(parentDsti);
+  nsCOMPtr<nsPIDOMWindow> parent =
+    parentDsti ? parentDsti->GetWindow() : nullptr;
   if (parent) {
     nsCOMPtr<nsIDocument> parentdoc = parent->GetDoc();
     if (!parentdoc) {
@@ -8419,7 +8422,8 @@ nsGlobalWindow::ReallyCloseWindow()
       nsCOMPtr<nsIBrowserDOMWindow> bwin;
       nsCOMPtr<nsIDocShellTreeItem> rootItem;
       mDocShell->GetRootTreeItem(getter_AddRefs(rootItem));
-      nsCOMPtr<nsIDOMWindow> rootWin(do_GetInterface(rootItem));
+      nsCOMPtr<nsIDOMWindow> rootWin =
+       rootItem ? rootItem->GetWindow() : nullptr;
       nsCOMPtr<nsIDOMChromeWindow> chromeWin(do_QueryInterface(rootWin));
       if (chromeWin)
         chromeWin->GetBrowserDOMWindow(getter_AddRefs(bwin));
@@ -9784,7 +9788,11 @@ nsGlobalWindow::SetKeyboardIndicators(UIStateChangeType aShowAccelerators,
     for (int32_t i = 0; i < childCount; ++i) {
       nsCOMPtr<nsIDocShellTreeItem> childShell;
       docShell->GetChildAt(i, getter_AddRefs(childShell));
-      nsCOMPtr<nsPIDOMWindow> childWindow = do_GetInterface(childShell);
+      if (!childShell) {
+        continue;
+      }
+
+      nsCOMPtr<nsPIDOMWindow> childWindow = childShell->GetWindow();
       if (childWindow) {
         childWindow->SetKeyboardIndicators(aShowAccelerators, aShowFocusRings);
       }
@@ -11378,7 +11386,7 @@ nsGlobalWindow::FireDelayedDOMEvents()
       docShell->GetChildAt(i, getter_AddRefs(childShell));
       NS_ASSERTION(childShell, "null child shell");
 
-      nsCOMPtr<nsPIDOMWindow> pWin = do_GetInterface(childShell);
+      nsCOMPtr<nsPIDOMWindow> pWin = childShell->GetWindow();
       if (pWin) {
         nsGlobalWindow *win =
           static_cast<nsGlobalWindow*>
@@ -12748,7 +12756,7 @@ nsGlobalWindow::SuspendTimeouts(uint32_t aIncrease,
       docShell->GetChildAt(i, getter_AddRefs(childShell));
       NS_ASSERTION(childShell, "null child shell");
 
-      nsCOMPtr<nsPIDOMWindow> pWin = do_GetInterface(childShell);
+      nsCOMPtr<nsPIDOMWindow> pWin = childShell->GetWindow();
       if (pWin) {
         nsGlobalWindow *win =
           static_cast<nsGlobalWindow*>
@@ -12856,7 +12864,7 @@ nsGlobalWindow::ResumeTimeouts(bool aThawChildren)
       docShell->GetChildAt(i, getter_AddRefs(childShell));
       NS_ASSERTION(childShell, "null child shell");
 
-      nsCOMPtr<nsPIDOMWindow> pWin = do_GetInterface(childShell);
+      nsCOMPtr<nsPIDOMWindow> pWin = childShell->GetWindow();
       if (pWin) {
         nsGlobalWindow *win =
           static_cast<nsGlobalWindow*>
@@ -13115,6 +13123,7 @@ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(nsGlobalChromeWindow,
                                                   nsGlobalWindow)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mBrowserDOMWindow)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mMessageManager)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mGroupMessageManagers)
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
 
@@ -13126,6 +13135,10 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(nsGlobalChromeWindow,
       tmp->mMessageManager.get())->Disconnect();
     NS_IMPL_CYCLE_COLLECTION_UNLINK(mMessageManager)
   }
+
+  tmp->mGroupMessageManagers.EnumerateRead(DisconnectGroupMessageManager, nullptr);
+  tmp->mGroupMessageManagers.Clear();
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mGroupMessageManagers)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 DOMCI_DATA(ChromeWindow, nsGlobalChromeWindow)
@@ -13494,6 +13507,39 @@ nsGlobalWindow::GetMessageManager(ErrorResult& aError)
   return myself->mMessageManager;
 }
 
+NS_IMETHODIMP
+nsGlobalChromeWindow::GetGroupMessageManager(const nsAString& aGroup,
+                                             nsIMessageBroadcaster** aManager)
+{
+  ErrorResult rv;
+  NS_IF_ADDREF(*aManager = GetGroupMessageManager(aGroup, rv));
+  return rv.ErrorCode();
+}
+
+nsIMessageBroadcaster*
+nsGlobalWindow::GetGroupMessageManager(const nsAString& aGroup,
+                                       ErrorResult& aError)
+{
+  FORWARD_TO_INNER_OR_THROW(GetGroupMessageManager, (aGroup, aError), aError, nullptr);
+  MOZ_ASSERT(IsChromeWindow());
+
+  nsGlobalChromeWindow* myself = static_cast<nsGlobalChromeWindow*>(this);
+  nsCOMPtr<nsIMessageBroadcaster> messageManager =
+    myself->mGroupMessageManagers.Get(aGroup);
+
+  if (!messageManager) {
+    nsFrameMessageManager* parent =
+      static_cast<nsFrameMessageManager*>(GetMessageManager(aError));
+
+    messageManager = new nsFrameMessageManager(nullptr,
+                                               parent,
+                                               MM_CHROME | MM_BROADCASTER);
+    myself->mGroupMessageManagers.Put(aGroup, messageManager);
+  }
+
+  return messageManager;
+}
+
 // nsGlobalModalWindow implementation
 
 // QueryInterface implementation for nsGlobalModalWindow
diff --git a/dom/base/nsGlobalWindow.h b/dom/base/nsGlobalWindow.h
index 0a2fda840e63..725d0dd25143 100644
--- a/dom/base/nsGlobalWindow.h
+++ b/dom/base/nsGlobalWindow.h
@@ -12,6 +12,7 @@
 #include "nsTHashtable.h"
 #include "nsHashKeys.h"
 #include "nsRefPtrHashtable.h"
+#include "nsInterfaceHashtable.h"
 
 // Local Includes
 // Helper Classes
@@ -546,7 +547,7 @@ public:
     return static_cast<nsGlobalWindow *>(top.get());
   }
 
-  already_AddRefed<nsIDOMWindow> GetChildWindow(const nsAString& aName);
+  nsPIDOMWindow* GetChildWindow(const nsAString& aName);
 
   // These return true if we've reached the state in this top level window
   // where we ask the user if further dialogs should be blocked.
@@ -1007,6 +1008,8 @@ public:
   void NotifyDefaultButtonLoaded(mozilla::dom::Element& aDefaultButton,
                                  mozilla::ErrorResult& aError);
   nsIMessageBroadcaster* GetMessageManager(mozilla::ErrorResult& aError);
+  nsIMessageBroadcaster* GetGroupMessageManager(const nsAString& aGroup,
+                                                mozilla::ErrorResult& aError);
   void BeginWindowMove(mozilla::dom::Event& aMouseDownEvent,
                        mozilla::dom::Element* aPanel,
                        mozilla::ErrorResult& aError);
@@ -1622,16 +1625,32 @@ public:
   NS_DECL_NSIDOMCHROMEWINDOW
 
   nsGlobalChromeWindow(nsGlobalWindow *aOuterWindow)
-    : nsGlobalWindow(aOuterWindow)
+    : nsGlobalWindow(aOuterWindow),
+      mGroupMessageManagers(1)
   {
     mIsChrome = true;
     mCleanMessageManager = true;
   }
 
+  static PLDHashOperator
+  DisconnectGroupMessageManager(const nsAString& aKey,
+                                nsIMessageBroadcaster* aMM,
+                                void* aUserArg)
+  {
+    if (aMM) {
+      static_cast<nsFrameMessageManager*>(aMM)->Disconnect();
+    }
+    return PL_DHASH_NEXT;
+  }
+
   ~nsGlobalChromeWindow()
   {
     NS_ABORT_IF_FALSE(mCleanMessageManager,
                       "chrome windows may always disconnect the msg manager");
+
+    mGroupMessageManagers.EnumerateRead(DisconnectGroupMessageManager, nullptr);
+    mGroupMessageManagers.Clear();
+
     if (mMessageManager) {
       static_cast<nsFrameMessageManager *>(
         mMessageManager.get())->Disconnect();
@@ -1653,10 +1672,12 @@ public:
   using nsGlobalWindow::Restore;
   using nsGlobalWindow::NotifyDefaultButtonLoaded;
   using nsGlobalWindow::GetMessageManager;
+  using nsGlobalWindow::GetGroupMessageManager;
   using nsGlobalWindow::BeginWindowMove;
 
   nsCOMPtr<nsIBrowserDOMWindow> mBrowserDOMWindow;
   nsCOMPtr<nsIMessageBroadcaster> mMessageManager;
+  nsInterfaceHashtable<nsStringHashKey, nsIMessageBroadcaster> mGroupMessageManagers;
 };
 
 /*
diff --git a/dom/base/nsHistory.cpp b/dom/base/nsHistory.cpp
index e6691155e49d..2911355dd4d8 100644
--- a/dom/base/nsHistory.cpp
+++ b/dom/base/nsHistory.cpp
@@ -153,7 +153,10 @@ nsHistory::Go(int32_t aDelta, ErrorResult& aRv)
   }
 
   if (!aDelta) {
-    nsCOMPtr<nsPIDOMWindow> window(do_GetInterface(GetDocShell()));
+    nsCOMPtr<nsPIDOMWindow> window;
+    if (nsIDocShell* docShell = GetDocShell()) {
+      window = docShell->GetWindow();
+    }
 
     if (window && window->IsHandlingResizeEvent()) {
       // history.go(0) (aka location.reload()) was called on a window
diff --git a/dom/base/nsLocation.cpp b/dom/base/nsLocation.cpp
index 0e9237139a2a..c939e98c169e 100644
--- a/dom/base/nsLocation.cpp
+++ b/dom/base/nsLocation.cpp
@@ -54,8 +54,10 @@ GetDocumentCharacterSetForURI(const nsAString& aHref, nsACString& aCharset)
 
 nsLocation::nsLocation(nsIDocShell *aDocShell)
 {
+  MOZ_ASSERT(aDocShell);
+
   mDocShell = do_GetWeakReference(aDocShell);
-  nsCOMPtr<nsIDOMWindow> outer = do_GetInterface(aDocShell);
+  nsCOMPtr<nsIDOMWindow> outer = aDocShell->GetWindow();
   mOuter = do_GetWeakReference(outer);
 }
 
@@ -535,7 +537,8 @@ nsLocation::SetHrefWithBase(const nsAString& aHref, nsIURI* aBase,
           // Now check to make sure that the script is running in our window,
           // since we only want to replace if the location is set by a
           // <script> tag in the same window.  See bug 178729.
-          nsCOMPtr<nsIScriptGlobalObject> ourGlobal(do_GetInterface(docShell));
+          nsCOMPtr<nsIScriptGlobalObject> ourGlobal =
+            docShell ? docShell->GetScriptGlobalObject() : nullptr;
           inScriptTag = (ourGlobal == scriptContext->GetGlobalObject());
         }
       }  
@@ -786,7 +789,7 @@ nsLocation::Reload(bool aForceget)
   nsresult rv;
   nsCOMPtr<nsIDocShell> docShell(do_QueryReferent(mDocShell));
   nsCOMPtr<nsIWebNavigation> webNav(do_QueryInterface(docShell));
-  nsCOMPtr<nsPIDOMWindow> window(do_GetInterface(docShell));
+  nsCOMPtr<nsPIDOMWindow> window = docShell ? docShell->GetWindow() : nullptr;
 
   if (window && window->IsHandlingResizeEvent()) {
     // location.reload() was called on a window that is handling a
@@ -901,7 +904,7 @@ nsLocation::GetSourceBaseURL(JSContext* cx, nsIURI** sourceURL)
   // the docshell. If that fails, just return null and hope that the caller passed
   // an absolute URI.
   if (!sgo && GetDocShell()) {
-    sgo = do_GetInterface(GetDocShell());
+    sgo = GetDocShell()->GetScriptGlobalObject();
   }
   NS_ENSURE_TRUE(sgo, NS_OK);
   nsCOMPtr<nsPIDOMWindow> window = do_QueryInterface(sgo);
diff --git a/dom/base/nsPluginArray.cpp b/dom/base/nsPluginArray.cpp
index 03d5ec391c7b..931d5141fb08 100644
--- a/dom/base/nsPluginArray.cpp
+++ b/dom/base/nsPluginArray.cpp
@@ -270,7 +270,7 @@ nsPluginArray::Observe(nsISupports *aSubject, const char *aTopic,
 bool
 nsPluginArray::AllowPlugins() const
 {
-  nsCOMPtr<nsIDocShell> docShell = do_GetInterface(mWindow);
+  nsCOMPtr<nsIDocShell> docShell = mWindow ? mWindow->GetDocShell() : nullptr;
 
   return docShell && docShell->PluginsAllowedInCurrentDoc();
 }
diff --git a/dom/base/test/test_openDialogChromeOnly.html b/dom/base/test/test_openDialogChromeOnly.html
index 8044078a7246..6548668c0c60 100644
--- a/dom/base/test/test_openDialogChromeOnly.html
+++ b/dom/base/test/test_openDialogChromeOnly.html
@@ -16,11 +16,8 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=931768
     openDialog("chrome://browser/content/browser.xul");
     ok(false, "Calling openDialog from unprivileged script should throw.");
   } catch (e) {
-    // FIXME e should be a ReferenceError once we switch Window to new WebIDL bindings
-    ok(e.name == "SecurityError",
-       "openDialog shouldn't be callable to unprivileged script.");
-    todo(e instanceof ReferenceError,
-         "openDialog shouldn't be available to unprivileged script.");
+    ok(e instanceof ReferenceError,
+       "openDialog shouldn't be available to unprivileged script.");
   }
 </script>
 </body>
diff --git a/dom/bindings/Bindings.conf b/dom/bindings/Bindings.conf
index cdf84eb4e53e..f5002b2e0119 100644
--- a/dom/bindings/Bindings.conf
+++ b/dom/bindings/Bindings.conf
@@ -214,7 +214,6 @@ DOMInterfaces = {
 
 'ChromeWindow': {
     'concrete': False,
-    'register': False,
 },
 
 'ChromeWorker': {
@@ -1565,10 +1564,7 @@ DOMInterfaces = {
 
 'Window': {
     'nativeType': 'nsGlobalWindow',
-    # When turning on Window, remember to drop the "'register': False"
-    # from ChromeWindow.
     'hasXPConnectImpls': True,
-    'register': False,
     'binaryNames': {
         'postMessage': 'postMessageMoz',
     },
diff --git a/dom/bluetooth/BluetoothManager.cpp b/dom/bluetooth/BluetoothManager.cpp
index 082ec9aa0360..2556c083d524 100644
--- a/dom/bluetooth/BluetoothManager.cpp
+++ b/dom/bluetooth/BluetoothManager.cpp
@@ -107,7 +107,7 @@ BluetoothManager::BluetoothManager(nsPIDOMWindow *aWindow)
   MOZ_ASSERT(aWindow);
   MOZ_ASSERT(IsDOMBinding());
 
-  mPath.AssignLiteral("/");
+  mPath.Assign('/');
 
   BluetoothService* bs = BluetoothService::Get();
   NS_ENSURE_TRUE_VOID(bs);
diff --git a/dom/bluetooth/bluez/BluetoothHfpManager.cpp b/dom/bluetooth/bluez/BluetoothHfpManager.cpp
index 22d4c7340a18..6e1c50e36e1d 100644
--- a/dom/bluetooth/bluez/BluetoothHfpManager.cpp
+++ b/dom/bluetooth/bluez/BluetoothHfpManager.cpp
@@ -811,7 +811,7 @@ BluetoothHfpManager::ReceiveSocketData(BluetoothSocket* aSocket,
     message.AppendInt(mNetworkSelectionMode);
     message.AppendLiteral(",0,\"");
     message.Append(NS_ConvertUTF16toUTF8(mOperatorName));
-    message.AppendLiteral("\"");
+    message.Append('"');
     SendLine(message.get());
   } else if (msg.Find("AT+VTS=") != -1) {
     ParseAtCommand(msg, 7, atCommandValues);
@@ -1529,7 +1529,7 @@ BluetoothHfpManager::HandleCallStateChanged(uint32_t aCallIndex,
 
         nsAutoString number(aNumber);
         if (!mCLIP) {
-          number.AssignLiteral("");
+          number.Truncate();
         }
 
         MessageLoop::current()->PostDelayedTask(
diff --git a/dom/bluetooth2/BluetoothManager.cpp b/dom/bluetooth2/BluetoothManager.cpp
index c62b1ba9e37f..51ad8278d88a 100644
--- a/dom/bluetooth2/BluetoothManager.cpp
+++ b/dom/bluetooth2/BluetoothManager.cpp
@@ -107,7 +107,7 @@ BluetoothManager::BluetoothManager(nsPIDOMWindow *aWindow)
   MOZ_ASSERT(aWindow);
   MOZ_ASSERT(IsDOMBinding());
 
-  mPath.AssignLiteral("/");
+  mPath.Assign('/');
 
   BluetoothService* bs = BluetoothService::Get();
   NS_ENSURE_TRUE_VOID(bs);
diff --git a/dom/bluetooth2/bluedroid/BluetoothOppManager.cpp b/dom/bluetooth2/bluedroid/BluetoothOppManager.cpp
index c55faf3d7a68..09d22a391f99 100644
--- a/dom/bluetooth2/bluedroid/BluetoothOppManager.cpp
+++ b/dom/bluetooth2/bluedroid/BluetoothOppManager.cpp
@@ -716,7 +716,7 @@ BluetoothOppManager::RetrieveSentFileName()
                                      EmptyCString(),
                                      extension);
       if (NS_SUCCEEDED(rv)) {
-        mFileName.AppendLiteral(".");
+        mFileName.Append('.');
         AppendUTF8toUTF16(extension, mFileName);
       }
     }
diff --git a/dom/bluetooth2/bluez/BluetoothHfpManager.cpp b/dom/bluetooth2/bluez/BluetoothHfpManager.cpp
index 983e20ab61b5..c8c7095766f0 100644
--- a/dom/bluetooth2/bluez/BluetoothHfpManager.cpp
+++ b/dom/bluetooth2/bluez/BluetoothHfpManager.cpp
@@ -811,7 +811,7 @@ BluetoothHfpManager::ReceiveSocketData(BluetoothSocket* aSocket,
     message.AppendInt(mNetworkSelectionMode);
     message.AppendLiteral(",0,\"");
     message.Append(NS_ConvertUTF16toUTF8(mOperatorName));
-    message.AppendLiteral("\"");
+    message.Append('"');
     SendLine(message.get());
   } else if (msg.Find("AT+VTS=") != -1) {
     ParseAtCommand(msg, 7, atCommandValues);
@@ -1211,9 +1211,9 @@ BluetoothHfpManager::SendCLCC(const Call& aCall, int aIndex)
 
   nsAutoCString message(RESPONSE_CLCC);
   message.AppendInt(aIndex);
-  message.AppendLiteral(",");
+  message.Append(',');
   message.AppendInt(aCall.mDirection);
-  message.AppendLiteral(",");
+  message.Append(',');
 
   int status = 0;
   switch (aCall.mState) {
@@ -1290,7 +1290,7 @@ BluetoothHfpManager::SendCommand(const char* aCommand, uint32_t aValue)
     }
 
     message.AppendInt(aValue);
-    message.AppendLiteral(",");
+    message.Append(',');
     message.AppendInt(sCINDItems[aValue].value);
   } else if (!strcmp(aCommand, RESPONSE_CIND)) {
     if (!aValue) {
@@ -1300,9 +1300,9 @@ BluetoothHfpManager::SendCommand(const char* aCommand, uint32_t aValue)
         message.Append(sCINDItems[i].name);
         message.AppendLiteral("\",(");
         message.Append(sCINDItems[i].range);
-        message.AppendLiteral(")");
+        message.Append(')');
         if (i == (ArrayLength(sCINDItems) - 1)) {
-          message.AppendLiteral(")");
+          message.Append(')');
           break;
         }
         message.AppendLiteral("),");
@@ -1314,7 +1314,7 @@ BluetoothHfpManager::SendCommand(const char* aCommand, uint32_t aValue)
         if (i == (ArrayLength(sCINDItems) - 1)) {
           break;
         }
-        message.AppendLiteral(",");
+        message.Append(',');
       }
     }
 #ifdef MOZ_B2G_RIL
@@ -1529,7 +1529,7 @@ BluetoothHfpManager::HandleCallStateChanged(uint32_t aCallIndex,
 
         nsAutoString number(aNumber);
         if (!mCLIP) {
-          number.AssignLiteral("");
+          number.Truncate();
         }
 
         MessageLoop::current()->PostDelayedTask(
diff --git a/dom/bluetooth2/bluez/BluetoothOppManager.cpp b/dom/bluetooth2/bluez/BluetoothOppManager.cpp
index 09b790875dc3..e1e4449fd725 100644
--- a/dom/bluetooth2/bluez/BluetoothOppManager.cpp
+++ b/dom/bluetooth2/bluez/BluetoothOppManager.cpp
@@ -738,7 +738,7 @@ BluetoothOppManager::RetrieveSentFileName()
                                      EmptyCString(),
                                      extension);
       if (NS_SUCCEEDED(rv)) {
-        mFileName.AppendLiteral(".");
+        mFileName.Append('.');
         AppendUTF8toUTF16(extension, mFileName);
       }
     }
diff --git a/dom/browser-element/BrowserElementParent.cpp b/dom/browser-element/BrowserElementParent.cpp
index 0b26a9691625..67452e03650f 100644
--- a/dom/browser-element/BrowserElementParent.cpp
+++ b/dom/browser-element/BrowserElementParent.cpp
@@ -283,7 +283,7 @@ BrowserElementParent::OpenWindowInProcess(nsIDOMWindow* aOpenerWindow,
   frameLoader->GetDocShell(getter_AddRefs(docshell));
   NS_ENSURE_TRUE(docshell, BrowserElementParent::OPEN_WINDOW_IGNORED);
 
-  nsCOMPtr<nsIDOMWindow> window = do_GetInterface(docshell);
+  nsCOMPtr<nsIDOMWindow> window = docshell->GetWindow();
   window.forget(aReturnWindow);
 
   return !!*aReturnWindow ? opened : BrowserElementParent::OPEN_WINDOW_CANCELLED;
diff --git a/dom/crypto/CryptoBuffer.cpp b/dom/crypto/CryptoBuffer.cpp
index 4108c35bde67..f63570fe5329 100644
--- a/dom/crypto/CryptoBuffer.cpp
+++ b/dom/crypto/CryptoBuffer.cpp
@@ -19,6 +19,7 @@ CryptoBuffer::Assign(const uint8_t* aData, uint32_t aLength)
 uint8_t*
 CryptoBuffer::Assign(const SECItem* aItem)
 {
+  MOZ_ASSERT(aItem);
   return Assign(aItem->data, aItem->len);
 }
 
diff --git a/dom/crypto/CryptoBuffer.h b/dom/crypto/CryptoBuffer.h
index 363c3464c928..754a5063690a 100644
--- a/dom/crypto/CryptoBuffer.h
+++ b/dom/crypto/CryptoBuffer.h
@@ -20,24 +20,6 @@ class OwningArrayBufferViewOrArrayBuffer;
 class CryptoBuffer : public FallibleTArray<uint8_t>
 {
 public:
-  CryptoBuffer()
-    : FallibleTArray<uint8_t>()
-  {}
-
-  template<class T>
-  explicit CryptoBuffer(const T& aData)
-    : FallibleTArray<uint8_t>()
-  {
-    Assign(aData);
-  }
-
-  template<class T>
-  CryptoBuffer& operator=(const T& aData)
-  {
-    Assign(aData);
-    return *this;
-  }
-
   uint8_t* Assign(const uint8_t* aData, uint32_t aLength);
   uint8_t* Assign(const SECItem* aItem);
   uint8_t* Assign(const ArrayBuffer& aData);
@@ -45,6 +27,14 @@ public:
   uint8_t* Assign(const ArrayBufferViewOrArrayBuffer& aData);
   uint8_t* Assign(const OwningArrayBufferViewOrArrayBuffer& aData);
 
+  template<typename T,
+         JSObject* UnboxArray(JSObject*, uint32_t*, T**)>
+  uint8_t* Assign(const TypedArray_base<T, UnboxArray>& aData)
+  {
+    return Assign(aData.Data(), aData.Length());
+  }
+
+
   SECItem* ToSECItem();
 
   bool GetBigIntValue(unsigned long& aRetVal);
diff --git a/dom/crypto/Key.cpp b/dom/crypto/Key.cpp
index c495bbb14944..cab328f8f3f7 100644
--- a/dom/crypto/Key.cpp
+++ b/dom/crypto/Key.cpp
@@ -22,6 +22,31 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(Key)
   NS_INTERFACE_MAP_ENTRY(nsISupports)
 NS_INTERFACE_MAP_END
 
+nsresult
+StringToUsage(const nsString& aUsage, Key::KeyUsage& aUsageOut)
+{
+  if (aUsage.EqualsLiteral(WEBCRYPTO_KEY_USAGE_ENCRYPT)) {
+    aUsageOut = Key::ENCRYPT;
+  } else if (aUsage.EqualsLiteral(WEBCRYPTO_KEY_USAGE_DECRYPT)) {
+    aUsageOut = Key::DECRYPT;
+  } else if (aUsage.EqualsLiteral(WEBCRYPTO_KEY_USAGE_SIGN)) {
+    aUsageOut = Key::SIGN;
+  } else if (aUsage.EqualsLiteral(WEBCRYPTO_KEY_USAGE_VERIFY)) {
+    aUsageOut = Key::VERIFY;
+  } else if (aUsage.EqualsLiteral(WEBCRYPTO_KEY_USAGE_DERIVEKEY)) {
+    aUsageOut = Key::DERIVEKEY;
+  } else if (aUsage.EqualsLiteral(WEBCRYPTO_KEY_USAGE_DERIVEBITS)) {
+    aUsageOut = Key::DERIVEBITS;
+  } else if (aUsage.EqualsLiteral(WEBCRYPTO_KEY_USAGE_WRAPKEY)) {
+    aUsageOut = Key::WRAPKEY;
+  } else if (aUsage.EqualsLiteral(WEBCRYPTO_KEY_USAGE_UNWRAPKEY)) {
+    aUsageOut = Key::UNWRAPKEY;
+  } else {
+    return NS_ERROR_DOM_SYNTAX_ERR;
+  }
+  return NS_OK;
+}
+
 Key::Key(nsIGlobalObject* aGlobal)
   : mGlobal(aGlobal)
   , mAttributes(0)
@@ -155,26 +180,22 @@ Key::ClearUsages()
 nsresult
 Key::AddUsage(const nsString& aUsage)
 {
-  if (aUsage.EqualsLiteral(WEBCRYPTO_KEY_USAGE_ENCRYPT)) {
-    mAttributes |= ENCRYPT;
-  } else if (aUsage.EqualsLiteral(WEBCRYPTO_KEY_USAGE_DECRYPT)) {
-    mAttributes |= DECRYPT;
-  } else if (aUsage.EqualsLiteral(WEBCRYPTO_KEY_USAGE_SIGN)) {
-    mAttributes |= SIGN;
-  } else if (aUsage.EqualsLiteral(WEBCRYPTO_KEY_USAGE_VERIFY)) {
-    mAttributes |= VERIFY;
-  } else if (aUsage.EqualsLiteral(WEBCRYPTO_KEY_USAGE_DERIVEKEY)) {
-    mAttributes |= DERIVEKEY;
-  } else if (aUsage.EqualsLiteral(WEBCRYPTO_KEY_USAGE_DERIVEBITS)) {
-    mAttributes |= DERIVEBITS;
-  } else if (aUsage.EqualsLiteral(WEBCRYPTO_KEY_USAGE_WRAPKEY)) {
-    mAttributes |= WRAPKEY;
-  } else if (aUsage.EqualsLiteral(WEBCRYPTO_KEY_USAGE_UNWRAPKEY)) {
-    mAttributes |= UNWRAPKEY;
-  } else {
+  return AddUsageIntersecting(aUsage, USAGES_MASK);
+}
+
+nsresult
+Key::AddUsageIntersecting(const nsString& aUsage, uint32_t aUsageMask)
+{
+  KeyUsage usage;
+  if (NS_FAILED(StringToUsage(aUsage, usage))) {
     return NS_ERROR_DOM_SYNTAX_ERR;
   }
 
+  if (usage & aUsageMask) {
+    AddUsage(usage);
+    return NS_OK;
+  }
+
   return NS_OK;
 }
 
diff --git a/dom/crypto/Key.h b/dom/crypto/Key.h
index 41e29e40cd94..26408a019340 100644
--- a/dom/crypto/Key.h
+++ b/dom/crypto/Key.h
@@ -113,6 +113,7 @@ public:
   void SetAlgorithm(KeyAlgorithm* aAlgorithm);
   void ClearUsages();
   nsresult AddUsage(const nsString& aUsage);
+  nsresult AddUsageIntersecting(const nsString& aUsage, uint32_t aUsageMask);
   void AddUsage(KeyUsage aUsage);
   bool HasUsage(KeyUsage aUsage);
   bool HasUsageOtherThan(uint32_t aUsages);
diff --git a/dom/crypto/KeyPair.cpp b/dom/crypto/KeyPair.cpp
new file mode 100644
index 000000000000..4a245b0e248e
--- /dev/null
+++ b/dom/crypto/KeyPair.cpp
@@ -0,0 +1,31 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "mozilla/dom/KeyPair.h"
+#include "mozilla/dom/SubtleCryptoBinding.h"
+#include "nsContentUtils.h"
+
+namespace mozilla {
+namespace dom {
+
+
+NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE(KeyPair, mGlobal, mPublicKey, mPrivateKey)
+NS_IMPL_CYCLE_COLLECTING_ADDREF(KeyPair)
+NS_IMPL_CYCLE_COLLECTING_RELEASE(KeyPair)
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(KeyPair)
+  NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
+  NS_INTERFACE_MAP_ENTRY(nsISupports)
+NS_INTERFACE_MAP_END
+
+JSObject*
+KeyPair::WrapObject(JSContext* aCx)
+{
+  return KeyPairBinding::Wrap(aCx, this);
+}
+
+
+} // namespace dom
+} // namespace mozilla
diff --git a/dom/crypto/KeyPair.h b/dom/crypto/KeyPair.h
new file mode 100644
index 000000000000..2e3106d63ec2
--- /dev/null
+++ b/dom/crypto/KeyPair.h
@@ -0,0 +1,63 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_KeyPair_h
+#define mozilla_dom_KeyPair_h
+
+#include "nsCycleCollectionParticipant.h"
+#include "nsWrapperCache.h"
+#include "nsIGlobalObject.h"
+#include "mozilla/dom/Key.h"
+#include "js/TypeDecls.h"
+
+namespace mozilla {
+namespace dom {
+
+class KeyPair MOZ_FINAL : public nsISupports,
+                          public nsWrapperCache
+{
+public:
+  NS_DECL_CYCLE_COLLECTING_ISUPPORTS
+  NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(KeyPair)
+
+public:
+  KeyPair(nsIGlobalObject* aGlobal)
+    : mGlobal(aGlobal)
+    , mPublicKey(new Key(aGlobal))
+    , mPrivateKey(new Key(aGlobal))
+  {
+    SetIsDOMBinding();
+  }
+
+  ~KeyPair() {}
+
+  nsIGlobalObject* GetParentObject() const
+  {
+    return mGlobal;
+  }
+
+  virtual JSObject* WrapObject(JSContext* aCx) MOZ_OVERRIDE;
+
+  Key* PublicKey() const
+  {
+    return mPublicKey;
+  }
+
+  Key* PrivateKey() const
+  {
+    return mPrivateKey;
+  }
+
+private:
+  nsRefPtr<nsIGlobalObject> mGlobal;
+  nsRefPtr<Key> mPublicKey;
+  nsRefPtr<Key> mPrivateKey;
+};
+
+} // namespace dom
+} // namespace mozilla
+
+#endif // mozilla_dom_KeyPair_h
diff --git a/dom/crypto/WebCryptoCommon.h b/dom/crypto/WebCryptoCommon.h
index 34dfb1bced7a..1a369808df7f 100644
--- a/dom/crypto/WebCryptoCommon.h
+++ b/dom/crypto/WebCryptoCommon.h
@@ -74,10 +74,9 @@ ReadString(JSStructuredCloneReader* aReader, nsString& aString)
     return false;
   }
 
-  aString.SetCapacity(nameLength+1);
+  aString.SetLength(nameLength);
   size_t charSize = sizeof(nsString::char_type);
   read = JS_ReadBytes(aReader, (void*) aString.BeginWriting(), nameLength * charSize);
-  aString.SetCharAt('\0', nameLength);
   if (!read) {
     return false;
   }
diff --git a/dom/crypto/WebCryptoTask.cpp b/dom/crypto/WebCryptoTask.cpp
index 14772fd341ff..068ee1117fac 100644
--- a/dom/crypto/WebCryptoTask.cpp
+++ b/dom/crypto/WebCryptoTask.cpp
@@ -6,12 +6,14 @@
 
 #include "pk11pub.h"
 #include "cryptohi.h"
+#include "secerr.h"
 #include "ScopedNSSTypes.h"
 
 #include "mozilla/dom/WebCryptoTask.h"
 #include "mozilla/dom/TypedArray.h"
 #include "mozilla/dom/Key.h"
 #include "mozilla/dom/KeyAlgorithm.h"
+#include "mozilla/dom/KeyPair.h"
 #include "mozilla/dom/AesKeyAlgorithm.h"
 #include "mozilla/dom/HmacKeyAlgorithm.h"
 #include "mozilla/dom/RsaKeyAlgorithm.h"
@@ -24,6 +26,26 @@ namespace dom {
 
 // Convenience functions for extracting / converting information
 
+// OOM-safe CryptoBuffer initialization, suitable for constructors
+#define ATTEMPT_BUFFER_INIT(dst, src) \
+  if (!dst.Assign(src)) { \
+    mEarlyRv = NS_ERROR_DOM_UNKNOWN_ERR; \
+    return; \
+  }
+
+// OOM-safe CryptoBuffer-to-SECItem copy, suitable for DoCrypto
+#define ATTEMPT_BUFFER_TO_SECITEM(dst, src) \
+  dst = src.ToSECItem(); \
+  if (!dst) { \
+    return NS_ERROR_DOM_UNKNOWN_ERR; \
+  }
+
+// OOM-safe CryptoBuffer copy, suitable for DoCrypto
+#define ATTEMPT_BUFFER_ASSIGN(dst, src) \
+  if (!dst.Assign(src)) { \
+    return NS_ERROR_DOM_UNKNOWN_ERR; \
+  }
+
 class ClearException
 {
 public:
@@ -107,6 +129,450 @@ private:
   }
 };
 
+class AesTask : public ReturnArrayBufferViewTask
+{
+public:
+  AesTask(JSContext* aCx, const ObjectOrString& aAlgorithm,
+          mozilla::dom::Key& aKey, const CryptoOperationData& aData,
+          bool aEncrypt)
+    : mSymKey(aKey.GetSymKey())
+    , mEncrypt(aEncrypt)
+  {
+    ATTEMPT_BUFFER_INIT(mData, aData);
+
+    nsString algName;
+    mEarlyRv = GetAlgorithmName(aCx, aAlgorithm, algName);
+    if (NS_FAILED(mEarlyRv)) {
+      return;
+    }
+
+    // Check that we got a reasonable key
+    if ((mSymKey.Length() != 16) &&
+        (mSymKey.Length() != 24) &&
+        (mSymKey.Length() != 32))
+    {
+      mEarlyRv = NS_ERROR_DOM_DATA_ERR;
+      return;
+    }
+
+    // Cache parameters depending on the specific algorithm
+    if (algName.EqualsLiteral(WEBCRYPTO_ALG_AES_CBC)) {
+      mMechanism = CKM_AES_CBC_PAD;
+      AesCbcParams params;
+      nsresult rv = Coerce(aCx, params, aAlgorithm);
+      if (NS_FAILED(rv) || !params.mIv.WasPassed()) {
+        mEarlyRv = NS_ERROR_DOM_INVALID_ACCESS_ERR;
+        return;
+      }
+
+      ATTEMPT_BUFFER_INIT(mIv, params.mIv.Value())
+    } else if (algName.EqualsLiteral(WEBCRYPTO_ALG_AES_CTR)) {
+      mMechanism = CKM_AES_CTR;
+      AesCtrParams params;
+      nsresult rv = Coerce(aCx, params, aAlgorithm);
+      if (NS_FAILED(rv) || !params.mCounter.WasPassed() ||
+          !params.mLength.WasPassed()) {
+        mEarlyRv = NS_ERROR_DOM_SYNTAX_ERR;
+        return;
+      }
+
+      ATTEMPT_BUFFER_INIT(mIv, params.mCounter.Value())
+      if (mIv.Length() != 16) {
+        mEarlyRv = NS_ERROR_DOM_DATA_ERR;
+        return;
+      }
+
+      mCounterLength = params.mLength.Value();
+    } else if (algName.EqualsLiteral(WEBCRYPTO_ALG_AES_GCM)) {
+      mMechanism = CKM_AES_GCM;
+      AesGcmParams params;
+      nsresult rv = Coerce(aCx, params, aAlgorithm);
+      if (NS_FAILED(rv) || !params.mIv.WasPassed()) {
+        mEarlyRv = NS_ERROR_DOM_SYNTAX_ERR;
+        return;
+      }
+
+      ATTEMPT_BUFFER_INIT(mIv, params.mIv.Value())
+
+      if (params.mAdditionalData.WasPassed()) {
+        ATTEMPT_BUFFER_INIT(mAad, params.mAdditionalData.Value())
+      }
+
+      // 32, 64, 96, 104, 112, 120 or 128
+      mTagLength = 128;
+      if (params.mTagLength.WasPassed()) {
+        mTagLength = params.mTagLength.Value();
+        if ((mTagLength > 128) ||
+            !(mTagLength == 32 || mTagLength == 64 ||
+              (mTagLength >= 96 && mTagLength % 8 == 0))) {
+          mEarlyRv = NS_ERROR_DOM_SYNTAX_ERR;
+          return;
+        }
+      }
+    } else {
+      mEarlyRv = NS_ERROR_DOM_NOT_SUPPORTED_ERR;
+      return;
+    }
+  }
+
+private:
+  CK_MECHANISM_TYPE mMechanism;
+  CryptoBuffer mSymKey;
+  CryptoBuffer mIv;   // Initialization vector
+  CryptoBuffer mData;
+  CryptoBuffer mAad;  // Additional Authenticated Data
+  uint8_t mTagLength;
+  uint8_t mCounterLength;
+  bool mEncrypt;
+
+  virtual nsresult DoCrypto() MOZ_OVERRIDE
+  {
+    nsresult rv;
+
+    // Construct the parameters object depending on algorithm
+    SECItem param;
+    ScopedSECItem cbcParam;
+    CK_AES_CTR_PARAMS ctrParams;
+    CK_GCM_PARAMS gcmParams;
+    switch (mMechanism) {
+      case CKM_AES_CBC_PAD:
+        ATTEMPT_BUFFER_TO_SECITEM(cbcParam, mIv);
+        param = *cbcParam;
+        break;
+      case CKM_AES_CTR:
+        ctrParams.ulCounterBits = mCounterLength;
+        MOZ_ASSERT(mIv.Length() == 16);
+        memcpy(&ctrParams.cb, mIv.Elements(), 16);
+        param.type = siBuffer;
+        param.data = (unsigned char*) &ctrParams;
+        param.len  = sizeof(ctrParams);
+        break;
+      case CKM_AES_GCM:
+        gcmParams.pIv = mIv.Elements();
+        gcmParams.ulIvLen = mIv.Length();
+        gcmParams.pAAD = mAad.Elements();
+        gcmParams.ulAADLen = mAad.Length();
+        gcmParams.ulTagBits = mTagLength;
+        param.type = siBuffer;
+        param.data = (unsigned char*) &gcmParams;
+        param.len  = sizeof(gcmParams);
+        break;
+      default:
+        return NS_ERROR_DOM_NOT_SUPPORTED_ERR;
+    }
+
+    // Import the key
+    ScopedSECItem keyItem;
+    ATTEMPT_BUFFER_TO_SECITEM(keyItem, mSymKey);
+    ScopedPK11SlotInfo slot(PK11_GetInternalSlot());
+    MOZ_ASSERT(slot.get());
+    ScopedPK11SymKey symKey(PK11_ImportSymKey(slot, mMechanism, PK11_OriginUnwrap,
+                                              CKA_ENCRYPT, keyItem.get(), nullptr));
+    if (!symKey) {
+      return NS_ERROR_DOM_INVALID_ACCESS_ERR;
+    }
+
+    // Initialize the output buffer (enough space for padding / a full tag)
+    uint32_t dataLen = mData.Length();
+    uint32_t maxLen = dataLen + 16;
+    if (!mResult.SetLength(maxLen)) {
+      return NS_ERROR_DOM_UNKNOWN_ERR;
+    }
+    uint32_t outLen = 0;
+
+    // Perform the encryption/decryption
+    if (mEncrypt) {
+      rv = MapSECStatus(PK11_Encrypt(symKey.get(), mMechanism, &param,
+                                     mResult.Elements(), &outLen, maxLen,
+                                     mData.Elements(), mData.Length()));
+    } else {
+      rv = MapSECStatus(PK11_Decrypt(symKey.get(), mMechanism, &param,
+                                     mResult.Elements(), &outLen, maxLen,
+                                     mData.Elements(), mData.Length()));
+    }
+    NS_ENSURE_SUCCESS(rv, NS_ERROR_DOM_OPERATION_ERR);
+
+    mResult.SetLength(outLen);
+    return rv;
+  }
+};
+
+class RsaesPkcs1Task : public ReturnArrayBufferViewTask
+{
+public:
+  RsaesPkcs1Task(JSContext* aCx, const ObjectOrString& aAlgorithm,
+                 mozilla::dom::Key& aKey, const CryptoOperationData& aData,
+                 bool aEncrypt)
+    : mPrivKey(aKey.GetPrivateKey())
+    , mPubKey(aKey.GetPublicKey())
+    , mEncrypt(aEncrypt)
+  {
+    ATTEMPT_BUFFER_INIT(mData, aData);
+
+    if (mEncrypt) {
+      if (!mPubKey) {
+        mEarlyRv = NS_ERROR_DOM_INVALID_ACCESS_ERR;
+        return;
+      }
+      mStrength = SECKEY_PublicKeyStrength(mPubKey);
+
+      // Verify that the data input is not too big
+      // (as required by PKCS#1 / RFC 3447)
+      if (mData.Length() > mStrength - 11) {
+        mEarlyRv = NS_ERROR_DOM_DATA_ERR;
+        return;
+      }
+    } else {
+      if (!mPrivKey) {
+        mEarlyRv = NS_ERROR_DOM_INVALID_ACCESS_ERR;
+        return;
+      }
+      mStrength = PK11_GetPrivateModulusLen(mPrivKey);
+    }
+  }
+
+private:
+  ScopedSECKEYPrivateKey mPrivKey;
+  ScopedSECKEYPublicKey mPubKey;
+  CryptoBuffer mData;
+  uint32_t mStrength;
+  bool mEncrypt;
+
+  virtual nsresult DoCrypto() MOZ_OVERRIDE
+  {
+    nsresult rv;
+
+    // Ciphertext is an integer mod the modulus, so it will be
+    // no longer than mStrength octets
+    if (!mResult.SetLength(mStrength)) {
+      return NS_ERROR_DOM_UNKNOWN_ERR;
+    }
+
+    if (mEncrypt) {
+      rv = MapSECStatus(PK11_PubEncryptPKCS1(
+              mPubKey.get(), mResult.Elements(),
+              mData.Elements(), mData.Length(),
+              nullptr));
+    } else {
+      uint32_t outLen;
+      rv = MapSECStatus(PK11_PrivDecryptPKCS1(
+              mPrivKey.get(), mResult.Elements(),
+              &outLen, mResult.Length(),
+              mData.Elements(), mData.Length()));
+      mResult.SetLength(outLen);
+    }
+
+    NS_ENSURE_SUCCESS(rv, NS_ERROR_DOM_OPERATION_ERR);
+    return NS_OK;
+  }
+};
+
+class HmacTask : public WebCryptoTask
+{
+public:
+  HmacTask(JSContext* aCx, const ObjectOrString& aAlgorithm,
+           mozilla::dom::Key& aKey,
+           const CryptoOperationData& aSignature,
+           const CryptoOperationData& aData,
+           bool aSign)
+    : mMechanism(aKey.Algorithm()->Mechanism())
+    , mSymKey(aKey.GetSymKey())
+    , mSign(aSign)
+  {
+    ATTEMPT_BUFFER_INIT(mData, aData);
+    if (!aSign) {
+      ATTEMPT_BUFFER_INIT(mSignature, aSignature);
+    }
+
+    // Check that we got a symmetric key
+    if (mSymKey.Length() == 0) {
+      mEarlyRv = NS_ERROR_DOM_DATA_ERR;
+      return;
+    }
+  }
+
+private:
+  CK_MECHANISM_TYPE mMechanism;
+  CryptoBuffer mSymKey;
+  CryptoBuffer mData;
+  CryptoBuffer mSignature;
+  CryptoBuffer mResult;
+  bool mSign;
+
+  virtual nsresult DoCrypto() MOZ_OVERRIDE
+  {
+    // Initialize the output buffer
+    if (!mResult.SetLength(HASH_LENGTH_MAX)) {
+      return NS_ERROR_DOM_UNKNOWN_ERR;
+    }
+    uint32_t outLen;
+
+    // Import the key
+    ScopedSECItem keyItem;
+    ATTEMPT_BUFFER_TO_SECITEM(keyItem, mSymKey);
+    ScopedPK11SlotInfo slot(PK11_GetInternalSlot());
+    MOZ_ASSERT(slot.get());
+    ScopedPK11SymKey symKey(PK11_ImportSymKey(slot, mMechanism, PK11_OriginUnwrap,
+                                              CKA_SIGN, keyItem.get(), nullptr));
+    if (!symKey) {
+      return NS_ERROR_DOM_INVALID_ACCESS_ERR;
+    }
+
+    // Compute the MAC
+    SECItem param = { siBuffer, nullptr, 0 };
+    ScopedPK11Context ctx(PK11_CreateContextBySymKey(mMechanism, CKA_SIGN,
+                                                     symKey.get(), &param));
+    if (!ctx.get()) {
+      return NS_ERROR_DOM_OPERATION_ERR;
+    }
+    nsresult rv = MapSECStatus(PK11_DigestBegin(ctx.get()));
+    NS_ENSURE_SUCCESS(rv, NS_ERROR_DOM_OPERATION_ERR);
+    rv = MapSECStatus(PK11_DigestOp(ctx.get(), mData.Elements(), mData.Length()));
+    NS_ENSURE_SUCCESS(rv, NS_ERROR_DOM_OPERATION_ERR);
+    rv = MapSECStatus(PK11_DigestFinal(ctx.get(), mResult.Elements(),
+                                       &outLen, HASH_LENGTH_MAX));
+    NS_ENSURE_SUCCESS(rv, NS_ERROR_DOM_OPERATION_ERR);
+
+    mResult.SetLength(outLen);
+    return rv;
+  }
+
+  // Returns mResult as an ArrayBufferView, or an error
+  virtual void Resolve() MOZ_OVERRIDE
+  {
+    if (mSign) {
+      // Return the computed MAC
+      TypedArrayCreator<Uint8Array> ret(mResult);
+      mResultPromise->MaybeResolve(ret);
+    } else {
+      // Compare the MAC to the provided signature
+      // No truncation allowed
+      bool equal = (mResult.Length() == mSignature.Length());
+      int cmp = NSS_SecureMemcmp(mSignature.Elements(),
+                                 mResult.Elements(),
+                                 mSignature.Length());
+      equal = equal && (cmp == 0);
+      mResultPromise->MaybeResolve(equal);
+    }
+  }
+};
+
+class RsassaPkcs1Task : public WebCryptoTask
+{
+public:
+  RsassaPkcs1Task(JSContext* aCx, const ObjectOrString& aAlgorithm,
+                  mozilla::dom::Key& aKey,
+                  const CryptoOperationData& aSignature,
+                  const CryptoOperationData& aData,
+                  bool aSign)
+    : mOidTag(SEC_OID_UNKNOWN)
+    , mPrivKey(aKey.GetPrivateKey())
+    , mPubKey(aKey.GetPublicKey())
+    , mSign(aSign)
+    , mVerified(false)
+  {
+    ATTEMPT_BUFFER_INIT(mData, aData);
+    if (!aSign) {
+      ATTEMPT_BUFFER_INIT(mSignature, aSignature);
+    }
+
+    // Look up the SECOidTag based on the KeyAlgorithm
+    // static_cast is safe because we only get here if the algorithm name
+    // is RSASSA-PKCS1-v1_5, and that only happens if we've constructed
+    // an RsaHashedKeyAlgorithm
+    nsRefPtr<RsaHashedKeyAlgorithm> rsaAlg = static_cast<RsaHashedKeyAlgorithm*>(aKey.Algorithm());
+    nsRefPtr<KeyAlgorithm> hashAlg = rsaAlg->Hash();
+
+    switch (hashAlg->Mechanism()) {
+      case CKM_SHA_1:
+        mOidTag = SEC_OID_PKCS1_SHA1_WITH_RSA_ENCRYPTION; break;
+      case CKM_SHA224:
+        mOidTag = SEC_OID_PKCS1_SHA224_WITH_RSA_ENCRYPTION; break;
+      case CKM_SHA256:
+        mOidTag = SEC_OID_PKCS1_SHA256_WITH_RSA_ENCRYPTION; break;
+      case CKM_SHA384:
+        mOidTag = SEC_OID_PKCS1_SHA384_WITH_RSA_ENCRYPTION; break;
+      case CKM_SHA512:
+        mOidTag = SEC_OID_PKCS1_SHA512_WITH_RSA_ENCRYPTION; break;
+      default: {
+        mEarlyRv = NS_ERROR_DOM_NOT_SUPPORTED_ERR;
+        return;
+      }
+    }
+
+    // Check that we have the appropriate key
+    if ((mSign && !mPrivKey) || (!mSign && !mPubKey)) {
+      mEarlyRv = NS_ERROR_DOM_INVALID_ACCESS_ERR;
+      return;
+    }
+  }
+
+private:
+  SECOidTag mOidTag;
+  ScopedSECKEYPrivateKey mPrivKey;
+  ScopedSECKEYPublicKey mPubKey;
+  CryptoBuffer mSignature;
+  CryptoBuffer mData;
+  bool mSign;
+  bool mVerified;
+
+  virtual nsresult DoCrypto() MOZ_OVERRIDE
+  {
+    nsresult rv;
+    if (mSign) {
+      ScopedSECItem signature((SECItem*) PORT_Alloc(sizeof(SECItem)));
+      ScopedSGNContext ctx(SGN_NewContext(mOidTag, mPrivKey));
+      if (!ctx) {
+        return NS_ERROR_DOM_OPERATION_ERR;
+      }
+
+      rv = MapSECStatus(SGN_Begin(ctx));
+      NS_ENSURE_SUCCESS(rv, NS_ERROR_DOM_OPERATION_ERR);
+
+      rv = MapSECStatus(SGN_Update(ctx, mData.Elements(), mData.Length()));
+      NS_ENSURE_SUCCESS(rv, NS_ERROR_DOM_OPERATION_ERR);
+
+      rv = MapSECStatus(SGN_End(ctx, signature));
+      NS_ENSURE_SUCCESS(rv, NS_ERROR_DOM_OPERATION_ERR);
+
+      mSignature.Assign(signature);
+    } else {
+      ScopedSECItem signature(mSignature.ToSECItem());
+      ScopedVFYContext ctx(VFY_CreateContext(mPubKey, signature,
+                                             mOidTag, nullptr));
+      if (!ctx) {
+        int err = PORT_GetError();
+        if (err == SEC_ERROR_BAD_SIGNATURE) {
+          mVerified = false;
+          return NS_OK;
+        }
+        return NS_ERROR_DOM_OPERATION_ERR;
+      }
+
+      rv = MapSECStatus(VFY_Begin(ctx));
+      NS_ENSURE_SUCCESS(rv, NS_ERROR_DOM_OPERATION_ERR);
+
+      rv = MapSECStatus(VFY_Update(ctx, mData.Elements(), mData.Length()));
+      NS_ENSURE_SUCCESS(rv, NS_ERROR_DOM_OPERATION_ERR);
+
+      rv = MapSECStatus(VFY_End(ctx));
+      mVerified = NS_SUCCEEDED(rv);
+    }
+
+    return NS_OK;
+  }
+
+  virtual void Resolve() MOZ_OVERRIDE
+  {
+    if (mSign) {
+      TypedArrayCreator<Uint8Array> ret(mSignature);
+      mResultPromise->MaybeResolve(ret);
+    } else {
+      mResultPromise->MaybeResolve(mVerified);
+    }
+  }
+};
+
 class SimpleDigestTask : public ReturnArrayBufferViewTask
 {
 public:
@@ -114,10 +580,7 @@ public:
                    const ObjectOrString& aAlgorithm,
                    const CryptoOperationData& aData)
   {
-    if (!mData.Assign(aData)) {
-      mEarlyRv = NS_ERROR_DOM_UNKNOWN_ERR;
-      return;
-    }
+    ATTEMPT_BUFFER_INIT(mData, aData);
 
     nsString algName;
     mEarlyRv = GetAlgorithmName(aCx, aAlgorithm, algName);
@@ -503,6 +966,307 @@ private:
   }
 };
 
+class GenerateSymmetricKeyTask : public WebCryptoTask
+{
+public:
+  GenerateSymmetricKeyTask(JSContext* aCx,
+      const ObjectOrString& aAlgorithm, bool aExtractable,
+      const Sequence<nsString>& aKeyUsages)
+  {
+    nsIGlobalObject* global = xpc::GetNativeForGlobal(JS::CurrentGlobalOrNull(aCx));
+    if (!global) {
+      mEarlyRv = NS_ERROR_DOM_UNKNOWN_ERR;
+      return;
+    }
+
+    // Create an empty key and set easy attributes
+    mKey = new Key(global);
+    mKey->SetExtractable(aExtractable);
+    mKey->SetType(Key::SECRET);
+
+    // Extract algorithm name
+    nsString algName;
+    mEarlyRv = GetAlgorithmName(aCx, aAlgorithm, algName);
+    if (NS_FAILED(mEarlyRv)) {
+      return;
+    }
+
+    // Construct an appropriate KeyAlorithm
+    nsRefPtr<KeyAlgorithm> algorithm;
+    uint32_t allowedUsages = 0;
+    if (algName.EqualsLiteral(WEBCRYPTO_ALG_AES_CBC) ||
+        algName.EqualsLiteral(WEBCRYPTO_ALG_AES_CTR) ||
+        algName.EqualsLiteral(WEBCRYPTO_ALG_AES_GCM)) {
+      RootedDictionary<AesKeyGenParams> params(aCx);
+      mEarlyRv = Coerce(aCx, params, aAlgorithm);
+      if (NS_FAILED(mEarlyRv) || !params.mLength.WasPassed()) {
+        mEarlyRv = NS_ERROR_DOM_SYNTAX_ERR;
+      }
+
+      mLength = params.mLength.Value();
+      if (mLength != 128 && mLength != 192 && mLength != 256) {
+        mEarlyRv = NS_ERROR_DOM_DATA_ERR;
+        return;
+      }
+      algorithm = new AesKeyAlgorithm(global, algName, mLength);
+      allowedUsages = Key::ENCRYPT | Key::DECRYPT;
+    } else if (algName.EqualsLiteral(WEBCRYPTO_ALG_HMAC)) {
+      RootedDictionary<HmacKeyGenParams> params(aCx);
+      mEarlyRv = Coerce(aCx, params, aAlgorithm);
+      if (NS_FAILED(mEarlyRv) || !params.mLength.WasPassed() ||
+          !params.mHash.WasPassed()) {
+        mEarlyRv = NS_ERROR_DOM_SYNTAX_ERR;
+        return;
+      }
+
+      nsString hashName;
+      if (params.mHash.Value().IsString()) {
+        hashName.Assign(params.mHash.Value().GetAsString());
+      } else {
+        Algorithm hashAlg;
+        mEarlyRv = Coerce(aCx, hashAlg, params.mHash.Value());
+        if (NS_FAILED(mEarlyRv) || !hashAlg.mName.WasPassed()) {
+          return;
+        }
+        hashName.Assign(hashAlg.mName.Value());
+      }
+
+      mLength = params.mLength.Value();
+      algorithm = new HmacKeyAlgorithm(global, algName, mLength, hashName);
+      allowedUsages = Key::SIGN | Key::VERIFY;
+    } else {
+      mEarlyRv = NS_ERROR_DOM_NOT_SUPPORTED_ERR;
+      return;
+    }
+
+    // Add key usages
+    mKey->ClearUsages();
+    for (uint32_t i = 0; i < aKeyUsages.Length(); ++i) {
+      mEarlyRv = mKey->AddUsageIntersecting(aKeyUsages[i], allowedUsages);
+      if (NS_FAILED(mEarlyRv)) {
+        return;
+      }
+    }
+
+    mLength = mLength >> 3; // bits to bytes
+    mMechanism = algorithm->Mechanism();
+    mKey->SetAlgorithm(algorithm);
+    // SetSymKey done in Resolve, after we've done the keygen
+
+    return;
+  }
+
+private:
+  nsRefPtr<Key> mKey;
+  size_t mLength;
+  CK_MECHANISM_TYPE mMechanism;
+  CryptoBuffer mKeyData;
+
+  virtual nsresult DoCrypto() MOZ_OVERRIDE
+  {
+    ScopedPK11SlotInfo slot(PK11_GetInternalSlot());
+    MOZ_ASSERT(slot.get());
+
+    ScopedPK11SymKey symKey(PK11_KeyGen(slot.get(), mMechanism, nullptr,
+                                        mLength, nullptr));
+    if (!symKey) {
+      return NS_ERROR_DOM_UNKNOWN_ERR;
+    }
+
+    nsresult rv = MapSECStatus(PK11_ExtractKeyValue(symKey));
+    if (NS_FAILED(rv)) {
+      return NS_ERROR_DOM_UNKNOWN_ERR;
+    }
+
+    // This doesn't leak, because the SECItem* returned by PK11_GetKeyData
+    // just refers to a buffer managed by symKey.  The assignment copies the
+    // data, so mKeyData manages one copy, while symKey manages another.
+    ATTEMPT_BUFFER_ASSIGN(mKeyData, PK11_GetKeyData(symKey));
+    return NS_OK;
+  }
+
+  virtual void Resolve() {
+    mKey->SetSymKey(mKeyData);
+    mResultPromise->MaybeResolve(mKey);
+  }
+
+  virtual void Cleanup() {
+    mKey = nullptr;
+  }
+};
+
+class GenerateAsymmetricKeyTask : public WebCryptoTask
+{
+public:
+  GenerateAsymmetricKeyTask(JSContext* aCx,
+      const ObjectOrString& aAlgorithm, bool aExtractable,
+      const Sequence<nsString>& aKeyUsages)
+  {
+    nsIGlobalObject* global = xpc::GetNativeForGlobal(JS::CurrentGlobalOrNull(aCx));
+    if (!global) {
+      mEarlyRv = NS_ERROR_DOM_UNKNOWN_ERR;
+      return;
+    }
+
+    // Create an empty key and set easy attributes
+    mKeyPair = new KeyPair(global);
+
+    // Extract algorithm name
+    nsString algName;
+    mEarlyRv = GetAlgorithmName(aCx, aAlgorithm, algName);
+    if (NS_FAILED(mEarlyRv)) {
+      return;
+    }
+
+    // Construct an appropriate KeyAlorithm
+    KeyAlgorithm* algorithm;
+    uint32_t privateAllowedUsages = 0, publicAllowedUsages = 0;
+    if (algName.EqualsLiteral(WEBCRYPTO_ALG_RSASSA_PKCS1)) {
+      RootedDictionary<RsaHashedKeyGenParams> params(aCx);
+      mEarlyRv = Coerce(aCx, params, aAlgorithm);
+      if (NS_FAILED(mEarlyRv) || !params.mModulusLength.WasPassed() ||
+          !params.mPublicExponent.WasPassed() ||
+          !params.mHash.WasPassed()) {
+        // TODO fix error and handle default values
+        mEarlyRv = NS_ERROR_DOM_SYNTAX_ERR;
+      }
+
+      // Pull relevant info
+      uint32_t modulusLength = params.mModulusLength.Value();
+      CryptoBuffer publicExponent;
+      ATTEMPT_BUFFER_INIT(publicExponent, params.mPublicExponent.Value());
+      nsString hashName;
+      mEarlyRv = GetAlgorithmName(aCx, params.mHash.Value(), hashName);
+      if (NS_FAILED(mEarlyRv)) {
+        return;
+      }
+
+      // Create algorithm
+      algorithm = new RsaHashedKeyAlgorithm(global, algName, modulusLength,
+                                            publicExponent, hashName);
+      mKeyPair->PublicKey()->SetAlgorithm(algorithm);
+      mKeyPair->PrivateKey()->SetAlgorithm(algorithm);
+      mMechanism = CKM_RSA_PKCS_KEY_PAIR_GEN;
+
+      // Set up params struct
+      mRsaParams.keySizeInBits = modulusLength;
+      bool converted = publicExponent.GetBigIntValue(mRsaParams.pe);
+      if (!converted) {
+        mEarlyRv = NS_ERROR_DOM_INVALID_ACCESS_ERR;
+        return;
+      }
+
+      privateAllowedUsages = Key::SIGN;
+      publicAllowedUsages = Key::VERIFY;
+    } else if (algName.EqualsLiteral(WEBCRYPTO_ALG_RSAES_PKCS1)) {
+      RootedDictionary<RsaKeyGenParams> params(aCx);
+      mEarlyRv = Coerce(aCx, params, aAlgorithm);
+      if (NS_FAILED(mEarlyRv) || !params.mModulusLength.WasPassed() ||
+          !params.mPublicExponent.WasPassed()) {
+        // TODO fix error and handle default values
+        mEarlyRv = NS_ERROR_DOM_SYNTAX_ERR;
+      }
+
+      // Pull relevant info
+      uint32_t modulusLength = params.mModulusLength.Value();
+      CryptoBuffer publicExponent;
+      ATTEMPT_BUFFER_INIT(publicExponent, params.mPublicExponent.Value());
+
+      // Create algorithm and note the mechanism
+      algorithm = new RsaKeyAlgorithm(global, algName, modulusLength,
+                                      publicExponent);
+      mKeyPair->PublicKey()->SetAlgorithm(algorithm);
+      mKeyPair->PrivateKey()->SetAlgorithm(algorithm);
+      mMechanism = CKM_RSA_PKCS_KEY_PAIR_GEN;
+
+      // Set up params struct
+      mRsaParams.keySizeInBits = modulusLength;
+      bool converted = publicExponent.GetBigIntValue(mRsaParams.pe);
+      if (!converted) {
+        mEarlyRv = NS_ERROR_DOM_INVALID_ACCESS_ERR;
+        return;
+      }
+
+      privateAllowedUsages = Key::DECRYPT | Key::UNWRAPKEY;
+      publicAllowedUsages = Key::ENCRYPT | Key::WRAPKEY;
+    } else {
+      mEarlyRv = NS_ERROR_DOM_NOT_SUPPORTED_ERR;
+      return;
+    }
+
+    mKeyPair->PrivateKey()->SetExtractable(aExtractable);
+    mKeyPair->PrivateKey()->SetType(Key::PRIVATE);
+
+    mKeyPair->PublicKey()->SetExtractable(true);
+    mKeyPair->PublicKey()->SetType(Key::PUBLIC);
+
+    mKeyPair->PrivateKey()->ClearUsages();
+    mKeyPair->PublicKey()->ClearUsages();
+    for (uint32_t i=0; i < aKeyUsages.Length(); ++i) {
+      mEarlyRv = mKeyPair->PrivateKey()->AddUsageIntersecting(aKeyUsages[i],
+                                                              privateAllowedUsages);
+      if (NS_FAILED(mEarlyRv)) {
+        return;
+      }
+
+      mEarlyRv = mKeyPair->PublicKey()->AddUsageIntersecting(aKeyUsages[i],
+                                                             publicAllowedUsages);
+      if (NS_FAILED(mEarlyRv)) {
+        return;
+      }
+    }
+
+    return;
+  }
+
+private:
+  nsRefPtr<KeyPair> mKeyPair;
+  CK_MECHANISM_TYPE mMechanism;
+  PK11RSAGenParams mRsaParams;
+  ScopedSECKEYPublicKey mPublicKey;
+  ScopedSECKEYPrivateKey mPrivateKey;
+
+  virtual void ReleaseNSSResources() MOZ_OVERRIDE
+  {
+    mPublicKey.dispose();
+    mPrivateKey.dispose();
+  }
+
+  virtual nsresult DoCrypto() MOZ_OVERRIDE
+  {
+    ScopedPK11SlotInfo slot(PK11_GetInternalSlot());
+    MOZ_ASSERT(slot.get());
+
+    void* param;
+    switch (mMechanism) {
+      case CKM_RSA_PKCS_KEY_PAIR_GEN: param = &mRsaParams; break;
+      default: return NS_ERROR_DOM_NOT_SUPPORTED_ERR;
+    }
+
+    SECKEYPublicKey* pubKey;
+    mPrivateKey = PK11_GenerateKeyPair(slot.get(), mMechanism, param, &pubKey,
+                                       PR_FALSE, PR_FALSE, nullptr);
+    mPublicKey = pubKey;
+    if (!mPrivateKey.get() || !mPublicKey.get()) {
+      return NS_ERROR_DOM_UNKNOWN_ERR;
+    }
+
+    mKeyPair->PrivateKey()->SetPrivateKey(mPrivateKey);
+    mKeyPair->PublicKey()->SetPublicKey(mPublicKey);
+    return NS_OK;
+  }
+
+  virtual void Resolve() MOZ_OVERRIDE
+  {
+    mResultPromise->MaybeResolve(mKeyPair);
+  }
+
+  virtual void Cleanup() MOZ_OVERRIDE
+  {
+    mKeyPair = nullptr;
+  }
+};
+
 
 // Task creation methods for WebCryptoTask
 
@@ -513,6 +1277,26 @@ WebCryptoTask::EncryptDecryptTask(JSContext* aCx,
                                   const CryptoOperationData& aData,
                                   bool aEncrypt)
 {
+  nsString algName;
+  nsresult rv = GetAlgorithmName(aCx, aAlgorithm, algName);
+  if (NS_FAILED(rv)) {
+    return new FailureTask(rv);
+  }
+
+  // Ensure key is usable for this operation
+  if ((aEncrypt  && !aKey.HasUsage(Key::ENCRYPT)) ||
+      (!aEncrypt && !aKey.HasUsage(Key::DECRYPT))) {
+    return new FailureTask(NS_ERROR_DOM_INVALID_ACCESS_ERR);
+  }
+
+  if (algName.EqualsLiteral(WEBCRYPTO_ALG_AES_CBC) ||
+      algName.EqualsLiteral(WEBCRYPTO_ALG_AES_CTR) ||
+      algName.EqualsLiteral(WEBCRYPTO_ALG_AES_GCM)) {
+    return new AesTask(aCx, aAlgorithm, aKey, aData, aEncrypt);
+  } else if (algName.EqualsLiteral(WEBCRYPTO_ALG_RSAES_PKCS1)) {
+    return new RsaesPkcs1Task(aCx, aAlgorithm, aKey, aData, aEncrypt);
+  }
+
   return new FailureTask(NS_ERROR_DOM_NOT_SUPPORTED_ERR);
 }
 
@@ -524,6 +1308,24 @@ WebCryptoTask::SignVerifyTask(JSContext* aCx,
                               const CryptoOperationData& aData,
                               bool aSign)
 {
+  nsString algName;
+  nsresult rv = GetAlgorithmName(aCx, aAlgorithm, algName);
+  if (NS_FAILED(rv)) {
+    return new FailureTask(rv);
+  }
+
+  // Ensure key is usable for this operation
+  if ((aSign  && !aKey.HasUsage(Key::SIGN)) ||
+      (!aSign && !aKey.HasUsage(Key::VERIFY))) {
+    return new FailureTask(NS_ERROR_DOM_INVALID_ACCESS_ERR);
+  }
+
+  if (algName.EqualsLiteral(WEBCRYPTO_ALG_HMAC)) {
+    return new HmacTask(aCx, aAlgorithm, aKey, aSignature, aData, aSign);
+  } else if (algName.EqualsLiteral(WEBCRYPTO_ALG_RSASSA_PKCS1)) {
+    return new RsassaPkcs1Task(aCx, aAlgorithm, aKey, aSignature, aData, aSign);
+  }
+
   return new FailureTask(NS_ERROR_DOM_NOT_SUPPORTED_ERR);
 }
 
@@ -581,7 +1383,23 @@ WebCryptoTask::GenerateKeyTask(JSContext* aCx,
                                bool aExtractable,
                                const Sequence<nsString>& aKeyUsages)
 {
-  return new FailureTask(NS_ERROR_DOM_NOT_SUPPORTED_ERR);
+  nsString algName;
+  nsresult rv = GetAlgorithmName(aCx, aAlgorithm, algName);
+  if (NS_FAILED(rv)) {
+    return new FailureTask(rv);
+  }
+
+  if (algName.EqualsASCII(WEBCRYPTO_ALG_AES_CBC) ||
+      algName.EqualsASCII(WEBCRYPTO_ALG_AES_CTR) ||
+      algName.EqualsASCII(WEBCRYPTO_ALG_AES_GCM) ||
+      algName.EqualsASCII(WEBCRYPTO_ALG_HMAC)) {
+    return new GenerateSymmetricKeyTask(aCx, aAlgorithm, aExtractable, aKeyUsages);
+  } else if (algName.EqualsASCII(WEBCRYPTO_ALG_RSAES_PKCS1) ||
+             algName.EqualsASCII(WEBCRYPTO_ALG_RSASSA_PKCS1)) {
+    return new GenerateAsymmetricKeyTask(aCx, aAlgorithm, aExtractable, aKeyUsages);
+  } else {
+    return new FailureTask(NS_ERROR_DOM_NOT_SUPPORTED_ERR);
+  }
 }
 
 WebCryptoTask*
diff --git a/dom/crypto/WebCryptoTask.h b/dom/crypto/WebCryptoTask.h
index 944b7100b781..172d0af638c1 100644
--- a/dom/crypto/WebCryptoTask.h
+++ b/dom/crypto/WebCryptoTask.h
@@ -121,6 +121,7 @@ public:
                           const CryptoOperationData& aData)
   {
     CryptoOperationData dummy;
+    dummy.SetAsArrayBuffer(aCx);
     return SignVerifyTask(aCx, aAlgorithm, aKey, dummy, aData, true);
   }
 
diff --git a/dom/crypto/moz.build b/dom/crypto/moz.build
index 2d4172ded8ce..13b53721ec95 100644
--- a/dom/crypto/moz.build
+++ b/dom/crypto/moz.build
@@ -12,6 +12,7 @@ EXPORTS.mozilla.dom += [
     'HmacKeyAlgorithm.h',
     'Key.h',
     'KeyAlgorithm.h',
+    'KeyPair.h',
     'RsaHashedKeyAlgorithm.h',
     'RsaKeyAlgorithm.h',
     'WebCryptoCommon.h',
@@ -24,6 +25,7 @@ UNIFIED_SOURCES += [
     'HmacKeyAlgorithm.cpp',
     'Key.cpp',
     'KeyAlgorithm.cpp',
+    'KeyPair.cpp',
     'RsaHashedKeyAlgorithm.cpp',
     'RsaKeyAlgorithm.cpp',
     'WebCryptoTask.cpp',
diff --git a/dom/crypto/test/test-vectors.js b/dom/crypto/test/test-vectors.js
index 4c732dab1d1f..012b95c156d7 100644
--- a/dom/crypto/test/test-vectors.js
+++ b/dom/crypto/test/test-vectors.js
@@ -50,4 +50,264 @@ tv = {
     result: util.hex2abv("248D6A61D20638B8E5C026930C3E6039A33CE45964F" +
                          "F2167F6ECEDD419DB06C1"),
   },
+
+  // Test vector 2 from:
+  // <https://github.com/geertj/bluepass/blob/master/tests/vectors/aes-cbc-pkcs7.txt>
+  aes_cbc_enc: {
+    /*
+    key: util.hex2abv("893123f2d57b6e2c39e2f10d3ff818d1"),
+    iv: util.hex2abv("64be1b06ea7453ed2df9a79319d5edc5"),
+    data: util.hex2abv("44afb9a64ac896c2"),
+    result: util.hex2abv("7067c4cb6dfc69df949c2f39903c9310"),
+    */
+    key: util.hex2abv("893123f2d57b6e2c39e2f10d3ff818d1"),
+    iv: util.hex2abv("64be1b06ea7453ed2df9a79319d5edc5"),
+    data: util.hex2abv("44afb9a64ac896c2"),
+    result: util.hex2abv("7067c4cb6dfc69df949c2f39903c9310"),
+  },
+
+  // Test vector 11 from:
+  // <https://github.com/geertj/bluepass/blob/master/tests/vectors/aes-cbc-pkcs7.txt>
+  aes_cbc_dec: {
+    key: util.hex2abv("04952c3fcf497a4d449c41e8730c5d9a"),
+    iv: util.hex2abv("53549bf7d5553b727458c1abaf0ba167"),
+    data: util.hex2abv("7fa290322ca7a1a04b61a1147ff20fe6" +
+                       "6fde58510a1d0289d11c0ddf6f4decfd"),
+    result: util.hex2abv("c9a44f6f75e98ddbca7332167f5c45e3"),
+  },
+
+  // Test vector 2 from:
+  // <http://tools.ietf.org/html/rfc3686#section-6>
+  aes_ctr_enc: {
+    key: util.hex2abv("7E24067817FAE0D743D6CE1F32539163"),
+    iv: util.hex2abv("006CB6DBC0543B59DA48D90B00000001"),
+    data: util.hex2abv("000102030405060708090A0B0C0D0E0F" +
+                       "101112131415161718191A1B1C1D1E1F"),
+    result: util.hex2abv("5104A106168A72D9790D41EE8EDAD3" +
+                         "88EB2E1EFC46DA57C8FCE630DF9141BE28"),
+  },
+
+  // Test vector 3 from:
+  // <http://tools.ietf.org/html/rfc3686#section-6>
+  aes_ctr_dec: {
+    key: util.hex2abv("7691BE035E5020A8AC6E618529F9A0DC"),
+    iv: util.hex2abv("00E0017B27777F3F4A1786F000000001"),
+    data: util.hex2abv("000102030405060708090A0B0C0D0E0F" +
+                       "101112131415161718191A1B1C1D1E1F20212223"),
+    result: util.hex2abv("C1CF48A89F2FFDD9CF4652E9EFDB72D7" +
+                         "4540A42BDE6D7836D59A5CEAAEF3105325B2072F"),
+  },
+
+  // Test case #18 from McGrew and Viega
+  // <http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/gcm/gcm-revised-spec.pdf>
+  aes_gcm_enc: {
+    key: util.hex2abv("feffe9928665731c6d6a8f9467308308" +
+                      "feffe9928665731c6d6a8f9467308308"),
+    iv: util.hex2abv("9313225df88406e555909c5aff5269aa" +
+                     "6a7a9538534f7da1e4c303d2a318a728" +
+                     "c3c0c95156809539fcf0e2429a6b5254" +
+                     "16aedbf5a0de6a57a637b39b"),
+    adata: util.hex2abv("feedfacedeadbeeffeedfacedeadbeefabaddad2"),
+    data: util.hex2abv("d9313225f88406e5a55909c5aff5269a" +
+                       "86a7a9531534f7da2e4c303d8a318a72" +
+                       "1c3c0c95956809532fcf0e2449a6b525" +
+                       "b16aedf5aa0de657ba637b39"),
+    result: util.hex2abv("5a8def2f0c9e53f1f75d7853659e2a20" +
+                         "eeb2b22aafde6419a058ab4f6f746bf4" +
+                         "0fc0c3b780f244452da3ebf1c5d82cde" +
+                         "a2418997200ef82e44ae7e3f" +
+                         "a44a8266ee1c8eb0c8b5d4cf5ae9f19a"),
+  },
+
+
+  // Test case #17 from McGrew and Viega
+  // <http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/gcm/gcm-revised-spec.pdf>
+  aes_gcm_dec: {
+    key: util.hex2abv("feffe9928665731c6d6a8f9467308308" +
+                      "feffe9928665731c6d6a8f9467308308"),
+    iv: util.hex2abv("cafebabefacedbad"),
+    adata: util.hex2abv("feedfacedeadbeeffeedfacedeadbeefabaddad2"),
+    data: util.hex2abv("c3762df1ca787d32ae47c13bf19844cb" +
+                       "af1ae14d0b976afac52ff7d79bba9de0" +
+                       "feb582d33934a4f0954cc2363bc73f78" +
+                       "62ac430e64abe499f47c9b1f" +
+                       "3a337dbf46a792c45e454913fe2ea8f2"),
+    result: util.hex2abv("d9313225f88406e5a55909c5aff5269a" +
+                       "86a7a9531534f7da2e4c303d8a318a72" +
+                       "1c3c0c95956809532fcf0e2449a6b525" +
+                       "b16aedf5aa0de657ba637b39"),
+  },
+
+  // Test case #17 from McGrew and Viega
+  // ... but with part of the authentication tag zeroed
+  // <http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/gcm/gcm-revised-spec.pdf>
+  aes_gcm_dec_fail: {
+    key: util.hex2abv("feffe9928665731c6d6a8f9467308308" +
+                      "feffe9928665731c6d6a8f9467308308"),
+    iv: util.hex2abv("cafebabefacedbad"),
+    adata: util.hex2abv("feedfacedeadbeeffeedfacedeadbeefabaddad2"),
+    data: util.hex2abv("c3762df1ca787d32ae47c13bf19844cb" +
+                       "af1ae14d0b976afac52ff7d79bba9de0" +
+                       "feb582d33934a4f0954cc2363bc73f78" +
+                       "62ac430e64abe499f47c9b1f" +
+                       "00000000000000005e454913fe2ea8f2"),
+    result: util.hex2abv("d9313225f88406e5a55909c5aff5269a" +
+                       "86a7a9531534f7da2e4c303d8a318a72" +
+                       "1c3c0c95956809532fcf0e2449a6b525" +
+                       "b16aedf5aa0de657ba637b39"),
+  },
+
+  // RFC 4231 <http://tools.ietf.org/html/rfc4231>, Test Case 7
+  hmac_sign: {
+    key: util.hex2abv("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" +
+                      "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" +
+                      "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" +
+                      "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" +
+                      "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" +
+                      "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" +
+                      "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" +
+                      "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" +
+                      "aaaaaa"),
+    data: util.hex2abv("54686973206973206120746573742075" +
+                       "73696e672061206c6172676572207468" +
+                       "616e20626c6f636b2d73697a65206b65" +
+                       "7920616e642061206c61726765722074" +
+                       "68616e20626c6f636b2d73697a652064" +
+                       "6174612e20546865206b6579206e6565" +
+                       "647320746f2062652068617368656420" +
+                       "6265666f7265206265696e6720757365" +
+                       "642062792074686520484d414320616c" +
+                       "676f726974686d2e"),
+    result: util.hex2abv("9b09ffa71b942fcb27635fbcd5b0e944" +
+                         "bfdc63644f0713938a7f51535c3a35e2"),
+  },
+
+  // RFC 4231 <http://tools.ietf.org/html/rfc4231>, Test Case 6
+  hmac_verify: {
+    key: util.hex2abv("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" +
+                      "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" +
+                      "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" +
+                      "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" +
+                      "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" +
+                      "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" +
+                      "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" +
+                      "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" +
+                      "aaaaaa"),
+    data: util.hex2abv("54657374205573696e67204c61726765" +
+                       "72205468616e20426c6f636b2d53697a" +
+                       "65204b6579202d2048617368204b6579" +
+                       "204669727374"),
+    sig: util.hex2abv("60e431591ee0b67f0d8a26aacbf5b77f" +
+                      "8e0bc6213728c5140546040f0ee37f54"),
+    sig_fail: util.hex2abv("000000001ee0b67f0d8a26aacbf5b77f" +
+                           "8e0bc6213728c5140546040f0ee37f54"),
+  },
+
+  // RSA test vectors, Example 1.3
+  // <ftp://ftp.rsa.com/pub/rsalabs/tmp/pkcs1v15crypt-vectors.txt>
+  rsaes: {
+    pkcs8: util.hex2abv(
+      "30820276020100300d06092a864886f70d0101010500048202603082025c0201" +
+      "0002818100a8b3b284af8eb50b387034a860f146c4919f318763cd6c5598c8ae" +
+      "4811a1e0abc4c7e0b082d693a5e7fced675cf4668512772c0cbc64a742c6c630" +
+      "f533c8cc72f62ae833c40bf25842e984bb78bdbf97c0107d55bdb662f5c4e0fa" +
+      "b9845cb5148ef7392dd3aaff93ae1e6b667bb3d4247616d4f5ba10d4cfd226de" +
+      "88d39f16fb020301000102818053339cfdb79fc8466a655c7316aca85c55fd8f" +
+      "6dd898fdaf119517ef4f52e8fd8e258df93fee180fa0e4ab29693cd83b152a55" +
+      "3d4ac4d1812b8b9fa5af0e7f55fe7304df41570926f3311f15c4d65a732c4831" +
+      "16ee3d3d2d0af3549ad9bf7cbfb78ad884f84d5beb04724dc7369b31def37d0c" +
+      "f539e9cfcdd3de653729ead5d1024100cc8853d1d54da630fac004f471f281c7" +
+      "b8982d8224a490edbeb33d3e3d5cc93c4765703d1dd791642f1f116a0dd852be" +
+      "2419b2af72bfe9a030e860b0288b5d77024100d32737e7267ffe1341b2d5c0d1" +
+      "50a81b586fb3132bed2f8d5262864a9cb9f30af38be448598d413a172efb802c" +
+      "21acf1c11c520c2f26a471dcad212eac7ca39d02410095297b0f95a2fa67d007" +
+      "07d609dfd4fc05c89dafc2ef6d6ea55bec771ea333734d9251e79082ecda866e" +
+      "fef13c459e1a631386b7e354c899f5f112ca85d7158302400e12bf1718e9cef5" +
+      "599ba1c3882fe8046a90874eefce8f2ccc20e4f2741fb0a33a3848aec9c9305f" +
+      "becbd2d76819967d4671acc6431e4037968db37878e695c102407fbf3360826f" +
+      "c125dceac9bf8d38b6cad8ccc8b4f867bfea02dcbf5df008258ee9902ea07e28" +
+      "7770df660328c81e906184b6aa2239868775204d098fc846c669"
+    ),
+    spki: util.hex2abv(
+      "30819f300d06092a864886f70d010101050003818d0030818902818100a8b3b2" +
+      "84af8eb50b387034a860f146c4919f318763cd6c5598c8ae4811a1e0abc4c7e0" +
+      "b082d693a5e7fced675cf4668512772c0cbc64a742c6c630f533c8cc72f62ae8" +
+      "33c40bf25842e984bb78bdbf97c0107d55bdb662f5c4e0fab9845cb5148ef739" +
+      "2dd3aaff93ae1e6b667bb3d4247616d4f5ba10d4cfd226de88d39f16fb020301" +
+      "0001"
+    ),
+    data: util.hex2abv(
+      "d94ae0832e6445ce42331cb06d531a82b1db4baad30f746dc916df24d4e3c245" +
+      "1fff59a6423eb0e1d02d4fe646cf699dfd818c6e97b051"
+    ),
+    result: util.hex2abv(
+      "709c7d2d4598c96065b6588da2f89fa87f062d7241ef6595898f637ada57eae9" +
+      "0173f0fb4bf6a91ebd96506907c853dacf208494be94d313a04185d474a90741" +
+      "2effc3e024d07e4d09aa245fbcb130219bfa5de02d4f7e2ec9e62e8ad32dee5f" +
+      "f4d8e4cfecbc5033a1c2c61c5233ae16192a481d0075bfc7ce028212cd27bebe"
+    ),
+  },
+
+  // RSA test vectors, Example 1.3 (sig256 generated with PyCrypto)
+  // <ftp://ftp.rsa.com/pub/rsalabs/tmp/pkcs1v15sign-vectors.txt>
+  rsassa: {
+    pkcs8: util.hex2abv(
+      "30820275020100300d06092a864886f70d01010105000482025f3082025b0201" +
+      "0002818100a56e4a0e701017589a5187dc7ea841d156f2ec0e36ad52a44dfeb1" +
+      "e61f7ad991d8c51056ffedb162b4c0f283a12a88a394dff526ab7291cbb307ce" +
+      "abfce0b1dfd5cd9508096d5b2b8b6df5d671ef6377c0921cb23c270a70e2598e" +
+      "6ff89d19f105acc2d3f0cb35f29280e1386b6f64c4ef22e1e1f20d0ce8cffb22" +
+      "49bd9a2137020301000102818033a5042a90b27d4f5451ca9bbbd0b44771a101" +
+      "af884340aef9885f2a4bbe92e894a724ac3c568c8f97853ad07c0266c8c6a3ca" +
+      "0929f1e8f11231884429fc4d9ae55fee896a10ce707c3ed7e734e44727a39574" +
+      "501a532683109c2abacaba283c31b4bd2f53c3ee37e352cee34f9e503bd80c06" +
+      "22ad79c6dcee883547c6a3b325024100e7e8942720a877517273a356053ea2a1" +
+      "bc0c94aa72d55c6e86296b2dfc967948c0a72cbccca7eacb35706e09a1df55a1" +
+      "535bd9b3cc34160b3b6dcd3eda8e6443024100b69dca1cf7d4d7ec81e75b90fc" +
+      "ca874abcde123fd2700180aa90479b6e48de8d67ed24f9f19d85ba275874f542" +
+      "cd20dc723e6963364a1f9425452b269a6799fd024028fa13938655be1f8a159c" +
+      "baca5a72ea190c30089e19cd274a556f36c4f6e19f554b34c077790427bbdd8d" +
+      "d3ede2448328f385d81b30e8e43b2fffa02786197902401a8b38f398fa712049" +
+      "898d7fb79ee0a77668791299cdfa09efc0e507acb21ed74301ef5bfd48be455e" +
+      "aeb6e1678255827580a8e4e8e14151d1510a82a3f2e729024027156aba4126d2" +
+      "4a81f3a528cbfb27f56886f840a9f6e86e17a44b94fe9319584b8e22fdde1e5a" +
+      "2e3bd8aa5ba8d8584194eb2190acf832b847f13a3d24a79f4d"
+    ),
+    spki: util.hex2abv(
+      "30819f300d06092a864886f70d010101050003818d0030818902818100a56e4a" +
+      "0e701017589a5187dc7ea841d156f2ec0e36ad52a44dfeb1e61f7ad991d8c510" +
+      "56ffedb162b4c0f283a12a88a394dff526ab7291cbb307ceabfce0b1dfd5cd95" +
+      "08096d5b2b8b6df5d671ef6377c0921cb23c270a70e2598e6ff89d19f105acc2" +
+      "d3f0cb35f29280e1386b6f64c4ef22e1e1f20d0ce8cffb2249bd9a2137020301" +
+      "0001"
+    ),
+    data: util.hex2abv(
+      "a4b159941761c40c6a82f2b80d1b94f5aa2654fd17e12d588864679b54cd04ef" +
+      "8bd03012be8dc37f4b83af7963faff0dfa225477437c48017ff2be8191cf3955" +
+      "fc07356eab3f322f7f620e21d254e5db4324279fe067e0910e2e81ca2cab31c7" +
+      "45e67a54058eb50d993cdb9ed0b4d029c06d21a94ca661c3ce27fae1d6cb20f4" +
+      "564d66ce4767583d0e5f060215b59017be85ea848939127bd8c9c4d47b51056c" +
+      "031cf336f17c9980f3b8f5b9b6878e8b797aa43b882684333e17893fe9caa6aa" +
+      "299f7ed1a18ee2c54864b7b2b99b72618fb02574d139ef50f019c9eef4169713" +
+      "38e7d470"
+    ),
+    sig1: util.hex2abv(
+      "0b1f2e5180e5c7b4b5e672929f664c4896e50c35134b6de4d5a934252a3a245f" +
+      "f48340920e1034b7d5a5b524eb0e1cf12befef49b27b732d2c19e1c43217d6e1" +
+      "417381111a1d36de6375cf455b3c9812639dbc27600c751994fb61799ecf7da6" +
+      "bcf51540afd0174db4033188556675b1d763360af46feeca5b60f882829ee7b2"
+    ),
+    sig256: util.hex2abv(
+      "558af496a9900ec497a51723a0bf1be167a3fdd0e40c95764575bcc93d35d415" +
+      "94aef08cd8d339272387339fe5faa5635a1c4ad6c9b622f8c38edce6b26d9b76" +
+      "e3fec5b567e5b996624c4aeef74191c4349e5ac9e29b848c54bcfa538fec58d5" +
+      "9368253f0ff9a7ba0637918dd16b2c95f8c73ad7484482ba4387655f2f7d4b00"
+    ),
+    sig_fail: util.hex2abv(
+      "8000000080e5c7b4b5e672929f664c4896e50c35134b6de4d5a934252a3a245f" +
+      "f48340920e1034b7d5a5b524eb0e1cf12befef49b27b732d2c19e1c43217d6e1" +
+      "417381111a1d36de6375cf455b3c9812639dbc27600c751994fb61799ecf7da6" +
+      "bcf51540afd0174db4033188556675b1d763360af46feeca5b60f882829ee7b2"
+    ),
+  },
 }
diff --git a/dom/crypto/test/tests.js b/dom/crypto/test/tests.js
index ec724d87b290..34fdf2157974 100644
--- a/dom/crypto/test/tests.js
+++ b/dom/crypto/test/tests.js
@@ -309,6 +309,53 @@ TestArray.addTest(
   }
 );
 
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "Generate a 192-bit AES key",
+  function() {
+    var that = this;
+    var alg = { name: "AES-GCM", length: 192 };
+    crypto.subtle.generateKey(alg, true, ["encrypt"]).then(
+      complete(that, function(x) {
+        return hasKeyFields(x);
+      }),
+      error(that)
+    );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "Generate a 1024-bit RSA key",
+  function() {
+    var that = this;
+    var alg = {
+      name: "RSAES-PKCS1-v1_5",
+      modulusLength: 1024,
+      publicExponent: new Uint8Array([0x01, 0x00, 0x01])
+    };
+    crypto.subtle.generateKey(alg, false, ["encrypt", "decrypt"]).then(
+      complete(that, function(x) {
+        return exists(x.publicKey) &&
+               (x.publicKey.algorithm.name == alg.name) &&
+               (x.publicKey.algorithm.modulusLength == alg.modulusLength) &&
+               (x.publicKey.type == "public") &&
+               x.publicKey.extractable &&
+               (x.publicKey.usages.length == 1) &&
+               (x.publicKey.usages[0] == "encrypt") &&
+               exists(x.privateKey) &&
+               (x.privateKey.algorithm.name == alg.name) &&
+               (x.privateKey.algorithm.modulusLength == alg.modulusLength) &&
+               (x.privateKey.type == "private") &&
+               !x.privateKey.extractable &&
+               (x.privateKey.usages.length == 1) &&
+               (x.privateKey.usages[0] == "decrypt");
+      }),
+      error(that)
+    );
+  }
+);
+
 // -----------------------------------------------------------------------------
 TestArray.addTest(
   "SHA-256 digest",
@@ -332,3 +379,439 @@ TestArray.addTest(
     );
   }
 );
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "AES-CBC encrypt",
+  function () {
+    var that = this;
+
+    function doEncrypt(x) {
+      console.log(x);
+      return crypto.subtle.encrypt(
+        { name: "AES-CBC", iv: tv.aes_cbc_enc.iv },
+        x, tv.aes_cbc_enc.data);
+    }
+
+    crypto.subtle.importKey("raw", tv.aes_cbc_enc.key, "AES-CBC", false, ['encrypt'])
+      .then(doEncrypt)
+      .then(
+        memcmp_complete(that, tv.aes_cbc_enc.result),
+        error(that)
+      );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "AES-CBC decrypt",
+  function () {
+    var that = this;
+
+    function doDecrypt(x) {
+      return crypto.subtle.decrypt(
+        { name: "AES-CBC", iv: tv.aes_cbc_dec.iv },
+        x, tv.aes_cbc_dec.data);
+    }
+
+    crypto.subtle.importKey("raw", tv.aes_cbc_dec.key, "AES-CBC", false, ['decrypt'])
+      .then(doDecrypt)
+      .then(
+        memcmp_complete(that, tv.aes_cbc_dec.result),
+        error(that)
+      );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "AES-CTR encryption",
+  function () {
+    var that = this;
+
+    function doEncrypt(x) {
+      return crypto.subtle.encrypt(
+        { name: "AES-CTR", counter: tv.aes_ctr_enc.iv, length: 32 },
+        x, tv.aes_ctr_enc.data);
+    }
+
+    crypto.subtle.importKey("raw", tv.aes_ctr_enc.key, "AES-CTR", false, ['encrypt'])
+      .then(doEncrypt)
+      .then(
+        memcmp_complete(that, tv.aes_ctr_enc.result),
+        error(that)
+      );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "AES-CTR decryption",
+  function () {
+    var that = this;
+
+    function doDecrypt(x) {
+      return crypto.subtle.decrypt(
+        { name: "AES-CTR", counter: tv.aes_ctr_dec.iv, length: 32 },
+        x, tv.aes_ctr_dec.data);
+    }
+
+    crypto.subtle.importKey("raw", tv.aes_ctr_dec.key, "AES-CTR", false, ['decrypt'])
+      .then(doDecrypt)
+      .then(
+        memcmp_complete(that, tv.aes_ctr_dec.result),
+        error(that)
+      );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "AES-GCM encryption",
+  function () {
+    var that = this;
+
+    function doEncrypt(x) {
+      return crypto.subtle.encrypt(
+        {
+          name: "AES-GCM",
+          iv: tv.aes_gcm_enc.iv,
+          additionalData: tv.aes_gcm_enc.adata,
+          tagLength: 128
+        },
+        x, tv.aes_gcm_enc.data);
+    }
+
+    crypto.subtle.importKey("raw", tv.aes_gcm_enc.key, "AES-GCM", false, ['encrypt'])
+      .then(doEncrypt)
+      .then(
+        memcmp_complete(that, tv.aes_gcm_enc.result),
+        error(that)
+      );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "AES-GCM decryption",
+  function () {
+    var that = this;
+
+    function doDecrypt(x) {
+      return crypto.subtle.decrypt(
+        {
+          name: "AES-GCM",
+          iv: tv.aes_gcm_dec.iv,
+          additionalData: tv.aes_gcm_dec.adata,
+          tagLength: 128
+        },
+        x, tv.aes_gcm_dec.data);
+    }
+
+    crypto.subtle.importKey("raw", tv.aes_gcm_dec.key, "AES-GCM", false, ['decrypt'])
+      .then(doDecrypt)
+      .then(
+        memcmp_complete(that, tv.aes_gcm_dec.result),
+        error(that)
+      );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "AES-GCM decryption, failing authentication check",
+  function () {
+    var that = this;
+
+    function doDecrypt(x) {
+      return crypto.subtle.decrypt(
+        {
+          name: "AES-GCM",
+          iv: tv.aes_gcm_dec_fail.iv,
+          additionalData: tv.aes_gcm_dec_fail.adata,
+          tagLength: 128
+        },
+        x, tv.aes_gcm_dec_fail.data);
+    }
+
+    crypto.subtle.importKey("raw", tv.aes_gcm_dec_fail.key, "AES-GCM", false, ['decrypt'])
+      .then(doDecrypt)
+      .then(
+        error(that),
+        complete(that)
+      );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "HMAC SHA-256 sign",
+  function() {
+    var that = this;
+    var alg = {
+      name: "HMAC",
+      hash: "SHA-256"
+    }
+
+    function doSign(x) {
+      return crypto.subtle.sign("HMAC", x, tv.hmac_sign.data);
+    }
+
+    crypto.subtle.importKey("raw", tv.hmac_sign.key, alg, false, ['sign'])
+      .then(doSign)
+      .then(
+        memcmp_complete(that, tv.hmac_sign.result),
+        error(that)
+      );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "HMAC SHA-256 verify",
+  function() {
+    var that = this;
+    var alg = {
+      name: "HMAC",
+      hash: "SHA-256"
+    }
+
+    function doVerify(x) {
+      return crypto.subtle.verify("HMAC", x, tv.hmac_verify.sig, tv.hmac_verify.data);
+    }
+
+    crypto.subtle.importKey("raw", tv.hmac_verify.key, alg, false, ['verify'])
+      .then(doVerify)
+      .then(
+        complete(that, function(x) { return !!x; }),
+        error(that)
+      );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "HMAC SHA-256, failing verification due to bad signature",
+  function() {
+    var that = this;
+    var alg = {
+      name: "HMAC",
+      hash: "SHA-256"
+    }
+
+    function doVerify(x) {
+      return crypto.subtle.verify("HMAC", x, tv.hmac_verify.sig_fail,
+                                             tv.hmac_verify.data);
+    }
+
+    crypto.subtle.importKey("raw", tv.hmac_verify.key, alg, false, ['verify'])
+      .then(doVerify)
+      .then(
+        complete(that, function(x) { return !x; }),
+        error(that)
+      );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "HMAC SHA-256, failing verification due to key usage restriction",
+  function() {
+    var that = this;
+    var alg = {
+      name: "HMAC",
+      hash: "SHA-256"
+    }
+
+    function doVerify(x) {
+      return crypto.subtle.verify("HMAC", x, tv.hmac_verify.sig,
+                                             tv.hmac_verify.data);
+    }
+
+    crypto.subtle.importKey("raw", tv.hmac_verify.key, alg, false, ['encrypt'])
+      .then(doVerify)
+      .then(
+        error(that),
+        complete(that, function(x) { return true; })
+      );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "RSAES-PKCS#1 encrypt/decrypt round-trip",
+  function () {
+    var that = this;
+    var privKey, pubKey;
+    var alg = {name:"RSAES-PKCS1-v1_5"};
+
+    var privKey, pubKey, data, ct, pt;
+    function setPriv(x) { privKey = x; }
+    function setPub(x) { pubKey = x; }
+    function doEncrypt() {
+      return crypto.subtle.encrypt(alg.name, pubKey, tv.rsaes.data);
+    }
+    function doDecrypt(x) {
+      return crypto.subtle.decrypt(alg.name, privKey, x);
+    }
+
+    function fail() { error(that); }
+
+    Promise.all([
+      crypto.subtle.importKey("pkcs8", tv.rsaes.pkcs8, alg, false, ['decrypt'])
+          .then(setPriv, error(that)),
+      crypto.subtle.importKey("spki", tv.rsaes.spki, alg, false, ['encrypt'])
+          .then(setPub, error(that))
+    ]).then(doEncrypt, error(that))
+      .then(doDecrypt, error(that))
+      .then(
+        memcmp_complete(that, tv.rsaes.data),
+        error(that)
+      );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "RSAES-PKCS#1 decryption known answer",
+  function () {
+    var that = this;
+    var alg = {name:"RSAES-PKCS1-v1_5"};
+
+    function doDecrypt(x) {
+      return crypto.subtle.decrypt(alg.name, x, tv.rsaes.result);
+    }
+    function fail() { error(that); }
+
+    crypto.subtle.importKey("pkcs8", tv.rsaes.pkcs8, alg, false, ['decrypt'])
+      .then( doDecrypt, fail )
+      .then( memcmp_complete(that, tv.rsaes.data), fail );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "RSASSA/SHA-1 signature",
+  function () {
+    var that = this;
+    var alg = { name: "RSASSA-PKCS1-v1_5", hash: "SHA-1" };
+
+    function doSign(x) {
+      console.log("sign");
+      console.log(x);
+      return crypto.subtle.sign(alg.name, x, tv.rsassa.data);
+    }
+    function fail() { console.log("fail"); error(that); }
+
+    crypto.subtle.importKey("pkcs8", tv.rsassa.pkcs8, alg, false, ['sign'])
+      .then( doSign, fail )
+      .then( memcmp_complete(that, tv.rsassa.sig1), fail );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "RSASSA verification (SHA-1)",
+  function () {
+    var that = this;
+    var alg = { name: "RSASSA-PKCS1-v1_5", hash: "SHA-1" };
+
+    function doVerify(x) {
+      return crypto.subtle.verify(alg.name, x, tv.rsassa.sig1, tv.rsassa.data);
+    }
+    function fail(x) { error(that); }
+
+    crypto.subtle.importKey("spki", tv.rsassa.spki, alg, false, ['verify'])
+      .then( doVerify, fail )
+      .then(
+        complete(that, function(x) { return x; }),
+        fail
+      );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "RSASSA verification (SHA-1), failing verification",
+  function () {
+    var that = this;
+    var alg = { name: "RSASSA-PKCS1-v1_5", hash: "SHA-1" };
+
+    function doVerify(x) {
+      return crypto.subtle.verify(alg.name, x, tv.rsassa.sig_fail, tv.rsassa.data);
+    }
+    function fail(x) { error(that); }
+
+    crypto.subtle.importKey("spki", tv.rsassa.spki, alg, false, ['verify'])
+      .then( doVerify, fail )
+      .then(
+        complete(that, function(x) { return !x; }),
+        fail
+      );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "RSASSA/SHA-256 signature",
+  function () {
+    var that = this;
+    var alg = { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" };
+
+    function doSign(x) {
+      return crypto.subtle.sign(alg.name, x, tv.rsassa.data);
+    }
+    function fail(x) { console.log(x); error(that); }
+
+    crypto.subtle.importKey("pkcs8", tv.rsassa.pkcs8, alg, false, ['sign'])
+      .then( doSign, fail )
+      .then( memcmp_complete(that, tv.rsassa.sig256), fail );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "RSASSA verification (SHA-256)",
+  function () {
+    var that = this;
+    var alg = { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" };
+
+    function doVerify(x) {
+      return crypto.subtle.verify(alg.name, x, tv.rsassa.sig256, tv.rsassa.data);
+    }
+    function fail(x) { error(that); }
+
+    crypto.subtle.importKey("spki", tv.rsassa.spki, alg, false, ['verify'])
+      .then( doVerify, fail )
+      .then(
+        complete(that, function(x) { return x; }),
+        fail
+      );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
+  "RSASSA verification (SHA-256), failing verification",
+  function () {
+    var that = this;
+    var alg = { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" };
+    var use = ['sign', 'verify'];
+
+    function doVerify(x) {
+      console.log("verifying")
+      return crypto.subtle.verify(alg.name, x, tv.rsassa.sig_fail, tv.rsassa.data);
+    }
+    function fail(x) { console.log("failing"); error(that)(x); }
+
+    console.log("running")
+    crypto.subtle.importKey("spki", tv.rsassa.spki, alg, false, ['verify'])
+      .then( doVerify, fail )
+      .then(
+        complete(that, function(x) { return !x; }),
+        fail
+      );
+  }
+);
+
+
diff --git a/dom/devicestorage/nsDeviceStorage.cpp b/dom/devicestorage/nsDeviceStorage.cpp
index 142a24fe3d9a..187272d9f3fe 100644
--- a/dom/devicestorage/nsDeviceStorage.cpp
+++ b/dom/devicestorage/nsDeviceStorage.cpp
@@ -315,7 +315,7 @@ DeviceStorageTypeChecker::Check(const nsAString& aType, nsIFile* aFile)
   }
 
   nsAutoString extensionMatch;
-  extensionMatch.AssignLiteral("*");
+  extensionMatch.Assign('*');
   extensionMatch.Append(Substring(path, dotIdx));
   extensionMatch.Append(';');
 
@@ -358,7 +358,7 @@ DeviceStorageTypeChecker::GetTypeFromFileName(const nsAString& aFileName,
   }
 
   nsAutoString extensionMatch;
-  extensionMatch.AssignLiteral("*");
+  extensionMatch.Assign('*');
   extensionMatch.Append(Substring(aFileName, dotIdx));
   extensionMatch.Append(';');
 
diff --git a/dom/events/PointerEvent.cpp b/dom/events/PointerEvent.cpp
index 9478be4c4b56..fad5fe9ff006 100644
--- a/dom/events/PointerEvent.cpp
+++ b/dom/events/PointerEvent.cpp
@@ -104,7 +104,7 @@ PointerEvent::GetPointerType(nsAString& aPointerType)
       aPointerType.AssignLiteral("touch");
       break;
     case nsIDOMMouseEvent::MOZ_SOURCE_UNKNOWN:
-      aPointerType.AssignLiteral("");
+      aPointerType.Truncate();
       break;
   }
 }
diff --git a/dom/events/UIEvent.cpp b/dom/events/UIEvent.cpp
index 163353e4f17b..944463d5c127 100644
--- a/dom/events/UIEvent.cpp
+++ b/dom/events/UIEvent.cpp
@@ -15,6 +15,7 @@
 #include "nsContentUtils.h"
 #include "nsIContent.h"
 #include "nsIInterfaceRequestorUtils.h"
+#include "nsIDocShell.h"
 #include "nsIDOMWindow.h"
 #include "nsIDOMNode.h"
 #include "nsIFrame.h"
@@ -68,12 +69,10 @@ UIEvent::UIEvent(EventTarget* aOwner,
   mView = nullptr;
   if (mPresContext)
   {
-    nsISupports* container = mPresContext->GetContainerWeak();
-    if (container)
+    nsIDocShell* docShell = mPresContext->GetDocShell();
+    if (docShell)
     {
-       nsCOMPtr<nsIDOMWindow> window = do_GetInterface(container);
-       if (window)
-          mView = do_QueryInterface(window);
+       mView = docShell->GetWindow();
     }
   }
 }
diff --git a/dom/imptests/failures/html/html/browsers/the-window-object/mochitest.ini b/dom/imptests/failures/html/html/browsers/the-window-object/mochitest.ini
index 4a218f1cbd20..98fa8dc55a8c 100644
--- a/dom/imptests/failures/html/html/browsers/the-window-object/mochitest.ini
+++ b/dom/imptests/failures/html/html/browsers/the-window-object/mochitest.ini
@@ -7,4 +7,3 @@ support-files =
 [test_window-named-properties.html.json]
 skip-if = true # bug 859075
 [test_window-properties.html.json]
-[test_window-prototype-chain.html.json]
diff --git a/dom/imptests/failures/html/html/browsers/the-window-object/test_window-properties.html.json b/dom/imptests/failures/html/html/browsers/the-window-object/test_window-properties.html.json
index 5b7543c6ead9..3a3aa7ffe992 100644
--- a/dom/imptests/failures/html/html/browsers/the-window-object/test_window-properties.html.json
+++ b/dom/imptests/failures/html/html/browsers/the-window-object/test_window-properties.html.json
@@ -2,29 +2,6 @@
   "EventTarget method: addEventListener": true,
   "EventTarget method: removeEventListener": true,
   "EventTarget method: dispatchEvent": true,
-  "Window method: close": true,
-  "Window method: stop": true,
-  "Window method: focus": true,
-  "Window method: blur": true,
-  "Window method: open": true,
-  "Window method: alert": true,
-  "Window method: confirm": true,
-  "Window method: prompt": true,
-  "Window method: print": true,
-  "Window method: showModalDialog": true,
-  "Window method: postMessage": true,
-  "Window method: btoa": true,
-  "Window method: atob": true,
-  "Window method: setTimeout": true,
-  "Window method: clearTimeout": true,
-  "Window method: setInterval": true,
-  "Window method: clearInterval": true,
-  "Window method: getSelection": true,
-  "Window method: getComputedStyle": true,
-  "Window method: matchMedia": true,
-  "Window method: scroll": true,
-  "Window method: scrollTo": true,
-  "Window method: scrollBy": true,
   "Window readonly attribute: history": true,
   "Window readonly attribute: parent": true,
   "Window readonly attribute: frameElement": true,
@@ -44,93 +21,12 @@
   "Window readonly attribute: screenY": true,
   "Window readonly attribute: outerWidth": true,
   "Window readonly attribute: outerHeight": true,
-  "Window attribute: name": true,
-  "Window attribute: status": true,
-  "Window attribute: opener": true,
-  "Window attribute: onabort": true,
-  "Window attribute: onafterprint": true,
-  "Window attribute: onbeforeprint": true,
-  "Window attribute: onbeforeunload": true,
-  "Window attribute: onblur": true,
-  "Window attribute: oncancel": true,
-  "Window attribute: oncanplay": true,
-  "Window attribute: oncanplaythrough": true,
-  "Window attribute: onchange": true,
-  "Window attribute: onclick": true,
-  "Window attribute: onclose": true,
-  "Window attribute: oncontextmenu": true,
-  "Window attribute: oncuechange": true,
-  "Window attribute: ondblclick": true,
-  "Window attribute: ondrag": true,
-  "Window attribute: ondragend": true,
-  "Window attribute: ondragenter": true,
-  "Window attribute: ondragleave": true,
-  "Window attribute: ondragover": true,
-  "Window attribute: ondragstart": true,
-  "Window attribute: ondrop": true,
-  "Window attribute: ondurationchange": true,
-  "Window attribute: onemptied": true,
-  "Window attribute: onended": true,
-  "Window attribute: onerror": true,
-  "Window attribute: onfocus": true,
-  "Window attribute: onhashchange": true,
-  "Window attribute: oninput": true,
-  "Window attribute: oninvalid": true,
-  "Window attribute: onkeydown": true,
-  "Window attribute: onkeypress": true,
-  "Window attribute: onkeyup": true,
   "Window attribute: oncancel": true,
   "Window attribute: onclose": true,
   "Window attribute: oncuechange": true,
   "Window attribute: onmousewheel": true,
-  "Window attribute: onload": true,
-  "Window attribute: onloadeddata": true,
-  "Window attribute: onloadedmetadata": true,
-  "Window attribute: onloadstart": true,
-  "Window attribute: onmessage": true,
-  "Window attribute: onmousedown": true,
-  "Window attribute: onmousemove": true,
-  "Window attribute: onmouseout": true,
-  "Window attribute: onmouseover": true,
-  "Window attribute: onmouseup": true,
-  "Window attribute: onmousewheel": true,
-  "Window attribute: onoffline": true,
-  "Window attribute: ononline": true,
-  "Window attribute: onpause": true,
-  "Window attribute: onplay": true,
-  "Window attribute: onplaying": true,
-  "Window attribute: onpagehide": true,
-  "Window attribute: onpageshow": true,
-  "Window attribute: onpopstate": true,
-  "Window attribute: onprogress": true,
-  "Window attribute: onratechange": true,
-  "Window attribute: onreset": true,
-  "Window attribute: onresize": true,
-  "Window attribute: onscroll": true,
-  "Window attribute: onseeked": true,
-  "Window attribute: onseeking": true,
-  "Window attribute: onselect": true,
-  "Window attribute: onshow": true,
-  "Window attribute: onstalled": true,
   "Window attribute: onstorage": true,
-  "Window attribute: onsubmit": true,
-  "Window attribute: onsuspend": true,
-  "Window attribute: ontimeupdate": true,
-  "Window attribute: onunload": true,
-  "Window attribute: onvolumechange": true,
-  "Window attribute: onwaiting": true,
   "Window unforgeable attribute: window": true,
   "Window unforgeable attribute: document": true,
-  "Window unforgeable attribute: location": true,
-  "Window unforgeable attribute: top": true,
-  "Window replaceable attribute: self": true,
-  "Window replaceable attribute: locationbar": true,
-  "Window replaceable attribute: menubar": true,
-  "Window replaceable attribute: personalbar": true,
-  "Window replaceable attribute: scrollbars": true,
-  "Window replaceable attribute: statusbar": true,
-  "Window replaceable attribute: toolbar": true,
-  "Window replaceable attribute: frames": true,
-  "Window replaceable attribute: length": true,
-  "constructor": true
+  "Window unforgeable attribute: top": true
 }
diff --git a/dom/imptests/failures/html/html/browsers/the-window-object/test_window-prototype-chain.html.json b/dom/imptests/failures/html/html/browsers/the-window-object/test_window-prototype-chain.html.json
deleted file mode 100644
index 3c327bae8890..000000000000
--- a/dom/imptests/failures/html/html/browsers/the-window-object/test_window-prototype-chain.html.json
+++ /dev/null
@@ -1,5 +0,0 @@
-{
-  "Window.prototype": true,
-  "EventTarget.prototype": true,
-  "Object.prototype": true
-}
diff --git a/dom/interfaces/base/nsIDOMChromeWindow.idl b/dom/interfaces/base/nsIDOMChromeWindow.idl
index 4c4561743e38..9118a0f801f0 100644
--- a/dom/interfaces/base/nsIDOMChromeWindow.idl
+++ b/dom/interfaces/base/nsIDOMChromeWindow.idl
@@ -10,7 +10,7 @@ interface nsIDOMElement;
 interface nsIDOMEvent;
 interface nsIMessageBroadcaster;
 
-[scriptable, uuid(0c10226f-8abb-4345-aa6b-2780a6f4687e)]
+[scriptable, uuid(78bdcb41-1efa-409f-aaba-70842213f80f)]
 interface nsIDOMChromeWindow : nsISupports
 {
   const unsigned short STATE_MAXIMIZED = 1;
@@ -45,6 +45,12 @@ interface nsIDOMChromeWindow : nsISupports
 
   readonly attribute nsIMessageBroadcaster messageManager;
 
+  /**
+   * Returns the message manager identified by the given group name that
+   * manages all frame loaders belonging to that group.
+   */
+  nsIMessageBroadcaster getGroupMessageManager(in AString group);
+
   /**
    * On some operating systems, we must allow the window manager to
    * handle window dragging. This function tells the window manager to
diff --git a/dom/ipc/TabParent.cpp b/dom/ipc/TabParent.cpp
index c9fa69d48d87..6d7474b9c93c 100644
--- a/dom/ipc/TabParent.cpp
+++ b/dom/ipc/TabParent.cpp
@@ -722,8 +722,9 @@ bool TabParent::SendRealMouseEvent(WidgetMouseEvent& event)
   if (mIsDestroyed) {
     return false;
   }
-  MaybeForwardEventToRenderFrame(event, nullptr);
-  if (!MapEventCoordinatesForChildProcess(&event)) {
+  nsEventStatus status = MaybeForwardEventToRenderFrame(event, nullptr);
+  if (status == nsEventStatus_eConsumeNoDefault ||
+      !MapEventCoordinatesForChildProcess(&event)) {
     return false;
   }
   return PBrowserParent::SendRealMouseEvent(event);
@@ -789,8 +790,9 @@ bool TabParent::SendMouseWheelEvent(WidgetWheelEvent& event)
   if (mIsDestroyed) {
     return false;
   }
-  MaybeForwardEventToRenderFrame(event, nullptr);
-  if (!MapEventCoordinatesForChildProcess(&event)) {
+  nsEventStatus status = MaybeForwardEventToRenderFrame(event, nullptr);
+  if (status == nsEventStatus_eConsumeNoDefault ||
+      !MapEventCoordinatesForChildProcess(&event)) {
     return false;
   }
   return PBrowserParent::SendMouseWheelEvent(event);
@@ -910,9 +912,9 @@ bool TabParent::SendRealTouchEvent(WidgetTouchEvent& event)
   }
 
   ScrollableLayerGuid guid;
-  MaybeForwardEventToRenderFrame(event, &guid);
+  nsEventStatus status = MaybeForwardEventToRenderFrame(event, &guid);
 
-  if (mIsDestroyed) {
+  if (status == nsEventStatus_eConsumeNoDefault || mIsDestroyed) {
     return false;
   }
 
@@ -1889,13 +1891,14 @@ TabParent::UseAsyncPanZoom()
           GetScrollingBehavior() == ASYNC_PAN_ZOOM);
 }
 
-void
+nsEventStatus
 TabParent::MaybeForwardEventToRenderFrame(WidgetInputEvent& aEvent,
                                           ScrollableLayerGuid* aOutTargetGuid)
 {
   if (RenderFrameParent* rfp = GetRenderFrame()) {
-    rfp->NotifyInputEvent(aEvent, aOutTargetGuid);
+    return rfp->NotifyInputEvent(aEvent, aOutTargetGuid);
   }
+  return nsEventStatus_eIgnore;
 }
 
 bool
diff --git a/dom/ipc/TabParent.h b/dom/ipc/TabParent.h
index c0a0026d1a0a..70b44078eb45 100644
--- a/dom/ipc/TabParent.h
+++ b/dom/ipc/TabParent.h
@@ -381,8 +381,8 @@ private:
     // |aOutTargetGuid| will contain the identifier
     // of the APZC instance that handled the event. aOutTargetGuid may be
     // null.
-    void MaybeForwardEventToRenderFrame(WidgetInputEvent& aEvent,
-                                        ScrollableLayerGuid* aOutTargetGuid);
+    nsEventStatus MaybeForwardEventToRenderFrame(WidgetInputEvent& aEvent,
+                                                 ScrollableLayerGuid* aOutTargetGuid);
     // The offset for the child process which is sampled at touch start. This
     // means that the touch events are relative to where the frame was at the
     // start of the touch. We need to look for a better solution to this
diff --git a/dom/media/MediaManager.cpp b/dom/media/MediaManager.cpp
index b44555275c4d..eb3c35ed54bc 100644
--- a/dom/media/MediaManager.cpp
+++ b/dom/media/MediaManager.cpp
@@ -331,14 +331,14 @@ MediaDevice::GetType(nsAString& aType)
 NS_IMETHODIMP
 VideoDevice::GetType(nsAString& aType)
 {
-  aType.AssignLiteral("video");
+  aType.AssignLiteral(MOZ_UTF16("video"));
   return NS_OK;
 }
 
 NS_IMETHODIMP
 AudioDevice::GetType(nsAString& aType)
 {
-  aType.AssignLiteral("audio");
+  aType.AssignLiteral(MOZ_UTF16("audio"));
   return NS_OK;
 }
 
@@ -1834,7 +1834,7 @@ MediaManager::Observe(nsISupports* aSubject, const char* aTopic,
       MOZ_ASSERT(msg);
       msg->GetData(errorMessage);
       if (errorMessage.IsEmpty())
-        errorMessage.AssignLiteral("UNKNOWN_ERROR");
+        errorMessage.AssignLiteral(MOZ_UTF16("UNKNOWN_ERROR"));
     }
 
     nsString key(aData);
@@ -1986,7 +1986,7 @@ MediaManager::MediaCaptureWindowStateInternal(nsIDOMWindow* aWindow, bool* aVide
       for (i = 0; i < count; ++i) {
         nsCOMPtr<nsIDocShellTreeItem> item;
         docShell->GetChildAt(i, getter_AddRefs(item));
-        nsCOMPtr<nsPIDOMWindow> win = do_GetInterface(item);
+        nsCOMPtr<nsPIDOMWindow> win = item ? item->GetWindow() : nullptr;
 
         MediaCaptureWindowStateInternal(win, aVideo, aAudio);
         if (*aAudio && *aVideo) {
diff --git a/dom/plugins/base/nsJSNPRuntime.cpp b/dom/plugins/base/nsJSNPRuntime.cpp
index d998f3b3eaa6..6debf2bef339 100644
--- a/dom/plugins/base/nsJSNPRuntime.cpp
+++ b/dom/plugins/base/nsJSNPRuntime.cpp
@@ -65,6 +65,10 @@ typedef js::HashMap<nsJSObjWrapperKey,
                     js::SystemAllocPolicy> JSObjWrapperTable;
 static JSObjWrapperTable sJSObjWrappers;
 
+// Whether it's safe to iterate sJSObjWrappers.  Set to true when sJSObjWrappers
+// has been initialized and is not currently being enumerated.
+static bool sJSObjWrappersAccessible = false;
+
 // Hash of NPObject wrappers that wrap NPObjects as JSObjects.
 static PLDHashTable sNPObjWrappers;
 
@@ -258,12 +262,13 @@ OnWrapperDestroyed()
   NS_ASSERTION(sWrapperCount, "Whaaa, unbalanced created/destroyed calls!");
 
   if (--sWrapperCount == 0) {
-    if (sJSObjWrappers.initialized()) {
+    if (sJSObjWrappersAccessible) {
       MOZ_ASSERT(sJSObjWrappers.count() == 0);
 
       // No more wrappers, and our hash was initialized. Finish the
       // hash to prevent leaking it.
       sJSObjWrappers.finish();
+      sJSObjWrappersAccessible = false;
     }
 
     if (sNPObjWrappers.ops) {
@@ -513,12 +518,6 @@ nsJSObjWrapper::~nsJSObjWrapper()
   OnWrapperDestroyed();
 }
 
-void
-nsJSObjWrapper::ClearJSObject() {
-  // Forget our reference to the JSObject.
-  mJSObj = nullptr;
-}
-
 // static
 NPObject *
 nsJSObjWrapper::NP_Allocate(NPP npp, NPClass *aClass)
@@ -545,12 +544,16 @@ nsJSObjWrapper::NP_Invalidate(NPObject *npobj)
 
   if (jsnpobj && jsnpobj->mJSObj) {
 
-    // Remove the wrapper from the hash
-    MOZ_ASSERT(sJSObjWrappers.initialized());
-    nsJSObjWrapperKey key(jsnpobj->mJSObj, jsnpobj->mNpp);
-    sJSObjWrappers.remove(key);
+    if (sJSObjWrappersAccessible) {
+      // Remove the wrapper from the hash
+      nsJSObjWrapperKey key(jsnpobj->mJSObj, jsnpobj->mNpp);
+      JSObjWrapperTable::Ptr ptr = sJSObjWrappers.lookup(key);
+      MOZ_ASSERT(ptr.found());
+      sJSObjWrappers.remove(ptr);
+    }
 
-    jsnpobj->ClearJSObject();
+    // Forget our reference to the JSObject.
+    jsnpobj->mJSObj = nullptr;
   }
 }
 
@@ -932,6 +935,7 @@ nsJSObjWrapper::NP_Construct(NPObject *npobj, const NPVariant *args,
 static void
 JSObjWrapperKeyMarkCallback(JSTracer *trc, JSObject *obj, void *data) {
   NPP npp = static_cast<NPP>(data);
+  MOZ_ASSERT(sJSObjWrappersAccessible);
   if (!sJSObjWrappers.initialized())
     return;
 
@@ -1000,7 +1004,9 @@ nsJSObjWrapper::GetNewOrUsed(NPP npp, JSContext *cx, JS::Handle<JSObject*> obj)
 
       return nullptr;
     }
+    sJSObjWrappersAccessible = true;
   }
+  MOZ_ASSERT(sJSObjWrappersAccessible);
 
   JSObjWrapperTable::Ptr p = sJSObjWrappers.lookupForAdd(nsJSObjWrapperKey(obj, npp));
   if (p) {
@@ -1849,16 +1855,26 @@ NPObjWrapperPluginDestroyedCallback(PLDHashTable *table, PLDHashEntryHdr *hdr,
 void
 nsJSNPRuntime::OnPluginDestroy(NPP npp)
 {
-  if (sJSObjWrappers.initialized()) {
+  if (sJSObjWrappersAccessible) {
+
+    // Prevent modification of sJSObjWrappers table if we go reentrant.
+    sJSObjWrappersAccessible = false;
+
     for (JSObjWrapperTable::Enum e(sJSObjWrappers); !e.empty(); e.popFront()) {
       nsJSObjWrapper *npobj = e.front().value();
       MOZ_ASSERT(npobj->_class == &nsJSObjWrapper::sJSObjWrapperNPClass);
       if (npobj->mNpp == npp) {
-        npobj->ClearJSObject();
+        if (npobj->_class && npobj->_class->invalidate) {
+          npobj->_class->invalidate(npobj);
+        }
+
         _releaseobject(npobj);
+
         e.removeFront();
       }
     }
+
+    sJSObjWrappersAccessible = true;
   }
 
   // Use the safe JSContext here as we're not always able to find the
diff --git a/dom/plugins/base/nsJSNPRuntime.h b/dom/plugins/base/nsJSNPRuntime.h
index e094ea32d2d5..791ab460ed6d 100644
--- a/dom/plugins/base/nsJSNPRuntime.h
+++ b/dom/plugins/base/nsJSNPRuntime.h
@@ -47,8 +47,6 @@ public:
   static NPObject *GetNewOrUsed(NPP npp, JSContext *cx,
                                 JS::Handle<JSObject*> obj);
 
-  void ClearJSObject();
-
 protected:
   nsJSObjWrapper(NPP npp);
   ~nsJSObjWrapper();
diff --git a/dom/smil/TimeEvent.cpp b/dom/smil/TimeEvent.cpp
index 03b94f35e8c5..6c31a6cfe638 100644
--- a/dom/smil/TimeEvent.cpp
+++ b/dom/smil/TimeEvent.cpp
@@ -5,6 +5,7 @@
 
 #include "mozilla/dom/TimeEvent.h"
 #include "mozilla/BasicEvents.h"
+#include "nsIDocShell.h"
 #include "nsIInterfaceRequestorUtils.h"
 #include "nsPresContext.h"
 
@@ -34,12 +35,9 @@ TimeEvent::TimeEvent(EventTarget* aOwner,
   mEvent->mFlags.mCancelable = false;
 
   if (mPresContext) {
-    nsISupports* container = mPresContext->GetContainerWeak();
-    if (container) {
-      nsCOMPtr<nsIDOMWindow> window = do_GetInterface(container);
-      if (window) {
-        mView = do_QueryInterface(window);
-      }
+    nsCOMPtr<nsIDocShell> docShell = mPresContext->GetDocShell();
+    if (docShell) {
+      mView = docShell->GetWindow();
     }
   }
 }
diff --git a/dom/tests/mochitest/chrome/window_focus.xul b/dom/tests/mochitest/chrome/window_focus.xul
index baba7e9e93da..da399615f3bb 100644
--- a/dom/tests/mochitest/chrome/window_focus.xul
+++ b/dom/tests/mochitest/chrome/window_focus.xul
@@ -1566,7 +1566,7 @@ function doFrameHistoryTests()
   }, true);
 
   // make sure that loading a new page and then going back maintains the focus
-  gChildWindow.location = "data:text/html,<script>window.onload=function() {setTimeout(function () {window.back();}, 0);}</script>";
+  gChildWindow.location = "data:text/html,<script>window.onload=function() {setTimeout(function () {SpecialPowers.wrap(window).back();}, 0);}</script>";
 }
 
 function addFrameSwitchingListeners(frame)
diff --git a/dom/tests/mochitest/general/test_interfaces.html b/dom/tests/mochitest/general/test_interfaces.html
index 144ceaee9e92..2115595abf3e 100644
--- a/dom/tests/mochitest/general/test_interfaces.html
+++ b/dom/tests/mochitest/general/test_interfaces.html
@@ -576,6 +576,8 @@ var interfaceNamesInGlobalScope =
     {name: "Key", pref: "dom.webcrypto.enabled"},
 // IMPORTANT: Do not change this list without review from a DOM peer!
     "KeyEvent",
+// IMPORTANT: Do not change this list without review from a DOM peer!
+    {name: "KeyPair", pref: "dom.webcrypto.enabled"},
 // IMPORTANT: Do not change this list without review from a DOM peer!
     "KeyboardEvent",
 // IMPORTANT: Do not change this list without review from a DOM peer!
diff --git a/dom/webidl/HTMLLinkElement.webidl b/dom/webidl/HTMLLinkElement.webidl
index 70712f4f9049..6e3c1431a06d 100644
--- a/dom/webidl/HTMLLinkElement.webidl
+++ b/dom/webidl/HTMLLinkElement.webidl
@@ -31,7 +31,6 @@ interface HTMLLinkElement : HTMLElement {
   [PutForwards=value] readonly attribute DOMSettableTokenList sizes;
 };
 HTMLLinkElement implements LinkStyle;
-HTMLLinkElement implements LinkImport;
 
 // http://www.whatwg.org/specs/web-apps/current-work/#other-elements,-attributes-and-apis
 partial interface HTMLLinkElement {
@@ -42,3 +41,9 @@ partial interface HTMLLinkElement {
   [SetterThrows, Pure]
            attribute DOMString target;
 };
+
+// http://w3c.github.io/webcomponents/spec/imports/#interface-import
+partial interface HTMLLinkElement {
+    readonly attribute Document? import;
+};
+
diff --git a/dom/webidl/InstallTrigger.webidl b/dom/webidl/InstallTrigger.webidl
index 1d10efb0d954..789fb2bc4099 100644
--- a/dom/webidl/InstallTrigger.webidl
+++ b/dom/webidl/InstallTrigger.webidl
@@ -10,6 +10,12 @@
  */
 callback InstallTriggerCallback = void(DOMString url, short status);
 
+dictionary InstallTriggerData {
+  DOMString URL;
+  DOMString? IconURL;
+  DOMString? Hash;
+};
+
 /**
  * The interface for the InstallTrigger object available to all websites.
  */
@@ -51,7 +57,8 @@ interface InstallTriggerImpl {
    *         A callback to call as each installation succeeds or fails
    * @return true if the installations were successfully started
    */
-  boolean install(object installs, optional InstallTriggerCallback callback);
+  boolean install(MozMap<(DOMString or InstallTriggerData)> installs,
+                  optional InstallTriggerCallback callback);
 
   /**
    * Starts installing a new add-on.
diff --git a/dom/webidl/LinkImport.webidl b/dom/webidl/LinkImport.webidl
deleted file mode 100644
index b1aa6fd2f28d..000000000000
--- a/dom/webidl/LinkImport.webidl
+++ /dev/null
@@ -1,13 +0,0 @@
-/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this file,
- * You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * The origin of this IDL file is
- * http://www.w3.org/TR/2013/WD-html-imports-20130514/
- */
-
-[NoInterfaceObject]
-interface LinkImport {
-    readonly attribute Document? import;
-};
diff --git a/dom/webidl/SubtleCrypto.webidl b/dom/webidl/SubtleCrypto.webidl
index 9ba0593f71fd..ab538d0b6cda 100644
--- a/dom/webidl/SubtleCrypto.webidl
+++ b/dom/webidl/SubtleCrypto.webidl
@@ -108,6 +108,12 @@ interface Key {
   [Cached, Constant, Frozen] readonly attribute sequence<KeyUsage> usages;
 };
 
+[Pref="dom.webcrypto.enabled"]
+interface KeyPair {
+  readonly attribute Key publicKey;
+  readonly attribute Key privateKey;
+};
+
 typedef DOMString KeyFormat;
 typedef (ArrayBufferView or ArrayBuffer) CryptoOperationData;
 typedef (ArrayBufferView or ArrayBuffer) KeyData;
diff --git a/dom/webidl/Window.webidl b/dom/webidl/Window.webidl
index b8469742647a..8d7a6f5af03d 100644
--- a/dom/webidl/Window.webidl
+++ b/dom/webidl/Window.webidl
@@ -433,6 +433,13 @@ interface ChromeWindow {
   [Throws, Func="nsGlobalWindow::IsChromeWindow"]
   readonly attribute nsIMessageBroadcaster messageManager;
 
+  /**
+   * Returns the message manager identified by the given group name that
+   * manages all frame loaders belonging to that group.
+   */
+  [Throws, Func="nsGlobalWindow::IsChromeWindow"]
+  nsIMessageBroadcaster getGroupMessageManager(DOMString aGroup);
+
   /**
    * On some operating systems, we must allow the window manager to
    * handle window dragging. This function tells the window manager to
diff --git a/dom/webidl/moz.build b/dom/webidl/moz.build
index d46b26fc79cc..f36823fdf2fc 100644
--- a/dom/webidl/moz.build
+++ b/dom/webidl/moz.build
@@ -224,7 +224,6 @@ WEBIDL_FILES = [
     'KeyboardEvent.webidl',
     'KeyEvent.webidl',
     'LegacyQueryInterface.webidl',
-    'LinkImport.webidl',
     'LinkStyle.webidl',
     'LocalMediaStream.webidl',
     'Location.webidl',
diff --git a/dom/workers/WorkerPrivate.cpp b/dom/workers/WorkerPrivate.cpp
index 146047879e52..a63d393c6b9d 100644
--- a/dom/workers/WorkerPrivate.cpp
+++ b/dom/workers/WorkerPrivate.cpp
@@ -3365,7 +3365,7 @@ WorkerPrivateParent<Derived>::SetBaseURI(nsIURI* aBaseURI)
 
   nsCOMPtr<nsIURL> url(do_QueryInterface(aBaseURI));
   if (url && NS_SUCCEEDED(url->GetQuery(temp)) && !temp.IsEmpty()) {
-    mLocationInfo.mSearch.AssignLiteral("?");
+    mLocationInfo.mSearch.Assign('?');
     mLocationInfo.mSearch.Append(temp);
   }
 
@@ -3378,13 +3378,13 @@ WorkerPrivateParent<Derived>::SetBaseURI(nsIURI* aBaseURI)
       if (NS_SUCCEEDED(aBaseURI->GetOriginCharset(charset)) &&
           NS_SUCCEEDED(converter->UnEscapeURIForUI(charset, temp,
                                                    unicodeRef))) {
-        mLocationInfo.mHash.AssignLiteral("#");
+        mLocationInfo.mHash.Assign('#');
         mLocationInfo.mHash.Append(NS_ConvertUTF16toUTF8(unicodeRef));
       }
     }
 
     if (mLocationInfo.mHash.IsEmpty()) {
-      mLocationInfo.mHash.AssignLiteral("#");
+      mLocationInfo.mHash.Assign('#');
       mLocationInfo.mHash.Append(temp);
     }
   }
diff --git a/dom/xslt/xslt/txEXSLTFunctions.cpp b/dom/xslt/xslt/txEXSLTFunctions.cpp
index 3e147dadbc5b..705d60ac9452 100644
--- a/dom/xslt/xslt/txEXSLTFunctions.cpp
+++ b/dom/xslt/xslt/txEXSLTFunctions.cpp
@@ -481,7 +481,7 @@ txEXSLTFunctionCall::evaluate(txIEvalContext *aContext,
                 NS_ENSURE_SUCCESS(rv, rv);
             }
             else if (mType == SPLIT) {
-                pattern.AssignLiteral(" ");
+                pattern.Assign(' ');
             }
             else {
                 pattern.AssignLiteral("\t\r\n ");
diff --git a/dom/xslt/xslt/txXSLTNumber.cpp b/dom/xslt/xslt/txXSLTNumber.cpp
index b99985926d4c..62df4399acf7 100644
--- a/dom/xslt/xslt/txXSLTNumber.cpp
+++ b/dom/xslt/xslt/txXSLTNumber.cpp
@@ -324,7 +324,7 @@ txXSLTNumber::getCounters(Expr* aGroupSize, Expr* aGroupSeparator,
                                                groupSeparator, defaultCounter);
         NS_ENSURE_SUCCESS(rv, rv);
 
-        defaultCounter->mSeparator.AssignLiteral(".");
+        defaultCounter->mSeparator.Assign('.');
         rv = aCounters.add(defaultCounter);
         if (NS_FAILED(rv)) {
             // XXX ErrorReport: out of memory
@@ -343,7 +343,7 @@ txXSLTNumber::getCounters(Expr* aGroupSize, Expr* aGroupSeparator,
             // there is only one formatting token and we're formatting a
             // value-list longer then one we use the default separator. This
             // won't be used when formatting the first value anyway.
-            sepToken.AssignLiteral(".");
+            sepToken.Assign('.');
         }
         else {
             while (formatPos < formatLen &&
diff --git a/editor/libeditor/html/nsHTMLEditor.cpp b/editor/libeditor/html/nsHTMLEditor.cpp
index 450f8a6afeb9..e7d26a6e0fe6 100644
--- a/editor/libeditor/html/nsHTMLEditor.cpp
+++ b/editor/libeditor/html/nsHTMLEditor.cpp
@@ -2303,7 +2303,7 @@ nsHTMLEditor::GetElementOrParentByTagName(const nsAString& aTagName,
   bool getLink = IsLinkTag(tagName);
   bool getNamedAnchor = IsNamedAnchorTag(tagName);
   if (getLink || getNamedAnchor) {
-    tagName.AssignLiteral("a");
+    tagName.Assign('a');
   }
   bool findTableCell = tagName.EqualsLiteral("td");
   bool findList = tagName.EqualsLiteral("list");
@@ -2577,7 +2577,7 @@ nsHTMLEditor::CreateElementWithDefaults(const nsAString& aTagName)
   nsAutoString realTagName;
 
   if (IsLinkTag(tagName) || IsNamedAnchorTag(tagName)) {
-    realTagName.AssignLiteral("a");
+    realTagName.Assign('a');
   } else {
     realTagName = tagName;
   }
diff --git a/editor/libeditor/html/nsHTMLObjectResizer.cpp b/editor/libeditor/html/nsHTMLObjectResizer.cpp
index 494c6d8cd50d..ed865987d21b 100644
--- a/editor/libeditor/html/nsHTMLObjectResizer.cpp
+++ b/editor/libeditor/html/nsHTMLObjectResizer.cpp
@@ -708,9 +708,9 @@ nsHTMLEditor::SetResizingInfoPosition(int32_t aX, int32_t aY, int32_t aW, int32_
   int32_t diffWidth  = aW - mResizedObjectWidth;
   int32_t diffHeight = aH - mResizedObjectHeight;
   if (diffWidth > 0)
-    diffWidthStr.AssignLiteral("+");
+    diffWidthStr.Assign('+');
   if (diffHeight > 0)
-    diffHeightStr.AssignLiteral("+");
+    diffHeightStr.Assign('+');
   diffWidthStr.AppendInt(diffWidth);
   diffHeightStr.AppendInt(diffHeight);
 
diff --git a/embedding/browser/webBrowser/nsWebBrowser.cpp b/embedding/browser/webBrowser/nsWebBrowser.cpp
index 0fc627c3f63e..4911a8eef4c0 100644
--- a/embedding/browser/webBrowser/nsWebBrowser.cpp
+++ b/embedding/browser/webBrowser/nsWebBrowser.cpp
@@ -363,13 +363,9 @@ NS_IMETHODIMP nsWebBrowser::SetParentURIContentListener(nsIURIContentListener*
 NS_IMETHODIMP nsWebBrowser::GetContentDOMWindow(nsIDOMWindow **_retval)
 {
     NS_ENSURE_STATE(mDocShell);
-    nsresult rv = NS_OK;
-    nsCOMPtr<nsIDOMWindow> retval = do_GetInterface(mDocShell, &rv);
-    if (NS_FAILED(rv)) return rv;
-
-    *_retval = retval;
-    NS_ADDREF(*_retval);
-    return rv;
+    nsCOMPtr<nsIDOMWindow> retval = mDocShell->GetWindow();
+    retval.forget(_retval);
+    return *_retval ? NS_OK : NS_ERROR_FAILURE;
 }
 
 NS_IMETHODIMP nsWebBrowser::GetIsActive(bool *rv)
@@ -512,6 +508,18 @@ NS_IMETHODIMP nsWebBrowser::FindItemWithName(const char16_t *aName,
       aOriginalRequestor, _retval);
 }
 
+nsIDocument*
+nsWebBrowser::GetDocument()
+{
+  return mDocShell ? mDocShell->GetDocument() : nullptr;
+}
+
+nsPIDOMWindow*
+nsWebBrowser::GetWindow()
+{
+  return mDocShell ? mDocShell->GetWindow() : nullptr;
+}
+
 NS_IMETHODIMP nsWebBrowser::GetTreeOwner(nsIDocShellTreeOwner** aTreeOwner)
 {  
     NS_ENSURE_ARG_POINTER(aTreeOwner);
@@ -1482,7 +1490,7 @@ NS_IMETHODIMP nsWebBrowser::GetMainWidget(nsIWidget** mainWidget)
 
 NS_IMETHODIMP nsWebBrowser::SetFocus()
 {
-  nsCOMPtr<nsIDOMWindow> window = do_GetInterface(mDocShell);
+  nsCOMPtr<nsIDOMWindow> window = GetWindow();
   NS_ENSURE_TRUE(window, NS_ERROR_FAILURE);
 
   nsCOMPtr<nsIFocusManager> fm = do_GetService(FOCUSMANAGER_CONTRACTID);
@@ -1647,9 +1655,9 @@ static void DrawThebesLayer(ThebesLayer* aLayer,
 void nsWebBrowser::WindowRaised(nsIWidget* aWidget)
 {
 #if defined(DEBUG_smaug)
-  nsCOMPtr<nsIDOMDocument> domDocument = do_GetInterface(mDocShell);
+  nsCOMPtr<nsIDocument> document = mDocShell->GetDocument();
   nsAutoString documentURI;
-  domDocument->GetDocumentURI(documentURI);
+  document->GetDocumentURI(documentURI);
   printf("nsWebBrowser::NS_ACTIVATE %p %s\n", (void*)this,
          NS_ConvertUTF16toUTF8(documentURI).get());
 #endif
@@ -1659,9 +1667,9 @@ void nsWebBrowser::WindowRaised(nsIWidget* aWidget)
 void nsWebBrowser::WindowLowered(nsIWidget* aWidget)
 {
 #if defined(DEBUG_smaug)
-  nsCOMPtr<nsIDOMDocument> domDocument = do_GetInterface(mDocShell);
+  nsCOMPtr<nsIDocument> document = mDocShell->GetDocument();
   nsAutoString documentURI;
-  domDocument->GetDocumentURI(documentURI);
+  document->GetDocumentURI(documentURI);
   printf("nsWebBrowser::NS_DEACTIVATE %p %s\n", (void*)this,
          NS_ConvertUTF16toUTF8(documentURI).get());
 #endif
@@ -1698,7 +1706,7 @@ NS_IMETHODIMP nsWebBrowser::GetPrimaryContentWindow(nsIDOMWindow** aDOMWindow)
   docShell = do_QueryInterface(item);
   NS_ENSURE_TRUE(docShell, NS_ERROR_FAILURE);
   
-  nsCOMPtr<nsIDOMWindow> domWindow = do_GetInterface(docShell);
+  nsCOMPtr<nsIDOMWindow> domWindow = docShell->GetWindow();
   NS_ENSURE_TRUE(domWindow, NS_ERROR_FAILURE);
 
   *aDOMWindow = domWindow;
@@ -1714,7 +1722,7 @@ NS_IMETHODIMP nsWebBrowser::GetPrimaryContentWindow(nsIDOMWindow** aDOMWindow)
 NS_IMETHODIMP nsWebBrowser::Activate(void)
 {
   nsCOMPtr<nsIFocusManager> fm = do_GetService(FOCUSMANAGER_CONTRACTID);
-  nsCOMPtr<nsIDOMWindow> window = do_GetInterface(mDocShell);
+  nsCOMPtr<nsIDOMWindow> window = GetWindow();
   if (fm && window)
     return fm->WindowRaised(window);
   return NS_OK;
@@ -1724,7 +1732,7 @@ NS_IMETHODIMP nsWebBrowser::Activate(void)
 NS_IMETHODIMP nsWebBrowser::Deactivate(void)
 {
   nsCOMPtr<nsIFocusManager> fm = do_GetService(FOCUSMANAGER_CONTRACTID);
-  nsCOMPtr<nsIDOMWindow> window = do_GetInterface(mDocShell);
+  nsCOMPtr<nsIDOMWindow> window = GetWindow();
   if (fm && window)
     return fm->WindowLowered(window);
   return NS_OK;
@@ -1748,7 +1756,9 @@ NS_IMETHODIMP nsWebBrowser::GetFocusedWindow(nsIDOMWindow * *aFocusedWindow)
   NS_ENSURE_ARG_POINTER(aFocusedWindow);
   *aFocusedWindow = nullptr;
 
-  nsCOMPtr<nsIDOMWindow> window = do_GetInterface(mDocShell);
+  NS_ENSURE_TRUE(mDocShell, NS_ERROR_FAILURE);
+
+  nsCOMPtr<nsIDOMWindow> window = mDocShell->GetWindow();
   NS_ENSURE_TRUE(window, NS_ERROR_FAILURE);
 
   nsCOMPtr<nsIDOMElement> focusedElement;
@@ -1767,8 +1777,9 @@ NS_IMETHODIMP nsWebBrowser::SetFocusedWindow(nsIDOMWindow * aFocusedWindow)
 NS_IMETHODIMP nsWebBrowser::GetFocusedElement(nsIDOMElement * *aFocusedElement)
 {
   NS_ENSURE_ARG_POINTER(aFocusedElement);
+  NS_ENSURE_TRUE(mDocShell, NS_ERROR_FAILURE);
 
-  nsCOMPtr<nsIDOMWindow> window = do_GetInterface(mDocShell);
+  nsCOMPtr<nsIDOMWindow> window = mDocShell->GetWindow();
   NS_ENSURE_TRUE(window, NS_ERROR_FAILURE);
 
   nsCOMPtr<nsIFocusManager> fm = do_GetService(FOCUSMANAGER_CONTRACTID);
diff --git a/embedding/components/find/src/nsWebBrowserFind.cpp b/embedding/components/find/src/nsWebBrowserFind.cpp
index 95a9252d4d75..c6d2df66e993 100644
--- a/embedding/components/find/src/nsWebBrowserFind.cpp
+++ b/embedding/components/find/src/nsWebBrowserFind.cpp
@@ -156,8 +156,10 @@ NS_IMETHODIMP nsWebBrowserFind::FindNext(bool *outDidFind)
 
         if (doFind)
         {
-            searchFrame = do_GetInterface(curItem, &rv);
-            if (NS_FAILED(rv)) break;
+            searchFrame = curItem->GetWindow();
+            if (!searchFrame) {
+              break;
+            }
 
             OnStartSearchFrame(searchFrame);
 
@@ -201,8 +203,11 @@ NS_IMETHODIMP nsWebBrowserFind::FindNext(bool *outDidFind)
         curItem = do_QueryInterface(curSupports, &rv);
         if (NS_FAILED(rv)) break;
 
-        searchFrame = do_GetInterface(curItem, &rv);
-        if (NS_FAILED(rv)) break;
+        searchFrame = curItem->GetWindow();
+        if (!searchFrame) {
+          rv = NS_ERROR_FAILURE;
+          break;
+        }
 
         if (curItem.get() == startingItem.get())
         {
diff --git a/embedding/components/windowwatcher/src/nsWindowWatcher.cpp b/embedding/components/windowwatcher/src/nsWindowWatcher.cpp
index 1c197934ef85..122d60d3bbdb 100644
--- a/embedding/components/windowwatcher/src/nsWindowWatcher.cpp
+++ b/embedding/components/windowwatcher/src/nsWindowWatcher.cpp
@@ -801,10 +801,8 @@ nsWindowWatcher::OpenWindowInternal(nsIDOMWindow *aParent,
     // cases we do _not_ set the parent window principal as the owner of the
     // load--since we really don't know who the owner is, just leave it null.
     nsCOMPtr<nsPIDOMWindow> newWindow = do_QueryInterface(*_retval);
-#ifdef DEBUG
-    nsCOMPtr<nsPIDOMWindow> newDebugWindow = do_GetInterface(newDocShell);
-    NS_ASSERTION(newWindow == newDebugWindow, "Different windows??");
-#endif
+    NS_ASSERTION(newWindow == newDocShell->GetWindow(), "Different windows??");
+
     // The principal of the initial about:blank document gets set up in
     // nsWindowWatcher::AddWindow. Make sure to call it. In the common case
     // this call already happened when the window was created, but
@@ -1312,8 +1310,10 @@ nsWindowWatcher::GetWindowByName(const char16_t *aTargetName,
     FindItemWithName(aTargetName, nullptr, nullptr, getter_AddRefs(treeItem));
   }
 
-  nsCOMPtr<nsIDOMWindow> domWindow = do_GetInterface(treeItem);
-  domWindow.swap(*aResult);
+  if (treeItem) {
+    nsCOMPtr<nsIDOMWindow> domWindow = treeItem->GetWindow();
+    domWindow.forget(aResult);
+  }
 
   return NS_OK;
 }
@@ -1734,7 +1734,7 @@ nsWindowWatcher::GetCallerTreeItem(nsIDocShellTreeItem* aParentItem)
   return callerItem.forget();
 }
 
-already_AddRefed<nsIDOMWindow>
+nsPIDOMWindow*
 nsWindowWatcher::SafeGetWindowByName(const nsAString& aName,
                                      nsIDOMWindow* aCurrentWindow)
 {
@@ -1755,8 +1755,7 @@ nsWindowWatcher::SafeGetWindowByName(const nsAString& aName,
                      getter_AddRefs(foundItem));
   }
 
-  nsCOMPtr<nsIDOMWindow> foundWin = do_GetInterface(foundItem);
-  return foundWin.forget();
+  return foundItem ? foundItem->GetWindow() : nullptr;
 }
 
 /* Fetch the nsIDOMWindow corresponding to the given nsIDocShellTreeItem.
@@ -1772,8 +1771,10 @@ nsWindowWatcher::ReadyOpenedDocShellItem(nsIDocShellTreeItem *aOpenedItem,
 {
   nsresult rv = NS_ERROR_FAILURE;
 
+  NS_ENSURE_ARG(aOpenedWindow);
+
   *aOpenedWindow = 0;
-  nsCOMPtr<nsPIDOMWindow> piOpenedWindow(do_GetInterface(aOpenedItem));
+  nsCOMPtr<nsPIDOMWindow> piOpenedWindow = aOpenedItem->GetWindow();
   if (piOpenedWindow) {
     if (aParent) {
       piOpenedWindow->SetOpenerWindow(aParent, aWindowIsNew); // damnit
diff --git a/embedding/components/windowwatcher/src/nsWindowWatcher.h b/embedding/components/windowwatcher/src/nsWindowWatcher.h
index fa8fa98aafde..7cb324411daa 100644
--- a/embedding/components/windowwatcher/src/nsWindowWatcher.h
+++ b/embedding/components/windowwatcher/src/nsWindowWatcher.h
@@ -22,6 +22,7 @@
 class  nsIURI;
 class  nsIDocShellTreeItem;
 class  nsIDocShellTreeOwner;
+class nsPIDOMWindow;
 class  nsIWebBrowserChrome;
 class  nsString;
 class  nsWatcherWindowEnumerator;
@@ -64,7 +65,7 @@ protected:
   
   // Unlike GetWindowByName this will look for a caller on the JS
   // stack, and then fall back on aCurrentWindow if it can't find one.
-  already_AddRefed<nsIDOMWindow>
+  nsPIDOMWindow*
     SafeGetWindowByName(const nsAString& aName, nsIDOMWindow* aCurrentWindow);
 
   // Just like OpenWindowJS, but knows whether it got called via OpenWindowJS
diff --git a/extensions/spellcheck/hunspell/src/mozHunspell.cpp b/extensions/spellcheck/hunspell/src/mozHunspell.cpp
index 477f12ea5a0c..d2e9c35a0ac3 100644
--- a/extensions/spellcheck/hunspell/src/mozHunspell.cpp
+++ b/extensions/spellcheck/hunspell/src/mozHunspell.cpp
@@ -155,9 +155,9 @@ NS_IMETHODIMP mozHunspell::SetDictionary(const char16_t *aDictionary)
   if (nsDependentString(aDictionary).IsEmpty()) {
     delete mHunspell;
     mHunspell = nullptr;
-    mDictionary.AssignLiteral("");
-    mAffixFileName.AssignLiteral("");
-    mLanguage.AssignLiteral("");
+    mDictionary.Truncate();
+    mAffixFileName.Truncate();
+    mLanguage.Truncate();
     mDecoder = nullptr;
     mEncoder = nullptr;
 
diff --git a/extensions/spellcheck/locales/en-US/hunspell/dictionary-sources/upstream-hunspell.diff b/extensions/spellcheck/locales/en-US/hunspell/dictionary-sources/upstream-hunspell.diff
index 4a995d13fd7c..1aa4311a7bed 100644
--- a/extensions/spellcheck/locales/en-US/hunspell/dictionary-sources/upstream-hunspell.diff
+++ b/extensions/spellcheck/locales/en-US/hunspell/dictionary-sources/upstream-hunspell.diff
@@ -9138,6 +9138,10 @@
 < awol
 12829a18645
 > axe/M
+12969c18785
+< badge/MZDRS
+---
+> badge/MZDRSG
 13864a19681
 > biodiesel/M
 14179a19997,19999
@@ -9180,6 +9184,14 @@
 > catalyses
 15940d21758
 < caviare/M
+16277c22095
+< check/AGMDS
+---
+> check/AGMDSU
+16327c22145
+< chemistry/M
+---
+> chemistry/MS
 16372c22190
 < chickenshit/S!
 ---
@@ -9204,493 +9216,515 @@
 < cocksucker/S!
 ---
 > cocksucker/SM!
-17755c23570
+17301a23117,23118
+> colonoscope/SM
+> colonoscopy/SM
+17755c23572
 < confer/S
 ---
 > confer/SB
-17800a23616
+17800a23618
 > conformant
-18151d23966
+18151d23968
 < convenor/S
-18206c24021
+18206c24023
 < cookie/M
 ---
 > cookie/SM
-18375a24191,24192
+18375a24193,24194
 > corrigibility/IM
 > corrigible/I
-18389a24207
+18389a24209
 > corruptibly/I
-18467a24286
+18467a24288
 > could've
-18999a24819
+18999a24821
 > cryptologist/MS
-19000a24821
+19000a24823
 > cryptosystem/S
-19035a24857
+19035a24859
 > cul-de-sac
-19246c25068
+19246c25070
 < cysteine
 ---
 > cysteine/M
-19935a25758
+19536a25361
+> decertify/DSGNX
+19935a25761
 > dequeue/DSG
-20196,20197c26019,26020
+20196,20197c26022,26023
 < dialog/SM
 < dialogue/SM
 ---
 > dialog/SMGD
 > dialogue/SMRGD
-20220a26044
+20220a26047
 > diatomaceous
-20481a26306
+20481a26309
 > disclose/DSG
-20633a26459
+20633a26462
 > dissentious
-20830c26656
+20830c26659
 < dogie/M
 ---
 > dogie/SM
-20895a26722
+20895a26725
 > donator/MS
-21367a27195
+21367a27198
 > durian/SM
-21820a27649
+21820a27652
 > elicitor/MS
-22071a27901
+22071a27904
 > encyclopaedia
-22196a28027
+22196a28030
 > enqueue/DSG
-22556a28388
+22508a28343,28344
+> eschatological
+> eschatologist/SM
+22556a28393
 > estoppel
-22638c28470
+22638c28475
 < euthanize
 ---
 > euthanize/DSG
-22719a28552
+22719a28557
 > exabyte/MS
-22947a28781
+22947a28786
 > experimentalism
-23207,23208d29040
+23207,23208d29045
 < faecal
 < faeces/M
-23215c29047
+23215c29052
 < faggoting's
 ---
 > faggot/SMG
-23701a29534
+23418a29256
+> faux
+23701a29540
 > filesystem/MS
-24155c29988
+24155c29994
 < fluidized
 ---
 > fluidize/DSG
-24216a30050
+24216a30056
 > foci
-24736d30569
+24736d30575
 < frier/M
-24855,24856c30688,30689
+24855,24856c30694,30695
 < fucker/M!
 < fuckhead/S!
 ---
 > fucker/SM!
 > fuckhead/SM!
-24953d30785
+24953d30791
 < furore/MS
-25125c30957
+25125c30963
 < gaolbird/S
 ---
 > gaolbirds
-25180d31011
+25180d31017
 < gasolene/M
-25190a31022
+25190a31028
 > gastroenterologist/M
-25262c31094
+25262c31100
 < geezer/M
 ---
 > geezer/MS
-25327c31159
+25327c31165
 < genomic
 ---
 > genomic/S
-25462a31295
+25462a31301
 > gigabit/MS
-25464a31298,31300
+25464a31304,31306
 > gigajoule/MS
 > gigapixel/MS
 > gigawatt/MS
-25560d31395
+25560d31401
 < glamourize/DSG
-25674c31509
+25674c31515
 < glycerine's
 ---
 > glycerine/M
-25905c31740
+25905c31746
 < gram/MS
 ---
 > gram/KMS
-25909d31743
+25909d31749
 < gramme/SM
-26063c31897,31898
+26063c31903,31904
 < greybeard
 ---
 > grey/MDRTGSP
 > greybeard/SM
-26066c31901
+26066c31907
 < greyness
 ---
 > greyness/M
-26246,26247d32080
+26246,26247d32086
 < guerilla's
 < guerillas
-26432,26436d32264
+26432,26436d32270
 < haemoglobin's
 < haemophilia/M
 < haemorrhage/DSMG
 < haemorrhoid/S
 < haemorrhoids/M
-27167c32995
+27167c33001
 < hexane
 ---
 > hexane/SM
-27273a33102
+27273a33108
 > hippopotami
-27875d33703
+27875d33709
 < hyaena/SM
-28017c33845
+28017c33851
 < iPod/M
 ---
 > iPod/MS
-28105a33934
+28105a33940
 > idolator/SM
-28227c34056
+28227c34062
 < immerse/XDSGN
 ---
 > immerse/XDSGNV
-28513c34342
+28513c34348
 < inbound
 ---
 > inbound/s
-28590,28591c34419
+28590,28591c34425
 < incorrigibility/M
 < incorrigible
 ---
 > incorrigibleness
-28593d34420
+28593d34426
 < incorruptibly
-28650a34478
+28650a34484
 > indices
-28812d34639
+28812d34645
 < inflexion/SM
-29216a35044
+29204a35038
+> intermediacy/S
+29206c35040,35042
+< intermediate/SMY
+---
+> intermediate/SMYPGD
+> intermediation/SE
+> intermediator/SM
+29216a35053
 > intern/GDL
-29266a35095
+29266a35104
 > interruptible/U
-29272a35102,35105
+29272a35111,35114
 > intersex
 > intersexual/MS
 > intersexualism
 > intersexuality
-29724c35557
+29724c35566
 < jewellery's
 ---
 > jewellery/M
-29870a35704
+29870a35713
 > judgement/MS
-30066c35900
+30066c35909
 < kiddie/M
 ---
 > kiddie/SM
-30262,30263c36096
+30262,30263c36105
 < kraut's
 < kraut/S!
 ---
 > kraut/MS!
-30665a36499
+30665a36508
 > lector/MS
-31031c36865
+31031c36874
 < linguini's
 ---
 > linguini/M
-31034c36868
+31034c36877
 < linguistically
 ---
 > linguistical/Y
-31151,31152c36985
+31151,31152c36994
 < liver's
 < liver/S
 ---
 > liver/MS
-31639a37473
+31639a37482
 > mage/SM
-32230c38064
+32230c38073
 < meanie/M
 ---
 > meanie/MS
-32317,32318c38151
+32317,32318c38160
 < megadeath/M
 < megadeaths
 ---
 > megadeath/SM
-32320c38153
+32320c38162
 < megajoules
 ---
 > megajoule/SM
-32329c38162
+32329c38171
 < megapixel/S
 ---
 > megapixel/MS
-32708a38542
+32708a38551
 > might've
-32717a38552
+32717a38561
 > migrator/SM
-32760a38596
+32760a38605
 > millennia
-32777d38612
+32777d38621
 < millionnaire/M
-32934a38770
+32934a38779
 > miscommunication/S
-32991a38828
+32991a38837
 > misjudgement/MS
-33784a39622
+33784a39631
 > must've
-33963c39801
+33963c39810
 < native/MS
 ---
 > native/MSY
-34169,34171c40007,40008
+34169,34171c40016,40017
 < neurone/S
 < neurophysiology
 < neuroscience
 ---
 > neurophysiology/M
 > neuroscience/MS
-34275c40112
+34275c40121
 < nightie/M
 ---
 > nightie/SM
-35104a40942
+35104a40951
 > octopi
-35219d41056
+35219d41065
 < oleomargarin/M
-35226a41064
+35226a41073
 > oligo
-35345c41183
+35345c41192
 < oppose/DSG
 ---
 > oppose/DSGRB
-35913c41751
+35913c41760
 < oversize/D
 ---
 > oversize
-36056,36059d41893
+36056,36059d41902
 < paederast/S
 < paediatrician's
 < paediatricians
 < paediatrics/M
-36291a42126
+36291a42135
 > paralyses
-36403d42237
+36377a42222
+> parkour
+36403d42247
 < parrakeet/MS
-36449d42282
+36449d42292
 < partizan/SM
-37093a42927
+37093a42937
 > petabyte/MS
-37102c42936
+37102c42946
 < petitioner/M
 ---
 > petitioner/MS
-37221a43056,43057
+37221a43066,43067
 > phlebotomist/SM
 > phlebotomize/SGD
-37264a43101
+37264a43111
 > phosphorylate/DSGN
-37316d43152
+37316d43162
 < phrenetic
-37630a43467
+37630a43477
 > plaintext
-37796a43634
+37796a43644
 > plugin/MS
-37987c43825
+37987c43835
 < polypeptide/S
 ---
 > polypeptide/MS
-38291d44128
+38291d44138
 < practise's
-38451a44289
+38451a44299
 > prejudgement/MS
-38805a44644
+38805a44654
 > profiler/SM
-38835a44675
+38835a44685
 > programmatically
-38891a44732,44733
+38891a44742,44743
 > pronate/DSGN
 > pronator/MS
-38951c44793
+38951c44803
 < proprietorship/M
 ---
 > proprietorship/MS
-39039a44882
+39039a44892
 > provender/M
-39095a44939
+39095a44949
 > pseudorandom/Y
-39564a45409
+39564a45419
 > quinoa
-39873a45719,45720
+39873a45729,45730
 > rasterization/M
 > rasterize/SGDR
-40036a45884
+40036a45894
 > recency
-40140a45989
+40140a45999
 > recurse/DGSV
-40141a45991
+40141a46001
 > recuse/DGS
-40208a46059
+40208a46069
 > refactor/SMDG
-40244d46094
+40244d46104
 < reflexion/SM
-40659d46508
+40659d46518
 < resizing
-40829c46678
+40829c46688
 < reverie/M
 ---
 > reverie/MS
-40895a46745,46747
+40895a46755,46757
 > rheumatological
 > rheumatology/M
 > rheumatologist/SM
-41415a47268
+41415a47278
 > sabre/MS
-41914c47767
+41914c47777
 < schnaps's
 ---
 > schnaps/M
-41949c47802
+41949c47812
 < schrod's
 ---
 > schrod/SM
-41998a47852
+41998a47862
 > scot-free
-42883,42885c48737
+42883,42885c48747
 < shit's
 < shit/S!
 < shite/S!
 ---
 > shit/MS!
-42887,42888c48739,48740
+42887,42888c48749,48750
 < shithead/S!
 < shitload/!
 ---
 > shithead/MS!
 > shitload/MS!
-42891c48743
+42891c48753
 < shitty/RT!
 ---
 > shitty/TR!
-42976a48829
+42976a48839
 > should've
-43008c48861
+43008c48871
 < showtime
 ---
 > showtime/MS
-43328c49181
+43328c49191
 < size/MGBDRS
 ---
 > size/AMGBDRS
-43724,43726c49577
+43724,43726c49587
 < smoulder's
 < smouldered
 < smoulders
 ---
 > smoulder/GSMD
-43766a49618,49619
+43766a49628,49629
 > snarkily
 > snarky/TR
-44041a49895
+44041a49905
 > sommelier/SM
-44062c49916
+44062c49926
 < sonofabitch
 ---
 > sonofabitch/!
-44346a50201
+44346a50211
 > spelled
-44348a50204
+44348a50214
 > spelt
-44371a50228
+44371a50238
 > spick/S!
-44383c50240
+44383c50250
 < spik/S
 ---
 > spik/S!
-46106a51964
+46106a51974
 > syllabi
-46160c52018
+46160c52028
 < synch/GMD
 ---
 > synch/GMDS
-46167d52024
+46167d52034
 < synchs
-46178a52036,52038
+46178a52046,52048
 > synesthesia
 > synesthete/S
 > synesthetic
-46203,46204c52063,52064
+46203,46204c52073,52074
 < sysadmin/S
 < sysop/S
 ---
 > sysadmin/MS
 > sysop/MS
-46632a52493,52494
+46632a52503,52504
 > teleport/SGD
 > teleportation
-46752a52615
+46752a52625
 > terabit/MS
-46753a52617,52618
+46753a52627,52628
 > terahertz/M
 > terapixel/MS
-46817a52683
+46817a52693
 > testcase/MS
-46831a52698
+46831a52708
 > testsuite/MS
-46845a52713
+46845a52723
 > textbox/SM
-46925a52794
+46925a52804
 > theremin/MS
-47455c53324
+47455c53334
 < toolbar
 ---
 > toolbar/MS
-47755a53625
+47644a53524
+> traceur/SM
+47755a53636
 > transfect/DSMG
-47774a53645,53646
+47774a53656,53657
 > transgenderism
 > transgene/MS
-47951c53823
+47951c53834
 < triage/M
 ---
 > triage/MGS
-48869a54742
+48869a54753
 > unlikeable
-49211c55084
+49211c55095
 < vagina/M
 ---
 > vagina/MS
-49368,49369c55241
+49368,49369c55252
 < velour's
 < velours's
 ---
 > velour/MS
-49478a55351
+49478a55362
 > vertices
-50148a56022
+50148a56033
 > weaponize/DSG
-50260,50261d56133
+50260,50261d56144
 < werwolf/M
 < werwolves
-50728c56600
+50728c56611
 < women
 ---
 > women/M
-50794c56666
+50794c56677
 < wop/S!
 ---
 > wop/MS!
diff --git a/extensions/spellcheck/locales/en-US/hunspell/en-US.dic b/extensions/spellcheck/locales/en-US/hunspell/en-US.dic
index ba06f6567bdc..5c8fb1ac86c6 100644
--- a/extensions/spellcheck/locales/en-US/hunspell/en-US.dic
+++ b/extensions/spellcheck/locales/en-US/hunspell/en-US.dic
@@ -1,4 +1,4 @@
-57488
+57499
 0/nm
 0th/pt
 1/n1
@@ -19033,7 +19033,7 @@ baddest
 baddie/M
 baddy/SM
 bade
-badge/MZDRS
+badge/MZDRSG
 badger/GMD
 badinage/M
 badlands/M
@@ -22354,7 +22354,7 @@ cheapo
 cheapskate/SM
 cheat/ZGMDRS
 cheater/M
-check/AGMDS
+check/AGMDSU
 checkbook/SM
 checked/U
 checker/MDGS
@@ -22404,7 +22404,7 @@ chemiluminescence
 chemiluminescent
 chemise/MS
 chemist/MS
-chemistry/M
+chemistry/MS
 chemo/M
 chemosynthesis
 chemotherapeutic
@@ -23379,6 +23379,8 @@ colonizations
 colonize/CAGSD
 colonizer/MS
 colonnade/MDS
+colonoscope/SM
+colonoscopy/SM
 colony/SM
 colophon/SM
 color's
@@ -25627,6 +25629,7 @@ decent/ITRY
 deception/MS
 deceptive/YP
 deceptiveness/M
+decertify/DSGNX
 decibel/MS
 decidability/U
 decidable/U
@@ -28614,6 +28617,8 @@ escapology
 escargot/MS
 escarole/MS
 escarpment/SM
+eschatological
+eschatologist/SM
 eschatology
 eschew/SDG
 escort/SMDG
@@ -29526,6 +29531,7 @@ faun/MS
 fauna/SM
 fauvism/M
 fauvist/SM
+faux
 fave/S
 favor/ESMDG
 favorable/U
@@ -35321,8 +35327,11 @@ interloper/M
 interlude/MGDS
 intermarriage/MS
 intermarry/DSG
+intermediacy/S
 intermediary/SM
-intermediate/SMY
+intermediate/SMYPGD
+intermediation/SE
+intermediator/SM
 interment/EM
 interments
 intermezzi
@@ -42530,6 +42539,7 @@ park/MDSG
 parka/SM
 parking/M
 parkland
+parkour
 parkway/MS
 parky
 parlance/M
@@ -53867,6 +53877,7 @@ traceable/U
 traceless
 tracer/M
 tracery/SM
+traceur/SM
 trachea/M
 tracheae
 tracheal
diff --git a/extensions/spellcheck/src/mozSpellChecker.cpp b/extensions/spellcheck/src/mozSpellChecker.cpp
index 45a55c0a36ff..1d2b20b5881a 100644
--- a/extensions/spellcheck/src/mozSpellChecker.cpp
+++ b/extensions/spellcheck/src/mozSpellChecker.cpp
@@ -319,7 +319,7 @@ NS_IMETHODIMP
 mozSpellChecker::GetCurrentDictionary(nsAString &aDictionary)
 {
   if (!mSpellCheckingEngine) {
-    aDictionary.AssignLiteral("");
+    aDictionary.Truncate();
     return NS_OK;
   }
 
diff --git a/gfx/2d/Path.cpp b/gfx/2d/Path.cpp
index 6b9464041bf2..c41707456697 100644
--- a/gfx/2d/Path.cpp
+++ b/gfx/2d/Path.cpp
@@ -278,8 +278,11 @@ FindInflectionApproximationRange(BezierControlPoints aControlPoints,
 
     if (cp21.x == 0 && cp21.y == 0) {
       // In this case s3 becomes lim[n->0] (cp41.x * n) / n - (cp41.y * n) / n = cp41.x - cp41.y.
-      *aMin = aT - CubicRoot(double(aTolerance / (cp41.x - cp41.y)));
-      *aMax = aT + CubicRoot(aTolerance / (cp41.x - cp41.y));
+
+      // Use the absolute value so that Min and Max will correspond with the
+      // minimum and maximum of the range.
+      *aMin = aT - CubicRoot(abs(aTolerance / (cp41.x - cp41.y)));
+      *aMax = aT + CubicRoot(abs(aTolerance / (cp41.x - cp41.y)));
       return;
     }
 
diff --git a/gfx/gl/GLContext.cpp b/gfx/gl/GLContext.cpp
index 13bf707f5462..fc64d42803b2 100644
--- a/gfx/gl/GLContext.cpp
+++ b/gfx/gl/GLContext.cpp
@@ -70,6 +70,7 @@ static const char *sExtensionNames[] = {
     "GL_OES_depth32",
     "GL_OES_stencil8",
     "GL_OES_texture_npot",
+    "GL_IMG_texture_npot",
     "GL_ARB_depth_texture",
     "GL_OES_depth_texture",
     "GL_OES_packed_depth_stencil",
diff --git a/gfx/gl/GLContext.h b/gfx/gl/GLContext.h
index 066e1c19e1d5..cc06f03f6bf0 100644
--- a/gfx/gl/GLContext.h
+++ b/gfx/gl/GLContext.h
@@ -338,6 +338,7 @@ public:
         OES_depth32,
         OES_stencil8,
         OES_texture_npot,
+        IMG_texture_npot,
         ARB_depth_texture,
         OES_depth_texture,
         OES_packed_depth_stencil,
diff --git a/gfx/layers/apz/src/APZCTreeManager.cpp b/gfx/layers/apz/src/APZCTreeManager.cpp
index c3615cd6b1ff..9c0572efb904 100644
--- a/gfx/layers/apz/src/APZCTreeManager.cpp
+++ b/gfx/layers/apz/src/APZCTreeManager.cpp
@@ -38,6 +38,7 @@ static bool gPrintApzcTree = false;
 
 APZCTreeManager::APZCTreeManager()
     : mTreeLock("APZCTreeLock"),
+      mInOverscrolledApzc(false),
       mTouchCount(0),
       mApzcTreeLog("apzctree")
 {
@@ -66,7 +67,7 @@ APZCTreeManager::GetAllowedTouchBehavior(WidgetInputEvent* aEvent,
     spt.x = touchEvent->touches[i]->mRefPoint.x;
     spt.y = touchEvent->touches[i]->mRefPoint.y;
 
-    nsRefPtr<AsyncPanZoomController> apzc = GetTargetAPZC(spt);
+    nsRefPtr<AsyncPanZoomController> apzc = GetTargetAPZC(spt, nullptr);
     aOutValues.AppendElement(apzc
       ? apzc->GetAllowedTouchBehavior(spt)
       : AllowedTouchBehavior::UNKNOWN);
@@ -378,14 +379,17 @@ APZCTreeManager::ReceiveInputEvent(const InputData& aEvent,
         // MULTITOUCH_START input contains all active touches of the current
         // session thus resetting mTouchCount.
         mTouchCount = multiTouchInput.mTouches.Length();
-        mApzcForInputBlock = GetTargetAPZC(ScreenPoint(multiTouchInput.mTouches[0].mScreenPoint));
+        mInOverscrolledApzc = false;
+        mApzcForInputBlock = GetTargetAPZC(ScreenPoint(multiTouchInput.mTouches[0].mScreenPoint),
+                                           &mInOverscrolledApzc);
         if (multiTouchInput.mTouches.Length() == 1) {
           // If we have one touch point, this might be the start of a pan.
           // Prepare for possible overscroll handoff.
           BuildOverscrollHandoffChain(mApzcForInputBlock);
         }
         for (size_t i = 1; i < multiTouchInput.mTouches.Length(); i++) {
-          nsRefPtr<AsyncPanZoomController> apzc2 = GetTargetAPZC(ScreenPoint(multiTouchInput.mTouches[i].mScreenPoint));
+          nsRefPtr<AsyncPanZoomController> apzc2 = GetTargetAPZC(ScreenPoint(multiTouchInput.mTouches[i].mScreenPoint),
+                                                                 &mInOverscrolledApzc);
           mApzcForInputBlock = CommonAncestor(mApzcForInputBlock.get(), apzc2.get());
           APZC_LOG("Using APZC %p as the common ancestor\n", mApzcForInputBlock.get());
           // For now, we only ever want to do pinching on the root APZC for a given layers id. So
@@ -415,8 +419,11 @@ APZCTreeManager::ReceiveInputEvent(const InputData& aEvent,
         for (size_t i = 0; i < inputForApzc.mTouches.Length(); i++) {
           ApplyTransform(&(inputForApzc.mTouches[i].mScreenPoint), transformToApzc);
         }
-        result = mApzcForInputBlock->ReceiveInputEvent(inputForApzc);
+        mApzcForInputBlock->ReceiveInputEvent(inputForApzc);
       }
+      result = mInOverscrolledApzc ? nsEventStatus_eConsumeNoDefault
+             : mApzcForInputBlock ? nsEventStatus_eConsumeDoDefault
+             : nsEventStatus_eIgnore;
       if (multiTouchInput.mType == MultiTouchInput::MULTITOUCH_CANCEL ||
           multiTouchInput.mType == MultiTouchInput::MULTITOUCH_END) {
         if (mTouchCount >= multiTouchInput.mTouches.Length()) {
@@ -430,31 +437,42 @@ APZCTreeManager::ReceiveInputEvent(const InputData& aEvent,
         // then null it out so we don't keep a dangling reference and leak things.
         if (mTouchCount == 0) {
           mApzcForInputBlock = nullptr;
+          mInOverscrolledApzc = false;
           ClearOverscrollHandoffChain();
         }
       }
       break;
     } case PINCHGESTURE_INPUT: {
       const PinchGestureInput& pinchInput = aEvent.AsPinchGestureInput();
-      nsRefPtr<AsyncPanZoomController> apzc = GetTargetAPZC(pinchInput.mFocusPoint);
+      bool inOverscrolledApzc = false;
+      nsRefPtr<AsyncPanZoomController> apzc = GetTargetAPZC(pinchInput.mFocusPoint,
+                                                            &inOverscrolledApzc);
       if (apzc) {
         apzc->GetGuid(aOutTargetGuid);
         GetInputTransforms(apzc, transformToApzc, transformToGecko);
         PinchGestureInput inputForApzc(pinchInput);
         ApplyTransform(&(inputForApzc.mFocusPoint), transformToApzc);
-        result = apzc->ReceiveInputEvent(inputForApzc);
+        apzc->ReceiveInputEvent(inputForApzc);
       }
+      result = inOverscrolledApzc ? nsEventStatus_eConsumeNoDefault
+             : apzc ? nsEventStatus_eConsumeDoDefault
+             : nsEventStatus_eIgnore;
       break;
     } case TAPGESTURE_INPUT: {
       const TapGestureInput& tapInput = aEvent.AsTapGestureInput();
-      nsRefPtr<AsyncPanZoomController> apzc = GetTargetAPZC(ScreenPoint(tapInput.mPoint));
+      bool inOverscrolledApzc = false;
+      nsRefPtr<AsyncPanZoomController> apzc = GetTargetAPZC(ScreenPoint(tapInput.mPoint),
+                                                            &inOverscrolledApzc);
       if (apzc) {
         apzc->GetGuid(aOutTargetGuid);
         GetInputTransforms(apzc, transformToApzc, transformToGecko);
         TapGestureInput inputForApzc(tapInput);
         ApplyTransform(&(inputForApzc.mPoint), transformToApzc);
-        result = apzc->ReceiveInputEvent(inputForApzc);
+        apzc->ReceiveInputEvent(inputForApzc);
       }
+      result = inOverscrolledApzc ? nsEventStatus_eConsumeNoDefault
+             : apzc ? nsEventStatus_eConsumeDoDefault
+             : nsEventStatus_eIgnore;
       break;
     }
   }
@@ -462,10 +480,12 @@ APZCTreeManager::ReceiveInputEvent(const InputData& aEvent,
 }
 
 already_AddRefed<AsyncPanZoomController>
-APZCTreeManager::GetTouchInputBlockAPZC(const WidgetTouchEvent& aEvent)
+APZCTreeManager::GetTouchInputBlockAPZC(const WidgetTouchEvent& aEvent,
+                                        bool* aOutInOverscrolledApzc)
 {
   ScreenPoint point = ScreenPoint(aEvent.touches[0]->mRefPoint.x, aEvent.touches[0]->mRefPoint.y);
-  nsRefPtr<AsyncPanZoomController> apzc = GetTargetAPZC(point);
+  // Ignore events if any touch hits inside an overscrolled apzc.
+  nsRefPtr<AsyncPanZoomController> apzc = GetTargetAPZC(point, aOutInOverscrolledApzc);
   if (aEvent.touches.Length() == 1) {
     // If we have one touch point, this might be the start of a pan.
     // Prepare for possible overscroll handoff.
@@ -473,7 +493,7 @@ APZCTreeManager::GetTouchInputBlockAPZC(const WidgetTouchEvent& aEvent)
   }
   for (size_t i = 1; i < aEvent.touches.Length(); i++) {
     point = ScreenPoint(aEvent.touches[i]->mRefPoint.x, aEvent.touches[i]->mRefPoint.y);
-    nsRefPtr<AsyncPanZoomController> apzc2 = GetTargetAPZC(point);
+    nsRefPtr<AsyncPanZoomController> apzc2 = GetTargetAPZC(point, aOutInOverscrolledApzc);
     apzc = CommonAncestor(apzc.get(), apzc2.get());
     APZC_LOG("Using APZC %p as the common ancestor\n", apzc.get());
     // For now, we only ever want to do pinching on the root APZC for a given layers id. So
@@ -490,15 +510,15 @@ APZCTreeManager::ProcessTouchEvent(WidgetTouchEvent& aEvent,
 {
   MOZ_ASSERT(NS_IsMainThread());
 
-  nsEventStatus ret = nsEventStatus_eIgnore;
   if (!aEvent.touches.Length()) {
-    return ret;
+    return nsEventStatus_eIgnore;
   }
   if (aEvent.message == NS_TOUCH_START) {
     // NS_TOUCH_START event contains all active touches of the current
     // session thus resetting mTouchCount.
     mTouchCount = aEvent.touches.Length();
-    mApzcForInputBlock = GetTouchInputBlockAPZC(aEvent);
+    mInOverscrolledApzc = false;
+    mApzcForInputBlock = GetTouchInputBlockAPZC(aEvent, &mInOverscrolledApzc);
     if (mApzcForInputBlock) {
       // Cache apz transform so it can be used for future events in this block.
       gfx3DMatrix transformToGecko;
@@ -519,7 +539,7 @@ APZCTreeManager::ProcessTouchEvent(WidgetTouchEvent& aEvent,
     for (size_t i = 0; i < inputForApzc.mTouches.Length(); i++) {
       ApplyTransform(&(inputForApzc.mTouches[i].mScreenPoint), transformToApzc);
     }
-    ret = mApzcForInputBlock->ReceiveInputEvent(inputForApzc);
+    mApzcForInputBlock->ReceiveInputEvent(inputForApzc);
 
     // For computing the event to pass back to Gecko, use the up-to-date transforms.
     // This ensures that transformToApzc and transformToGecko are in sync
@@ -531,6 +551,9 @@ APZCTreeManager::ProcessTouchEvent(WidgetTouchEvent& aEvent,
       ApplyTransform(&(aEvent.touches[i]->mRefPoint), outTransform);
     }
   }
+  nsEventStatus result = mInOverscrolledApzc ? nsEventStatus_eConsumeNoDefault
+                       : mApzcForInputBlock ? nsEventStatus_eConsumeDoDefault
+                       : nsEventStatus_eIgnore;
   // If we have an mApzcForInputBlock and it's the end of the touch sequence
   // then null it out so we don't keep a dangling reference and leak things.
   if (aEvent.message == NS_TOUCH_CANCEL ||
@@ -544,10 +567,11 @@ APZCTreeManager::ProcessTouchEvent(WidgetTouchEvent& aEvent,
     }
     if (mTouchCount == 0) {
       mApzcForInputBlock = nullptr;
+      mInOverscrolledApzc = false;
       ClearOverscrollHandoffChain();
     }
   }
-  return ret;
+  return result;
 }
 
 void
@@ -555,7 +579,7 @@ APZCTreeManager::TransformCoordinateToGecko(const ScreenIntPoint& aPoint,
                                             LayoutDeviceIntPoint* aOutTransformedPoint)
 {
   MOZ_ASSERT(aOutTransformedPoint);
-  nsRefPtr<AsyncPanZoomController> apzc = GetTargetAPZC(aPoint);
+  nsRefPtr<AsyncPanZoomController> apzc = GetTargetAPZC(aPoint, nullptr);
   if (apzc && aOutTransformedPoint) {
     gfx3DMatrix transformToApzc;
     gfx3DMatrix transformToGecko;
@@ -573,18 +597,22 @@ APZCTreeManager::ProcessEvent(WidgetInputEvent& aEvent,
 {
   MOZ_ASSERT(NS_IsMainThread());
 
-  // Transform the refPoint
-  nsRefPtr<AsyncPanZoomController> apzc = GetTargetAPZC(ScreenPoint(aEvent.refPoint.x, aEvent.refPoint.y));
-  if (!apzc) {
-    return nsEventStatus_eIgnore;
+  // Transform the refPoint.
+  // If the event hits an overscrolled APZC, instruct the caller to ignore it.
+  bool inOverscrolledApzc = false;
+  nsRefPtr<AsyncPanZoomController> apzc = GetTargetAPZC(ScreenPoint(aEvent.refPoint.x, aEvent.refPoint.y),
+                                                        &inOverscrolledApzc);
+  if (apzc) {
+    apzc->GetGuid(aOutTargetGuid);
+    gfx3DMatrix transformToApzc;
+    gfx3DMatrix transformToGecko;
+    GetInputTransforms(apzc, transformToApzc, transformToGecko);
+    gfx3DMatrix outTransform = transformToApzc * transformToGecko;
+    ApplyTransform(&(aEvent.refPoint), outTransform);
   }
-  apzc->GetGuid(aOutTargetGuid);
-  gfx3DMatrix transformToApzc;
-  gfx3DMatrix transformToGecko;
-  GetInputTransforms(apzc, transformToApzc, transformToGecko);
-  gfx3DMatrix outTransform = transformToApzc * transformToGecko;
-  ApplyTransform(&(aEvent.refPoint), outTransform);
-  return nsEventStatus_eIgnore;
+  return inOverscrolledApzc ? nsEventStatus_eConsumeNoDefault
+       : apzc ? nsEventStatus_eConsumeDoDefault
+       : nsEventStatus_eIgnore;
 }
 
 nsEventStatus
@@ -707,7 +735,7 @@ TransformDisplacement(APZCTreeManager* aTreeManager,
   ApplyTransform(&aEndPoint, transformToApzc);
 }
 
-void
+bool
 APZCTreeManager::DispatchScroll(AsyncPanZoomController* aPrev, ScreenPoint aStartPoint, ScreenPoint aEndPoint,
                                 uint32_t aOverscrollHandoffChainIndex)
 {
@@ -723,14 +751,15 @@ APZCTreeManager::DispatchScroll(AsyncPanZoomController* aPrev, ScreenPoint aStar
     // nothing more to scroll, so we ignore the rest of the pan gesture.
     if (aOverscrollHandoffChainIndex >= mOverscrollHandoffChain.length()) {
       // Nothing more to scroll - ignore the rest of the pan gesture.
-      return;
+      return false;
     }
 
     next = mOverscrollHandoffChain[aOverscrollHandoffChainIndex];
   }
 
-  if (next == nullptr)
-    return;
+  if (next == nullptr) {
+    return false;
+  }
 
   // Convert the start and end points from |aPrev|'s coordinate space to
   // |next|'s coordinate space. Since |aPrev| may be the same as |next|
@@ -743,10 +772,10 @@ APZCTreeManager::DispatchScroll(AsyncPanZoomController* aPrev, ScreenPoint aStar
 
   // Scroll |next|. If this causes overscroll, it will call DispatchScroll()
   // again with an incremented index.
-  next->AttemptScroll(aStartPoint, aEndPoint, aOverscrollHandoffChainIndex);
+  return next->AttemptScroll(aStartPoint, aEndPoint, aOverscrollHandoffChainIndex);
 }
 
-void
+bool
 APZCTreeManager::HandOffFling(AsyncPanZoomController* aPrev, ScreenPoint aVelocity)
 {
   // Build the overscroll handoff chain. This is necessary because it is
@@ -785,7 +814,7 @@ APZCTreeManager::HandOffFling(AsyncPanZoomController* aPrev, ScreenPoint aVeloci
 
   // Nothing to hand off fling to.
   if (next == nullptr) {
-    return;
+    return false;
   }
 
   // The fling's velocity needs to be transformed from the screen coordinates
@@ -801,7 +830,7 @@ APZCTreeManager::HandOffFling(AsyncPanZoomController* aPrev, ScreenPoint aVeloci
   ScreenPoint transformedVelocity = endPoint - startPoint;
 
   // Tell |next| to start a fling with the transformed velocity.
-  next->TakeOverFling(transformedVelocity);
+  return next->TakeOverFling(transformedVelocity);
 }
 
 bool
@@ -847,17 +876,8 @@ APZCTreeManager::CanBePanned(AsyncPanZoomController* aApzc)
 bool
 APZCTreeManager::HitTestAPZC(const ScreenIntPoint& aPoint)
 {
-  MonitorAutoLock lock(mTreeLock);
-  nsRefPtr<AsyncPanZoomController> target;
-  // The root may have siblings, so check those too
-  gfxPoint point(aPoint.x, aPoint.y);
-  for (AsyncPanZoomController* apzc = mRootApzc; apzc; apzc = apzc->GetPrevSibling()) {
-    target = GetAPZCAtPoint(apzc, point);
-    if (target) {
-      return true;
-    }
-  }
-  return false;
+  nsRefPtr<AsyncPanZoomController> target = GetTargetAPZC(aPoint, nullptr);
+  return target != nullptr;
 }
 
 already_AddRefed<AsyncPanZoomController>
@@ -883,14 +903,14 @@ struct CompareByScrollPriority
 };
 
 already_AddRefed<AsyncPanZoomController>
-APZCTreeManager::GetTargetAPZC(const ScreenPoint& aPoint)
+APZCTreeManager::GetTargetAPZC(const ScreenPoint& aPoint, bool* aOutInOverscrolledApzc)
 {
   MonitorAutoLock lock(mTreeLock);
   nsRefPtr<AsyncPanZoomController> target;
   // The root may have siblings, so check those too
   gfxPoint point(aPoint.x, aPoint.y);
   for (AsyncPanZoomController* apzc = mRootApzc; apzc; apzc = apzc->GetPrevSibling()) {
-    target = GetAPZCAtPoint(apzc, point);
+    target = GetAPZCAtPoint(apzc, point, aOutInOverscrolledApzc);
     if (target) {
       break;
     }
@@ -1023,7 +1043,9 @@ APZCTreeManager::FindTargetAPZC(AsyncPanZoomController* aApzc, const ScrollableL
 }
 
 AsyncPanZoomController*
-APZCTreeManager::GetAPZCAtPoint(AsyncPanZoomController* aApzc, const gfxPoint& aHitTestPoint)
+APZCTreeManager::GetAPZCAtPoint(AsyncPanZoomController* aApzc,
+                                const gfxPoint& aHitTestPoint,
+                                bool* aOutInOverscrolledApzc)
 {
   mTreeLock.AssertCurrentThreadOwns();
 
@@ -1058,20 +1080,33 @@ APZCTreeManager::GetAPZCAtPoint(AsyncPanZoomController* aApzc, const gfxPoint& a
            aHitTestPoint.x, aHitTestPoint.y,
            hitTestPointForChildLayers.x, hitTestPointForChildLayers.y, aApzc);
 
+  AsyncPanZoomController* result = nullptr;
   // This walks the tree in depth-first, reverse order, so that it encounters
   // APZCs front-to-back on the screen.
   for (AsyncPanZoomController* child = aApzc->GetLastChild(); child; child = child->GetPrevSibling()) {
-    AsyncPanZoomController* match = GetAPZCAtPoint(child, hitTestPointForChildLayers);
+    AsyncPanZoomController* match = GetAPZCAtPoint(child, hitTestPointForChildLayers, aOutInOverscrolledApzc);
     if (match) {
-      return match;
+      result = match;
+      break;
     }
   }
-  if (aApzc->VisibleRegionContains(ViewAs<ParentLayerPixel>(hitTestPointForThisLayer))) {
+  if (!result && aApzc->VisibleRegionContains(ViewAs<ParentLayerPixel>(hitTestPointForThisLayer))) {
     APZC_LOG("Successfully matched untransformed point %f %f to visible region for APZC %p\n",
              hitTestPointForThisLayer.x, hitTestPointForThisLayer.y, aApzc);
-    return aApzc;
+    result = aApzc;
   }
-  return nullptr;
+
+  // If we are overscrolled, and the point matches us or one of our children,
+  // the result is inside an overscrolled APZC, inform our caller of this
+  // (callers typically ignore events targeted at overscrolled APZCs).
+  if (result && aApzc->IsOverscrolled()) {
+    if (aOutInOverscrolledApzc) {
+      *aOutInOverscrolledApzc = true;
+    }
+    result = nullptr;
+  }
+
+  return result;
 }
 
 /* This function sets the aTransformToApzcOut and aTransformToGeckoOut out-parameters
diff --git a/gfx/layers/apz/src/APZCTreeManager.h b/gfx/layers/apz/src/APZCTreeManager.h
index 7991af84fff2..7e2783ed4684 100644
--- a/gfx/layers/apz/src/APZCTreeManager.h
+++ b/gfx/layers/apz/src/APZCTreeManager.h
@@ -246,6 +246,10 @@ public:
    * |aOverscrollHandoffChainIndex| is the next position in the overscroll
    *   handoff chain that should be scrolled.
    *
+   * Returns true iff. some APZC accepted the scroll and scrolled.
+   * This is to allow the sending APZC to go into an overscrolled state if
+   * no APZC further up in the handoff chain accepted the overscroll.
+   *
    * The way this method works is best illustrated with an example.
    * Consider three nested APZCs, A, B, and C, with C being the innermost one.
    * Say B is scroll-grabbing.
@@ -267,7 +271,7 @@ public:
    * Note: this should be used for panning only. For handing off overscroll for
    *       a fling, use HandOffFling().
    */
-  void DispatchScroll(AsyncPanZoomController* aAPZC, ScreenPoint aStartPoint, ScreenPoint aEndPoint,
+  bool DispatchScroll(AsyncPanZoomController* aAPZC, ScreenPoint aStartPoint, ScreenPoint aEndPoint,
                       uint32_t aOverscrollHandoffChainIndex);
 
   /**
@@ -276,8 +280,11 @@ public:
    * @param aApzc the APZC that is handing off the fling
    * @param aVelocity the current velocity of the fling, in |aApzc|'s screen
    *                  pixels per millisecond
+   * Returns true iff. another APZC accepted the handed-off fling. The caller
+   * (|aApzc|) uses this return value to determine whether it should consume
+   * the excess fling itself by going into an overscroll fling.
    */
-  void HandOffFling(AsyncPanZoomController* aApzc, ScreenPoint aVelocity);
+  bool HandOffFling(AsyncPanZoomController* aApzc, ScreenPoint aVelocity);
 
   bool FlushRepaintsForOverscrollHandoffChain();
 
@@ -296,6 +303,11 @@ protected:
    * Build the chain of APZCs that will handle overscroll for a pan starting at |aInitialTarget|.
    */
   void BuildOverscrollHandoffChain(const nsRefPtr<AsyncPanZoomController>& aInitialTarget);
+
+  /*
+   * Clear the handoff chain built in BuildOverscrollHandoffChain().
+   */
+  void ClearOverscrollHandoffChain();
 public:
   /* Some helper functions to find an APZC given some identifying input. These functions
      lock the tree of APZCs while they find the right one, and then return an addref'd
@@ -304,22 +316,27 @@ public:
      used by other production code.
   */
   already_AddRefed<AsyncPanZoomController> GetTargetAPZC(const ScrollableLayerGuid& aGuid);
-  already_AddRefed<AsyncPanZoomController> GetTargetAPZC(const ScreenPoint& aPoint);
+  already_AddRefed<AsyncPanZoomController> GetTargetAPZC(const ScreenPoint& aPoint,
+                                                         bool* aOutInOverscrolledApzc);
   void GetInputTransforms(AsyncPanZoomController *aApzc, gfx3DMatrix& aTransformToApzcOut,
                           gfx3DMatrix& aTransformToGeckoOut);
 private:
   /* Helpers */
   AsyncPanZoomController* FindTargetAPZC(AsyncPanZoomController* aApzc, FrameMetrics::ViewID aScrollId);
   AsyncPanZoomController* FindTargetAPZC(AsyncPanZoomController* aApzc, const ScrollableLayerGuid& aGuid);
-  AsyncPanZoomController* GetAPZCAtPoint(AsyncPanZoomController* aApzc, const gfxPoint& aHitTestPoint);
+  AsyncPanZoomController* GetAPZCAtPoint(AsyncPanZoomController* aApzc,
+                                         const gfxPoint& aHitTestPoint,
+                                         bool* aOutInOverscrolledApzc);
   already_AddRefed<AsyncPanZoomController> CommonAncestor(AsyncPanZoomController* aApzc1, AsyncPanZoomController* aApzc2);
   already_AddRefed<AsyncPanZoomController> RootAPZCForLayersId(AsyncPanZoomController* aApzc);
-  already_AddRefed<AsyncPanZoomController> GetTouchInputBlockAPZC(const WidgetTouchEvent& aEvent);
-  nsEventStatus ProcessTouchEvent(WidgetTouchEvent& touchEvent, ScrollableLayerGuid* aOutTargetGuid);
-  nsEventStatus ProcessEvent(WidgetInputEvent& inputEvent, ScrollableLayerGuid* aOutTargetGuid);
+  already_AddRefed<AsyncPanZoomController> GetTouchInputBlockAPZC(const WidgetTouchEvent& aEvent,
+                                                                  bool* aOutInOverscrolledApzc);
+  nsEventStatus ProcessTouchEvent(WidgetTouchEvent& touchEvent,
+                                  ScrollableLayerGuid* aOutTargetGuid);
+  nsEventStatus ProcessEvent(WidgetInputEvent& inputEvent,
+                             ScrollableLayerGuid* aOutTargetGuid);
   void UpdateZoomConstraintsRecursively(AsyncPanZoomController* aApzc,
                                         const ZoomConstraints& aConstraints);
-  void ClearOverscrollHandoffChain();
 
   /**
    * Recursive helper function to build the APZC tree. The tree of APZC instances has
@@ -356,6 +373,10 @@ private:
    * input delivery thread, and so does not require locking.
    */
   nsRefPtr<AsyncPanZoomController> mApzcForInputBlock;
+  /* Whether the current input event block is being ignored because the touch-start
+   * was inside an overscrolled APZC.
+   */
+  bool mInOverscrolledApzc;
   /* The number of touch points we are tracking that are currently on the screen. */
   uint32_t mTouchCount;
   /* The transform from root screen coordinates into mApzcForInputBlock's
diff --git a/gfx/layers/apz/src/AsyncPanZoomController.cpp b/gfx/layers/apz/src/AsyncPanZoomController.cpp
index a24465fd3e17..4b1e71e4a0be 100644
--- a/gfx/layers/apz/src/AsyncPanZoomController.cpp
+++ b/gfx/layers/apz/src/AsyncPanZoomController.cpp
@@ -45,7 +45,7 @@
 #include "mozilla/layers/TaskThrottler.h"  // for TaskThrottler
 #include "mozilla/mozalloc.h"           // for operator new, etc
 #include "mozilla/unused.h"             // for unused
-#include "mozilla/FloatingPoint.h"      // for FuzzyEqualsMultiplicative
+#include "mozilla/FloatingPoint.h"      // for FuzzyEquals*
 #include "nsAlgorithm.h"                // for clamped
 #include "nsAutoPtr.h"                  // for nsRefPtr
 #include "nsCOMPtr.h"                   // for already_AddRefed
@@ -129,8 +129,6 @@ WidgetModifiersToDOMModifiers(mozilla::Modifiers aModifiers)
 namespace mozilla {
 namespace layers {
 
-using namespace mozilla::css;
-
 typedef mozilla::layers::AllowedTouchBehavior AllowedTouchBehavior;
 typedef GeckoContentController::APZStateChange APZStateChange;
 
@@ -213,6 +211,17 @@ typedef GeckoContentController::APZStateChange APZStateChange;
  *
  * "apz.num_paint_duration_samples"
  * Number of samples to store of how long it took to paint after the previous
+ *
+ * "apz.overscroll.enabled"
+ * Pref that enables overscrolling. If this is disabled, excess scroll that
+ * cannot be handed off is discarded.
+ *
+ * "apz.overscroll.snap_back_accel"
+ * Amount of acceleration applied during the snap-back animation.
+ *
+ * "apz.overscroll.snap_back_init_vel"
+ * Initial velocity of a snap-back animation along one axis.
+ * Units: screen pixels per millisecond
  * requests.
  *
  * "apz.pan_repaint_interval"
@@ -236,6 +245,12 @@ typedef GeckoContentController::APZStateChange APZStateChange;
  * How much to adjust the displayport in the direction of scrolling. This value
  * is multiplied by the velocity and added to the displayport offset.
  *
+ * "apz.velocity_relevance_time_ms"
+ * When computing a fling velocity from the most recently stored velocity
+ * information, only velocities within the most X milliseconds are used.
+ * This pref controls the value of X.
+ * Units: ms
+ *
  * "apz.x_skate_size_multiplier", "apz.y_skate_size_multiplier"
  * The multiplier we apply to the displayport size if it is skating (current
  * velocity is above apz.min_skate_speed). We prefer to increase the size of the
@@ -291,7 +306,7 @@ static const double ALLOWED_DIRECT_PAN_ANGLE = M_PI / 3.0; // 60 degrees
 /**
  * Computed time function used for sampling frames of a zoom to animation.
  */
-StaticAutoPtr<ComputedTimingFunction> gComputedTimingFunction;
+StaticAutoPtr<css::ComputedTimingFunction> gComputedTimingFunction;
 
 /**
  * Maximum zoom amount, always used, even if a page asks for higher.
@@ -354,9 +369,12 @@ GetFrameTime() {
 
 class FlingAnimation: public AsyncPanZoomAnimation {
 public:
-  FlingAnimation(AsyncPanZoomController& aApzc, bool aApplyAcceleration)
+  FlingAnimation(AsyncPanZoomController& aApzc,
+                 bool aApplyAcceleration,
+                 bool aAllowOverscroll)
     : AsyncPanZoomAnimation(TimeDuration::FromMilliseconds(gfxPrefs::APZFlingRepaintInterval()))
     , mApzc(aApzc)
+    , mAllowOverscroll(aAllowOverscroll)
   {
     TimeStamp now = GetFrameTime();
     ScreenPoint velocity(mApzc.mX.GetVelocity(), mApzc.mY.GetVelocity());
@@ -395,7 +413,7 @@ public:
    * or false if there is no fling or the fling has ended.
    */
   virtual bool Sample(FrameMetrics& aFrameMetrics,
-                      const TimeDuration& aDelta);
+                      const TimeDuration& aDelta) MOZ_OVERRIDE;
 
 private:
   static bool SameDirection(float aVelocity1, float aVelocity2)
@@ -412,6 +430,7 @@ private:
   }
 
   AsyncPanZoomController& mApzc;
+  bool mAllowOverscroll;
 };
 
 class ZoomAnimation: public AsyncPanZoomAnimation {
@@ -426,7 +445,7 @@ public:
   {}
 
   virtual bool Sample(FrameMetrics& aFrameMetrics,
-                      const TimeDuration& aDelta);
+                      const TimeDuration& aDelta) MOZ_OVERRIDE;
 
 private:
   TimeDuration mDuration;
@@ -446,6 +465,26 @@ private:
   CSSToScreenScale mEndZoom;
 };
 
+class OverscrollSnapBackAnimation: public AsyncPanZoomAnimation {
+public:
+  OverscrollSnapBackAnimation(AsyncPanZoomController& aApzc)
+    : mApzc(aApzc)
+  {
+    mApzc.mX.StartSnapBack();
+    mApzc.mY.StartSnapBack();
+  }
+
+  virtual bool Sample(FrameMetrics& aFrameMetrics,
+                      const TimeDuration& aDelta) MOZ_OVERRIDE
+  {
+    return mApzc.mX.SampleSnapBack(aDelta)
+        || mApzc.mY.SampleSnapBack(aDelta);
+  }
+
+private:
+  AsyncPanZoomController& mApzc;
+};
+
 void
 AsyncPanZoomController::SetFrameTime(const TimeStamp& aTime) {
   sFrameTime = aTime;
@@ -471,7 +510,7 @@ AsyncPanZoomController::InitializeGlobalState()
     return;
   sInitialized = true;
 
-  gComputedTimingFunction = new ComputedTimingFunction();
+  gComputedTimingFunction = new css::ComputedTimingFunction();
   gComputedTimingFunction->Init(
     nsTimingFunction(NS_STYLE_TRANSITION_TIMING_FUNCTION_EASE));
   ClearOnShutdown(&gComputedTimingFunction);
@@ -653,7 +692,6 @@ nsEventStatus AsyncPanZoomController::HandleInputEvent(const InputData& aEvent)
   default: NS_WARNING("Unhandled input event"); break;
   }
 
-  mLastEventTime = aEvent.mTime;
   return rv;
 }
 
@@ -688,7 +726,6 @@ nsEventStatus AsyncPanZoomController::HandleGestureEvent(const InputData& aEvent
   default: NS_WARNING("Unhandled input event"); break;
   }
 
-  mLastEventTime = aEvent.mTime;
   return rv;
 }
 
@@ -712,8 +749,8 @@ nsEventStatus AsyncPanZoomController::OnTouchStart(const MultiTouchInput& aEvent
       CancelAnimation();
       // Fall through.
     case NOTHING: {
-      mX.StartTouch(point.x);
-      mY.StartTouch(point.y);
+      mX.StartTouch(point.x, aEvent.mTime);
+      mY.StartTouch(point.y, aEvent.mTime);
       APZCTreeManager* treeManagerLocal = mTreeManager;
       nsRefPtr<GeckoContentController> controller = GetGeckoContentController();
       if (treeManagerLocal && controller) {
@@ -792,6 +829,9 @@ nsEventStatus AsyncPanZoomController::OnTouchMove(const MultiTouchInput& aEvent)
       return nsEventStatus_eIgnore;
 
     case WAITING_CONTENT_RESPONSE:
+    case SNAP_BACK:  // Should not receive a touch-move in the SNAP_BACK state
+                     // as touch blocks that begin in an overscrolled state
+                     // are ignored.
       NS_WARNING("Received impossible touch in OnTouchMove");
       break;
   }
@@ -848,10 +888,12 @@ nsEventStatus AsyncPanZoomController::OnTouchEnd(const MultiTouchInput& aEvent)
         }
       }
     }
-    mX.EndTouch();
-    mY.EndTouch();
+    mX.EndTouch(aEvent.mTime);
+    mY.EndTouch(aEvent.mTime);
     SetState(FLING);
-    StartAnimation(new FlingAnimation(*this, true));
+    StartAnimation(new FlingAnimation(*this,
+                                      true  /* apply acceleration */,
+                                      false /* allow overscroll */));
     return nsEventStatus_eConsumeNoDefault;
 
   case PINCHING:
@@ -861,6 +903,9 @@ nsEventStatus AsyncPanZoomController::OnTouchEnd(const MultiTouchInput& aEvent)
     return nsEventStatus_eIgnore;
 
   case WAITING_CONTENT_RESPONSE:
+  case SNAP_BACK:  // Should not receive a touch-move in the SNAP_BACK state
+                   // as touch blocks that begin in an overscrolled state
+                   // are ignored.
     NS_WARNING("Received impossible touch in OnTouchEnd");
     break;
   }
@@ -1124,7 +1169,7 @@ void AsyncPanZoomController::HandlePanningWithTouchAction(double aAngle, TouchBe
   // Handling of cross sliding will need to be added in this method after touch-action released
   // enabled by default.
   if ((aBehavior & AllowedTouchBehavior::VERTICAL_PAN) && (aBehavior & AllowedTouchBehavior::HORIZONTAL_PAN)) {
-    if (mX.Scrollable() && mY.Scrollable()) {
+    if (mX.CanScrollNow() && mY.CanScrollNow()) {
       if (IsCloseToHorizontal(aAngle, AXIS_LOCK_ANGLE)) {
         mY.SetAxisLocked(true);
         SetState(PANNING_LOCKED_X);
@@ -1134,7 +1179,7 @@ void AsyncPanZoomController::HandlePanningWithTouchAction(double aAngle, TouchBe
       } else {
         SetState(PANNING);
       }
-    } else if (mX.Scrollable() || mY.Scrollable()) {
+    } else if (mX.CanScrollNow() || mY.CanScrollNow()) {
       SetState(PANNING);
     } else {
       SetState(NOTHING);
@@ -1165,11 +1210,11 @@ void AsyncPanZoomController::HandlePanningWithTouchAction(double aAngle, TouchBe
 }
 
 void AsyncPanZoomController::HandlePanning(double aAngle) {
-  if (!gfxPrefs::APZCrossSlideEnabled() && (!mX.Scrollable() || !mY.Scrollable())) {
+  if (!gfxPrefs::APZCrossSlideEnabled() && (!mX.CanScrollNow() || !mY.CanScrollNow())) {
     SetState(PANNING);
   } else if (IsCloseToHorizontal(aAngle, AXIS_LOCK_ANGLE)) {
     mY.SetAxisLocked(true);
-    if (mX.Scrollable()) {
+    if (mX.CanScrollNow()) {
       SetState(PANNING_LOCKED_X);
     } else {
       SetState(CROSS_SLIDING_X);
@@ -1177,7 +1222,7 @@ void AsyncPanZoomController::HandlePanning(double aAngle) {
     }
   } else if (IsCloseToVertical(aAngle, AXIS_LOCK_ANGLE)) {
     mX.SetAxisLocked(true);
-    if (mY.Scrollable()) {
+    if (mY.CanScrollNow()) {
       SetState(PANNING_LOCKED_Y);
     } else {
       SetState(CROSS_SLIDING_Y);
@@ -1197,9 +1242,8 @@ nsEventStatus AsyncPanZoomController::StartPanning(const MultiTouchInput& aEvent
 
   // When the touch move breaks through the pan threshold, reposition the touch down origin
   // so the page won't jump when we start panning.
-  mX.StartTouch(point.x);
-  mY.StartTouch(point.y);
-  mLastEventTime = aEvent.mTime;
+  mX.StartTouch(point.x, aEvent.mTime);
+  mY.StartTouch(point.y, aEvent.mTime);
 
   double angle = atan2(dy, dx); // range [-pi, pi]
   angle = fabs(angle); // range [0, pi]
@@ -1226,18 +1270,11 @@ nsEventStatus AsyncPanZoomController::StartPanning(const MultiTouchInput& aEvent
 
 void AsyncPanZoomController::UpdateWithTouchAtDevicePoint(const MultiTouchInput& aEvent) {
   ScreenIntPoint point = GetFirstTouchScreenPoint(aEvent);
-  TimeDuration timeDelta = TimeDuration().FromMilliseconds(aEvent.mTime - mLastEventTime);
-
-  // Probably a duplicate event, just throw it away.
-  if (timeDelta.ToMilliseconds() <= EPSILON) {
-    return;
-  }
-
-  mX.UpdateWithTouchAtDevicePoint(point.x, timeDelta);
-  mY.UpdateWithTouchAtDevicePoint(point.y, timeDelta);
+  mX.UpdateWithTouchAtDevicePoint(point.x, aEvent.mTime);
+  mY.UpdateWithTouchAtDevicePoint(point.y, aEvent.mTime);
 }
 
-void AsyncPanZoomController::AttemptScroll(const ScreenPoint& aStartPoint,
+bool AsyncPanZoomController::AttemptScroll(const ScreenPoint& aStartPoint,
                                            const ScreenPoint& aEndPoint,
                                            uint32_t aOverscrollHandoffChainIndex) {
 
@@ -1247,6 +1284,7 @@ void AsyncPanZoomController::AttemptScroll(const ScreenPoint& aStartPoint,
   ScreenPoint displacement = aStartPoint - aEndPoint;
 
   ScreenPoint overscroll;  // will be used outside monitor block
+  CSSPoint cssOverscroll;  // ditto
   {
     ReentrantMonitorAutoEnter lock(mMonitor);
 
@@ -1256,7 +1294,6 @@ void AsyncPanZoomController::AttemptScroll(const ScreenPoint& aStartPoint,
     // the same swipe should move you a shorter distance).
     CSSPoint cssDisplacement = displacement / zoom;
 
-    CSSPoint cssOverscroll;
     CSSPoint allowedDisplacement(mX.AdjustDisplacement(cssDisplacement.x,
                                                        cssOverscroll.x),
                                  mY.AdjustDisplacement(cssDisplacement.y,
@@ -1265,53 +1302,113 @@ void AsyncPanZoomController::AttemptScroll(const ScreenPoint& aStartPoint,
 
     if (!IsZero(allowedDisplacement)) {
       ScrollBy(allowedDisplacement);
-      ScheduleComposite();
-
-      TimeDuration timePaintDelta = mPaintThrottler.TimeSinceLastRequest(GetFrameTime());
-      if (timePaintDelta.ToMilliseconds() > gfxPrefs::APZPanRepaintInterval()) {
-        RequestContentRepaint();
-      }
+      ScheduleCompositeAndMaybeRepaint();
       UpdateSharedCompositorFrameMetrics();
     }
   }
 
-  if (!IsZero(overscroll)) {
-    // "+ overscroll" rather than "- overscroll" because "overscroll" is what's
-    // left of "displacement", and "displacement" is "start - end".
-    CallDispatchScroll(aEndPoint + overscroll, aEndPoint, aOverscrollHandoffChainIndex + 1);
+  // If we consumed the entire displacement as a normal scroll, great.
+  if (IsZero(overscroll)) {
+    return true;
   }
+
+  // If there is overscroll, first try to hand it off to an APZC later
+  // in the handoff chain to consume (either as a normal scroll or as
+  // overscroll).
+  // Note: "+ overscroll" rather than "- overscroll" because "overscroll"
+  // is what's left of "displacement", and "displacement" is "start - end".
+  if (CallDispatchScroll(aEndPoint + overscroll, aEndPoint, aOverscrollHandoffChainIndex + 1)) {
+    return true;
+  }
+
+  // If there is no APZC later in the handoff chain that accepted the
+  // overscroll, try to accept it ourselves. We only accept it if we
+  // are pannable.
+  return OverscrollBy(cssOverscroll);
 }
 
-void AsyncPanZoomController::TakeOverFling(ScreenPoint aVelocity) {
+bool AsyncPanZoomController::OverscrollBy(const CSSPoint& aOverscroll) {
+  if (!gfxPrefs::APZOverscrollEnabled()) {
+    return false;
+  }
+
+  ReentrantMonitorAutoEnter lock(mMonitor);
+  // Do not go into overscroll in a direction in which we have no room to
+  // scroll to begin with.
+  bool xCanScroll = mX.CanScroll();
+  bool yCanScroll = mY.CanScroll();
+  if (xCanScroll) {
+    mX.OverscrollBy(aOverscroll.x);
+  }
+  if (yCanScroll) {
+    mY.OverscrollBy(aOverscroll.y);
+  }
+  if (xCanScroll || yCanScroll) {
+    ScheduleComposite();
+    return true;
+  }
+  // TODO(botond): If one of the x- or y-overscroll was not accepted, we
+  // may want to propagate that one to an APZC earlier in the handoff chain.
+  return false;
+}
+
+void AsyncPanZoomController::AcceptFling(const ScreenPoint& aVelocity,
+                                         bool aAllowOverscroll) {
   // We may have a pre-existing velocity for whatever reason (for example,
   // a previously handed off fling). We don't want to clobber that.
   mX.SetVelocity(mX.GetVelocity() + aVelocity.x);
   mY.SetVelocity(mY.GetVelocity() + aVelocity.y);
   SetState(FLING);
-  StartAnimation(new FlingAnimation(*this, false));
+  StartAnimation(new FlingAnimation(*this, false /* no acceleration */,
+                                    aAllowOverscroll));
 }
 
-void AsyncPanZoomController::CallDispatchScroll(const ScreenPoint& aStartPoint, const ScreenPoint& aEndPoint,
+bool AsyncPanZoomController::TakeOverFling(ScreenPoint aVelocity) {
+  // If we are pannable, take over the fling ourselves.
+  if (IsPannable()) {
+    AcceptFling(aVelocity, false /* do not allow overscroll */);
+    return true;
+  }
+
+  // Otherwise, hand the fling back to the tree manager to pass on to the
+  // next APZC in the handoff chain. Had we started a fling animation in this
+  // APZC, we would have done this hand-off on its first frame anyways, but
+  // doing it here allows the tree manager to tell the previous APZC to enter
+  // an overscroll fling if nothing further in the chain wants the fling.
+  APZCTreeManager* treeManagerLocal = mTreeManager;
+  return treeManagerLocal
+      && treeManagerLocal->HandOffFling(this, aVelocity);
+}
+
+void AsyncPanZoomController::HandleFlingOverscroll(const ScreenPoint& aVelocity) {
+  APZCTreeManager* treeManagerLocal = mTreeManager;
+  if (!(treeManagerLocal && treeManagerLocal->HandOffFling(this, aVelocity))) {
+    // No one wanted the fling, so we enter into an overscroll fling ourselves.
+    if (IsPannable()) {
+      AcceptFling(aVelocity, true /* allow overscroll */);
+    }
+  }
+}
+
+void AsyncPanZoomController::StartSnapBack() {
+  SetState(SNAP_BACK);
+  StartAnimation(new OverscrollSnapBackAnimation(*this));
+}
+
+bool AsyncPanZoomController::CallDispatchScroll(const ScreenPoint& aStartPoint, const ScreenPoint& aEndPoint,
                                                 uint32_t aOverscrollHandoffChainIndex) {
   // Make a local copy of the tree manager pointer and check if it's not
   // null before calling DispatchScroll(). This is necessary because
   // Destroy(), which nulls out mTreeManager, could be called concurrently.
   APZCTreeManager* treeManagerLocal = mTreeManager;
-  if (treeManagerLocal) {
-    treeManagerLocal->DispatchScroll(this, aStartPoint, aEndPoint,
-                                     aOverscrollHandoffChainIndex);
-  }
+  return treeManagerLocal
+      && treeManagerLocal->DispatchScroll(this, aStartPoint, aEndPoint,
+                                          aOverscrollHandoffChainIndex);
 }
 
 void AsyncPanZoomController::TrackTouch(const MultiTouchInput& aEvent) {
   ScreenIntPoint prevTouchPoint(mX.GetPos(), mY.GetPos());
   ScreenIntPoint touchPoint = GetFirstTouchScreenPoint(aEvent);
-  TimeDuration timeDelta = TimeDuration().FromMilliseconds(aEvent.mTime - mLastEventTime);
-
-  // Probably a duplicate event, just throw it away.
-  if (timeDelta.ToMilliseconds() <= EPSILON) {
-    return;
-  }
 
   // If we're axis-locked, check if the user is trying to break the lock
   if (GetAxisLockMode() == STICKY && !mPanDirRestricted) {
@@ -1341,7 +1438,9 @@ void AsyncPanZoomController::TrackTouch(const MultiTouchInput& aEvent) {
 
   UpdateWithTouchAtDevicePoint(aEvent);
 
-  CallDispatchScroll(prevTouchPoint, touchPoint, 0);
+  if (prevTouchPoint != touchPoint) {
+    CallDispatchScroll(prevTouchPoint, touchPoint, 0);
+  }
 }
 
 ScreenIntPoint& AsyncPanZoomController::GetFirstTouchScreenPoint(const MultiTouchInput& aEvent) {
@@ -1367,6 +1466,10 @@ bool FlingAnimation::Sample(FrameMetrics& aFrameMetrics,
        shouldContinueFlingY = mApzc.mY.FlingApplyFrictionOrCancel(aDelta);
   // If we shouldn't continue the fling, let's just stop and repaint.
   if (!shouldContinueFlingX && !shouldContinueFlingY) {
+    // If we are in overscroll, schedule the snap-back animation that relieves it.
+    if (mApzc.IsOverscrolled()) {
+      mDeferredTasks.append(NewRunnableMethod(&mApzc, &AsyncPanZoomController::StartSnapBack));
+    }
     return false;
   }
 
@@ -1387,36 +1490,45 @@ bool FlingAnimation::Sample(FrameMetrics& aFrameMetrics,
     mApzc.mY.AdjustDisplacement(cssOffset.y, overscroll.y)
   ));
 
-  // If the fling has caused us to reach the end of our scroll range, hand
-  // off the fling to the next APZC in the overscroll handoff chain.
+  // The fling may have caused us to reach the end of our scroll range.
   if (!IsZero(overscroll)) {
-    // We may have reached the end of the scroll range along one axis but
-    // not the other. In such a case we only want to hand off the relevant
-    // component of the fling.
-    if (FuzzyEqualsMultiplicative(overscroll.x, 0.0f)) {
-      velocity.x = 0;
-    } else if (FuzzyEqualsMultiplicative(overscroll.y, 0.0f)) {
-      velocity.y = 0;
-    }
+    if (mAllowOverscroll) {
+      // If this is a fling that allows overscroll, then go into overscroll.
 
-    // To hand off the fling, we call APZCTreeManager::HandOffFling()
-    // which starts a new fling in the next APZC in the handoff chain with
-    // the same velocity. For simplicity, the actual overscroll of the current
-    // sample is discarded rather than being handed off. The compositor should
-    // sample animations sufficiently frequently that this is not noticeable.
+      mApzc.OverscrollBy(overscroll);
 
-    // Make a local copy of the tree manager pointer and check if it's not
-    // null before calling HandOffFling(). This is necessary because
-    // Destroy(), which nulls out mTreeManager, could be called concurrently.
-    APZCTreeManager* treeManagerLocal = mApzc.mTreeManager;
-    if (treeManagerLocal) {
-      // APZC is holding mMonitor, so directly calling HandOffFling()
-      // (which acquires the tree lock) would violate the lock ordering. Instead
-      // we schedule HandOffFling() to be called after mMonitor is
-      // released.
-      mDeferredTasks.append(NewRunnableMethod(treeManagerLocal,
-                                              &APZCTreeManager::HandOffFling,
-                                              &mApzc,
+      // Restore the velocity of the fling, which was zeroed out by
+      // AdjustDisplacement().
+      mApzc.mX.SetVelocity(velocity.x);
+      mApzc.mY.SetVelocity(velocity.y);
+
+    } else {
+      // Otherwise, hand off the fling to the next APZC in the overscroll
+      // handoff chain.
+
+      // We may have reached the end of the scroll range along one axis but
+      // not the other. In such a case we only want to hand off the relevant
+      // component of the fling.
+      if (FuzzyEqualsAdditive(overscroll.x, 0.0f, COORDINATE_EPSILON)) {
+        velocity.x = 0;
+      } else if (FuzzyEqualsAdditive(overscroll.y, 0.0f, COORDINATE_EPSILON)) {
+        velocity.y = 0;
+      }
+
+      // To hand off the fling, we attempt to find a target APZC and start a new
+      // fling with the same velocity on that APZC. For simplicity, the actual
+      // overscroll of the current sample is discarded rather than being handed
+      // off. The compositor should sample animations sufficiently frequently
+      // that this is not noticeable. The target APZC is chosen by seeing if
+      // there is an APZC further in the handoff chain which is pannable; if
+      // there isn't, we take the new fling ourselves, entering an overscrolled
+      // state.
+      // Note: APZC is holding mMonitor, so directly calling
+      // HandleFlingOverscroll() (which acquires the tree lock) would violate
+      // the lock ordering. Instead we schedule HandleFlingOverscroll() to be
+      // called after mMonitor is released.
+      mDeferredTasks.append(NewRunnableMethod(&mApzc,
+                                              &AsyncPanZoomController::HandleFlingOverscroll,
                                               velocity));
     }
   }
@@ -1556,6 +1668,15 @@ void AsyncPanZoomController::ScheduleComposite() {
   }
 }
 
+void AsyncPanZoomController::ScheduleCompositeAndMaybeRepaint() {
+  ScheduleComposite();
+
+  TimeDuration timePaintDelta = mPaintThrottler.TimeSinceLastRequest(GetFrameTime());
+  if (timePaintDelta.ToMilliseconds() > gfxPrefs::APZPanRepaintInterval()) {
+    RequestContentRepaint();
+  }
+}
+
 void AsyncPanZoomController::FlushRepaintForOverscrollHandoff() {
   ReentrantMonitorAutoEnter lock(mMonitor);
   RequestContentRepaint();
@@ -1564,7 +1685,7 @@ void AsyncPanZoomController::FlushRepaintForOverscrollHandoff() {
 
 bool AsyncPanZoomController::IsPannable() const {
   ReentrantMonitorAutoEnter lock(mMonitor);
-  return mX.HasRoomToPan() || mY.HasRoomToPan();
+  return mX.CanScroll() || mY.CanScroll();
 }
 
 void AsyncPanZoomController::RequestContentRepaint() {
@@ -1670,10 +1791,13 @@ bool ZoomAnimation::Sample(FrameMetrics& aFrameMetrics,
   return true;
 }
 
-bool AsyncPanZoomController::UpdateAnimation(const TimeStamp& aSampleTime)
+bool AsyncPanZoomController::UpdateAnimation(const TimeStamp& aSampleTime,
+                                             Vector<Task*>* aOutDeferredTasks)
 {
   if (mAnimation) {
-    if (mAnimation->Sample(mFrameMetrics, aSampleTime - mLastSampleTime)) {
+    bool continueAnimation = mAnimation->Sample(mFrameMetrics, aSampleTime - mLastSampleTime);
+    *aOutDeferredTasks = mAnimation->TakeDeferredTasks();
+    if (continueAnimation) {
       if (mPaintThrottler.TimeSinceLastRequest(aSampleTime) >
           mAnimation->mRepaintInterval) {
         RequestContentRepaint();
@@ -1691,6 +1815,91 @@ bool AsyncPanZoomController::UpdateAnimation(const TimeStamp& aSampleTime)
   return false;
 }
 
+void AsyncPanZoomController::ApplyOverscrollEffect(ViewTransform* aTransform) const {
+  // The overscroll effect applied here is a combination of a translation in
+  // the direction of overscroll, and shrinking in both directions. For
+  // example, when overscrolling past the top of the page, the rectangle of
+  // content that filled the composition bounds will now fill a smaller
+  // rectangle at the bottom of the composition bounds, centred horizontally.
+  // The magnitude of the translation and the shrinking depends on the amount
+  // of the overscroll.
+  // With the effect applied, we can think of the composited region as being
+  // made up of the following subregions.
+  //  (1) The shrunk content that used to fill the composited region.
+  //  (2) The space created along the axis that has overscroll. This space is
+  //      blank, filled by the background color of the overscrolled content.
+  //      TODO(botond): Implement handling of background color.
+  //  (3) The space created along the other axis. There may or may not be
+  //      content available to fill this space, depending on our scroll
+  //      position along this axis. If there is content, it's shown from the
+  //      displayport. (TODO: Currently we don't take any measures to ensure
+  //      that the displayport is large enough to have this content. Perhaps
+  //      we should.) Otherwise, these spaces are also blank like (2).
+  // To illustrate, for the case where we are overscrolling past the top of
+  // the page, these regions are (1) the bottom-centre region, (2) the top
+  // regions, and (3) the bottom-left and bottom-right regions of the
+  // composited area, respectively.
+
+  // The maximum proportion of the composition length which can become blank
+  // space along an axis as we overscroll along that axis.
+  const float CLAMPING = 0.5;
+
+  // The proportion of the composition length which will become blank space
+  // along each axis as a result of overscroll along that axis. Since
+  // Axis::ApplyResistance() keeps the magnitude of the overscroll in the range
+  // [0, GetCompositionLength()], these scale factors should be in the range
+  // [0, CLAMPING].
+  float spacePropX = CLAMPING * fabsf(mX.GetOverscroll()) / mX.GetCompositionLength();
+  float spacePropY = CLAMPING * fabsf(mY.GetOverscroll()) / mY.GetCompositionLength();
+
+  // The translation to apply for overscroll along the x axis.
+  CSSPoint translationX;
+  if (mX.GetOverscroll() < 0) {
+    // Overscroll on left.
+    // Keep content at the midpoint of the screen's right edge fixed.
+    translationX.x = spacePropX * mX.GetCompositionLength();
+    translationX.y = (spacePropX * mY.GetCompositionLength()) / 2;
+  } else if (mX.GetOverscroll() > 0) {
+    // Overscroll on right.
+    // Keep content at the midpoint of the screen's left edge fixed.
+    translationX.y = (spacePropX * mY.GetCompositionLength()) / 2;
+  }
+
+  // The translation to apply for overscroll along the y axis.
+  CSSPoint translationY;
+  if (mY.GetOverscroll() < 0) {
+    // Overscroll at top.
+    // Keep content at the midpoint of the screen's bottom edge fixed.
+    translationY.x = (spacePropY * mX.GetCompositionLength()) / 2;
+    translationY.y = spacePropY * mY.GetCompositionLength();
+  } else if (mY.GetOverscroll() > 0) {
+    // Overscroll at bottom.
+    // Keep content at the midpoint of the screen's top edge fixed.
+    translationY.x = (spacePropY * mX.GetCompositionLength()) / 2;
+  }
+
+  // Combine the transformations along the two axes.
+  // TODO(botond): This method of combination is imperfect, and results in a
+  // funny-looking snap-back animation when we have overscroll along both axes.
+  // We should fine-tune this.
+  float spaceProp = std::max(spacePropX, spacePropY);
+  CSSPoint translation(std::max(translationX.x, translationY.x),
+                       std::max(translationX.y, translationY.y));
+
+  // The prpoportion of the composition length which will be taken up by the
+  // original content; this is the scale we will apply to the content.
+  float contentProp = 1 - spaceProp;
+
+  // In a ViewTransform, the translation is applied before the scale. We want
+  // to apply our translation after our scale, so we compensate for that here.
+  translation.x /= contentProp;
+  translation.y /= contentProp;
+
+  // Finally, apply the transformations.
+  aTransform->mScale.scale *= contentProp;
+  aTransform->mTranslation += translation * mFrameMetrics.LayersPixelsPerCSSPixel();
+}
+
 bool AsyncPanZoomController::SampleContentTransformForFrame(const TimeStamp& aSampleTime,
                                                             ViewTransform* aNewTransform,
                                                             ScreenPoint& aScrollOffset) {
@@ -1705,27 +1914,26 @@ bool AsyncPanZoomController::SampleContentTransformForFrame(const TimeStamp& aSa
   {
     ReentrantMonitorAutoEnter lock(mMonitor);
 
-    requestAnimationFrame = UpdateAnimation(aSampleTime);
+    requestAnimationFrame = UpdateAnimation(aSampleTime, &deferredTasks);
 
     aScrollOffset = mFrameMetrics.GetScrollOffset() * mFrameMetrics.GetZoom();
     *aNewTransform = GetCurrentAsyncTransform();
 
+    // GetCurrentAsyncTransform() does not consider any overscroll we may have.
+    // Adjust the transform to account for that.
+    ApplyOverscrollEffect(aNewTransform);
+
     LogRendertraceRect(GetGuid(), "viewport", "red",
       CSSRect(mFrameMetrics.GetScrollOffset(),
               ParentLayerSize(mFrameMetrics.mCompositionBounds.Size()) / mFrameMetrics.GetZoomToParent()));
 
     mCurrentAsyncScrollOffset = mFrameMetrics.GetScrollOffset();
-
-    // Get any deferred tasks queued up by mAnimation's Sample() (called by
-    // UpdateAnimation()). This needs to be done here since mAnimation can
-    // be destroyed by another thread when we release the monitor, but
-    // the tasks need to be executed after we release the monitor since they
-    // are allowed to call APZCTreeManager methods which can grab the tree lock. 
-    if (mAnimation) {
-      deferredTasks = mAnimation->TakeDeferredTasks();
-    }
   }
 
+  // Execute any deferred tasks queued up by mAnimation's Sample() (called by
+  // UpdateAnimation()). This needs to be done after the monitor is released
+  // since the tasks are allowed to call APZCTreeManager methods which can grab
+  // the tree lock.
   for (uint32_t i = 0; i < deferredTasks.length(); ++i) {
     deferredTasks[i]->Run();
     delete deferredTasks[i];
diff --git a/gfx/layers/apz/src/AsyncPanZoomController.h b/gfx/layers/apz/src/AsyncPanZoomController.h
index 5514fb89b70a..2fcd39e45636 100644
--- a/gfx/layers/apz/src/AsyncPanZoomController.h
+++ b/gfx/layers/apz/src/AsyncPanZoomController.h
@@ -150,7 +150,8 @@ public:
   // These methods must only be called on the compositor thread.
   //
 
-  bool UpdateAnimation(const TimeStamp& aSampleTime);
+  bool UpdateAnimation(const TimeStamp& aSampleTime,
+                       Vector<Task*>* aOutDeferredTasks);
 
   /**
    * The compositor calls this when it's about to draw pannable/zoomable content
@@ -411,6 +412,12 @@ protected:
    */
   void ScheduleComposite();
 
+  /**
+   * Schedules a composite, and if enough time has elapsed since the last
+   * paint, a paint.
+   */
+  void ScheduleCompositeAndMaybeRepaint();
+
   /**
    * Gets the displacement of the current touch since it began. That is, it is
    * the distance between the current position and the initial position of the
@@ -532,6 +539,7 @@ private:
                                  put a finger down, but we don't yet know if a touch listener has
                                  prevented the default actions yet and the allowed touch behavior
                                  was not set yet. we still need to abort animations. */
+    SNAP_BACK,                /* snap-back animation to relieve overscroll */
   };
 
   // State related to a single touch block. Does not persist across touch blocks.
@@ -611,6 +619,12 @@ private:
   bool IsTransformingState(PanZoomState aState);
   bool IsPanningState(PanZoomState mState);
 
+  /**
+   * Apply to |aTransform| a visual effect that reflects this apzc's
+   * overscrolled state, if any.
+   */
+  void ApplyOverscrollEffect(ViewTransform* aTransform) const;
+
   enum AxisLockMode {
     FREE,     /* No locking at all */
     STANDARD, /* Default axis locking mode that remains locked until pan ends*/
@@ -713,8 +727,6 @@ private:
   // The last time the compositor has sampled the content transform for this
   // frame.
   TimeStamp mLastSampleTime;
-  // The last time a touch event came through on the UI thread.
-  uint32_t mLastEventTime;
 
   // Stores the previous focus point if there is a pinch gesture happening. Used
   // to allow panning by moving multiple fingers (thus moving the focus point).
@@ -753,22 +765,39 @@ private:
 
   /* ===================================================================
    * The functions and members in this section are used to manage
-   * fling animations.
+   * fling animations and handling overscroll during a fling.
    */
 public:
   /**
    * Take over a fling with the given velocity from another APZC. Used for
-   * during overscroll handoff for a fling.
+   * during overscroll handoff for a fling. If we are not pannable, calls
+   * mTreeManager->HandOffFling() to hand the fling off further.
+   * Returns true iff. any APZC (whether this one or one further in the handoff
+   * chain accepted the fling).
    */
-  void TakeOverFling(ScreenPoint aVelocity);
+  bool TakeOverFling(ScreenPoint aVelocity);
 
 private:
   friend class FlingAnimation;
+  friend class OverscrollSnapBackAnimation;
   // The initial velocity of the most recent fling.
   ScreenPoint mLastFlingVelocity;
   // The time at which the most recent fling started.
   TimeStamp mLastFlingTime;
 
+  // Deal with overscroll resulting from a fling animation. This is only ever
+  // called on APZC instances that were actually performing a fling.
+  // The overscroll is handled by trying to hand the fling off to an APZC
+  // later in the handoff chain, or if there are no takers, continuing the
+  // fling and entering an overscrolled state.
+  void HandleFlingOverscroll(const ScreenPoint& aVelocity);
+
+  // Helper function used by TakeOverFling() and HandleFlingOverscroll().
+  void AcceptFling(const ScreenPoint& aVelocity, bool aAllowOverscroll);
+
+  // Start a snap-back animation to relieve overscroll.
+  void StartSnapBack();
+
 
   /* ===================================================================
    * The functions and members in this section are used to build a tree
@@ -807,10 +836,6 @@ public:
     return !mParent || (mParent->mLayersId != mLayersId);
   }
 
-  bool IsRootForLayersId(const uint64_t& aLayersId) const {
-    return (mLayersId == aLayersId) && IsRootForLayersId();
-  }
-
 private:
   // This is a raw pointer to avoid introducing a reference cycle between
   // AsyncPanZoomController and APZCTreeManager. Since these objects don't
@@ -825,9 +850,8 @@ private:
 
 
   /* ===================================================================
-   * The functions and members in this section are used in building the
-   * scroll handoff chain, so that we can have seamless scrolling continue
-   * across APZC instances.
+   * The functions and members in this section are used for scrolling,
+   * including handing off scroll to another APZC, and overscrolling.
    */
 public:
   void SetScrollHandoffParentId(FrameMetrics::ViewID aScrollParentId) {
@@ -845,13 +869,20 @@ public:
    * at these points, but this function will scroll as if there had been.
    * If this attempt causes overscroll (i.e. the layer cannot be scrolled
    * by the entire amount requested), the overscroll is passed back to the
-   * tree manager via APZCTreeManager::DispatchScroll().
+   * tree manager via APZCTreeManager::DispatchScroll(). If the tree manager
+   * does not find an APZC further in the handoff chain to accept the
+   * overscroll, and this APZC is pannable, this APZC enters an overscrolled
+   * state.
    * |aOverscrollHandoffChainIndex| is used by the tree manager to keep track
    * of which APZC to hand off the overscroll to; this function increments it
    * and passes it on to APZCTreeManager::DispatchScroll() in the event of
    * overscroll.
+   * Returns true iff. this APZC, or an APZC further down the
+   * handoff chain, accepted the scroll (possibly entering an overscrolled
+   * state). If this return false, the caller APZC knows that it should enter
+   * an overscrolled state itself if it can.
    */
-  void AttemptScroll(const ScreenPoint& aStartPoint, const ScreenPoint& aEndPoint,
+  bool AttemptScroll(const ScreenPoint& aStartPoint, const ScreenPoint& aEndPoint,
                      uint32_t aOverscrollHandoffChainIndex = 0);
 
   void FlushRepaintForOverscrollHandoff();
@@ -864,9 +895,17 @@ private:
    * Guards against the case where the APZC is being concurrently destroyed
    * (and thus mTreeManager is being nulled out).
    */
-  void CallDispatchScroll(const ScreenPoint& aStartPoint, const ScreenPoint& aEndPoint,
+  bool CallDispatchScroll(const ScreenPoint& aStartPoint, const ScreenPoint& aEndPoint,
                           uint32_t aOverscrollHandoffChainIndex);
 
+  /**
+   * Try to overscroll by 'aOverscroll'.
+   * If we are pannable, 'aOverscroll' is added to any existing overscroll,
+   * and the function returns true.
+   * Otherwise, nothing happens and the function return false.
+   */
+  bool OverscrollBy(const CSSPoint& aOverscroll);
+
 
   /* ===================================================================
    * The functions and members in this section are used to maintain the
@@ -894,6 +933,10 @@ public:
     return mVisibleRect.Contains(aPoint);
   }
 
+  bool IsOverscrolled() const {
+    return mX.IsOverscrolled() || mY.IsOverscrolled();
+  }
+
 private:
   /* This is the visible region of the layer that this APZC corresponds to, in
    * that layer's screen pixels (the same coordinate system in which this APZC
diff --git a/gfx/layers/apz/src/Axis.cpp b/gfx/layers/apz/src/Axis.cpp
index 7cd801be060f..b6e14e8f84a4 100644
--- a/gfx/layers/apz/src/Axis.cpp
+++ b/gfx/layers/apz/src/Axis.cpp
@@ -14,6 +14,7 @@
 #include "mozilla/Preferences.h"        // for Preferences
 #include "mozilla/gfx/Rect.h"           // for RoundedIn
 #include "mozilla/mozalloc.h"           // for operator new
+#include "mozilla/FloatingPoint.h"      // for FuzzyEqualsAdditive
 #include "nsMathUtils.h"                // for NS_lround
 #include "nsThreadUtils.h"              // for NS_DispatchToMainThread, etc
 #include "nscore.h"                     // for NS_IMETHOD
@@ -24,31 +25,40 @@ namespace layers {
 
 Axis::Axis(AsyncPanZoomController* aAsyncPanZoomController)
   : mPos(0),
+    mPosTimeMs(0),
     mVelocity(0.0f),
     mAxisLocked(false),
-    mAsyncPanZoomController(aAsyncPanZoomController)
+    mAsyncPanZoomController(aAsyncPanZoomController),
+    mOverscroll(0)
 {
 }
 
-void Axis::UpdateWithTouchAtDevicePoint(int32_t aPos, const TimeDuration& aTimeDelta) {
-  float newVelocity = mAxisLocked ? 0 : (mPos - aPos) / aTimeDelta.ToMilliseconds();
+void Axis::UpdateWithTouchAtDevicePoint(int32_t aPos, uint32_t aTimestampMs) {
+  if (aTimestampMs == mPosTimeMs) {
+    // Duplicate event?
+    return;
+  }
+
+  float newVelocity = mAxisLocked ? 0 : (float)(mPos - aPos) / (float)(aTimestampMs - mPosTimeMs);
   if (gfxPrefs::APZMaxVelocity() > 0.0f) {
     newVelocity = std::min(newVelocity, gfxPrefs::APZMaxVelocity() * APZCTreeManager::GetDPI());
   }
 
   mVelocity = newVelocity;
   mPos = aPos;
+  mPosTimeMs = aTimestampMs;
 
   // Limit queue size pased on pref
-  mVelocityQueue.AppendElement(mVelocity);
+  mVelocityQueue.AppendElement(std::make_pair(aTimestampMs, mVelocity));
   if (mVelocityQueue.Length() > gfxPrefs::APZMaxVelocityQueueSize()) {
     mVelocityQueue.RemoveElementAt(0);
   }
 }
 
-void Axis::StartTouch(int32_t aPos) {
+void Axis::StartTouch(int32_t aPos, uint32_t aTimestampMs) {
   mStartPos = aPos;
   mPos = aPos;
+  mPosTimeMs = aTimestampMs;
   mAxisLocked = false;
 }
 
@@ -60,8 +70,19 @@ float Axis::AdjustDisplacement(float aDisplacement, float& aOverscrollAmountOut)
 
   float displacement = aDisplacement;
 
-  // If this displacement will cause an overscroll, throttle it. Can potentially
-  // bring it to 0 even if the velocity is high.
+  // First consume any overscroll in the opposite direction along this axis.
+  if (mOverscroll > 0 && aDisplacement < 0) {
+    float consumedOverscroll = std::min(mOverscroll, -aDisplacement);
+    mOverscroll -= consumedOverscroll;
+    displacement += consumedOverscroll;
+  } else if (mOverscroll < 0 && aDisplacement > 0) {
+    float consumedOverscroll = std::min(-mOverscroll, aDisplacement);
+    mOverscroll += consumedOverscroll;
+    displacement -= consumedOverscroll;
+  }
+
+  // Split the requested displacement into an allowed displacement that does
+  // not overscroll, and an overscroll amount.
   if (DisplacementWillOverscroll(displacement) != OVERSCROLL_NONE) {
     // No need to have a velocity along this axis anymore; it won't take us
     // anywhere, so we're just spinning needlessly.
@@ -72,6 +93,84 @@ float Axis::AdjustDisplacement(float aDisplacement, float& aOverscrollAmountOut)
   return displacement;
 }
 
+float Axis::ApplyResistance(float aRequestedOverscroll) const {
+  // 'resistanceFactor' is a value between 0 and 1, which:
+  //   - tends to 1 as the existing overscroll tends to 0
+  //   - tends to 0 as the existing overscroll tends to the composition length
+  // The actual overscroll is the requested overscroll multiplied by this
+  // factor; this should prevent overscrolling by more than the composition
+  // length.
+  float resistanceFactor = 1 - fabsf(mOverscroll) / GetCompositionLength();
+  return resistanceFactor < 0 ? 0 : aRequestedOverscroll * resistanceFactor;
+}
+
+void Axis::OverscrollBy(float aOverscroll) {
+  MOZ_ASSERT(CanScroll());
+  aOverscroll = ApplyResistance(aOverscroll);
+  if (aOverscroll > 0) {
+    MOZ_ASSERT(FuzzyEqualsAdditive(GetCompositionEnd(), GetPageEnd(), COORDINATE_EPSILON));
+    MOZ_ASSERT(mOverscroll >= 0);
+  } else if (aOverscroll < 0) {
+    MOZ_ASSERT(FuzzyEqualsAdditive(GetOrigin(), GetPageStart(), COORDINATE_EPSILON));
+    MOZ_ASSERT(mOverscroll <= 0);
+  }
+  mOverscroll += aOverscroll;
+}
+
+float Axis::GetOverscroll() const {
+  return mOverscroll;
+}
+
+void Axis::StartSnapBack() {
+  float initialSnapBackVelocity = gfxPrefs::APZSnapBackInitialVelocity();
+  if (mOverscroll > 0) {
+    mVelocity = -initialSnapBackVelocity;
+  } else {
+    mVelocity = initialSnapBackVelocity;
+  }
+}
+
+bool Axis::SampleSnapBack(const TimeDuration& aDelta) {
+  // Accelerate the snap-back as time goes on.
+  // Note: this method of acceleration isn't perfectly smooth, as it assumes
+  // a constant velocity over 'aDelta', instead of an accelerating velocity.
+  // (The way we applying friction to flings has the same issue.)
+  mVelocity *= pow(1.0f + gfxPrefs::APZSnapBackAcceleration(), float(aDelta.ToMilliseconds()));
+  float screenDisplacement = mVelocity * aDelta.ToMilliseconds();
+  float cssDisplacement = screenDisplacement / GetFrameMetrics().GetZoom().scale;
+  if (mOverscroll > 0) {
+    if (cssDisplacement > 0) {
+      NS_WARNING("Overscroll snap-back animation is moving in the wrong direction!");
+      return false;
+    }
+    mOverscroll = std::max(mOverscroll + cssDisplacement, 0.0f);
+    // Overscroll relieved, do not continue animation.
+    if (mOverscroll == 0) {
+      mVelocity = 0;
+      return false;
+    }
+    return true;
+  } else if (mOverscroll < 0) {
+    if (cssDisplacement < 0) {
+      NS_WARNING("Overscroll snap-back animation is moving in the wrong direction!");
+      return false;
+    }
+    mOverscroll = std::min(mOverscroll + cssDisplacement, 0.0f);
+    // Overscroll relieved, do not continue animation.
+    if (mOverscroll == 0) {
+      mVelocity = 0;
+      return false;
+    }
+    return true;
+  }
+  // No overscroll on this axis, do not continue animation.
+  return false;
+}
+
+bool Axis::IsOverscrolled() const {
+  return mOverscroll != 0;
+}
+
 float Axis::PanDistance() {
   return fabsf(mPos - mStartPos);
 }
@@ -80,15 +179,18 @@ float Axis::PanDistance(float aPos) {
   return fabsf(aPos - mStartPos);
 }
 
-void Axis::EndTouch() {
-  // Calculate the mean velocity and empty the queue.
-  int count = mVelocityQueue.Length();
-  if (count) {
-    mVelocity = 0;
-    while (!mVelocityQueue.IsEmpty()) {
-      mVelocity += mVelocityQueue[0];
-      mVelocityQueue.RemoveElementAt(0);
+void Axis::EndTouch(uint32_t aTimestampMs) {
+  mVelocity = 0;
+  int count = 0;
+  while (!mVelocityQueue.IsEmpty()) {
+    uint32_t timeDelta = (aTimestampMs - mVelocityQueue[0].first);
+    if (timeDelta < gfxPrefs::APZVelocityRelevanceTime()) {
+      count++;
+      mVelocity += mVelocityQueue[0].second;
     }
+    mVelocityQueue.RemoveElementAt(0);
+  }
+  if (count > 1) {
     mVelocity /= count;
   }
 }
@@ -100,11 +202,12 @@ void Axis::CancelTouch() {
   }
 }
 
-bool Axis::Scrollable() {
-    if (mAxisLocked) {
-        return false;
-    }
-    return GetCompositionLength() < GetPageLength();
+bool Axis::CanScroll() const {
+  return GetCompositionLength() < GetPageLength();
+}
+
+bool Axis::CanScrollNow() const {
+  return !mAxisLocked && CanScroll();
 }
 
 bool Axis::FlingApplyFrictionOrCancel(const TimeDuration& aDelta) {
@@ -120,35 +223,6 @@ bool Axis::FlingApplyFrictionOrCancel(const TimeDuration& aDelta) {
   return true;
 }
 
-Axis::Overscroll Axis::GetOverscroll() {
-  // If the current pan takes the window to the left of or above the current
-  // page rect.
-  bool minus = GetOrigin() < GetPageStart();
-  // If the current pan takes the window to the right of or below the current
-  // page rect.
-  bool plus = GetCompositionEnd() > GetPageEnd();
-  if (minus && plus) {
-    return OVERSCROLL_BOTH;
-  }
-  if (minus) {
-    return OVERSCROLL_MINUS;
-  }
-  if (plus) {
-    return OVERSCROLL_PLUS;
-  }
-  return OVERSCROLL_NONE;
-}
-
-float Axis::GetExcess() {
-  switch (GetOverscroll()) {
-  case OVERSCROLL_MINUS: return GetOrigin() - GetPageStart();
-  case OVERSCROLL_PLUS: return GetCompositionEnd() - GetPageEnd();
-  case OVERSCROLL_BOTH: return (GetCompositionEnd() - GetPageEnd()) +
-                               (GetPageStart() - GetOrigin());
-  default: return 0;
-  }
-}
-
 Axis::Overscroll Axis::DisplacementWillOverscroll(float aDisplacement) {
   // If the current pan plus a displacement takes the window to the left of or
   // above the current page rect.
@@ -216,27 +290,26 @@ float Axis::GetPageEnd() const {
 }
 
 float Axis::GetOrigin() const {
-  CSSPoint origin = mAsyncPanZoomController->GetFrameMetrics().GetScrollOffset();
+  CSSPoint origin = GetFrameMetrics().GetScrollOffset();
   return GetPointOffset(origin);
 }
 
 float Axis::GetCompositionLength() const {
-  const FrameMetrics& metrics = mAsyncPanZoomController->GetFrameMetrics();
-  return GetRectLength(metrics.CalculateCompositedRectInCssPixels());
+  return GetRectLength(GetFrameMetrics().CalculateCompositedRectInCssPixels());
 }
 
 float Axis::GetPageStart() const {
-  CSSRect pageRect = mAsyncPanZoomController->GetFrameMetrics().GetExpandedScrollableRect();
+  CSSRect pageRect = GetFrameMetrics().GetExpandedScrollableRect();
   return GetRectOffset(pageRect);
 }
 
 float Axis::GetPageLength() const {
-  CSSRect pageRect = mAsyncPanZoomController->GetFrameMetrics().GetExpandedScrollableRect();
+  CSSRect pageRect = GetFrameMetrics().GetExpandedScrollableRect();
   return GetRectLength(pageRect);
 }
 
 bool Axis::ScaleWillOverscrollBothSides(float aScale) {
-  const FrameMetrics& metrics = mAsyncPanZoomController->GetFrameMetrics();
+  const FrameMetrics& metrics = GetFrameMetrics();
 
   CSSToParentLayerScale scale(metrics.GetZoomToParent().scale * aScale);
   CSSRect cssCompositionBounds = metrics.mCompositionBounds / scale;
@@ -244,9 +317,8 @@ bool Axis::ScaleWillOverscrollBothSides(float aScale) {
   return GetRectLength(metrics.GetExpandedScrollableRect()) < GetRectLength(cssCompositionBounds);
 }
 
-bool Axis::HasRoomToPan() const {
-  return GetOrigin() > GetPageStart()
-      || GetCompositionEnd() < GetPageEnd();
+const FrameMetrics& Axis::GetFrameMetrics() const {
+  return mAsyncPanZoomController->GetFrameMetrics();
 }
 
 
diff --git a/gfx/layers/apz/src/Axis.h b/gfx/layers/apz/src/Axis.h
index f58cf8c40f25..346c24fd834d 100644
--- a/gfx/layers/apz/src/Axis.h
+++ b/gfx/layers/apz/src/Axis.h
@@ -17,6 +17,15 @@ namespace layers {
 
 const float EPSILON = 0.0001f;
 
+// Epsilon to be used when comparing 'float' coordinate values
+// with FuzzyEqualsAdditive. The rationale is that 'float' has 7 decimal
+// digits of precision, and coordinate values should be no larger than in the
+// ten thousands. Note also that the smallest legitimate difference in page
+// coordinates is 1 app unit, which is 1/60 of a (CSS pixel), so this epsilon
+// isn't too large.
+const float COORDINATE_EPSILON = 0.01f;
+
+class FrameMetrics;
 class AsyncPanZoomController;
 
 /**
@@ -43,23 +52,22 @@ public:
   };
 
   /**
-   * Notify this Axis that a new touch has been received, including a time delta
-   * indicating how long it has been since the previous one. This triggers a
-   * recalculation of velocity.
+   * Notify this Axis that a new touch has been received, including a timestamp
+   * for when the touch was received. This triggers a recalculation of velocity.
    */
-  void UpdateWithTouchAtDevicePoint(int32_t aPos, const TimeDuration& aTimeDelta);
+  void UpdateWithTouchAtDevicePoint(int32_t aPos, uint32_t aTimestampMs);
 
   /**
    * Notify this Axis that a touch has begun, i.e. the user has put their finger
    * on the screen but has not yet tried to pan.
    */
-  void StartTouch(int32_t aPos);
+  void StartTouch(int32_t aPos, uint32_t aTimestampMs);
 
   /**
    * Notify this Axis that a touch has ended gracefully. This may perform
    * recalculations of the axis velocity.
    */
-  void EndTouch();
+  void EndTouch(uint32_t aTimestampMs);
 
   /**
    * Notify this Axis that a touch has ended forcefully. Useful for stopping
@@ -79,6 +87,33 @@ public:
    */
   float AdjustDisplacement(float aDisplacement, float& aOverscrollAmountOut);
 
+  /**
+   * Overscrolls this axis by the requested amount in the requested direction.
+   * The axis must be at the end of its scroll range in this direction.
+   */
+  void OverscrollBy(float aOverscroll);
+
+  /**
+   * Return the amount of overscroll on this axis, in CSS pixels.
+   */
+  float GetOverscroll() const;
+
+  /**
+   * Start a snap-back animation to relieve overscroll.
+   */
+  void StartSnapBack();
+
+  /**
+   * Sample the snap-back animation to relieve overscroll.
+   * |aDelta| is the time since the last sample.
+   */
+  bool SampleSnapBack(const TimeDuration& aDelta);
+
+  /**
+   * Return whether this axis is overscrolled in either direction.
+   */
+  bool IsOverscrolled() const;
+
   /**
    * Gets the distance between the starting position of the touch supplied in
    * startTouch() and the current touch from the last
@@ -100,29 +135,19 @@ public:
    */
   bool FlingApplyFrictionOrCancel(const TimeDuration& aDelta);
 
-  /*
-   * Returns true if the page is zoomed in to some degree along this axis such that scrolling is
-   * possible and this axis has not been scroll locked while panning. Otherwise, returns false.
+  /**
+   * Returns true if the page has room to be scrolled along this axis.
    */
-  bool Scrollable();
+  bool CanScroll() const;
+
+  /**
+   * Returns true if the page has room to be scrolled along this axis
+   * and this axis is not scroll-locked.
+   */
+  bool CanScrollNow() const;
 
   void SetAxisLocked(bool aAxisLocked) { mAxisLocked = aAxisLocked; }
 
-  /**
-   * Gets the overscroll state of the axis in its current position.
-   */
-  Overscroll GetOverscroll();
-
-  /**
-   * If there is overscroll, returns the amount. Sign depends on in what
-   * direction it is overscrolling. Positive excess means that it is
-   * overscrolling in the positive direction, whereas negative excess means
-   * that it is overscrolling in the negative direction. If there is overscroll
-   * in both directions, this returns 0; it assumes that you check
-   * GetOverscroll() first.
-   */
-  float GetExcess();
-
   /**
    * Gets the raw velocity of this axis at this moment.
    */
@@ -170,11 +195,6 @@ public:
    */
   bool ScaleWillOverscrollBothSides(float aScale);
 
-  /**
-   * Returns whether there is room to pan on this axis in either direction.
-   */
-  bool HasRoomToPan() const;
-
   float GetOrigin() const;
   float GetCompositionLength() const;
   float GetPageStart() const;
@@ -190,11 +210,28 @@ public:
 
 protected:
   int32_t mPos;
+  uint32_t mPosTimeMs;
   int32_t mStartPos;
   float mVelocity;
   bool mAxisLocked;     // Whether movement on this axis is locked.
   AsyncPanZoomController* mAsyncPanZoomController;
-  nsTArray<float> mVelocityQueue;
+  // The amount by which this axis is in overscroll, in CSS coordinates.
+  // If this amount is nonzero, the relevant component of
+  // mAsyncPanZoomController->mFrameMetrics.mScrollOffset must be at its
+  // extreme allowed value in the relevant direction (that is, it must be at
+  // its maximum value if mOverscroll is positive, and at its minimum value
+  // if mOverscroll is negative).
+  float mOverscroll;
+  // A queue of (timestamp, velocity) pairs; these are the historical
+  // velocities at the given timestamps. Timestamps are in milliseconds,
+  // velocities are in screen pixels per ms.
+  nsTArray<std::pair<uint32_t, float> > mVelocityQueue;
+
+  const FrameMetrics& GetFrameMetrics() const;
+
+  // Adjust a requested overscroll amount for resistance, yielding a smaller
+  // actual overscroll amount.
+  float ApplyResistance(float aOverscroll) const;
 };
 
 class AxisX : public Axis {
diff --git a/gfx/layers/composite/TextureHost.cpp b/gfx/layers/composite/TextureHost.cpp
index 9fa956188239..d9e643ce16b9 100644
--- a/gfx/layers/composite/TextureHost.cpp
+++ b/gfx/layers/composite/TextureHost.cpp
@@ -675,6 +675,9 @@ TextureParent::SendFenceHandleIfPresent()
 #if defined(MOZ_WIDGET_GONK) && ANDROID_VERSION >= 17
   if (mTextureHost) {
     TextureHostOGL* hostOGL = mTextureHost->AsHostOGL();
+    if (!hostOGL) {
+      return;
+    }
     android::sp<android::Fence> fence = hostOGL->GetAndResetReleaseFence();
     if (fence.get() && fence->isValid()) {
       // HWC might not provide Fence.
diff --git a/gfx/layers/opengl/CompositingRenderTargetOGL.h b/gfx/layers/opengl/CompositingRenderTargetOGL.h
index 4cd38d9e5be4..647db1127482 100644
--- a/gfx/layers/opengl/CompositingRenderTargetOGL.h
+++ b/gfx/layers/opengl/CompositingRenderTargetOGL.h
@@ -82,11 +82,12 @@ public:
    */
   static TemporaryRef<CompositingRenderTargetOGL>
   RenderTargetForWindow(CompositorOGL* aCompositor,
+                        const gfx::IntPoint& aOrigin,
                         const gfx::IntSize& aSize,
                         const gfx::Matrix& aTransform)
   {
     RefPtr<CompositingRenderTargetOGL> result
-      = new CompositingRenderTargetOGL(aCompositor, gfx::IntPoint(0, 0), 0, 0);
+      = new CompositingRenderTargetOGL(aCompositor, aOrigin, 0, 0);
     result->mTransform = aTransform;
     result->mInitParams = InitParams(aSize, 0, INIT_MODE_NONE);
     result->mInitParams.mStatus = InitParams::INITIALIZED;
diff --git a/gfx/layers/opengl/CompositorOGL.cpp b/gfx/layers/opengl/CompositorOGL.cpp
index b2d99014148c..26415247362b 100644
--- a/gfx/layers/opengl/CompositorOGL.cpp
+++ b/gfx/layers/opengl/CompositorOGL.cpp
@@ -376,6 +376,12 @@ SetRects(int n,
   aTextureRects[n] = Rect(tx0, ty0, tx1 - tx0, ty1 - ty0);
 }
 
+static inline bool
+FuzzyEqual(float a, float b)
+{
+  return fabs(a - b) < 0.0001f;
+}
+
 static int
 DecomposeIntoNoRepeatRects(const Rect& aRect,
                            const Rect& aTexCoordRect,
@@ -389,61 +395,47 @@ DecomposeIntoNoRepeatRects(const Rect& aRect,
   bool flipped = false;
   if (texCoordRect.height < 0) {
     flipped = true;
-    texCoordRect.y = texCoordRect.YMost();
+    texCoordRect.y += texCoordRect.height;
     texCoordRect.height = -texCoordRect.height;
   }
 
+  // Wrap the texture coordinates so they are within [0,1] and cap width/height
+  // at 1. We rely on this below.
+  texCoordRect = Rect(Point(WrapTexCoord(texCoordRect.x),
+                            WrapTexCoord(texCoordRect.y)),
+                      Size(std::min(texCoordRect.width, 1.0f),
+                           std::min(texCoordRect.height, 1.0f)));
+
+  NS_ASSERTION(texCoordRect.x >= 0.0f && texCoordRect.x <= 1.0f &&
+               texCoordRect.y >= 0.0f && texCoordRect.y <= 1.0f &&
+               texCoordRect.width >= 0.0f && texCoordRect.width <= 1.0f &&
+               texCoordRect.height >= 0.0f && texCoordRect.height <= 1.0f &&
+               texCoordRect.XMost() >= 0.0f && texCoordRect.XMost() <= 2.0f &&
+               texCoordRect.YMost() >= 0.0f && texCoordRect.YMost() <= 2.0f,
+               "We just wrapped the texture coordinates, didn't we?");
+
+  // Get the top left and bottom right points of the rectangle. Note that
+  // tl.x/tl.y are within [0,1] but br.x/br.y are within [0,2].
   Point tl = texCoordRect.TopLeft();
   Point br = texCoordRect.BottomRight();
 
-  // Chen check if we wrap in either the x or y axis; if we do,
-  // then also use fmod to figure out the "true" non-wrapping
-  // texture coordinates.
-  bool xwrap = false, ywrap = false;
-
-  if (texCoordRect.x < 0 ||
-      texCoordRect.x > 1.0f ||
-      texCoordRect.XMost() < 0 ||
-      texCoordRect.XMost() > 1.0f) {
-    xwrap = true;
-    tl = Point(WrapTexCoord(tl.x), tl.y);
-    br = Point(WrapTexCoord(br.x), br.y);
-  }
-
-  if (texCoordRect.y < 0 ||
-      texCoordRect.y > 1.0f ||
-      texCoordRect.YMost() < 0 ||
-      texCoordRect.YMost() > 1.0f) {
-    ywrap = true;
-    tl = Point(tl.x, WrapTexCoord(tl.y));
-    br = Point(br.x, WrapTexCoord(br.y));
-  }
-
   NS_ASSERTION(tl.x >= 0.0f && tl.x <= 1.0f &&
                tl.y >= 0.0f && tl.y <= 1.0f &&
-               br.x >= 0.0f && br.x <= 1.0f &&
-               br.y >= 0.0f && br.y <= 1.0f,
+               br.x >= tl.x && br.x <= 2.0f &&
+               br.y >= tl.y && br.y <= 2.0f &&
+               br.x - tl.x <= 1.0f &&
+               br.y - tl.y <= 1.0f,
                "Somehow generated invalid texture coordinates");
 
-  // If xwrap is false, the texture will be sampled from tl.x
-  // .. br.x.  If xwrap is true, then it will be split into tl.x
-  // .. 1.0, and 0.0 .. br.x.  Same for the Y axis.  The
-  // destination rectangle is also split appropriately, according
-  // to the calculated xmid/ymid values.
-
-  // There isn't a 1:1 mapping between tex coords and destination coords;
-  // when computing midpoints, we have to take that into account.  We
-  // need to map the texture coords, which are (in the wrap case):
-  // |tl->1| and |0->br| to the |0->1| range of the vertex coords.  So
-  // we have the length (1-tl)+(br) that needs to map into 0->1.
-  // These are only valid if there is wrap involved, they won't be used
-  // otherwise.
-  GLfloat xlen = (1.0f - tl.x) + br.x;
-  GLfloat ylen = (1.0f - tl.y) + br.y;
-
-  NS_ASSERTION(!xwrap || xlen > 0.0f, "xlen isn't > 0, what's going on?");
-  NS_ASSERTION(!ywrap || ylen > 0.0f, "ylen isn't > 0, what's going on?");
+  // Then check if we wrap in either the x or y axis.
+  bool xwrap = br.x > 1.0f;
+  bool ywrap = br.y > 1.0f;
 
+  // If xwrap is false, the texture will be sampled from tl.x .. br.x.
+  // If xwrap is true, then it will be split into tl.x .. 1.0, and
+  // 0.0 .. WrapTexCoord(br.x). Same for the Y axis. The destination
+  // rectangle is also split appropriately, according to the calculated
+  // xmid/ymid values.
   if (!xwrap && !ywrap) {
     SetRects(0, aLayerRects, aTextureRects,
              aRect.x, aRect.y, aRect.XMost(), aRect.YMost(),
@@ -452,8 +444,28 @@ DecomposeIntoNoRepeatRects(const Rect& aRect,
     return 1;
   }
 
-  GLfloat xmid = aRect.x + (1.0f - tl.x) / xlen * aRect.width;
-  GLfloat ymid = aRect.y + (1.0f - tl.y) / ylen * aRect.height;
+  // If we are dealing with wrapping br.x and br.y are greater than 1.0 so
+  // wrap them here as well.
+  br = Point(xwrap ? WrapTexCoord(br.x) : br.x,
+             ywrap ? WrapTexCoord(br.y) : br.y);
+
+  // If we wrap around along the x axis, we will draw first from
+  // tl.x .. 1.0 and then from 0.0 .. br.x (which we just wrapped above).
+  // The same applies for the Y axis. The midpoints we calculate here are
+  // only valid if we actually wrap around.
+  GLfloat xmid = aRect.x + (1.0f - tl.x) / texCoordRect.width * aRect.width;
+  GLfloat ymid = aRect.y + (1.0f - tl.y) / texCoordRect.height * aRect.height;
+
+  NS_ASSERTION(!xwrap ||
+               (xmid > aRect.x &&
+                xmid < aRect.XMost() &&
+                FuzzyEqual((xmid - aRect.x) + (aRect.XMost() - xmid), aRect.width)),
+               "xmid should be within [x,XMost()] and the wrapped rect should have the same width");
+  NS_ASSERTION(!ywrap ||
+               (ymid > aRect.y &&
+                ymid < aRect.YMost() &&
+                FuzzyEqual((ymid - aRect.y) + (aRect.YMost() - ymid), aRect.height)),
+               "ymid should be within [y,YMost()] and the wrapped rect should have the same height");
 
   if (!xwrap && ywrap) {
     SetRects(0, aLayerRects, aTextureRects,
@@ -544,9 +556,6 @@ CompositorOGL::PrepareViewport(const gfx::IntSize& aSize,
   viewMatrix.Translate(-1.0, 1.0);
   viewMatrix.Scale(2.0f / float(aSize.width), 2.0f / float(aSize.height));
   viewMatrix.Scale(1.0f, -1.0f);
-  if (!mTarget) {
-    viewMatrix.Translate(mRenderOffset.x, mRenderOffset.y);
-  }
 
   viewMatrix = aWorldTransform * viewMatrix;
 
@@ -715,7 +724,17 @@ CompositorOGL::BeginFrame(const nsIntRegion& aInvalidRegion,
   TexturePoolOGL::Fill(gl());
 #endif
 
+  // Make sure the render offset is respected. We ignore this when we have a
+  // target to stop tests failing - this is only used by the Android browser
+  // UI for its dynamic toolbar.
+  IntPoint origin;
+  if (!mTarget) {
+    origin.x = -mRenderOffset.x;
+    origin.y = -mRenderOffset.y;
+  }
+
   mCurrentRenderTarget = CompositingRenderTargetOGL::RenderTargetForWindow(this,
+                            origin,
                             IntSize(width, height),
                             aTransform);
   mCurrentRenderTarget->BindRenderTarget();
@@ -951,12 +970,8 @@ CompositorOGL::DrawQuad(const Rect& aRect,
   PROFILER_LABEL("CompositorOGL", "DrawQuad");
   MOZ_ASSERT(mFrameInProgress, "frame not started");
 
-  Rect clipRect = aClipRect;
-  if (!mTarget) {
-    clipRect.MoveBy(mRenderOffset.x, mRenderOffset.y);
-  }
   IntRect intClipRect;
-  clipRect.ToIntRect(&intClipRect);
+  aClipRect.ToIntRect(&intClipRect);
 
   gl()->fScissor(intClipRect.x, FlipY(intClipRect.y + intClipRect.height),
                  intClipRect.width, intClipRect.height);
diff --git a/gfx/layers/opengl/TextureHostOGL.cpp b/gfx/layers/opengl/TextureHostOGL.cpp
index 1dcbdca6ab63..d2620c476907 100644
--- a/gfx/layers/opengl/TextureHostOGL.cpp
+++ b/gfx/layers/opengl/TextureHostOGL.cpp
@@ -121,7 +121,8 @@ WrapMode(gl::GLContext *aGl, TextureFlags aFlags)
 {
   if ((aFlags & TextureFlags::ALLOW_REPEAT) &&
       (aGl->IsExtensionSupported(GLContext::ARB_texture_non_power_of_two) ||
-       aGl->IsExtensionSupported(GLContext::OES_texture_npot))) {
+       aGl->IsExtensionSupported(GLContext::OES_texture_npot) ||
+       aGl->IsExtensionSupported(GLContext::IMG_texture_npot))) {
     return LOCAL_GL_REPEAT;
   }
   return LOCAL_GL_CLAMP_TO_EDGE;
diff --git a/gfx/src/nsFont.cpp b/gfx/src/nsFont.cpp
index a219aba0e767..c394042d5bed 100644
--- a/gfx/src/nsFont.cpp
+++ b/gfx/src/nsFont.cpp
@@ -115,6 +115,7 @@ bool nsFont::BaseEquals(const nsFont& aOther) const
       (synthesis == aOther.synthesis) &&
       (fontFeatureSettings == aOther.fontFeatureSettings) &&
       (languageOverride == aOther.languageOverride) &&
+      (variant == aOther.variant) &&
       (variantAlternates == aOther.variantAlternates) &&
       (variantCaps == aOther.variantCaps) &&
       (variantEastAsian == aOther.variantEastAsian) &&
@@ -132,7 +133,6 @@ bool nsFont::BaseEquals(const nsFont& aOther) const
 bool nsFont::Equals(const nsFont& aOther) const
 {
   if (BaseEquals(aOther) &&
-      (variant == aOther.variant) &&
       (decorations == aOther.decorations)) {
     return true;
   }
diff --git a/gfx/src/nsFontMetrics.cpp b/gfx/src/nsFontMetrics.cpp
index a54ae57123af..320069d1e87e 100644
--- a/gfx/src/nsFontMetrics.cpp
+++ b/gfx/src/nsFontMetrics.cpp
@@ -122,6 +122,7 @@ nsFontMetrics::Init(const nsFont& aFont, nsIAtom* aLanguage,
                        aFont.sizeAdjust,
                        aFont.systemFont,
                        mDeviceContext->IsPrinterSurface(),
+                       aFont.variant == NS_STYLE_FONT_VARIANT_SMALL_CAPS,
                        aFont.languageOverride);
 
     aFont.AddFontFeaturesToStyle(&style);
diff --git a/gfx/tests/crashtests/crashtests.list b/gfx/tests/crashtests/crashtests.list
index d0f433c08a6a..e7a8e2f0d758 100644
--- a/gfx/tests/crashtests/crashtests.list
+++ b/gfx/tests/crashtests/crashtests.list
@@ -100,7 +100,7 @@ load 783041-2.html
 load 783041-3.html
 load 783041-4.html
 asserts-if(gtk2Widget,1) load 798853.html # bug 868792
-asserts-if(winWidget,0-1) skip-if(B2G) skip-if(Android&&AndroidVersion==10) load 815489.html # bug 978277
+asserts-if(winWidget,0-1) skip-if(B2G) load 815489.html
 load 836225-1.html
 load 839745-1.html
 load 856784-1.html
diff --git a/gfx/tests/gtest/TestAsyncPanZoomController.cpp b/gfx/tests/gtest/TestAsyncPanZoomController.cpp
index d545ee7f37fe..5c3c69bab057 100644
--- a/gfx/tests/gtest/TestAsyncPanZoomController.cpp
+++ b/gfx/tests/gtest/TestAsyncPanZoomController.cpp
@@ -143,10 +143,13 @@ public:
 
 class TestAPZCTreeManager : public APZCTreeManager {
 public:
-  // Expose this so test code can call it directly.
+  // Expose these so test code can call it directly.
   void BuildOverscrollHandoffChain(AsyncPanZoomController* aApzc) {
     APZCTreeManager::BuildOverscrollHandoffChain(aApzc);
   }
+  void ClearOverscrollHandoffChain() {
+    APZCTreeManager::ClearOverscrollHandoffChain();
+  }
 };
 
 static
@@ -235,6 +238,10 @@ void ApzcPan(AsyncPanZoomController* apzc,
   aTime += TIME_BETWEEN_TOUCH_EVENT;
   mti.mTouches.AppendElement(SingleTouchData(0, ScreenIntPoint(10, aTouchEndY), ScreenSize(0, 0), 0, 0));
   status = apzc->ReceiveInputEvent(mti);
+
+  // Since we've explicitly built the overscroll handoff chain before
+  // touch-start, we need to explicitly clear it after touch-end.
+  aTreeManager->ClearOverscrollHandoffChain();
 }
 
 static
@@ -1099,7 +1106,7 @@ static already_AddRefed<AsyncPanZoomController>
 GetTargetAPZC(APZCTreeManager* manager, const ScreenPoint& aPoint,
               gfx3DMatrix& aTransformToApzcOut, gfx3DMatrix& aTransformToGeckoOut)
 {
-  nsRefPtr<AsyncPanZoomController> hit = manager->GetTargetAPZC(aPoint);
+  nsRefPtr<AsyncPanZoomController> hit = manager->GetTargetAPZC(aPoint, nullptr);
   if (hit) {
     manager->GetInputTransforms(hit.get(), aTransformToApzcOut, aTransformToGeckoOut);
   }
diff --git a/gfx/thebes/gfxFT2FontList.cpp b/gfx/thebes/gfxFT2FontList.cpp
index 536d6042ba2a..8f42163dd1cb 100644
--- a/gfx/thebes/gfxFT2FontList.cpp
+++ b/gfx/thebes/gfxFT2FontList.cpp
@@ -1195,7 +1195,7 @@ gfxFT2FontList::FindFonts()
             bool moreFiles = handle != INVALID_HANDLE_VALUE;
             while (moreFiles) {
                 nsAutoString filePath(path);
-                filePath.AppendLiteral("\\");
+                filePath.Append('\\');
                 filePath.Append(results.cFileName);
                 AppendFacesFromFontFile(NS_ConvertUTF16toUTF8(filePath));
                 moreFiles = FindNextFile(handle, &results);
diff --git a/gfx/thebes/gfxFont.cpp b/gfx/thebes/gfxFont.cpp
index b320c86a7a04..2c602dd20b9e 100644
--- a/gfx/thebes/gfxFont.cpp
+++ b/gfx/thebes/gfxFont.cpp
@@ -27,6 +27,8 @@
 #include "gfxUserFontSet.h"
 #include "gfxPlatformFontList.h"
 #include "gfxScriptItemizer.h"
+#include "nsSpecialCasingData.h"
+#include "nsTextRunTransformations.h"
 #include "nsUnicodeProperties.h"
 #include "nsMathUtils.h"
 #include "nsBidiUtils.h"
@@ -123,9 +125,12 @@ gfxFontEntry::gfxFontEntry() :
     mCheckedForGraphiteTables(false),
     mHasCmapTable(false),
     mGrFaceInitialized(false),
+    mCheckedForColorGlyph(false),
     mWeight(500), mStretch(NS_FONT_STRETCH_NORMAL),
     mUVSOffset(0), mUVSData(nullptr),
     mLanguageOverride(NO_FONT_LANGUAGE_OVERRIDE),
+    mCOLR(nullptr),
+    mCPAL(nullptr),
     mUnitsPerEm(0),
     mHBFace(nullptr),
     mGrFace(nullptr),
@@ -153,9 +158,12 @@ gfxFontEntry::gfxFontEntry(const nsAString& aName, bool aIsStandardFace) :
     mCheckedForGraphiteTables(false),
     mHasCmapTable(false),
     mGrFaceInitialized(false),
+    mCheckedForColorGlyph(false),
     mWeight(500), mStretch(NS_FONT_STRETCH_NORMAL),
     mUVSOffset(0), mUVSData(nullptr),
     mLanguageOverride(NO_FONT_LANGUAGE_OVERRIDE),
+    mCOLR(nullptr),
+    mCPAL(nullptr),
     mUnitsPerEm(0),
     mHBFace(nullptr),
     mGrFace(nullptr),
@@ -167,6 +175,14 @@ gfxFontEntry::gfxFontEntry(const nsAString& aName, bool aIsStandardFace) :
 
 gfxFontEntry::~gfxFontEntry()
 {
+    if (mCOLR) {
+        hb_blob_destroy(mCOLR);
+    }
+
+    if (mCPAL) {
+        hb_blob_destroy(mCPAL);
+    }
+
     // For downloaded fonts, we need to tell the user font cache that this
     // entry is being deleted.
     if (!mIsProxy && IsUserFont() && !IsLocalUserFont()) {
@@ -482,6 +498,39 @@ gfxFontEntry::GetMathVariantsParts(uint32_t aGlyphID, bool aVertical,
     return mMathTable->GetMathVariantsParts(aGlyphID, aVertical, aGlyphs);
 }
 
+bool
+gfxFontEntry::TryGetColorGlyphs()
+{
+    if (mCheckedForColorGlyph) {
+        return (mCOLR && mCPAL);
+    }
+
+    mCheckedForColorGlyph = true;
+
+    mCOLR = GetFontTable(TRUETYPE_TAG('C', 'O', 'L', 'R'));
+    if (!mCOLR) {
+        return false;
+    }
+
+    mCPAL = GetFontTable(TRUETYPE_TAG('C', 'P', 'A', 'L'));
+    if (!mCPAL) {
+        hb_blob_destroy(mCOLR);
+        mCOLR = nullptr;
+        return false;
+    }
+
+    // validation COLR and CPAL table
+    if (gfxFontUtils::ValidateColorGlyphs(mCOLR, mCPAL)) {
+        return true;
+    }
+
+    hb_blob_destroy(mCOLR);
+    hb_blob_destroy(mCPAL);
+    mCOLR = nullptr;
+    mCPAL = nullptr;
+    return false;
+}
+
 /**
  * FontTableBlobData
  *
@@ -830,6 +879,18 @@ gfxFontEntry::CheckForGraphiteTables()
     mHasGraphiteTables = HasFontTable(TRUETYPE_TAG('S','i','l','f'));
 }
 
+bool
+gfxFontEntry::GetColorLayersInfo(uint32_t aGlyphId,
+                            nsTArray<uint16_t>& aLayerGlyphs,
+                            nsTArray<mozilla::gfx::Color>& aLayerColors)
+{
+    return gfxFontUtils::GetColorGlyphLayers(mCOLR,
+                                             mCPAL,
+                                             aGlyphId,
+                                             aLayerGlyphs,
+                                             aLayerColors);
+}
+
 /* static */ size_t
 gfxFontEntry::FontTableHashEntry::SizeOfEntryExcludingThis
     (FontTableHashEntry *aEntry,
@@ -2867,6 +2928,7 @@ gfxFont::Draw(gfxTextRun *aTextRun, uint32_t aStart, uint32_t aEnd,
     gfxMatrix globalMatrix = aContext->CurrentMatrix();
 
     bool haveSVGGlyphs = GetFontEntry()->TryGetSVGData(this);
+    bool haveColorGlyphs = GetFontEntry()->TryGetColorGlyphs();
     nsAutoPtr<gfxTextContextPaint> contextPaint;
     if (haveSVGGlyphs && !aContextPaint) {
         // If no pattern is specified for fill, use the current pattern
@@ -2939,6 +3001,14 @@ gfxFont::Draw(gfxTextRun *aTextRun, uint32_t aStart, uint32_t aEnd,
                   }
               }
 
+              if (haveColorGlyphs) {
+                  gfxPoint point(ToDeviceUnits(glyphX, devUnitsPerAppUnit),
+                                 ToDeviceUnits(y, devUnitsPerAppUnit));
+                  if (RenderColorGlyph(aContext, point, glyphData->GetSimpleGlyph())) {
+                      continue;
+                  }
+              }
+
               // Perhaps we should put a scale in the cairo context instead of
               // doing this scaling here...
               // Multiplying by the reciprocal may introduce tiny error here,
@@ -3001,13 +3071,14 @@ gfxFont::Draw(gfxTextRun *aTextRun, uint32_t aStart, uint32_t aEnd,
                               glyphX -= advance;
                           }
 
-                          gfxPoint point(ToDeviceUnits(glyphX, devUnitsPerAppUnit),
-                                         ToDeviceUnits(y, devUnitsPerAppUnit));
-
                           if (haveSVGGlyphs) {
                               if (!paintSVGGlyphs) {
                                   continue;
                               }
+
+                              gfxPoint point(ToDeviceUnits(glyphX, devUnitsPerAppUnit),
+                                             ToDeviceUnits(y, devUnitsPerAppUnit));
+
                               DrawMode mode = ForcePaintingDrawMode(aDrawMode);
                               if (RenderSVGGlyph(aContext, point, mode,
                                                   details->mGlyphID,
@@ -3017,6 +3088,17 @@ gfxFont::Draw(gfxTextRun *aTextRun, uint32_t aStart, uint32_t aEnd,
                               }
                           }
 
+                          if (haveColorGlyphs) {
+                              gfxPoint point(ToDeviceUnits(glyphX,
+                                                           devUnitsPerAppUnit),
+                                             ToDeviceUnits(y + details->mYOffset,
+                                                           devUnitsPerAppUnit));
+                              if (RenderColorGlyph(aContext, point,
+                                                   details->mGlyphID)) {
+                                  continue;
+                              }
+                          }
+
                           glyph = glyphs.AppendGlyph();
                           glyph->index = details->mGlyphID;
                           glyph->x = ToDeviceUnits(glyphX, devUnitsPerAppUnit);
@@ -3157,6 +3239,18 @@ gfxFont::Draw(gfxTextRun *aTextRun, uint32_t aStart, uint32_t aEnd,
                   }
               }
 
+              if (haveColorGlyphs) {
+                  mozilla::gfx::Point point(ToDeviceUnits(glyphX,
+                                                          devUnitsPerAppUnit),
+                                            ToDeviceUnits(y,
+                                                          devUnitsPerAppUnit));
+                  if (RenderColorGlyph(aContext, scaledFont, renderingOptions,
+                                       drawOptions, matInv * point,
+                                       glyphData->GetSimpleGlyph())) {
+                      continue;
+                  }
+              }
+
               // Perhaps we should put a scale in the cairo context instead of
               // doing this scaling here...
               // Multiplying by the reciprocal may introduce tiny error here,
@@ -3243,6 +3337,19 @@ gfxFont::Draw(gfxTextRun *aTextRun, uint32_t aStart, uint32_t aEnd,
                               }
                           }
 
+                          if (haveColorGlyphs) {
+                              mozilla::gfx::Point point(ToDeviceUnits(glyphX,
+                                                                      devUnitsPerAppUnit),
+                                                        ToDeviceUnits(y + details->mYOffset,
+                                                                      devUnitsPerAppUnit));
+                              if (RenderColorGlyph(aContext, scaledFont,
+                                                   renderingOptions,
+                                                   drawOptions, matInv * point,
+                                                   details->mGlyphID)) {
+                                  continue;
+                              }
+                          }
+
                           glyph = glyphs.AppendGlyph();
                           glyph->mIndex = details->mGlyphID;
                           glyph->mPosition.x = ToDeviceUnits(glyphX, devUnitsPerAppUnit);
@@ -3343,6 +3450,73 @@ gfxFont::RenderSVGGlyph(gfxContext *aContext, gfxPoint aPoint, DrawMode aDrawMod
     return rendered;
 }
 
+bool
+gfxFont::RenderColorGlyph(gfxContext* aContext, gfxPoint& point,
+                          uint32_t aGlyphId)
+{
+    nsAutoTArray<uint16_t, 8> layerGlyphs;
+    nsAutoTArray<mozilla::gfx::Color, 8> layerColors;
+
+    if (!GetFontEntry()->GetColorLayersInfo(aGlyphId, layerGlyphs, layerColors)) {
+        return false;
+    }
+
+    cairo_t* cr = aContext->GetCairo();
+    cairo_save(cr);
+    for (uint32_t layerIndex = 0; layerIndex < layerGlyphs.Length();
+         layerIndex++) {
+
+        cairo_glyph_t glyph;
+        glyph.index = layerGlyphs[layerIndex];
+        glyph.x = point.x;
+        glyph.y = point.y;
+
+        mozilla::gfx::Color &color = layerColors[layerIndex];
+        cairo_pattern_t* pattern =
+            cairo_pattern_create_rgba(color.r, color.g, color.b, color.a);
+
+        cairo_set_source(cr, pattern);
+        cairo_show_glyphs(cr, &glyph, 1);
+        cairo_pattern_destroy(pattern);
+    }
+    cairo_restore(cr);
+
+    return true;
+}
+
+bool
+gfxFont::RenderColorGlyph(gfxContext* aContext,
+                          mozilla::gfx::ScaledFont* scaledFont,
+                          GlyphRenderingOptions* aRenderingOptions,
+                          mozilla::gfx::DrawOptions aDrawOptions,
+                          const mozilla::gfx::Point& aPoint,
+                          uint32_t aGlyphId)
+{
+    nsAutoTArray<uint16_t, 8> layerGlyphs;
+    nsAutoTArray<mozilla::gfx::Color, 8> layerColors;
+
+    if (!GetFontEntry()->GetColorLayersInfo(aGlyphId, layerGlyphs, layerColors)) {
+        return false;
+    }
+
+    RefPtr<DrawTarget> dt = aContext->GetDrawTarget();
+    for (uint32_t layerIndex = 0; layerIndex < layerGlyphs.Length();
+         layerIndex++) {
+        Glyph glyph;
+        glyph.mIndex = layerGlyphs[layerIndex];
+        glyph.mPosition = aPoint;
+
+        mozilla::gfx::GlyphBuffer buffer;
+        buffer.mGlyphs = &glyph;
+        buffer.mNumGlyphs = 1;
+
+        dt->FillGlyphs(scaledFont, buffer,
+                       ColorPattern(layerColors[layerIndex]),
+                       aDrawOptions, aRenderingOptions);
+    }
+    return true;
+}
+
 static void
 UnionRange(gfxFloat aX, gfxFloat* aDestMin, gfxFloat* aDestMax)
 {
@@ -3879,8 +4053,8 @@ template<typename T>
 bool
 gfxFont::SplitAndInitTextRun(gfxContext *aContext,
                              gfxTextRun *aTextRun,
-                             const T *aString,
-                             uint32_t aRunStart,
+                             const T *aString, // text for this font run
+                             uint32_t aRunStart, // position in the textrun
                              uint32_t aRunLength,
                              int32_t aRunScript)
 {
@@ -3914,9 +4088,9 @@ gfxFont::SplitAndInitTextRun(gfxContext *aContext,
     // is short enough to fit in the word cache and it lacks spaces.
     if (SpaceMayParticipateInShaping(aRunScript)) {
         if (aRunLength > wordCacheCharLimit ||
-            HasSpaces(aString + aRunStart, aRunLength)) {
+            HasSpaces(aString, aRunLength)) {
             TEXT_PERF_INCR(tp, wordCacheSpaceRules);
-            return ShapeTextWithoutWordCache(aContext, aString + aRunStart,
+            return ShapeTextWithoutWordCache(aContext, aString,
                                              aRunStart, aRunLength, aRunScript,
                                              aTextRun);
         }
@@ -3933,16 +4107,15 @@ gfxFont::SplitAndInitTextRun(gfxContext *aContext,
         flags |= gfxTextRunFactory::TEXT_IS_8BIT;
     }
 
-    const T *text = aString + aRunStart;
     uint32_t wordStart = 0;
     uint32_t hash = 0;
     bool wordIs8Bit = true;
     int32_t appUnitsPerDevUnit = aTextRun->GetAppUnitsPerDevUnit();
 
-    T nextCh = text[0];
+    T nextCh = aString[0];
     for (uint32_t i = 0; i <= aRunLength; ++i) {
         T ch = nextCh;
-        nextCh = (i < aRunLength - 1) ? text[i + 1] : '\n';
+        nextCh = (i < aRunLength - 1) ? aString[i + 1] : '\n';
         bool boundary = IsBoundarySpace(ch, nextCh);
         bool invalid = !boundary && gfxFontGroup::IsInvalidChar(ch);
         uint32_t length = i - wordStart;
@@ -3966,7 +4139,7 @@ gfxFont::SplitAndInitTextRun(gfxContext *aContext,
         if (length > wordCacheCharLimit) {
             TEXT_PERF_INCR(tp, wordCacheLong);
             bool ok = ShapeFragmentWithoutWordCache(aContext,
-                                                    text + wordStart,
+                                                    aString + wordStart,
                                                     aRunStart + wordStart,
                                                     length,
                                                     aRunScript,
@@ -3985,7 +4158,7 @@ gfxFont::SplitAndInitTextRun(gfxContext *aContext,
                 }
             }
             gfxShapedWord *sw = GetShapedWord(aContext,
-                                              text + wordStart, length,
+                                              aString + wordStart, length,
                                               hash, aRunScript,
                                               appUnitsPerDevUnit,
                                               wordFlags, tp);
@@ -5218,8 +5391,8 @@ gfxFontGroup::InitTextRun(gfxContext *aContext,
             }
 #endif
 
-            InitScriptRun(aContext, aTextRun, textPtr,
-                          runStart, runLimit, runScript);
+            InitScriptRun(aContext, aTextRun, textPtr + runStart,
+                          runStart, runLimit - runStart, runScript);
         }
     }
 
@@ -5248,20 +5421,20 @@ template<typename T>
 void
 gfxFontGroup::InitScriptRun(gfxContext *aContext,
                             gfxTextRun *aTextRun,
-                            const T *aString,
-                            uint32_t aScriptRunStart,
-                            uint32_t aScriptRunEnd,
+                            const T *aString, // text for this script run,
+                                              // not the entire textrun
+                            uint32_t aOffset, // position of the script run
+                                              // within the textrun
+                            uint32_t aLength, // length of the script run
                             int32_t aRunScript)
 {
-    NS_ASSERTION(aScriptRunEnd > aScriptRunStart,
-                 "don't call InitScriptRun for a zero-length run");
+    NS_ASSERTION(aLength > 0, "don't call InitScriptRun for a 0-length run");
 
     gfxFont *mainFont = GetFontAt(0);
 
-    uint32_t runStart = aScriptRunStart;
+    uint32_t runStart = 0;
     nsAutoTArray<gfxTextRange,3> fontRanges;
-    ComputeRanges(fontRanges, aString + aScriptRunStart,
-                  aScriptRunEnd - aScriptRunStart, aRunScript);
+    ComputeRanges(fontRanges, aString, aLength, aRunScript);
     uint32_t numRanges = fontRanges.Length();
 
     for (uint32_t r = 0; r < numRanges; r++) {
@@ -5271,25 +5444,38 @@ gfxFontGroup::InitScriptRun(gfxContext *aContext,
 
         // create the glyph run for this range
         if (matchedFont) {
-            aTextRun->AddGlyphRun(matchedFont, range.matchType,
-                                  runStart, (matchedLength > 0));
-            // do glyph layout and record the resulting positioned glyphs
-            if (!matchedFont->SplitAndInitTextRun(aContext, aTextRun, aString,
-                                                  runStart, matchedLength,
-                                                  aRunScript)) {
-                // glyph layout failed! treat as missing glyphs
-                matchedFont = nullptr;
+            if (mStyle.smallCaps) {
+                if (!matchedFont->InitSmallCapsRun(aContext, aTextRun,
+                                                   aString + runStart,
+                                                   aOffset + runStart,
+                                                   matchedLength,
+                                                   range.matchType,
+                                                   aRunScript)) {
+                    matchedFont = nullptr;
+                }
+            } else {
+                aTextRun->AddGlyphRun(matchedFont, range.matchType,
+                                      aOffset + runStart, (matchedLength > 0));
+                // do glyph layout and record the resulting positioned glyphs
+                if (!matchedFont->SplitAndInitTextRun(aContext, aTextRun,
+                                                      aString + runStart,
+                                                      aOffset + runStart,
+                                                      matchedLength,
+                                                      aRunScript)) {
+                    // glyph layout failed! treat as missing glyphs
+                    matchedFont = nullptr;
+                }
             }
         } else {
             aTextRun->AddGlyphRun(mainFont, gfxTextRange::kFontGroup,
-                                  runStart, (matchedLength > 0));
+                                  aOffset + runStart, (matchedLength > 0));
         }
 
         if (!matchedFont) {
             // We need to set cluster boundaries (and mark spaces) so that
             // surrogate pairs, combining characters, etc behave properly,
             // even if we don't have glyphs for them
-            aTextRun->SetupClusterBoundaries(runStart, aString + runStart,
+            aTextRun->SetupClusterBoundaries(aOffset + runStart, aString + runStart,
                                              matchedLength);
 
             // various "missing" characters may need special handling,
@@ -5301,11 +5487,11 @@ gfxFontGroup::InitScriptRun(gfxContext *aContext,
                 // tab and newline are not to be displayed as hexboxes,
                 // but do need to be recorded in the textrun
                 if (ch == '\n') {
-                    aTextRun->SetIsNewline(index);
+                    aTextRun->SetIsNewline(aOffset + index);
                     continue;
                 }
                 if (ch == '\t') {
-                    aTextRun->SetIsTab(index);
+                    aTextRun->SetIsTab(aOffset + index);
                     continue;
                 }
 
@@ -5313,10 +5499,10 @@ gfxFontGroup::InitScriptRun(gfxContext *aContext,
                 // special Unicode spaces; omit these checks in 8-bit runs
                 if (sizeof(T) == sizeof(char16_t)) {
                     if (NS_IS_HIGH_SURROGATE(ch) &&
-                        index + 1 < aScriptRunEnd &&
+                        index + 1 < aLength &&
                         NS_IS_LOW_SURROGATE(aString[index + 1]))
                     {
-                        aTextRun->SetMissingGlyph(index,
+                        aTextRun->SetMissingGlyph(aOffset + index,
                                                   SURROGATE_TO_UCS4(ch,
                                                                     aString[index + 1]),
                                                   mainFont);
@@ -5331,7 +5517,7 @@ gfxFontGroup::InitScriptRun(gfxContext *aContext,
                         nscoord advance =
                             aTextRun->GetAppUnitsPerDevUnit() * floor(wid + 0.5);
                         if (gfxShapedText::CompressedGlyph::IsSimpleAdvance(advance)) {
-                            aTextRun->GetCharacterGlyphs()[index].
+                            aTextRun->GetCharacterGlyphs()[aOffset + index].
                                 SetSimpleGlyph(advance,
                                                mainFont->GetSpaceGlyph());
                         } else {
@@ -5341,7 +5527,7 @@ gfxFontGroup::InitScriptRun(gfxContext *aContext,
                             detailedGlyph.mXOffset = detailedGlyph.mYOffset = 0;
                             gfxShapedText::CompressedGlyph g;
                             g.SetComplex(true, true, 1);
-                            aTextRun->SetGlyphs(index,
+                            aTextRun->SetGlyphs(aOffset + index,
                                                 g, &detailedGlyph);
                         }
                         continue;
@@ -5354,7 +5540,7 @@ gfxFontGroup::InitScriptRun(gfxContext *aContext,
                 }
 
                 // record char code so we can draw a box with the Unicode value
-                aTextRun->SetMissingGlyph(index, ch, mainFont);
+                aTextRun->SetMissingGlyph(aOffset + index, ch, mainFont);
             }
         }
 
@@ -5362,6 +5548,180 @@ gfxFontGroup::InitScriptRun(gfxContext *aContext,
     }
 }
 
+bool
+gfxFont::InitSmallCapsRun(gfxContext     *aContext,
+                          gfxTextRun     *aTextRun,
+                          const uint8_t  *aText,
+                          uint32_t        aOffset,
+                          uint32_t        aLength,
+                          uint8_t         aMatchType,
+                          int32_t         aScript)
+{
+    NS_ConvertASCIItoUTF16 unicodeString(reinterpret_cast<const char*>(aText),
+                                         aLength);
+    return InitSmallCapsRun(aContext, aTextRun, unicodeString.get(),
+                            aOffset, aLength, aMatchType, aScript);
+}
+
+bool
+gfxFont::InitSmallCapsRun(gfxContext     *aContext,
+                          gfxTextRun     *aTextRun,
+                          const char16_t *aText,
+                          uint32_t        aOffset,
+                          uint32_t        aLength,
+                          uint8_t         aMatchType,
+                          int32_t         aScript)
+{
+    bool ok = true;
+
+    nsRefPtr<gfxFont> smallCapsFont = GetSmallCapsFont();
+
+    enum RunCaseState {
+        kUpperOrCaseless, // will be untouched by font-variant:small-caps
+        kLowercase,       // will be uppercased and reduced
+        kSpecialUpper     // specials: don't shrink, but apply uppercase mapping
+    };
+    RunCaseState runCase = kUpperOrCaseless;
+    uint32_t runStart = 0;
+
+    for (uint32_t i = 0; i <= aLength; ++i) {
+        RunCaseState chCase = kUpperOrCaseless;
+        // Unless we're at the end, figure out what treatment the current
+        // character will need.
+        if (i < aLength) {
+            uint32_t ch = aText[i];
+            if (NS_IS_HIGH_SURROGATE(ch) && i < aLength - 1 &&
+                NS_IS_LOW_SURROGATE(aText[i + 1])) {
+                ch = SURROGATE_TO_UCS4(ch, aText[i + 1]);
+            }
+            // Characters that aren't the start of a cluster are ignored here.
+            // They get added to whatever lowercase/non-lowercase run we're in.
+            if (IsClusterExtender(ch)) {
+                chCase = runCase;
+            } else {
+                uint32_t ch2 = ToUpperCase(ch);
+                if (ch != ch2 || mozilla::unicode::SpecialUpper(ch)) {
+                    chCase = kLowercase;
+                }
+                else if (mStyle.language == nsGkAtoms::el) {
+                    // In Greek, check for characters that will be modified by
+                    // the GreekUpperCase mapping - this catches accented
+                    // capitals where the accent is to be removed (bug 307039).
+                    // These are handled by using the full-size font with the
+                    // uppercasing transform.
+                    GreekCasing::State state;
+                    ch2 = GreekCasing::UpperCase(ch, state);
+                    if (ch != ch2) {
+                        chCase = kSpecialUpper;
+                    }
+                }
+            }
+        }
+
+        // At the end of the text or when the current character needs different
+        // casing treatment from the current run, finish the run-in-progress
+        // and prepare to accumulate a new run.
+        // Note that we do not look at any source data for offset [i] here,
+        // as that would be invalid in the case where i==length.
+        if ((i == aLength || runCase != chCase) && runStart < i) {
+            uint32_t runLength = i - runStart;
+            gfxFont* f = this;
+            switch (runCase) {
+            case kUpperOrCaseless:
+                // just use the current font and the existing string
+                aTextRun->AddGlyphRun(f, aMatchType, aOffset + runStart, true);
+                if (!f->SplitAndInitTextRun(aContext, aTextRun,
+                                            aText + runStart,
+                                            aOffset + runStart, runLength,
+                                            aScript)) {
+                    ok = false;
+                }
+                break;
+
+            case kLowercase:
+                // use reduced-size font, fall through to uppercase the text
+                f = smallCapsFont;
+
+            case kSpecialUpper:
+                // apply uppercase transform to the string
+                nsDependentSubstring origString(aText + runStart, runLength);
+                nsAutoString convertedString;
+                nsAutoTArray<bool,50> charsToMergeArray;
+                nsAutoTArray<bool,50> deletedCharsArray;
+
+                bool mergeNeeded = nsCaseTransformTextRunFactory::
+                    TransformString(origString,
+                                    convertedString,
+                                    true,
+                                    mStyle.language,
+                                    charsToMergeArray,
+                                    deletedCharsArray);
+
+                if (mergeNeeded) {
+                    // This is the hard case: the transformation caused chars
+                    // to be inserted or deleted, so we can't shape directly
+                    // into the destination textrun but have to handle the
+                    // mismatch of character positions.
+                    gfxTextRunFactory::Parameters params = {
+                        aContext, nullptr, nullptr, nullptr, 0,
+                        aTextRun->GetAppUnitsPerDevUnit()
+                    };
+                    nsAutoPtr<gfxTextRun> tempRun;
+                    tempRun =
+                        gfxTextRun::Create(&params, convertedString.Length(),
+                                           aTextRun->GetFontGroup(), 0);
+                    tempRun->AddGlyphRun(f, aMatchType, 0, true);
+                    if (!f->SplitAndInitTextRun(aContext, tempRun,
+                                                convertedString.BeginReading(),
+                                                0, convertedString.Length(),
+                                                aScript)) {
+                        ok = false;
+                    } else {
+                        nsAutoPtr<gfxTextRun> mergedRun;
+                        mergedRun =
+                            gfxTextRun::Create(&params, runLength,
+                                               aTextRun->GetFontGroup(), 0);
+                        MergeCharactersInTextRun(mergedRun, tempRun,
+                                                 charsToMergeArray.Elements(),
+                                                 deletedCharsArray.Elements());
+                        aTextRun->CopyGlyphDataFrom(mergedRun, 0, runLength,
+                                                    aOffset + runStart);
+                    }
+                } else {
+                    aTextRun->AddGlyphRun(f, aMatchType, aOffset + runStart,
+                                          true);
+                    if (!f->SplitAndInitTextRun(aContext, aTextRun,
+                                                convertedString.BeginReading(),
+                                                aOffset + runStart, runLength,
+                                                aScript)) {
+                        ok = false;
+                    }
+                }
+                break;
+            }
+
+            runStart = i;
+        }
+
+        if (i < aLength) {
+            runCase = chCase;
+        }
+    }
+
+    return ok;
+}
+
+already_AddRefed<gfxFont>
+gfxFont::GetSmallCapsFont()
+{
+    gfxFontStyle style(*GetStyle());
+    style.size *= SMALL_CAPS_SCALE_FACTOR;
+    style.smallCaps = false;
+    gfxFontEntry* fe = GetFontEntry();
+    bool needsBold = style.weight >= 600 && !fe->IsBold();
+    return fe->FindOrMakeFont(&style, needsBold);
+}
+
 gfxTextRun *
 gfxFontGroup::GetEllipsisTextRun(int32_t aAppUnitsPerDevPixel,
                                  LazyReferenceContextGetter& aRefContextGetter)
@@ -5809,6 +6169,7 @@ gfxFontStyle::gfxFontStyle() :
     languageOverride(NO_FONT_LANGUAGE_OVERRIDE),
     weight(NS_FONT_WEIGHT_NORMAL), stretch(NS_FONT_STRETCH_NORMAL),
     systemFont(true), printerFont(false), useGrayscaleAntialiasing(false),
+    smallCaps(false),
     style(NS_FONT_STYLE_NORMAL)
 {
 }
@@ -5816,14 +6177,16 @@ gfxFontStyle::gfxFontStyle() :
 gfxFontStyle::gfxFontStyle(uint8_t aStyle, uint16_t aWeight, int16_t aStretch,
                            gfxFloat aSize, nsIAtom *aLanguage,
                            float aSizeAdjust, bool aSystemFont,
-                           bool aPrinterFont,
+                           bool aPrinterFont, bool aSmallCaps,
                            const nsString& aLanguageOverride):
     language(aLanguage),
     size(aSize), sizeAdjust(aSizeAdjust),
     languageOverride(ParseFontLanguageOverride(aLanguageOverride)),
     weight(aWeight), stretch(aStretch),
     systemFont(aSystemFont), printerFont(aPrinterFont),
-    useGrayscaleAntialiasing(false), style(aStyle)
+    useGrayscaleAntialiasing(false),
+    smallCaps(aSmallCaps),
+    style(aStyle)
 {
     MOZ_ASSERT(!mozilla::IsNaN(size));
     MOZ_ASSERT(!mozilla::IsNaN(sizeAdjust));
@@ -5855,6 +6218,7 @@ gfxFontStyle::gfxFontStyle(const gfxFontStyle& aStyle) :
     weight(aStyle.weight), stretch(aStyle.stretch),
     systemFont(aStyle.systemFont), printerFont(aStyle.printerFont),
     useGrayscaleAntialiasing(aStyle.useGrayscaleAntialiasing),
+    smallCaps(aStyle.smallCaps),
     style(aStyle.style)
 {
     featureSettings.AppendElements(aStyle.featureSettings);
diff --git a/gfx/thebes/gfxFont.h b/gfx/thebes/gfxFont.h
index 176bed0cd8ec..c9fde71965a3 100644
--- a/gfx/thebes/gfxFont.h
+++ b/gfx/thebes/gfxFont.h
@@ -60,6 +60,8 @@ class nsILanguageAtomService;
 
 #define NO_FONT_LANGUAGE_OVERRIDE      0
 
+#define SMALL_CAPS_SCALE_FACTOR        0.8
+
 struct FontListSizes;
 struct gfxTextRunDrawCallbacks;
 
@@ -74,7 +76,7 @@ struct gfxFontStyle {
     gfxFontStyle(uint8_t aStyle, uint16_t aWeight, int16_t aStretch,
                  gfxFloat aSize, nsIAtom *aLanguage,
                  float aSizeAdjust, bool aSystemFont,
-                 bool aPrinterFont,
+                 bool aPrinterFont, bool aSmallCaps,
                  const nsString& aLanguageOverride);
     gfxFontStyle(const gfxFontStyle& aStyle);
 
@@ -139,6 +141,10 @@ struct gfxFontStyle {
     // Used to imitate -webkit-font-smoothing: antialiased
     bool useGrayscaleAntialiasing : 1;
 
+    // Font should render as small-caps, using OT feature if available,
+    // otherwise using a synthetic small-caps implementation
+    bool smallCaps : 1;
+
     // The style of font (normal, italic, oblique)
     uint8_t style : 2;
 
@@ -163,6 +169,7 @@ struct gfxFontStyle {
             (*reinterpret_cast<const uint64_t*>(&size) ==
              *reinterpret_cast<const uint64_t*>(&other.size)) &&
             (style == other.style) &&
+            (smallCaps == other.smallCaps) &&
             (systemFont == other.systemFont) &&
             (printerFont == other.printerFont) &&
             (useGrayscaleAntialiasing == other.useGrayscaleAntialiasing) &&
@@ -389,6 +396,11 @@ public:
     bool     GetMathVariantsParts(uint32_t aGlyphID, bool aVertical,
                                   uint32_t aGlyphs[4]);
 
+    bool     TryGetColorGlyphs();
+    bool     GetColorLayersInfo(uint32_t aGlyphId,
+                                nsTArray<uint16_t>& layerGlyphs,
+                                nsTArray<mozilla::gfx::Color>& layerColors);
+
     virtual bool MatchesGenericFamily(const nsACString& aGeneric) const {
         return true;
     }
@@ -531,6 +543,7 @@ public:
     bool             mCheckedForGraphiteTables : 1;
     bool             mHasCmapTable : 1;
     bool             mGrFaceInitialized : 1;
+    bool             mCheckedForColorGlyph : 1;
 
     // bitvector of substitution space features per script, one each
     // for default and non-default features
@@ -551,6 +564,10 @@ public:
     nsTArray<gfxFontFeature> mFeatureSettings;
     uint32_t         mLanguageOverride;
 
+    // Color Layer font support
+    hb_blob_t*       mCOLR;
+    hb_blob_t*       mCPAL;
+
 protected:
     friend class gfxPlatformFontList;
     friend class gfxMacPlatformFontList;
@@ -1791,6 +1808,22 @@ public:
         return mFontEntry->GetUVSGlyph(aCh, aVS); 
     }
 
+    bool InitSmallCapsRun(gfxContext     *aContext,
+                          gfxTextRun     *aTextRun,
+                          const uint8_t  *aText,
+                          uint32_t        aOffset,
+                          uint32_t        aLength,
+                          uint8_t         aMatchType,
+                          int32_t         aScript);
+
+    bool InitSmallCapsRun(gfxContext     *aContext,
+                          gfxTextRun     *aTextRun,
+                          const char16_t *aText,
+                          uint32_t        aOffset,
+                          uint32_t        aLength,
+                          uint8_t         aMatchType,
+                          int32_t         aScript);
+
     // call the (virtual) InitTextRun method to do glyph generation/shaping,
     // limiting the length of text passed by processing the run in multiple
     // segments if necessary
@@ -1899,6 +1932,13 @@ public:
     }
 
 protected:
+    // Return a font that is a "clone" of this one, but reduced to 80% size
+    // (and with the smallCaps style set to false).
+    // Default implementation relies on gfxFontEntry::CreateFontInstance;
+    // backends that don't implement that will need to override this and use
+    // an alternative technique. (gfxPangoFonts, I'm looking at you...)
+    virtual already_AddRefed<gfxFont> GetSmallCapsFont();
+
     // subclasses may provide (possibly hinted) glyph widths (in font units);
     // if they do not override this, harfbuzz will use unhinted widths
     // derived from the font tables
@@ -2135,6 +2175,14 @@ protected:
                         gfxTextRunDrawCallbacks *aCallbacks,
                         bool& aEmittedGlyphs);
 
+    bool RenderColorGlyph(gfxContext* aContext, gfxPoint& point, uint32_t aGlyphId);
+    bool RenderColorGlyph(gfxContext* aContext,
+                          mozilla::gfx::ScaledFont* scaledFont,
+                          mozilla::gfx::GlyphRenderingOptions* renderingOptions,
+                          mozilla::gfx::DrawOptions drawOptions,
+                          const mozilla::gfx::Point& aPoint,
+                          uint32_t aGlyphId);
+
     // Bug 674909. When synthetic bolding text by drawing twice, need to
     // render using a pixel offset in device pixels, otherwise text
     // doesn't appear bolded, it appears as if a bad text shadow exists
diff --git a/gfx/thebes/gfxFontUtils.cpp b/gfx/thebes/gfxFontUtils.cpp
index 3f00228ee28b..7c00a3da1617 100644
--- a/gfx/thebes/gfxFontUtils.cpp
+++ b/gfx/thebes/gfxFontUtils.cpp
@@ -11,6 +11,7 @@
 #include "mozilla/ArrayUtils.h"
 
 #include "gfxFontUtils.h"
+#include "gfxColor.h"
 
 #include "nsServiceManagerUtils.h"
 
@@ -785,7 +786,7 @@ nsresult gfxFontUtils::MakeUniqueUserFontName(nsAString& aName)
             *p = '-';
     }
 
-    aName.AssignLiteral("uf");
+    aName.AssignLiteral(MOZ_UTF16("uf"));
     aName.AppendASCII(guidB64);
     return NS_OK;
 }
@@ -1439,6 +1440,215 @@ gfxFontUtils::ReadNames(const char *aNameData, uint32_t aDataLen,
     return NS_OK;
 }
 
+#pragma pack(1)
+
+struct COLRBaseGlyphRecord {
+    AutoSwap_PRUint16    glyphId;
+    AutoSwap_PRUint16    firstLayerIndex;
+    AutoSwap_PRUint16    numLayers;
+};
+
+struct COLRLayerRecord {
+    AutoSwap_PRUint16    glyphId;
+    AutoSwap_PRUint16    paletteEntryIndex;
+};
+
+struct CPALColorRecord {
+    uint8_t              blue;
+    uint8_t              green;
+    uint8_t              red;
+    uint8_t              alpha;
+};
+
+#pragma pack()
+
+bool
+gfxFontUtils::ValidateColorGlyphs(hb_blob_t* aCOLR, hb_blob_t* aCPAL)
+{
+    unsigned int colrLength;
+    const COLRHeader* colr =
+        reinterpret_cast<const COLRHeader*>(hb_blob_get_data(aCOLR, &colrLength));
+    unsigned int cpalLength;
+    const CPALHeaderVersion0* cpal =
+        reinterpret_cast<const CPALHeaderVersion0*>(hb_blob_get_data(aCPAL, &cpalLength));
+
+    if (!colr || !cpal || !colrLength || !cpalLength) {
+        return false;
+    }
+
+    if (uint16_t(colr->version) != 0 || uint16_t(cpal->version) != 0) {
+        // We only support version 0 headers.
+        return false;
+    }
+
+    const uint32_t offsetBaseGlyphRecord = colr->offsetBaseGlyphRecord;
+    const uint16_t numBaseGlyphRecord = colr->numBaseGlyphRecord;
+    const uint32_t offsetLayerRecord = colr->offsetLayerRecord;
+    const uint16_t numLayerRecords = colr->numLayerRecords;
+
+    const uint32_t offsetFirstColorRecord = cpal->offsetFirstColorRecord;
+    const uint16_t numColorRecords = cpal->numColorRecords;
+    const uint32_t numPaletteEntries = cpal->numPaletteEntries;
+
+    if (offsetBaseGlyphRecord >= colrLength) {
+        return false;
+    }
+
+    if (offsetLayerRecord >= colrLength) {
+        return false;
+    }
+
+    if (offsetFirstColorRecord >= cpalLength) {
+        return false;
+    }
+
+    if (!numPaletteEntries) {
+        return false;
+    }
+
+    if (sizeof(COLRBaseGlyphRecord) * numBaseGlyphRecord >
+            colrLength - offsetBaseGlyphRecord) {
+        // COLR base glyph record will be overflow
+        return false;
+    }
+
+    if (sizeof(COLRLayerRecord) * numLayerRecords >
+            colrLength - offsetLayerRecord) {
+        // COLR layer record will be overflow
+        return false;
+    }
+
+    if (sizeof(CPALColorRecord) * numColorRecords >
+            cpalLength - offsetFirstColorRecord) {
+        // CPAL color record will be overflow
+        return false;
+    }
+
+    if (numPaletteEntries * uint16_t(cpal->numPalettes) != numColorRecords ) {
+        // palette of CPAL color record will be overflow.
+        return false;
+    }
+
+    uint16_t lastGlyphId = 0;
+    const COLRBaseGlyphRecord* baseGlyph =
+        reinterpret_cast<const COLRBaseGlyphRecord*>(
+            reinterpret_cast<const uint8_t*>(colr) + offsetBaseGlyphRecord);
+
+    for (uint16_t i = 0; i < numBaseGlyphRecord; i++, baseGlyph++) {
+        const uint32_t firstLayerIndex = baseGlyph->firstLayerIndex;
+        const uint16_t numLayers = baseGlyph->numLayers;
+        const uint16_t glyphId = baseGlyph->glyphId;
+
+        if (lastGlyphId && lastGlyphId >= glyphId) {
+            // glyphId must be sorted
+            return false;
+        }
+        lastGlyphId = glyphId;
+
+        if (!numLayers) {
+            // no layer
+            return false;
+        }
+        if (firstLayerIndex + numLayers > numLayerRecords) {
+            // layer length of target glyph is overflow
+            return false;
+        }
+    }
+
+    const COLRLayerRecord* layer =
+        reinterpret_cast<const COLRLayerRecord*>(
+            reinterpret_cast<const uint8_t*>(colr) + offsetLayerRecord);
+
+    for (uint16_t i = 0; i < numLayerRecords; i++, layer++) {
+        if (uint16_t(layer->paletteEntryIndex) >= numPaletteEntries) {
+            // CPAL palette entry record is overflow
+            return false;
+        }
+    }
+
+    return true;
+}
+
+static int
+CompareBaseGlyph(const void* key, const void* data)
+{
+    uint32_t glyphId = (uint32_t)(uintptr_t)key;
+    const COLRBaseGlyphRecord* baseGlyph =
+        reinterpret_cast<const COLRBaseGlyphRecord*>(data);
+    uint32_t baseGlyphId = uint16_t(baseGlyph->glyphId);
+
+    if (baseGlyphId == glyphId) {
+        return 0;
+    }
+
+    return baseGlyphId > glyphId ? -1 : 1;
+}
+
+static
+COLRBaseGlyphRecord*
+LookForBaseGlyphRecord(const COLRHeader* aCOLR, uint32_t aGlyphId)
+{
+    const uint8_t* baseGlyphRecords =
+        reinterpret_cast<const uint8_t*>(aCOLR) +
+        uint32_t(aCOLR->offsetBaseGlyphRecord);
+    // BaseGlyphRecord is sorted by glyphId
+    return reinterpret_cast<COLRBaseGlyphRecord*>(
+               bsearch((void*)(uintptr_t)aGlyphId,
+                       baseGlyphRecords,
+                       uint16_t(aCOLR->numBaseGlyphRecord),
+                       sizeof(COLRBaseGlyphRecord),
+                       CompareBaseGlyph));
+}
+
+bool
+gfxFontUtils::GetColorGlyphLayers(hb_blob_t* aCOLR,
+                                  hb_blob_t* aCPAL,
+                                  uint32_t aGlyphId,
+                                  nsTArray<uint16_t>& aGlyphs,
+                                  nsTArray<mozilla::gfx::Color>& aColors)
+{
+    unsigned int blobLength;
+    const COLRHeader* colr =
+        reinterpret_cast<const COLRHeader*>(hb_blob_get_data(aCOLR,
+                                                             &blobLength));
+    MOZ_ASSERT(colr, "Cannot get COLR raw data");
+    MOZ_ASSERT(blobLength, "Found COLR data, but length is 0");
+
+    COLRBaseGlyphRecord* baseGlyph = LookForBaseGlyphRecord(colr, aGlyphId);
+    if (!baseGlyph) {
+        return false;
+    }
+
+    const CPALHeaderVersion0* cpal =
+        reinterpret_cast<const CPALHeaderVersion0*>(
+            hb_blob_get_data(aCPAL, &blobLength));
+    MOZ_ASSERT(cpal, "Cannot get CPAL raw data");
+    MOZ_ASSERT(blobLength, "Found CPAL data, but length is 0");
+
+    const COLRLayerRecord* layer =
+        reinterpret_cast<const COLRLayerRecord*>(
+            reinterpret_cast<const uint8_t*>(colr) +
+            uint32_t(colr->offsetLayerRecord) +
+            sizeof(COLRLayerRecord) * uint16_t(baseGlyph->firstLayerIndex));
+    const uint16_t numLayers = baseGlyph->numLayers;
+    const uint32_t offsetFirstColorRecord = cpal->offsetFirstColorRecord;
+
+    for (uint16_t layerIndex = 0; layerIndex < numLayers; layerIndex++) {
+        aGlyphs.AppendElement(uint16_t(layer->glyphId));
+        const CPALColorRecord* color =
+            reinterpret_cast<const CPALColorRecord*>(
+                reinterpret_cast<const uint8_t*>(cpal) +
+                offsetFirstColorRecord +
+                sizeof(CPALColorRecord) * uint16_t(layer->paletteEntryIndex));
+        aColors.AppendElement(mozilla::gfx::Color(color->red / 255.0,
+                                                  color->green / 255.0,
+                                                  color->blue / 255.0,
+                                                  color->alpha / 255.0));
+        layer++;
+    }
+    return true;
+}
+
 #ifdef XP_WIN
 
 /* static */
diff --git a/gfx/thebes/gfxFontUtils.h b/gfx/thebes/gfxFontUtils.h
index 7e3f24cf0885..ee75b23b595b 100644
--- a/gfx/thebes/gfxFontUtils.h
+++ b/gfx/thebes/gfxFontUtils.h
@@ -605,6 +605,22 @@ struct KernTableSubtableHeaderVersion1 {
     AutoSwap_PRUint16    tupleIndex;
 };
 
+struct COLRHeader {
+    AutoSwap_PRUint16    version;
+    AutoSwap_PRUint16    numBaseGlyphRecord;
+    AutoSwap_PRUint32    offsetBaseGlyphRecord;
+    AutoSwap_PRUint32    offsetLayerRecord;
+    AutoSwap_PRUint16    numLayerRecords;
+};
+
+struct CPALHeaderVersion0 {
+    AutoSwap_PRUint16    version;
+    AutoSwap_PRUint16    numPaletteEntries;
+    AutoSwap_PRUint16    numPalettes;
+    AutoSwap_PRUint16    numColorRecords;
+    AutoSwap_PRUint32    offsetFirstColorRecord;
+};
+
 #pragma pack()
 
 // Return just the highest bit of the given value, i.e., the highest
@@ -926,6 +942,14 @@ public:
     // generate a unique font name
     static nsresult MakeUniqueUserFontName(nsAString& aName);
 
+    // for color layer from glyph using COLR and CPAL tables
+    static bool ValidateColorGlyphs(hb_blob_t* aCOLR, hb_blob_t* aCPAL);
+    static bool GetColorGlyphLayers(hb_blob_t* aCOLR,
+                                    hb_blob_t* aCPAL,
+                                    uint32_t aGlyphId,
+                                    nsTArray<uint16_t> &aGlyphs,
+                                    nsTArray<mozilla::gfx::Color> &aColors);
+
 protected:
     static nsresult
     ReadNames(const char *aNameData, uint32_t aDataLen, uint32_t aNameID,
diff --git a/gfx/thebes/gfxPangoFonts.cpp b/gfx/thebes/gfxPangoFonts.cpp
index 98b1a199a626..abfc5e7c71e7 100644
--- a/gfx/thebes/gfxPangoFonts.cpp
+++ b/gfx/thebes/gfxPangoFonts.cpp
@@ -661,6 +661,8 @@ public:
 #endif
 
 protected:
+    virtual already_AddRefed<gfxFont> GetSmallCapsFont();
+
     virtual bool ShapeText(gfxContext      *aContext,
                            const char16_t *aText,
                            uint32_t         aOffset,
@@ -669,12 +671,6 @@ protected:
                            gfxShapedText   *aShapedText,
                            bool             aPreferPlatformShaping);
 
-    bool InitGlyphRunWithPango(const char16_t *aString,
-                               uint32_t         aOffset,
-                               uint32_t         aLength,
-                               int32_t          aScript,
-                               gfxShapedText   *aShapedText);
-
 private:
     gfxFcFont(cairo_scaled_font_t *aCairoFont, gfxFcFontEntry *aFontEntry,
               const gfxFontStyle *aFontStyle);
@@ -1601,6 +1597,41 @@ gfxFcFont::~gfxFcFont()
                                     nullptr);
 }
 
+already_AddRefed<gfxFont>
+gfxFcFont::GetSmallCapsFont()
+{
+    gfxFontStyle style(*GetStyle());
+    style.size *= SMALL_CAPS_SCALE_FACTOR;
+    style.smallCaps = false;
+    gfxFcFontEntry* fe = static_cast<gfxFcFontEntry*>(GetFontEntry());
+    nsRefPtr<gfxFont> font = gfxFontCache::GetCache()->Lookup(fe, &style);
+    if (font) {
+        return font.forget();
+    }
+
+    cairo_matrix_t fontMatrix;
+    cairo_scaled_font_get_font_matrix(mScaledFont, &fontMatrix);
+    cairo_matrix_scale(&fontMatrix,
+                       SMALL_CAPS_SCALE_FACTOR, SMALL_CAPS_SCALE_FACTOR);
+
+    cairo_matrix_t ctm;
+    cairo_scaled_font_get_ctm(mScaledFont, &ctm);
+
+    cairo_font_options_t *options = cairo_font_options_create();
+    cairo_scaled_font_get_font_options(mScaledFont, options);
+
+    cairo_scaled_font_t *smallFont =
+        cairo_scaled_font_create(cairo_scaled_font_get_font_face(mScaledFont),
+                                 &fontMatrix, &ctm, options);
+    cairo_font_options_destroy(options);
+
+    font = new gfxFcFont(smallFont, fe, &style);
+    gfxFontCache::GetCache()->AddNew(font);
+    cairo_scaled_font_destroy(smallFont);
+
+    return font.forget();
+}
+
 bool
 gfxFcFont::ShapeText(gfxContext      *aContext,
                      const char16_t *aText,
diff --git a/gfx/thebes/gfxPrefs.h b/gfx/thebes/gfxPrefs.h
index d14bb43e1668..f80aec2942e1 100644
--- a/gfx/thebes/gfxPrefs.h
+++ b/gfx/thebes/gfxPrefs.h
@@ -121,11 +121,15 @@ private:
   DECL_GFX_PREF(Once, "apz.max_velocity_queue_size",           APZMaxVelocityQueueSize, uint32_t, 5);
   DECL_GFX_PREF(Live, "apz.min_skate_speed",                   APZMinSkateSpeed, float, 1.0f);
   DECL_GFX_PREF(Live, "apz.num_paint_duration_samples",        APZNumPaintDurationSamples, int32_t, 3);
+  DECL_GFX_PREF(Live, "apz.overscroll.enabled",                APZOverscrollEnabled, bool, false);
+  DECL_GFX_PREF(Once, "apz.overscroll.snap_back_accel",        APZSnapBackAcceleration, float, 0.002f);
+  DECL_GFX_PREF(Live, "apz.overscroll.snap_back_init_vel",     APZSnapBackInitialVelocity, float, 1.0f);
   DECL_GFX_PREF(Live, "apz.pan_repaint_interval",              APZPanRepaintInterval, int32_t, 250);
   DECL_GFX_PREF(Live, "apz.subframe.enabled",                  APZSubframeEnabled, bool, false);
   DECL_GFX_PREF(Live, "apz.touch_start_tolerance",             APZTouchStartTolerance, float, 1.0f/4.5f);
   DECL_GFX_PREF(Live, "apz.use_paint_duration",                APZUsePaintDuration, bool, true);
   DECL_GFX_PREF(Live, "apz.velocity_bias",                     APZVelocityBias, float, 1.0f);
+  DECL_GFX_PREF(Live, "apz.velocity_relevance_time_ms",        APZVelocityRelevanceTime, uint32_t, 150);
   DECL_GFX_PREF(Live, "apz.x_skate_size_multiplier",           APZXSkateSizeMultiplier, float, 1.5f);
   DECL_GFX_PREF(Live, "apz.x_stationary_size_multiplier",      APZXStationarySizeMultiplier, float, 3.0f);
   DECL_GFX_PREF(Live, "apz.y_skate_size_multiplier",           APZYSkateSizeMultiplier, float, 2.5f);
diff --git a/gfx/thebes/gfxQtPlatform.cpp b/gfx/thebes/gfxQtPlatform.cpp
index 1931a23dcbeb..6e5eeba6e82d 100644
--- a/gfx/thebes/gfxQtPlatform.cpp
+++ b/gfx/thebes/gfxQtPlatform.cpp
@@ -46,17 +46,11 @@ using namespace mozilla::unicode;
 using namespace mozilla::gfx;
 
 gfxFontconfigUtils *gfxQtPlatform::sFontconfigUtils = nullptr;
-#ifdef MOZ_X11
-bool gfxQtPlatform::sUseXRender = true;
-#endif
 
 static gfxImageFormat sOffscreenFormat = gfxImageFormat::RGB24;
 
 gfxQtPlatform::gfxQtPlatform()
 {
-#ifdef MOZ_X11
-    sUseXRender = mozilla::Preferences::GetBool("gfx.xrender.enabled");
-#endif
     if (!sFontconfigUtils)
         sFontconfigUtils = gfxFontconfigUtils::GetFontconfigUtils();
 
diff --git a/gfx/thebes/gfxQtPlatform.h b/gfx/thebes/gfxQtPlatform.h
index 97676ee4751c..6796f065db5a 100644
--- a/gfx/thebes/gfxQtPlatform.h
+++ b/gfx/thebes/gfxQtPlatform.h
@@ -93,28 +93,12 @@ protected:
     static gfxFontconfigUtils *sFontconfigUtils;
 
 private:
-
-    bool UseXRender() {
-#if defined(MOZ_X11)
-        if (GetContentBackend() != mozilla::gfx::BackendType::NONE &&
-            GetContentBackend() != mozilla::gfx::BackendType::CAIRO)
-            return false;
-
-        return sUseXRender;
-#else
-        return false;
-#endif
-    }
-
     virtual void GetPlatformCMSOutputProfile(void *&mem, size_t &size) MOZ_OVERRIDE;
 
     // TODO: unify this with mPrefFonts (NB: holds families, not fonts) in gfxPlatformFontList
     nsDataHashtable<nsCStringHashKey, nsTArray<nsRefPtr<gfxFontEntry> > > mPrefFonts;
 
     int mScreenDepth;
-#ifdef MOZ_X11
-    static bool sUseXRender;
-#endif
 };
 
 #endif /* GFX_PLATFORM_QT_H */
diff --git a/gfx/thebes/gfxUserFontSet.cpp b/gfx/thebes/gfxUserFontSet.cpp
index 843418d002f2..4c671ed074b2 100644
--- a/gfx/thebes/gfxUserFontSet.cpp
+++ b/gfx/thebes/gfxUserFontSet.cpp
@@ -333,13 +333,15 @@ private:
 static ots::TableAction
 OTSTableAction(uint32_t aTag, void *aUserData)
 {
-    // preserve Graphite and SVG tables
+    // preserve Graphite, color glyph and SVG tables
     if (aTag == TRUETYPE_TAG('S', 'i', 'l', 'f') ||
         aTag == TRUETYPE_TAG('S', 'i', 'l', 'l') ||
         aTag == TRUETYPE_TAG('G', 'l', 'o', 'c') ||
         aTag == TRUETYPE_TAG('G', 'l', 'a', 't') ||
         aTag == TRUETYPE_TAG('F', 'e', 'a', 't') ||
-        aTag == TRUETYPE_TAG('S', 'V', 'G', ' ')) {
+        aTag == TRUETYPE_TAG('S', 'V', 'G', ' ') ||
+        aTag == TRUETYPE_TAG('C', 'O', 'L', 'R') ||
+        aTag == TRUETYPE_TAG('C', 'P', 'A', 'L')) {
         return ots::TABLE_ACTION_PASSTHRU;
     }
     return ots::TABLE_ACTION_DEFAULT;
diff --git a/gfx/thebes/gfxWindowsPlatform.cpp b/gfx/thebes/gfxWindowsPlatform.cpp
index 507bb80e2e22..74ea4db4f011 100644
--- a/gfx/thebes/gfxWindowsPlatform.cpp
+++ b/gfx/thebes/gfxWindowsPlatform.cpp
@@ -764,6 +764,7 @@ static const char kFontNirmalaUI[] = "Nirmala UI";
 static const char kFontNyala[] = "Nyala";
 static const char kFontPlantagenetCherokee[] = "Plantagenet Cherokee";
 static const char kFontSegoeUI[] = "Segoe UI";
+static const char kFontSegoeUIEmoji[] = "Segoe UI Emoji";
 static const char kFontSegoeUISymbol[] = "Segoe UI Symbol";
 static const char kFontSylfaen[] = "Sylfaen";
 static const char kFontTraditionalArabic[] = "Traditional Arabic";
@@ -781,6 +782,7 @@ gfxWindowsPlatform::GetCommonFallbackFonts(const uint32_t aCh,
     if (!IS_IN_BMP(aCh)) {
         uint32_t p = aCh >> 16;
         if (p == 1) { // SMP plane
+            aFontList.AppendElement(kFontSegoeUIEmoji);
             aFontList.AppendElement(kFontSegoeUISymbol);
             aFontList.AppendElement(kFontEbrima);
             aFontList.AppendElement(kFontNirmalaUI);
@@ -859,6 +861,7 @@ gfxWindowsPlatform::GetCommonFallbackFonts(const uint32_t aCh,
         case 0x2b:
         case 0x2c:
             aFontList.AppendElement(kFontSegoeUI);
+            aFontList.AppendElement(kFontSegoeUIEmoji);
             aFontList.AppendElement(kFontSegoeUISymbol);
             aFontList.AppendElement(kFontCambria);
             aFontList.AppendElement(kFontMeiryo);
@@ -1130,7 +1133,7 @@ gfxWindowsPlatform::GetDLLVersion(char16ptr_t aDLLPath, nsAString& aVersion)
 {
     DWORD versInfoSize, vers[4] = {0};
     // version info not available case
-    aVersion.AssignLiteral("0.0.0.0");
+    aVersion.AssignLiteral(MOZ_UTF16("0.0.0.0"));
     versInfoSize = GetFileVersionInfoSizeW(aDLLPath, nullptr);
     nsAutoTArray<BYTE,512> versionInfo;
     
diff --git a/image/decoders/icon/gtk/nsIconChannel.cpp b/image/decoders/icon/gtk/nsIconChannel.cpp
index 42876e5d765c..19a8f4daabc4 100644
--- a/image/decoders/icon/gtk/nsIconChannel.cpp
+++ b/image/decoders/icon/gtk/nsIconChannel.cpp
@@ -325,7 +325,7 @@ nsIconChannel::InitWithGnome(nsIMozIconURI *aIconURI)
                                 getter_Copies(appName));
     } else {
       NS_WARNING("brand.properties not present, using default application name");
-      appName.AssignLiteral("Gecko");
+      appName.AssignLiteral(MOZ_UTF16("Gecko"));
     }
 
     char* empty[] = { "" };
diff --git a/intl/locale/src/unix/nsCollationUnix.cpp b/intl/locale/src/unix/nsCollationUnix.cpp
index a0b724d4a3b3..3bc5a731c17f 100644
--- a/intl/locale/src/unix/nsCollationUnix.cpp
+++ b/intl/locale/src/unix/nsCollationUnix.cpp
@@ -81,7 +81,7 @@ nsresult nsCollationUnix::Initialize(nsILocale* locale)
   if (NS_SUCCEEDED(res)) {
     // keep the same behavior as 4.x as well as avoiding Linux collation key problem
     if (localeStr.LowerCaseEqualsLiteral("en_us")) { // note: locale is in platform format
-      localeStr.AssignLiteral("C");
+      localeStr.Assign('C');
     }
 
     nsPosixLocale::GetPlatformLocale(localeStr, mLocale);
diff --git a/intl/unicharutil/util/nsUnicharUtils.cpp b/intl/unicharutil/util/nsUnicharUtils.cpp
index f82902f0fbf2..420797fc9b0e 100644
--- a/intl/unicharutil/util/nsUnicharUtils.cpp
+++ b/intl/unicharutil/util/nsUnicharUtils.cpp
@@ -214,6 +214,263 @@ ToTitleCase(uint32_t aChar)
   return mozilla::unicode::GetTitlecaseForLower(aChar);
 }
 
+// Custom uppercase mapping for Greek; see bug 307039 for details
+#define GREEK_LOWER_ALPHA                      0x03B1
+#define GREEK_LOWER_ALPHA_TONOS                0x03AC
+#define GREEK_LOWER_ALPHA_OXIA                 0x1F71
+#define GREEK_LOWER_EPSILON                    0x03B5
+#define GREEK_LOWER_EPSILON_TONOS              0x03AD
+#define GREEK_LOWER_EPSILON_OXIA               0x1F73
+#define GREEK_LOWER_ETA                        0x03B7
+#define GREEK_LOWER_ETA_TONOS                  0x03AE
+#define GREEK_LOWER_ETA_OXIA                   0x1F75
+#define GREEK_LOWER_IOTA                       0x03B9
+#define GREEK_LOWER_IOTA_TONOS                 0x03AF
+#define GREEK_LOWER_IOTA_OXIA                  0x1F77
+#define GREEK_LOWER_IOTA_DIALYTIKA             0x03CA
+#define GREEK_LOWER_IOTA_DIALYTIKA_TONOS       0x0390
+#define GREEK_LOWER_IOTA_DIALYTIKA_OXIA        0x1FD3
+#define GREEK_LOWER_OMICRON                    0x03BF
+#define GREEK_LOWER_OMICRON_TONOS              0x03CC
+#define GREEK_LOWER_OMICRON_OXIA               0x1F79
+#define GREEK_LOWER_UPSILON                    0x03C5
+#define GREEK_LOWER_UPSILON_TONOS              0x03CD
+#define GREEK_LOWER_UPSILON_OXIA               0x1F7B
+#define GREEK_LOWER_UPSILON_DIALYTIKA          0x03CB
+#define GREEK_LOWER_UPSILON_DIALYTIKA_TONOS    0x03B0
+#define GREEK_LOWER_UPSILON_DIALYTIKA_OXIA     0x1FE3
+#define GREEK_LOWER_OMEGA                      0x03C9
+#define GREEK_LOWER_OMEGA_TONOS                0x03CE
+#define GREEK_LOWER_OMEGA_OXIA                 0x1F7D
+#define GREEK_UPPER_ALPHA                      0x0391
+#define GREEK_UPPER_EPSILON                    0x0395
+#define GREEK_UPPER_ETA                        0x0397
+#define GREEK_UPPER_IOTA                       0x0399
+#define GREEK_UPPER_IOTA_DIALYTIKA             0x03AA
+#define GREEK_UPPER_OMICRON                    0x039F
+#define GREEK_UPPER_UPSILON                    0x03A5
+#define GREEK_UPPER_UPSILON_DIALYTIKA          0x03AB
+#define GREEK_UPPER_OMEGA                      0x03A9
+#define GREEK_UPPER_ALPHA_TONOS                0x0386
+#define GREEK_UPPER_ALPHA_OXIA                 0x1FBB
+#define GREEK_UPPER_EPSILON_TONOS              0x0388
+#define GREEK_UPPER_EPSILON_OXIA               0x1FC9
+#define GREEK_UPPER_ETA_TONOS                  0x0389
+#define GREEK_UPPER_ETA_OXIA                   0x1FCB
+#define GREEK_UPPER_IOTA_TONOS                 0x038A
+#define GREEK_UPPER_IOTA_OXIA                  0x1FDB
+#define GREEK_UPPER_OMICRON_TONOS              0x038C
+#define GREEK_UPPER_OMICRON_OXIA               0x1FF9
+#define GREEK_UPPER_UPSILON_TONOS              0x038E
+#define GREEK_UPPER_UPSILON_OXIA               0x1FEB
+#define GREEK_UPPER_OMEGA_TONOS                0x038F
+#define GREEK_UPPER_OMEGA_OXIA                 0x1FFB
+#define COMBINING_ACUTE_ACCENT                 0x0301
+#define COMBINING_DIAERESIS                    0x0308
+#define COMBINING_ACUTE_TONE_MARK              0x0341
+#define COMBINING_GREEK_DIALYTIKA_TONOS        0x0344
+
+uint32_t
+GreekCasing::UpperCase(uint32_t aCh, GreekCasing::State& aState)
+{
+  switch (aCh) {
+  case GREEK_UPPER_ALPHA:
+  case GREEK_LOWER_ALPHA:
+    aState = kAlpha;
+    return GREEK_UPPER_ALPHA;
+
+  case GREEK_UPPER_EPSILON:
+  case GREEK_LOWER_EPSILON:
+    aState = kEpsilon;
+    return GREEK_UPPER_EPSILON;
+
+  case GREEK_UPPER_ETA:
+  case GREEK_LOWER_ETA:
+    aState = kEta;
+    return GREEK_UPPER_ETA;
+
+  case GREEK_UPPER_IOTA:
+    aState = kIota;
+    return GREEK_UPPER_IOTA;
+
+  case GREEK_UPPER_OMICRON:
+  case GREEK_LOWER_OMICRON:
+    aState = kOmicron;
+    return GREEK_UPPER_OMICRON;
+
+  case GREEK_UPPER_UPSILON:
+    switch (aState) {
+    case kOmicron:
+      aState = kOmicronUpsilon;
+      break;
+    default:
+      aState = kUpsilon;
+      break;
+    }
+    return GREEK_UPPER_UPSILON;
+
+  case GREEK_UPPER_OMEGA:
+  case GREEK_LOWER_OMEGA:
+    aState = kOmega;
+    return GREEK_UPPER_OMEGA;
+
+  // iota and upsilon may be the second vowel of a diphthong
+  case GREEK_LOWER_IOTA:
+    switch (aState) {
+    case kAlphaAcc:
+    case kEpsilonAcc:
+    case kOmicronAcc:
+    case kUpsilonAcc:
+      aState = kStart;
+      return GREEK_UPPER_IOTA_DIALYTIKA;
+    default:
+      break;
+    }
+    aState = kIota;
+    return GREEK_UPPER_IOTA;
+
+  case GREEK_LOWER_UPSILON:
+    switch (aState) {
+    case kAlphaAcc:
+    case kEpsilonAcc:
+    case kEtaAcc:
+    case kOmicronAcc:
+      aState = kStart;
+      return GREEK_UPPER_UPSILON_DIALYTIKA;
+    case kOmicron:
+      aState = kOmicronUpsilon;
+      break;
+    default:
+      aState = kUpsilon;
+      break;
+    }
+    return GREEK_UPPER_UPSILON;
+
+  case GREEK_UPPER_IOTA_DIALYTIKA:
+  case GREEK_LOWER_IOTA_DIALYTIKA:
+  case GREEK_UPPER_UPSILON_DIALYTIKA:
+  case GREEK_LOWER_UPSILON_DIALYTIKA:
+  case COMBINING_DIAERESIS:
+    aState = kDiaeresis;
+    return ToUpperCase(aCh);
+
+  // remove accent if it follows a vowel or diaeresis,
+  // and set appropriate state for diphthong detection
+  case COMBINING_ACUTE_ACCENT:
+  case COMBINING_ACUTE_TONE_MARK:
+    switch (aState) {
+    case kAlpha:
+      aState = kAlphaAcc;
+      return uint32_t(-1); // omit this char from result string
+    case kEpsilon:
+      aState = kEpsilonAcc;
+      return uint32_t(-1);
+    case kEta:
+      aState = kEtaAcc;
+      return uint32_t(-1);
+    case kIota:
+      aState = kIotaAcc;
+      return uint32_t(-1);
+    case kOmicron:
+      aState = kOmicronAcc;
+      return uint32_t(-1);
+    case kUpsilon:
+      aState = kUpsilonAcc;
+      return uint32_t(-1);
+    case kOmicronUpsilon:
+      aState = kStart; // this completed a diphthong
+      return uint32_t(-1);
+    case kOmega:
+      aState = kOmegaAcc;
+      return uint32_t(-1);
+    case kDiaeresis:
+      aState = kStart;
+      return uint32_t(-1);
+    default:
+      break;
+    }
+    break;
+
+  // combinations with dieresis+accent just strip the accent,
+  // and reset to start state (don't form diphthong with following vowel)
+  case GREEK_LOWER_IOTA_DIALYTIKA_TONOS:
+  case GREEK_LOWER_IOTA_DIALYTIKA_OXIA:
+    aState = kStart;
+    return GREEK_UPPER_IOTA_DIALYTIKA;
+
+  case GREEK_LOWER_UPSILON_DIALYTIKA_TONOS:
+  case GREEK_LOWER_UPSILON_DIALYTIKA_OXIA:
+    aState = kStart;
+    return GREEK_UPPER_UPSILON_DIALYTIKA;
+
+  case COMBINING_GREEK_DIALYTIKA_TONOS:
+    aState = kStart;
+    return COMBINING_DIAERESIS;
+
+  // strip accents from vowels, and note the vowel seen so that we can detect
+  // diphthongs where diaeresis needs to be added
+  case GREEK_LOWER_ALPHA_TONOS:
+  case GREEK_LOWER_ALPHA_OXIA:
+  case GREEK_UPPER_ALPHA_TONOS:
+  case GREEK_UPPER_ALPHA_OXIA:
+    aState = kAlphaAcc;
+    return GREEK_UPPER_ALPHA;
+
+  case GREEK_LOWER_EPSILON_TONOS:
+  case GREEK_LOWER_EPSILON_OXIA:
+  case GREEK_UPPER_EPSILON_TONOS:
+  case GREEK_UPPER_EPSILON_OXIA:
+    aState = kEpsilonAcc;
+    return GREEK_UPPER_EPSILON;
+
+  case GREEK_LOWER_ETA_TONOS:
+  case GREEK_LOWER_ETA_OXIA:
+  case GREEK_UPPER_ETA_TONOS:
+  case GREEK_UPPER_ETA_OXIA:
+    aState = kEtaAcc;
+    return GREEK_UPPER_ETA;
+
+  case GREEK_LOWER_IOTA_TONOS:
+  case GREEK_LOWER_IOTA_OXIA:
+  case GREEK_UPPER_IOTA_TONOS:
+  case GREEK_UPPER_IOTA_OXIA:
+    aState = kIotaAcc;
+    return GREEK_UPPER_IOTA;
+
+  case GREEK_LOWER_OMICRON_TONOS:
+  case GREEK_LOWER_OMICRON_OXIA:
+  case GREEK_UPPER_OMICRON_TONOS:
+  case GREEK_UPPER_OMICRON_OXIA:
+    aState = kOmicronAcc;
+    return GREEK_UPPER_OMICRON;
+
+  case GREEK_LOWER_UPSILON_TONOS:
+  case GREEK_LOWER_UPSILON_OXIA:
+  case GREEK_UPPER_UPSILON_TONOS:
+  case GREEK_UPPER_UPSILON_OXIA:
+    switch (aState) {
+    case kOmicron:
+      aState = kStart; // this completed a diphthong
+      break;
+    default:
+      aState = kUpsilonAcc;
+      break;
+    }
+    return GREEK_UPPER_UPSILON;
+
+  case GREEK_LOWER_OMEGA_TONOS:
+  case GREEK_LOWER_OMEGA_OXIA:
+  case GREEK_UPPER_OMEGA_TONOS:
+  case GREEK_UPPER_OMEGA_OXIA:
+    aState = kOmegaAcc;
+    return GREEK_UPPER_OMEGA;
+  }
+
+  // all other characters just reset the state, and use standard mappings
+  aState = kStart;
+  return ToUpperCase(aCh);
+}
+
 int32_t
 CaseInsensitiveCompare(const char16_t *a,
                        const char16_t *b,
diff --git a/intl/unicharutil/util/nsUnicharUtils.h b/intl/unicharutil/util/nsUnicharUtils.h
index 3f33c851da83..ec49c4ca0666 100644
--- a/intl/unicharutil/util/nsUnicharUtils.h
+++ b/intl/unicharutil/util/nsUnicharUtils.h
@@ -37,6 +37,63 @@ inline bool IsLowerCase(uint32_t c) {
   return ToUpperCase(c) != c;
 }
 
+class GreekCasing {
+  // When doing an Uppercase transform in Greek, we need to keep track of the
+  // current state while iterating through the string, to recognize and process
+  // diphthongs correctly. For clarity, we define a state for each vowel and
+  // each vowel with accent, although a few of these do not actually need any
+  // special treatment and could be folded into kStart.
+private:
+  enum GreekStates {
+    kStart,
+    kAlpha,
+    kEpsilon,
+    kEta,
+    kIota,
+    kOmicron,
+    kUpsilon,
+    kOmega,
+    kAlphaAcc,
+    kEpsilonAcc,
+    kEtaAcc,
+    kIotaAcc,
+    kOmicronAcc,
+    kUpsilonAcc,
+    kOmegaAcc,
+    kOmicronUpsilon,
+    kDiaeresis
+  };
+
+public:
+  class State {
+  public:
+    State()
+      : mState(kStart)
+    {
+    }
+
+    State(const GreekStates& aState)
+      : mState(aState)
+    {
+    }
+
+    void Reset()
+    {
+      mState = kStart;
+    }
+
+    operator GreekStates() const
+    {
+      return mState;
+    }
+
+  private:
+    GreekStates mState;
+  };
+
+  static uint32_t UpperCase(uint32_t aCh, State& aState);
+};
+
 #ifdef MOZILLA_INTERNAL_API
 
 class nsCaseInsensitiveStringComparator : public nsStringComparator
diff --git a/ipc/glue/GeckoChildProcessHost.cpp b/ipc/glue/GeckoChildProcessHost.cpp
index 0a1ded0a3e28..4a199d1fe6cd 100644
--- a/ipc/glue/GeckoChildProcessHost.cpp
+++ b/ipc/glue/GeckoChildProcessHost.cpp
@@ -310,7 +310,7 @@ void GeckoChildProcessHost::InitWindowsGroupID()
     if (isSupported && NS_SUCCEEDED(taskbarInfo->GetDefaultGroupId(appId))) {
       mGroupId.Append(appId);
     } else {
-      mGroupId.AssignLiteral("-");
+      mGroupId.Assign('-');
     }
   }
 }
diff --git a/ipc/nfc/Nfc.cpp b/ipc/nfc/Nfc.cpp
index a5b7e0ba6d56..c86d968c0bdb 100644
--- a/ipc/nfc/Nfc.cpp
+++ b/ipc/nfc/Nfc.cpp
@@ -168,7 +168,7 @@ DispatchNFCEvent::RunTask(JSContext* aCx)
 
     memcpy(JS_GetArrayBufferViewData(array), mMessage->mData, mMessage->mSize);
     JS::Rooted<JS::Value> rval(aCx);
-    return JS_CallFunctionName(aCx, obj, "onNfcMessage", arrayVal, &rval);
+    return JS_CallFunctionName(aCx, obj, "onNfcMessage", JS::HandleValueArray(arrayVal), &rval);
 }
 
 class NfcConnector : public mozilla::ipc::UnixSocketConnector
diff --git a/ipc/testshell/TestShellParent.cpp b/ipc/testshell/TestShellParent.cpp
index e15175200eeb..bf5279988d66 100644
--- a/ipc/testshell/TestShellParent.cpp
+++ b/ipc/testshell/TestShellParent.cpp
@@ -80,7 +80,7 @@ TestShellCommandParent::RunCallback(const nsString& aResponse)
 
   JS::Rooted<JS::Value> rval(mCx);
   JS::Rooted<JS::Value> callback(mCx, mCallback);
-  bool ok = JS_CallFunctionValue(mCx, global, callback, strVal, &rval);
+  bool ok = JS_CallFunctionValue(mCx, global, callback, JS::HandleValueArray(strVal), &rval);
   NS_ENSURE_TRUE(ok, false);
 
   return true;
diff --git a/js/public/CharacterEncoding.h b/js/public/CharacterEncoding.h
index 0626b129d211..a42b3bb3ea4f 100644
--- a/js/public/CharacterEncoding.h
+++ b/js/public/CharacterEncoding.h
@@ -151,7 +151,7 @@ class ConstTwoByteChars : public mozilla::RangedPtr<const jschar>
 {
   public:
     ConstTwoByteChars(const ConstTwoByteChars &s) : ConstCharPtr(s) {}
-    ConstTwoByteChars(const mozilla::RangedPtr<const jschar> &s) : ConstCharPtr(s) {}
+    MOZ_IMPLICIT ConstTwoByteChars(const mozilla::RangedPtr<const jschar> &s) : ConstCharPtr(s) {}
     ConstTwoByteChars(const jschar *s, size_t len) : ConstCharPtr(s, len) {}
     ConstTwoByteChars(const jschar *pos, const jschar *start, size_t len)
       : ConstCharPtr(pos, start, len)
diff --git a/js/public/GCAPI.h b/js/public/GCAPI.h
index 765dbe4c92d7..9abc1f0cab79 100644
--- a/js/public/GCAPI.h
+++ b/js/public/GCAPI.h
@@ -249,7 +249,7 @@ enum GCProgress {
 struct JS_FRIEND_API(GCDescription) {
     bool isCompartment_;
 
-    GCDescription(bool isCompartment)
+    explicit GCDescription(bool isCompartment)
       : isCompartment_(isCompartment) {}
 
     jschar *formatMessage(JSRuntime *rt) const;
@@ -341,7 +341,7 @@ class JS_FRIEND_API(AutoDisableGenerationalGC)
 #endif
 
   public:
-    AutoDisableGenerationalGC(JSRuntime *rt);
+    explicit AutoDisableGenerationalGC(JSRuntime *rt);
     ~AutoDisableGenerationalGC();
 };
 
@@ -395,7 +395,7 @@ class JS_PUBLIC_API(AutoAssertNoGC)
   public:
     /* Prevent unreferenced local warnings in opt builds. */
     AutoAssertNoGC() {}
-    AutoAssertNoGC(JSRuntime *) {}
+    explicit AutoAssertNoGC(JSRuntime *) {}
 #endif
 };
 
@@ -406,7 +406,7 @@ class JS_PUBLIC_API(ObjectPtr)
   public:
     ObjectPtr() : value(nullptr) {}
 
-    ObjectPtr(JSObject *obj) : value(obj) {}
+    explicit ObjectPtr(JSObject *obj) : value(obj) {}
 
     /* Always call finalize before the destructor. */
     ~ObjectPtr() { MOZ_ASSERT(!value); }
diff --git a/js/public/HashTable.h b/js/public/HashTable.h
index 5f0811739d07..a64a5286ac52 100644
--- a/js/public/HashTable.h
+++ b/js/public/HashTable.h
@@ -73,7 +73,7 @@ class HashMap
 
     // HashMap construction is fallible (due to OOM); thus the user must call
     // init after constructing a HashMap and check the return value.
-    HashMap(AllocPolicy a = AllocPolicy()) : impl(a)  {}
+    explicit HashMap(AllocPolicy a = AllocPolicy()) : impl(a)  {}
     bool init(uint32_t len = 16)                      { return impl.init(len); }
     bool initialized() const                          { return impl.initialized(); }
 
@@ -314,7 +314,7 @@ class HashSet
 
     // HashSet construction is fallible (due to OOM); thus the user must call
     // init after constructing a HashSet and check the return value.
-    HashSet(AllocPolicy a = AllocPolicy()) : impl(a)  {}
+    explicit HashSet(AllocPolicy a = AllocPolicy()) : impl(a)  {}
     bool init(uint32_t len = 16)                      { return impl.init(len); }
     bool initialized() const                          { return impl.initialized(); }
 
@@ -1062,7 +1062,7 @@ class HashTable : private AllocPolicy
     }
 
   public:
-    HashTable(AllocPolicy ap)
+    explicit HashTable(AllocPolicy ap)
       : AllocPolicy(ap),
         hashShift(sHashBits),
         entryCount(0),
diff --git a/js/public/MemoryMetrics.h b/js/public/MemoryMetrics.h
index 423760b2306c..383e4e790f63 100644
--- a/js/public/MemoryMetrics.h
+++ b/js/public/MemoryMetrics.h
@@ -567,7 +567,7 @@ struct RuntimeStats
     macro(_, _, gcHeapChunkAdmin) \
     macro(_, _, gcHeapGCThings) \
 
-    RuntimeStats(mozilla::MallocSizeOf mallocSizeOf)
+    explicit RuntimeStats(mozilla::MallocSizeOf mallocSizeOf)
       : FOR_EACH_SIZE(ZERO_SIZE)
         runtime(),
         cTotals(),
@@ -630,7 +630,7 @@ class ObjectPrivateVisitor
     typedef bool(*GetISupportsFun)(JSObject *obj, nsISupports **iface);
     GetISupportsFun getISupports_;
 
-    ObjectPrivateVisitor(GetISupportsFun getISupports)
+    explicit ObjectPrivateVisitor(GetISupportsFun getISupports)
       : getISupports_(getISupports)
     {}
 };
diff --git a/js/public/OldDebugAPI.h b/js/public/OldDebugAPI.h
index 25441936ceec..aa2b054c967a 100644
--- a/js/public/OldDebugAPI.h
+++ b/js/public/OldDebugAPI.h
@@ -444,7 +444,7 @@ class JS_PUBLIC_API(JSBrokenFrameIterator)
     void *data_;
 
   public:
-    JSBrokenFrameIterator(JSContext *cx);
+    explicit JSBrokenFrameIterator(JSContext *cx);
     ~JSBrokenFrameIterator();
 
     bool done() const;
diff --git a/js/public/ProfilingStack.h b/js/public/ProfilingStack.h
index f4e218f90978..0f6e7fd57edd 100644
--- a/js/public/ProfilingStack.h
+++ b/js/public/ProfilingStack.h
@@ -8,7 +8,7 @@
 #define js_ProfilingStack_h
 
 #include "mozilla/NullPtr.h"
-
+ 
 #include "jsbytecode.h"
 #include "jstypes.h"
 
@@ -34,97 +34,67 @@ class ProfileEntry
     // If the size modification were somehow reordered before the stores, then
     // if a sample were taken it would be examining bogus information.
     //
-    // A ProfileEntry represents both a C++ profile entry and a JS one.
-
-    // Descriptive string of this entry.
-    const char * volatile string;
-
-    // Stack pointer for non-JS entries, the script pointer otherwise.
-    void * volatile spOrScript;
-
-    // Line number for non-JS entries, the bytecode offset otherwise.
-    int32_t volatile lineOrPc;
-
-    // General purpose storage describing this frame.
-    uint32_t volatile flags;
+    // A ProfileEntry represents both a C++ profile entry and a JS one. Both use
+    // the string as a description, but JS uses the sp as nullptr or (void*)1 to
+    // indicate that it is a JS entry. The script_ is then only ever examined for
+    // a JS entry, and the idx is used by both, but with different meanings.
+    //
+    const char * volatile string; // Descriptive string of this entry
+    void * volatile sp;           // Relevant stack pointer for the entry,
+                                  // less than or equal to SCRIPT_OPT_STACKPOINTER for js
+                                  // script entries, greater for non-js entries.
+    JSScript * volatile script_;  // if js(), non-null script which is running - low bit
+                                  // indicates if script is optimized or not.
+    int32_t volatile idx;         // if js(), idx of pc, otherwise line number
 
   public:
-    ProfileEntry(void) : flags(0) {}
-
-    // These traits are bit masks. Make sure they're powers of 2.
-    enum Flags {
-        // Indicate whether a profile entry represents a CPP frame. If not set,
-        // a JS frame is assumed by default. You're not allowed to publicly
-        // change the frame type. Instead, call `setJsFrame` or `setCppFrame`.
-        IS_CPP_ENTRY = 0x01,
-
-        // Indicate that copying the frame label is not necessary when taking a
-        // sample of the pseudostack.
-        FRAME_LABEL_COPY = 0x02
-    };
+    static const uintptr_t SCRIPT_OPT_STACKPOINTER = 0x1;
 
     // All of these methods are marked with the 'volatile' keyword because SPS's
     // representation of the stack is stored such that all ProfileEntry
     // instances are volatile. These methods would not be available unless they
     // were marked as volatile as well.
 
-    bool isCpp() const volatile { return hasFlag(IS_CPP_ENTRY); }
-    bool isJs() const volatile { return !isCpp(); }
+    bool js() const volatile {
+        MOZ_ASSERT_IF(uintptr_t(sp) <= SCRIPT_OPT_STACKPOINTER, script_ != nullptr);
+        return uintptr_t(sp) <= SCRIPT_OPT_STACKPOINTER;
+    }
 
-    bool isCopyLabel() const volatile { return hasFlag(FRAME_LABEL_COPY); };
-
-    void setLabel(const char *aString) volatile { string = aString; }
+    uint32_t line() const volatile { MOZ_ASSERT(!js()); return idx; }
+    JSScript *script() const volatile { MOZ_ASSERT(js()); return script_; }
+    bool scriptIsOptimized() const volatile {
+        MOZ_ASSERT(js());
+        return uintptr_t(sp) <= SCRIPT_OPT_STACKPOINTER;
+    }
+    void *stackAddress() const volatile {
+        if (js())
+            return nullptr;
+        return sp;
+    }
     const char *label() const volatile { return string; }
 
-    void setJsFrame(JSScript *aScript, jsbytecode *aPc) volatile {
-        flags &= ~IS_CPP_ENTRY;
-        spOrScript = aScript;
-        setPC(aPc);
-    }
-    void setCppFrame(void *aSp, uint32_t aLine) volatile {
-        flags |= IS_CPP_ENTRY;
-        spOrScript = aSp;
-        lineOrPc = aLine;
-    }
-
-    void setFlag(Flags flag) volatile {
-        MOZ_ASSERT(flag != IS_CPP_ENTRY);
-        flags |= flag;
-    }
-    void unsetFlag(Flags flag) volatile {
-        MOZ_ASSERT(flag != IS_CPP_ENTRY);
-        flags &= ~flag;
-    }
-    bool hasFlag(Flags flag) const volatile {
-        return bool(flags & uint32_t(flag));
-    }
-
-    void *stackAddress() const volatile {
-        MOZ_ASSERT(!isJs());
-        return spOrScript;
-    }
-    JSScript *script() const volatile {
-        MOZ_ASSERT(isJs());
-        return (JSScript *)spOrScript;
-    }
-    uint32_t line() const volatile {
-        MOZ_ASSERT(!isJs());
-        return lineOrPc;
-    }
+    void setLine(uint32_t aLine) volatile { MOZ_ASSERT(!js()); idx = aLine; }
+    void setLabel(const char *aString) volatile { string = aString; }
+    void setStackAddress(void *aSp) volatile { sp = aSp; }
+    void setScript(JSScript *aScript) volatile { script_ = aScript; }
 
     // We can't know the layout of JSScript, so look in vm/SPSProfiler.cpp.
     JS_FRIEND_API(jsbytecode *) pc() const volatile;
     JS_FRIEND_API(void) setPC(jsbytecode *pc) volatile;
 
-    // The offset of a pc into a script's code can actually be 0, so to
-    // signify a nullptr pc, use a -1 index. This is checked against in
-    // pc() and setPC() to set/get the right pc.
-    static const int32_t NullPCOffset = -1;
+    static size_t offsetOfString() { return offsetof(ProfileEntry, string); }
+    static size_t offsetOfStackAddress() { return offsetof(ProfileEntry, sp); }
+    static size_t offsetOfPCIdx() { return offsetof(ProfileEntry, idx); }
+    static size_t offsetOfScript() { return offsetof(ProfileEntry, script_); }
 
-    static size_t offsetOfLabel() { return offsetof(ProfileEntry, string); }
-    static size_t offsetOfSpOrScript() { return offsetof(ProfileEntry, spOrScript); }
-    static size_t offsetOfLineOrPc() { return offsetof(ProfileEntry, lineOrPc); }
-    static size_t offsetOfFlags() { return offsetof(ProfileEntry, flags); }
+    // The index used in the entry can either be a line number or the offset of
+    // a pc into a script's code. To signify a nullptr pc, use a -1 index. This
+    // is checked against in pc() and setPC() to set/get the right pc.
+    static const int32_t NullPCIndex = -1;
+
+    // This bit is added to the stack address to indicate that copying the
+    // frame label is not necessary when taking a sample of the pseudostack.
+    static const uintptr_t NoCopyBit = 1;
 };
 
 JS_FRIEND_API(void)
diff --git a/js/public/RootingAPI.h b/js/public/RootingAPI.h
index ada108c9c628..7038f83b34a6 100644
--- a/js/public/RootingAPI.h
+++ b/js/public/RootingAPI.h
@@ -414,20 +414,20 @@ class MOZ_NONHEAP_CLASS Handle : public js::HandleBase<T>
     }
 
     /* Create a handle for a nullptr pointer. */
-    Handle(js::NullPtr) {
+    MOZ_IMPLICIT Handle(js::NullPtr) {
         static_assert(mozilla::IsPointer<T>::value,
                       "js::NullPtr overload not valid for non-pointer types");
         ptr = reinterpret_cast<const T *>(&js::NullPtr::constNullValue);
     }
 
     /* Create a handle for a nullptr pointer. */
-    Handle(JS::NullPtr) {
+    MOZ_IMPLICIT Handle(JS::NullPtr) {
         static_assert(mozilla::IsPointer<T>::value,
                       "JS::NullPtr overload not valid for non-pointer types");
         ptr = reinterpret_cast<const T *>(&JS::NullPtr::constNullValue);
     }
 
-    Handle(MutableHandle<T> handle) {
+    MOZ_IMPLICIT Handle(MutableHandle<T> handle) {
         ptr = handle.address();
     }
 
@@ -509,8 +509,8 @@ template <typename T>
 class MOZ_STACK_CLASS MutableHandle : public js::MutableHandleBase<T>
 {
   public:
-    inline MutableHandle(Rooted<T> *root);
-    inline MutableHandle(PersistentRooted<T> *root);
+    inline MOZ_IMPLICIT MutableHandle(Rooted<T> *root);
+    inline MOZ_IMPLICIT MutableHandle(PersistentRooted<T> *root);
 
   private:
     // Disallow true nullptr and emulated nullptr (gcc 4.4/4.5, __null, appears
@@ -625,7 +625,7 @@ class InternalHandle<T*>
      * Make this private to prevent accidental misuse; this is only for
      * fromMarkedLocation().
      */
-    InternalHandle(T *field)
+    explicit InternalHandle(T *field)
       : holder(reinterpret_cast<void * const *>(&js::NullPtr::constNullValue)),
         offset(uintptr_t(field))
     {}
@@ -711,8 +711,8 @@ class MOZ_STACK_CLASS Rooted : public js::RootedBase<T>
     }
 
   public:
-    Rooted(JSContext *cx
-           MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
+    explicit Rooted(JSContext *cx
+                    MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
       : ptr(js::GCMethods<T>::initial())
     {
         MOZ_GUARD_OBJECT_NOTIFIER_INIT;
@@ -733,8 +733,8 @@ class MOZ_STACK_CLASS Rooted : public js::RootedBase<T>
         init(js::ContextFriendFields::get(cx));
     }
 
-    Rooted(js::ContextFriendFields *cx
-           MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
+    explicit Rooted(js::ContextFriendFields *cx
+                    MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
       : ptr(js::GCMethods<T>::initial())
     {
         MOZ_GUARD_OBJECT_NOTIFIER_INIT;
@@ -749,8 +749,8 @@ class MOZ_STACK_CLASS Rooted : public js::RootedBase<T>
         init(cx);
     }
 
-    Rooted(js::PerThreadDataFriendFields *pt
-           MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
+    explicit Rooted(js::PerThreadDataFriendFields *pt
+                    MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
       : ptr(js::GCMethods<T>::initial())
     {
         MOZ_GUARD_OBJECT_NOTIFIER_INIT;
@@ -765,8 +765,8 @@ class MOZ_STACK_CLASS Rooted : public js::RootedBase<T>
         init(pt);
     }
 
-    Rooted(JSRuntime *rt
-           MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
+    explicit Rooted(JSRuntime *rt
+                    MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
       : ptr(js::GCMethods<T>::initial())
     {
         MOZ_GUARD_OBJECT_NOTIFIER_INIT;
@@ -886,7 +886,7 @@ class JS_PUBLIC_API(RootedGeneric)
   public:
     JS::Rooted<GCType> rooter;
 
-    RootedGeneric(js::ContextFriendFields *cx)
+    explicit RootedGeneric(js::ContextFriendFields *cx)
         : rooter(cx)
     {
     }
@@ -974,11 +974,11 @@ template <typename T>
 class FakeMutableHandle : public js::MutableHandleBase<T>
 {
   public:
-    FakeMutableHandle(T *t) {
+    MOZ_IMPLICIT FakeMutableHandle(T *t) {
         ptr = t;
     }
 
-    FakeMutableHandle(FakeRooted<T> *root) {
+    MOZ_IMPLICIT FakeMutableHandle(FakeRooted<T> *root) {
         ptr = root->address();
     }
 
@@ -1145,7 +1145,7 @@ class PersistentRooted : private mozilla::LinkedListElement<PersistentRooted<T>
     }
 
   public:
-    PersistentRooted(JSContext *cx) : ptr(js::GCMethods<T>::initial())
+    explicit PersistentRooted(JSContext *cx) : ptr(js::GCMethods<T>::initial())
     {
         registerWithRuntime(js::GetRuntime(cx));
     }
@@ -1155,7 +1155,7 @@ class PersistentRooted : private mozilla::LinkedListElement<PersistentRooted<T>
         registerWithRuntime(js::GetRuntime(cx));
     }
 
-    PersistentRooted(JSRuntime *rt) : ptr(js::GCMethods<T>::initial())
+    explicit PersistentRooted(JSRuntime *rt) : ptr(js::GCMethods<T>::initial())
     {
         registerWithRuntime(rt);
     }
@@ -1219,7 +1219,7 @@ namespace js {
 class CompilerRootNode
 {
   protected:
-    CompilerRootNode(js::gc::Cell *ptr) : next(nullptr), ptr_(ptr) {}
+    explicit CompilerRootNode(js::gc::Cell *ptr) : next(nullptr), ptr_(ptr) {}
 
   public:
     void **address() { return (void **)&ptr_; }
diff --git a/js/public/SliceBudget.h b/js/public/SliceBudget.h
index 5426f5b262f4..7c602c5572ae 100644
--- a/js/public/SliceBudget.h
+++ b/js/public/SliceBudget.h
@@ -32,7 +32,7 @@ struct JS_PUBLIC_API(SliceBudget)
     SliceBudget();
 
     /* Instantiate as SliceBudget(Time/WorkBudget(n)). */
-    SliceBudget(int64_t budget);
+    explicit SliceBudget(int64_t budget);
 
     void reset() {
         deadline = unlimitedDeadline;
diff --git a/js/public/Value.h b/js/public/Value.h
index d9d41c0440fc..b96f376f32b4 100644
--- a/js/public/Value.h
+++ b/js/public/Value.h
@@ -1251,7 +1251,7 @@ class Value
 
   private:
 #if defined(JS_VALUE_IS_CONSTEXPR)
-    JS_VALUE_CONSTEXPR Value(jsval_layout layout) : data(layout) {}
+    MOZ_IMPLICIT JS_VALUE_CONSTEXPR Value(jsval_layout layout) : data(layout) {}
 #endif
 
     void staticAssertions() {
diff --git a/js/public/Vector.h b/js/public/Vector.h
index e8aef1713da8..a2d24b10edab 100644
--- a/js/public/Vector.h
+++ b/js/public/Vector.h
@@ -54,7 +54,7 @@ class Vector
     typedef typename mozilla::VectorBase<T, MinInlineCapacity, AllocPolicy, Vector> Base;
 
   public:
-    Vector(AllocPolicy alloc = AllocPolicy()) : Base(alloc) {}
+    explicit Vector(AllocPolicy alloc = AllocPolicy()) : Base(alloc) {}
     Vector(Vector &&vec) : Base(mozilla::Move(vec)) {}
     Vector &operator=(Vector &&vec) {
         return Base::operator=(mozilla::Move(vec));
diff --git a/js/src/assembler/assembler/AbstractMacroAssembler.h b/js/src/assembler/assembler/AbstractMacroAssembler.h
index 88aaaa2fca03..597a1473ddc5 100644
--- a/js/src/assembler/assembler/AbstractMacroAssembler.h
+++ b/js/src/assembler/assembler/AbstractMacroAssembler.h
@@ -118,13 +118,13 @@ public:
     // Are equivalent, and the explicit wrapping of the Address in the former
     // is unnecessary.
     struct ImplicitAddress {
-        ImplicitAddress(RegisterID base)
+        explicit ImplicitAddress(RegisterID base)
             : base(base)
             , offset(0)
         {
         }
 
-        ImplicitAddress(Address address)
+        MOZ_IMPLICIT ImplicitAddress(Address address)
             : base(address.base)
             , offset(address.offset)
         {
@@ -285,7 +285,7 @@ public:
         {
         }
 
-        Label(AbstractMacroAssembler<AssemblerType>* masm)
+        explicit Label(AbstractMacroAssembler<AssemblerType>* masm)
             : m_label(masm->m_assembler.label())
         {
         }
@@ -310,7 +310,7 @@ public:
         {
         }
 
-        DataLabelPtr(AbstractMacroAssembler<AssemblerType>* masm)
+        explicit DataLabelPtr(AbstractMacroAssembler<AssemblerType>* masm)
             : m_label(masm->m_assembler.label())
         {
         }
@@ -334,7 +334,7 @@ public:
         {
         }
 
-        DataLabel32(AbstractMacroAssembler<AssemblerType>* masm)
+        explicit DataLabel32(AbstractMacroAssembler<AssemblerType>* masm)
             : m_label(masm->m_assembler.label())
         {
         }
@@ -403,7 +403,7 @@ public:
         {
         }
 
-        Jump(JmpSrc jmp)
+        explicit Jump(JmpSrc jmp)
             : m_jmp(jmp)
         {
         }
diff --git a/js/src/assembler/assembler/CodeLocation.h b/js/src/assembler/assembler/CodeLocation.h
index f2aa8966a144..10e4815cbdb5 100644
--- a/js/src/assembler/assembler/CodeLocation.h
+++ b/js/src/assembler/assembler/CodeLocation.h
@@ -71,7 +71,7 @@ protected:
     {
     }
 
-    CodeLocationCommon(MacroAssemblerCodePtr location)
+    explicit CodeLocationCommon(MacroAssemblerCodePtr location)
         : MacroAssemblerCodePtr(location)
     {
     }
diff --git a/js/src/assembler/assembler/MacroAssemblerARM.h b/js/src/assembler/assembler/MacroAssemblerARM.h
index 4ab79e5c0007..75cfd1ed151c 100644
--- a/js/src/assembler/assembler/MacroAssemblerARM.h
+++ b/js/src/assembler/assembler/MacroAssemblerARM.h
@@ -727,7 +727,7 @@ public:
         load16(left, ARMRegisters::S0);
         move(right, ARMRegisters::S1);
         m_assembler.cmp_r(ARMRegisters::S0, ARMRegisters::S1);
-        return m_assembler.jmp(ARMCondition(cond));
+        return Jump(m_assembler.jmp(ARMCondition(cond)));
     }
 
     Jump branchTest8(Condition cond, Address address, Imm32 mask = Imm32(-1))
diff --git a/js/src/assembler/assembler/MacroAssemblerX86Common.h b/js/src/assembler/assembler/MacroAssemblerX86Common.h
index fef1006f76c4..6b6078bf49c0 100644
--- a/js/src/assembler/assembler/MacroAssemblerX86Common.h
+++ b/js/src/assembler/assembler/MacroAssemblerX86Common.h
@@ -725,8 +725,8 @@ public:
         // Convert the integer result back to float & compare to the original value - if not equal or unordered (NaN) then jump.
         convertInt32ToDouble(dest, fpTemp);
         m_assembler.ucomisd_rr(fpTemp, src);
-        failureCases.append(m_assembler.jp());
-        failureCases.append(m_assembler.jne());
+        failureCases.append(Jump(m_assembler.jp()));
+        failureCases.append(Jump(m_assembler.jne()));
     }
 
     void zeroDouble(FPRegisterID srcDest)
diff --git a/js/src/assembler/assembler/MacroAssemblerX86_64.h b/js/src/assembler/assembler/MacroAssemblerX86_64.h
index 8434a4e2e3b3..be53bd2660a2 100644
--- a/js/src/assembler/assembler/MacroAssemblerX86_64.h
+++ b/js/src/assembler/assembler/MacroAssemblerX86_64.h
@@ -99,7 +99,7 @@ public:
     DataLabelPtr loadDouble(const void* address, FPRegisterID dest)
     {
         DataLabelPtr label = moveWithPatch(ImmPtr(address), scratchRegister);
-        loadDouble(scratchRegister, dest);
+        loadDouble(ImplicitAddress(scratchRegister), dest);
         return label;
     }
 
diff --git a/js/src/assembler/assembler/X86Assembler.h b/js/src/assembler/assembler/X86Assembler.h
index 956ea1749fde..8894b647a0f2 100644
--- a/js/src/assembler/assembler/X86Assembler.h
+++ b/js/src/assembler/assembler/X86Assembler.h
@@ -395,7 +395,7 @@ public:
         {
         }
 
-        JmpSrc(int offset)
+        explicit JmpSrc(int offset)
             : m_offset(offset)
         {
         }
@@ -426,7 +426,7 @@ public:
         void used() { m_used = true; }
         bool isValid() const { return m_offset != -1; }
 
-        JmpDst(int offset)
+        explicit JmpDst(int offset)
             : m_offset(offset)
             , m_used(false)
         {
diff --git a/js/src/builtin/Eval.cpp b/js/src/builtin/Eval.cpp
index 0d0e7a380ec4..d0e1071653b1 100644
--- a/js/src/builtin/Eval.cpp
+++ b/js/src/builtin/Eval.cpp
@@ -90,7 +90,7 @@ class EvalScriptGuard
     Rooted<JSLinearString*> lookupStr_;
 
   public:
-    EvalScriptGuard(JSContext *cx)
+    explicit EvalScriptGuard(JSContext *cx)
         : cx_(cx), script_(cx), lookup_(cx), lookupStr_(cx) {}
 
     ~EvalScriptGuard() {
diff --git a/js/src/builtin/MapObject.cpp b/js/src/builtin/MapObject.cpp
index 8d0d641a4da6..80c981166139 100644
--- a/js/src/builtin/MapObject.cpp
+++ b/js/src/builtin/MapObject.cpp
@@ -100,7 +100,7 @@ class OrderedHashTable
     AllocPolicy alloc;
 
   public:
-    OrderedHashTable(AllocPolicy &ap)
+    explicit OrderedHashTable(AllocPolicy &ap)
         : hashTable(nullptr), data(nullptr), dataLength(0), ranges(nullptr), alloc(ap) {}
 
     bool init() {
@@ -331,7 +331,7 @@ class OrderedHashTable
          * Create a Range over all the entries in ht.
          * (This is private on purpose. End users must use ht.all().)
          */
-        Range(OrderedHashTable &ht) : ht(ht), i(0), count(0), prevp(&ht.ranges), next(ht.ranges) {
+        explicit Range(OrderedHashTable &ht) : ht(ht), i(0), count(0), prevp(&ht.ranges), next(ht.ranges) {
             *prevp = this;
             if (next)
                 next->prevp = &next;
@@ -717,7 +717,7 @@ class OrderedHashMap
   public:
     typedef typename Impl::Range Range;
 
-    OrderedHashMap(AllocPolicy ap = AllocPolicy()) : impl(ap) {}
+    explicit OrderedHashMap(AllocPolicy ap = AllocPolicy()) : impl(ap) {}
     bool init()                                     { return impl.init(); }
     uint32_t count() const                          { return impl.count(); }
     bool has(const Key &key) const                  { return impl.has(key); }
@@ -753,7 +753,7 @@ class OrderedHashSet
   public:
     typedef typename Impl::Range Range;
 
-    OrderedHashSet(AllocPolicy ap = AllocPolicy()) : impl(ap) {}
+    explicit OrderedHashSet(AllocPolicy ap = AllocPolicy()) : impl(ap) {}
     bool init()                                     { return impl.init(); }
     uint32_t count() const                          { return impl.count(); }
     bool has(const T &value) const                  { return impl.has(value); }
diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctions.cpp
index c532a383b537..dbdd45e4b686 100644
--- a/js/src/builtin/TestingFunctions.cpp
+++ b/js/src/builtin/TestingFunctions.cpp
@@ -510,7 +510,14 @@ SelectForGC(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
+    /*
+     * The selectedForMarking set is intended to be manually marked at slice
+     * start to detect missing pre-barriers. It is invalid for nursery things
+     * to be in the set, so evict the nursery before adding items.
+     */
     JSRuntime *rt = cx->runtime();
+    MinorGC(rt, JS::gcreason::EVICT_NURSERY);
+
     for (unsigned i = 0; i < args.length(); i++) {
         if (args[i].isObject()) {
             if (!rt->gc.selectedForMarking.append(&args[i].toObject()))
diff --git a/js/src/builtin/TypedObject.cpp b/js/src/builtin/TypedObject.cpp
index ee33dfecc599..6e773aa2d7f5 100644
--- a/js/src/builtin/TypedObject.cpp
+++ b/js/src/builtin/TypedObject.cpp
@@ -3154,7 +3154,7 @@ class MemoryInitVisitor {
     const JSRuntime *rt_;
 
   public:
-    MemoryInitVisitor(const JSRuntime *rt)
+    explicit MemoryInitVisitor(const JSRuntime *rt)
       : rt_(rt)
     {}
 
@@ -3222,7 +3222,7 @@ class MemoryTracingVisitor {
 
   public:
 
-    MemoryTracingVisitor(JSTracer *trace)
+    explicit MemoryTracingVisitor(JSTracer *trace)
       : trace_(trace)
     {}
 
diff --git a/js/src/ctypes/CTypes.h b/js/src/ctypes/CTypes.h
index 5c9ff51447c8..cb0f04085a71 100644
--- a/js/src/ctypes/CTypes.h
+++ b/js/src/ctypes/CTypes.h
@@ -301,7 +301,7 @@ struct ClosureInfo
 
   // Anything conditionally freed in the destructor should be initialized to
   // nullptr here.
-  ClosureInfo(JSRuntime* runtime)
+  explicit ClosureInfo(JSRuntime* runtime)
     : rt(runtime)
     , errResult(nullptr)
     , closure(nullptr)
diff --git a/js/src/ds/IdValuePair.h b/js/src/ds/IdValuePair.h
index de471b5dd803..a491614fda60 100644
--- a/js/src/ds/IdValuePair.h
+++ b/js/src/ds/IdValuePair.h
@@ -19,7 +19,7 @@ struct IdValuePair
     Value value;
 
     IdValuePair() {}
-    IdValuePair(jsid idArg)
+    explicit IdValuePair(jsid idArg)
       : id(idArg), value(UndefinedValue())
     {}
 };
diff --git a/js/src/ds/InlineMap.h b/js/src/ds/InlineMap.h
index ff6f2d06adbe..f84e99b2f34b 100644
--- a/js/src/ds/InlineMap.h
+++ b/js/src/ds/InlineMap.h
@@ -157,7 +157,7 @@ class InlineMap
           : inlAddPtr(ptr), isInlinePtr(true), inlPtrFound(found)
         {}
 
-        AddPtr(const WordMapAddPtr &p) : mapAddPtr(p), isInlinePtr(false) {}
+        explicit AddPtr(const WordMapAddPtr &p) : mapAddPtr(p), isInlinePtr(false) {}
 
         void operator==(const AddPtr &other);
 
diff --git a/js/src/ds/LifoAlloc.h b/js/src/ds/LifoAlloc.h
index 186003329761..29fa677efc95 100644
--- a/js/src/ds/LifoAlloc.h
+++ b/js/src/ds/LifoAlloc.h
@@ -423,7 +423,7 @@ class LifoAlloc
         }
 
       public:
-        Enum(LifoAlloc &alloc)
+        explicit Enum(LifoAlloc &alloc)
           : alloc_(&alloc),
             chunk_(alloc.first),
             position_(static_cast<char *>(alloc.first ? alloc.first->start() : nullptr))
@@ -513,7 +513,7 @@ class LifoAllocPolicy
     LifoAlloc &alloc_;
 
   public:
-    LifoAllocPolicy(LifoAlloc &alloc)
+    MOZ_IMPLICIT LifoAllocPolicy(LifoAlloc &alloc)
       : alloc_(alloc)
     {}
     void *malloc_(size_t bytes) {
diff --git a/js/src/ds/PriorityQueue.h b/js/src/ds/PriorityQueue.h
index 6009b2bc39e8..4aa08a0181ca 100644
--- a/js/src/ds/PriorityQueue.h
+++ b/js/src/ds/PriorityQueue.h
@@ -31,7 +31,7 @@ class PriorityQueue
 
   public:
 
-    PriorityQueue(AllocPolicy ap = AllocPolicy())
+    explicit PriorityQueue(AllocPolicy ap = AllocPolicy())
       : heap(ap)
     {}
 
diff --git a/js/src/ds/SplayTree.h b/js/src/ds/SplayTree.h
index 019b008a010b..97cee9e15e32 100644
--- a/js/src/ds/SplayTree.h
+++ b/js/src/ds/SplayTree.h
@@ -27,7 +27,7 @@ class SplayTree
         T item;
         Node *left, *right, *parent;
 
-        Node(const T &item)
+        explicit Node(const T &item)
           : item(item), left(nullptr), right(nullptr), parent(nullptr)
         {}
     };
@@ -40,7 +40,7 @@ class SplayTree
 
   public:
 
-    SplayTree(LifoAlloc *alloc = nullptr)
+    explicit SplayTree(LifoAlloc *alloc = nullptr)
       : alloc(alloc), root(nullptr), freeList(nullptr)
     {}
 
diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitter.cpp
index c693192274b6..d34edc505fae 100644
--- a/js/src/frontend/BytecodeEmitter.cpp
+++ b/js/src/frontend/BytecodeEmitter.cpp
@@ -60,7 +60,7 @@ struct frontend::StmtInfoBCE : public StmtInfoBase
     ptrdiff_t       continues;      /* offset of last continue in loop */
     uint32_t        blockScopeIndex; /* index of scope in BlockScopeArray */
 
-    StmtInfoBCE(ExclusiveContext *cx) : StmtInfoBase(cx) {}
+    explicit StmtInfoBCE(ExclusiveContext *cx) : StmtInfoBase(cx) {}
 
     /*
      * To reuse space, alias two of the ptrdiff_t fields for use during
@@ -93,7 +93,7 @@ struct LoopStmtInfo : public StmtInfoBCE
     // Can we OSR into Ion from here?  True unless there is non-loop state on the stack.
     bool            canIonOsr;
 
-    LoopStmtInfo(ExclusiveContext *cx) : StmtInfoBCE(cx) {}
+    explicit LoopStmtInfo(ExclusiveContext *cx) : StmtInfoBCE(cx) {}
 
     static LoopStmtInfo* fromStmtInfo(StmtInfoBCE *stmt) {
         JS_ASSERT(stmt->isLoop());
@@ -3931,7 +3931,7 @@ class EmitLevelManager
 {
     BytecodeEmitter *bce;
   public:
-    EmitLevelManager(BytecodeEmitter *bce) : bce(bce) { bce->emitLevel++; }
+    explicit EmitLevelManager(BytecodeEmitter *bce) : bce(bce) { bce->emitLevel++; }
     ~EmitLevelManager() { bce->emitLevel--; }
 };
 
diff --git a/js/src/frontend/BytecodeEmitter.h b/js/src/frontend/BytecodeEmitter.h
index b75389d98e56..c20cceaa578f 100644
--- a/js/src/frontend/BytecodeEmitter.h
+++ b/js/src/frontend/BytecodeEmitter.h
@@ -31,7 +31,7 @@ class TokenStream;
 class CGConstList {
     Vector<Value> list;
   public:
-    CGConstList(ExclusiveContext *cx) : list(cx) {}
+    explicit CGConstList(ExclusiveContext *cx) : list(cx) {}
     bool append(Value v) { JS_ASSERT_IF(v.isString(), v.toString()->isAtom()); return list.append(v); }
     size_t length() const { return list.length(); }
     void finish(ConstArray *array);
@@ -51,7 +51,7 @@ struct CGObjectList {
 
 struct CGTryNoteList {
     Vector<JSTryNote> list;
-    CGTryNoteList(ExclusiveContext *cx) : list(cx) {}
+    explicit CGTryNoteList(ExclusiveContext *cx) : list(cx) {}
 
     bool append(JSTryNoteKind kind, uint32_t stackDepth, size_t start, size_t end);
     size_t length() const { return list.length(); }
@@ -60,7 +60,7 @@ struct CGTryNoteList {
 
 struct CGBlockScopeList {
     Vector<BlockScopeNote> list;
-    CGBlockScopeList(ExclusiveContext *cx) : list(cx) {}
+    explicit CGBlockScopeList(ExclusiveContext *cx) : list(cx) {}
 
     bool append(uint32_t scopeObject, uint32_t offset, uint32_t parent);
     uint32_t findEnclosingScope(uint32_t index);
diff --git a/js/src/frontend/ParseNode.h b/js/src/frontend/ParseNode.h
index ae5f53f90ca1..7f69a0764085 100644
--- a/js/src/frontend/ParseNode.h
+++ b/js/src/frontend/ParseNode.h
@@ -1135,7 +1135,7 @@ class ContinueStatement : public LoopControlStatement
 class DebuggerStatement : public ParseNode
 {
   public:
-    DebuggerStatement(const TokenPos &pos)
+    explicit DebuggerStatement(const TokenPos &pos)
       : ParseNode(PNK_DEBUGGER, JSOP_NOP, PN_NULLARY, pos)
     { }
 };
@@ -1178,13 +1178,13 @@ class ConditionalExpression : public ParseNode
 class ThisLiteral : public ParseNode
 {
   public:
-    ThisLiteral(const TokenPos &pos) : ParseNode(PNK_THIS, JSOP_THIS, PN_NULLARY, pos) { }
+    explicit ThisLiteral(const TokenPos &pos) : ParseNode(PNK_THIS, JSOP_THIS, PN_NULLARY, pos) { }
 };
 
 class NullLiteral : public ParseNode
 {
   public:
-    NullLiteral(const TokenPos &pos) : ParseNode(PNK_NULL, JSOP_NULL, PN_NULLARY, pos) { }
+    explicit NullLiteral(const TokenPos &pos) : ParseNode(PNK_NULL, JSOP_NULL, PN_NULLARY, pos) { }
 };
 
 class BooleanLiteral : public ParseNode
diff --git a/js/src/frontend/Parser.cpp b/js/src/frontend/Parser.cpp
index e23695e1a5ae..d71fe6502f7f 100644
--- a/js/src/frontend/Parser.cpp
+++ b/js/src/frontend/Parser.cpp
@@ -1202,7 +1202,7 @@ Parser<FullParseHandler>::makeDefIntoUse(Definition *dn, ParseNode *pn, JSAtom *
 template <typename ParseHandler>
 struct BindData
 {
-    BindData(ExclusiveContext *cx) : let(cx) {}
+    explicit BindData(ExclusiveContext *cx) : let(cx) {}
 
     typedef bool
     (*Binder)(BindData *data, HandlePropertyName name, Parser<ParseHandler> *parser);
@@ -1214,7 +1214,7 @@ struct BindData
     Binder          binder;     /* binder, discriminates u */
 
     struct LetData {
-        LetData(ExclusiveContext *cx) : blockObj(cx) {}
+        explicit LetData(ExclusiveContext *cx) : blockObj(cx) {}
         VarContext varContext;
         RootedStaticBlockObject blockObj;
         unsigned   overflow;
@@ -3227,7 +3227,7 @@ struct AddLetDecl
 {
     uint32_t blockid;
 
-    AddLetDecl(uint32_t blockid) : blockid(blockid) {}
+    explicit AddLetDecl(uint32_t blockid) : blockid(blockid) {}
 
     bool operator()(TokenStream &ts, ParseContext<FullParseHandler> *pc,
                     HandleStaticBlockObject blockObj, const Shape &shape, JSAtom *)
diff --git a/js/src/frontend/Parser.h b/js/src/frontend/Parser.h
index d0986ed2da65..05fc9c89ca8c 100644
--- a/js/src/frontend/Parser.h
+++ b/js/src/frontend/Parser.h
@@ -30,7 +30,7 @@ struct StmtInfoPC : public StmtInfoBase {
     uint32_t        blockid;        /* for simplified dominance computation */
     uint32_t        innerBlockScopeDepth; /* maximum depth of nested block scopes, in slots */
 
-    StmtInfoPC(ExclusiveContext *cx) : StmtInfoBase(cx), innerBlockScopeDepth(0) {}
+    explicit StmtInfoPC(ExclusiveContext *cx) : StmtInfoBase(cx), innerBlockScopeDepth(0) {}
 };
 
 typedef HashSet<JSAtom *> FuncStmtSet;
diff --git a/js/src/frontend/SharedContext.h b/js/src/frontend/SharedContext.h
index d0d1fe2ffbfc..034571cd1752 100644
--- a/js/src/frontend/SharedContext.h
+++ b/js/src/frontend/SharedContext.h
@@ -410,7 +410,7 @@ struct StmtInfoBase {
     // isNestedScope.
     Rooted<NestedScopeObject *> staticScope;
 
-    StmtInfoBase(ExclusiveContext *cx)
+    explicit StmtInfoBase(ExclusiveContext *cx)
         : isBlockScope(false), isNestedScope(false), isForLetBlock(false),
           label(cx), staticScope(cx)
     {}
diff --git a/js/src/frontend/TokenStream.h b/js/src/frontend/TokenStream.h
index ba1e079898ca..67bb21649bbc 100644
--- a/js/src/frontend/TokenStream.h
+++ b/js/src/frontend/TokenStream.h
@@ -597,7 +597,7 @@ class MOZ_STACK_CLASS TokenStream
         //
         // This class is explicity ignored by the analysis, so don't add any
         // more pointers to GC things here!
-        Position(AutoKeepAtoms&) { }
+        explicit Position(AutoKeepAtoms&) { }
       private:
         Position(const Position&) MOZ_DELETE;
         friend class TokenStream;
diff --git a/js/src/gc/Barrier.h b/js/src/gc/Barrier.h
index 33158751ea96..ead2bcc5f16a 100644
--- a/js/src/gc/Barrier.h
+++ b/js/src/gc/Barrier.h
@@ -412,7 +412,7 @@ class BarrieredBase : public BarrieredBaseMixins<T>
   protected:
     T value;
 
-    BarrieredBase(T v) : value(v) {}
+    explicit BarrieredBase(T v) : value(v) {}
     ~BarrieredBase() { pre(); }
 
   public:
@@ -468,7 +468,10 @@ class PreBarriered : public BarrieredBase<T>
 {
   public:
     PreBarriered() : BarrieredBase<T>(GCMethods<T>::initial()) {}
-    PreBarriered(T v) : BarrieredBase<T>(v) {}
+    /*
+     * Allow implicit construction for use in generic contexts, such as DebuggerWeakMap::markKeys.
+     */
+    MOZ_IMPLICIT PreBarriered(T v) : BarrieredBase<T>(v) {}
     explicit PreBarriered(const PreBarriered<T> &v)
       : BarrieredBase<T>(v.value) {}
 
@@ -735,8 +738,8 @@ class ReadBarriered
 
   public:
     ReadBarriered() : value(nullptr) {}
-    ReadBarriered(T value) : value(value) {}
-    ReadBarriered(const Rooted<T> &rooted) : value(rooted) {}
+    explicit ReadBarriered(T value) : value(value) {}
+    explicit ReadBarriered(const Rooted<T> &rooted) : value(rooted) {}
 
     T get() const {
         if (!InternalGCMethods<T>::isMarkable(value))
@@ -914,7 +917,7 @@ class HeapSlotArray
     HeapSlot *array;
 
   public:
-    HeapSlotArray(HeapSlot *array) : array(array) {}
+    explicit HeapSlotArray(HeapSlot *array) : array(array) {}
 
     operator const Value *() const { return Valueify(array); }
     operator HeapSlot *() const { return array; }
diff --git a/js/src/gc/FindSCCs.h b/js/src/gc/FindSCCs.h
index e7a7e9d8eedb..587296e899e6 100644
--- a/js/src/gc/FindSCCs.h
+++ b/js/src/gc/FindSCCs.h
@@ -64,7 +64,7 @@ template<class Node>
 class ComponentFinder
 {
   public:
-    ComponentFinder(uintptr_t sl)
+    explicit ComponentFinder(uintptr_t sl)
       : clock(1),
         stack(nullptr),
         firstComponent(nullptr),
diff --git a/js/src/gc/GCInternals.h b/js/src/gc/GCInternals.h
index 6da010e69a09..099b32e8903e 100644
--- a/js/src/gc/GCInternals.h
+++ b/js/src/gc/GCInternals.h
@@ -31,7 +31,7 @@ class AutoCopyFreeListToArenas
 
 struct AutoFinishGC
 {
-    AutoFinishGC(JSRuntime *rt);
+    explicit AutoFinishGC(JSRuntime *rt);
 };
 
 /*
@@ -41,7 +41,7 @@ struct AutoFinishGC
 class AutoTraceSession
 {
   public:
-    AutoTraceSession(JSRuntime *rt, HeapState state = Tracing);
+    explicit AutoTraceSession(JSRuntime *rt, HeapState state = Tracing);
     ~AutoTraceSession();
 
   protected:
@@ -68,7 +68,7 @@ class IncrementalSafety
 {
     const char *reason_;
 
-    IncrementalSafety(const char *reason) : reason_(reason) {}
+    explicit IncrementalSafety(const char *reason) : reason_(reason) {}
 
   public:
     static IncrementalSafety Safe() { return IncrementalSafety(nullptr); }
diff --git a/js/src/gc/GCRuntime.h b/js/src/gc/GCRuntime.h
index cda2ca9d2a12..aaf3e5241dda 100644
--- a/js/src/gc/GCRuntime.h
+++ b/js/src/gc/GCRuntime.h
@@ -104,7 +104,7 @@ class CallbackVector : public Vector<Callback<F>, 4, SystemAllocPolicy> {};
 class GCRuntime
 {
   public:
-    GCRuntime(JSRuntime *rt);
+    explicit GCRuntime(JSRuntime *rt);
     bool init(uint32_t maxbytes);
     void finish();
 
diff --git a/js/src/gc/Marking.cpp b/js/src/gc/Marking.cpp
index eadecc06fe1b..e8118faf4dc3 100644
--- a/js/src/gc/Marking.cpp
+++ b/js/src/gc/Marking.cpp
@@ -1694,7 +1694,7 @@ struct UnmarkGrayTracer : public JSTracer
      * We set eagerlyTraceWeakMaps to false because the cycle collector will fix
      * up any color mismatches involving weakmaps when it runs.
      */
-    UnmarkGrayTracer(JSRuntime *rt)
+    explicit UnmarkGrayTracer(JSRuntime *rt)
       : JSTracer(rt, UnmarkGrayChildren, DoNotTraceWeakMaps),
         tracingShape(false),
         previousShape(nullptr),
diff --git a/js/src/gc/Memory.cpp b/js/src/gc/Memory.cpp
index 4251d0f3b5e0..b31a3a0fead9 100644
--- a/js/src/gc/Memory.cpp
+++ b/js/src/gc/Memory.cpp
@@ -18,6 +18,18 @@ SystemPageAllocator::decommitEnabled()
     return pageSize == ArenaSize;
 }
 
+/*
+ * This returns the offset of address p from the nearest aligned address at
+ * or below p - or alternatively, the number of unaligned bytes at the end of
+ * the region starting at p (as we assert that allocation size is an integer
+ * multiple of the alignment).
+ */
+static inline size_t
+OffsetFromAligned(void *p, size_t alignment)
+{
+    return uintptr_t(p) % alignment;
+}
+
 #if defined(XP_WIN)
 #include "jswin.h"
 #include <psapi.h>
@@ -30,26 +42,51 @@ SystemPageAllocator::SystemPageAllocator()
     allocGranularity = sysinfo.dwAllocationGranularity;
 }
 
+static inline void *
+MapMemoryAt(void *desired, size_t length, int flags, int prot = PAGE_READWRITE)
+{
+    return VirtualAlloc(desired, length, flags, prot);
+}
+
+static inline void *
+MapMemory(size_t length, int flags, int prot = PAGE_READWRITE)
+{
+    return VirtualAlloc(nullptr, length, flags, prot);
+}
+
 void *
 SystemPageAllocator::mapAlignedPages(size_t size, size_t alignment)
 {
-    JS_ASSERT(size >= alignment);
-    JS_ASSERT(size % alignment == 0);
-    JS_ASSERT(size % pageSize == 0);
-    JS_ASSERT(alignment % allocGranularity == 0);
+    MOZ_ASSERT(size >= alignment);
+    MOZ_ASSERT(size % alignment == 0);
+    MOZ_ASSERT(size % pageSize == 0);
+    MOZ_ASSERT(alignment % allocGranularity == 0);
 
-    void *p = VirtualAlloc(nullptr, size, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
+    void *p = MapMemory(size, MEM_COMMIT | MEM_RESERVE);
 
     /* Special case: If we want allocation alignment, no further work is needed. */
     if (alignment == allocGranularity)
         return p;
 
-    if (uintptr_t(p) % alignment != 0) {
+    if (OffsetFromAligned(p, alignment) == 0)
+        return p;
+
+    void *retainedAddr;
+    size_t retainedSize;
+    getNewChunk(&p, &retainedAddr, &retainedSize, size, alignment);
+    if (retainedAddr)
+        unmapPages(retainedAddr, retainedSize);
+    if (p) {
+        if (OffsetFromAligned(p, alignment) == 0)
+            return p;
         unmapPages(p, size);
-        p = mapAlignedPagesSlow(size, alignment);
     }
 
-    JS_ASSERT(uintptr_t(p) % alignment == 0);
+    p = mapAlignedPagesSlow(size, alignment);
+    if (!p)
+        return mapAlignedPagesLastDitch(size, alignment);
+
+    MOZ_ASSERT(OffsetFromAligned(p, alignment) == 0);
     return p;
 }
 
@@ -73,12 +110,12 @@ SystemPageAllocator::mapAlignedPagesSlow(size_t size, size_t alignment)
          * mapping doesn't have to commit pages.
          */
         size_t reserveSize = size + alignment - pageSize;
-        p = VirtualAlloc(nullptr, reserveSize, MEM_RESERVE, PAGE_READWRITE);
+        p = MapMemory(reserveSize, MEM_RESERVE);
         if (!p)
             return nullptr;
         void *chunkStart = (void *)AlignBytes(uintptr_t(p), alignment);
         unmapPages(p, reserveSize);
-        p = VirtualAlloc(chunkStart, size, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
+        p = MapMemoryAt(chunkStart, size, MEM_COMMIT | MEM_RESERVE);
 
         /* Failure here indicates a race with another thread, so try again. */
     } while (!p);
@@ -86,10 +123,76 @@ SystemPageAllocator::mapAlignedPagesSlow(size_t size, size_t alignment)
     return p;
 }
 
+/*
+ * Even though there aren't any |size + alignment - pageSize| byte chunks left,
+ * the allocator may still be able to give us |size| byte chunks that are
+ * either already aligned, or *can* be aligned by allocating in the nearest
+ * aligned location. Since we can't tell the allocator to give us a different
+ * address each time, we temporarily hold onto the unaligned part of each chunk
+ * until the allocator gives us a chunk that either is, or can be aligned.
+ */
+void *
+SystemPageAllocator::mapAlignedPagesLastDitch(size_t size, size_t alignment)
+{
+    void *p = nullptr;
+    void *tempMaps[MaxLastDitchAttempts];
+    int attempt = 0;
+    for (; attempt < MaxLastDitchAttempts; ++attempt) {
+        size_t retainedSize;
+        getNewChunk(&p, tempMaps + attempt, &retainedSize, size, alignment);
+        if (OffsetFromAligned(p, alignment) == 0) {
+            if (tempMaps[attempt])
+                unmapPages(tempMaps[attempt], retainedSize);
+            break;
+        }
+        if (!tempMaps[attempt]) {
+            /* getNewChunk failed, but we can still try the simpler method. */
+            tempMaps[attempt] = p;
+            p = nullptr;
+        }
+    }
+    if (OffsetFromAligned(p, alignment)) {
+        unmapPages(p, size);
+        p = nullptr;
+    }
+    while (--attempt >= 0)
+        unmapPages(tempMaps[attempt], 0);
+    return p;
+}
+
+/*
+ * On Windows, map and unmap calls must be matched, so we deallocate the
+ * unaligned chunk, then reallocate the unaligned part to block off the
+ * old address and force the allocator to give us a new one.
+ */
+void
+SystemPageAllocator::getNewChunk(void **aAddress, void **aRetainedAddr, size_t *aRetainedSize,
+                                 size_t size, size_t alignment)
+{
+    void *address = *aAddress;
+    void *retainedAddr = nullptr;
+    size_t retainedSize = 0;
+    do {
+        if (!address)
+            address = MapMemory(size, MEM_COMMIT | MEM_RESERVE);
+        size_t offset = OffsetFromAligned(address, alignment);
+        if (!offset)
+            break;
+        unmapPages(address, size);
+        retainedSize = alignment - offset;
+        retainedAddr = MapMemoryAt(address, retainedSize, MEM_RESERVE);
+        address = MapMemory(size, MEM_COMMIT | MEM_RESERVE);
+        /* If retainedAddr is null here, we raced with another thread. */
+    } while (!retainedAddr);
+    *aAddress = address;
+    *aRetainedAddr = retainedAddr;
+    *aRetainedSize = retainedSize;
+}
+
 void
 SystemPageAllocator::unmapPages(void *p, size_t size)
 {
-    JS_ALWAYS_TRUE(VirtualFree(p, 0, MEM_RELEASE));
+    MOZ_ALWAYS_TRUE(VirtualFree(p, 0, MEM_RELEASE));
 }
 
 bool
@@ -98,15 +201,15 @@ SystemPageAllocator::markPagesUnused(void *p, size_t size)
     if (!decommitEnabled())
         return true;
 
-    JS_ASSERT(uintptr_t(p) % pageSize == 0);
-    LPVOID p2 = VirtualAlloc(p, size, MEM_RESET, PAGE_READWRITE);
+    MOZ_ASSERT(OffsetFromAligned(p, pageSize) == 0);
+    LPVOID p2 = MapMemoryAt(p, size, MEM_RESET);
     return p2 == p;
 }
 
 bool
 SystemPageAllocator::markPagesInUse(void *p, size_t size)
 {
-    JS_ASSERT(uintptr_t(p) % pageSize == 0);
+    MOZ_ASSERT(OffsetFromAligned(p, pageSize) == 0);
     return true;
 }
 
@@ -150,10 +253,10 @@ SystemPageAllocator::SystemPageAllocator()
 void *
 SystemPageAllocator::mapAlignedPages(size_t size, size_t alignment)
 {
-    JS_ASSERT(size >= alignment);
-    JS_ASSERT(size % alignment == 0);
-    JS_ASSERT(size % pageSize == 0);
-    JS_ASSERT(alignment % allocGranularity == 0);
+    MOZ_ASSERT(size >= alignment);
+    MOZ_ASSERT(size % alignment == 0);
+    MOZ_ASSERT(size % pageSize == 0);
+    MOZ_ASSERT(alignment % allocGranularity == 0);
 
     int prot = PROT_READ | PROT_WRITE;
     int flags = MAP_PRIVATE | MAP_ANON | MAP_ALIGN | MAP_NOSYNC;
@@ -167,20 +270,20 @@ SystemPageAllocator::mapAlignedPages(size_t size, size_t alignment)
 void
 SystemPageAllocator::unmapPages(void *p, size_t size)
 {
-    JS_ALWAYS_TRUE(0 == munmap((caddr_t)p, size));
+    MOZ_ALWAYS_TRUE(0 == munmap((caddr_t)p, size));
 }
 
 bool
 SystemPageAllocator::markPagesUnused(void *p, size_t size)
 {
-    JS_ASSERT(uintptr_t(p) % pageSize == 0);
+    MOZ_ASSERT(OffsetFromAligned(p, pageSize) == 0);
     return true;
 }
 
 bool
 SystemPageAllocator::markPagesInUse(void *p, size_t size)
 {
-    JS_ASSERT(uintptr_t(p) % pageSize == 0);
+    MOZ_ASSERT(OffsetFromAligned(p, pageSize) == 0);
     return true;
 }
 
@@ -207,6 +310,7 @@ SystemPageAllocator::DeallocateMappedContent(void *p, size_t length)
 #elif defined(XP_UNIX)
 
 #include <algorithm>
+#include <errno.h>
 #include <sys/mman.h>
 #include <sys/resource.h>
 #include <sys/stat.h>
@@ -216,10 +320,35 @@ SystemPageAllocator::DeallocateMappedContent(void *p, size_t length)
 SystemPageAllocator::SystemPageAllocator()
 {
     pageSize = allocGranularity = size_t(sysconf(_SC_PAGESIZE));
+    growthDirection = 0;
 }
 
 static inline void *
-MapMemory(size_t length, int prot, int flags, int fd, off_t offset)
+MapMemoryAt(void *desired, size_t length, int prot = PROT_READ | PROT_WRITE,
+            int flags = MAP_PRIVATE | MAP_ANON, int fd = -1, off_t offset = 0)
+{
+#if defined(__ia64__)
+    MOZ_ASSERT(0xffff800000000000ULL & (uintptr_t(desired) + length - 1) == 0);
+#endif
+    void *region = mmap(desired, length, prot, flags, fd, offset);
+    if (region == MAP_FAILED)
+        return nullptr;
+    /*
+     * mmap treats the given address as a hint unless the MAP_FIXED flag is
+     * used (which isn't usually what you want, as this overrides existing
+     * mappings), so check that the address we got is the address we wanted.
+     */
+    if (region != desired) {
+        if (munmap(region, length))
+            MOZ_ASSERT(errno == ENOMEM);
+        return nullptr;
+    }
+    return region;
+}
+
+static inline void *
+MapMemory(size_t length, int prot = PROT_READ | PROT_WRITE,
+          int flags = MAP_PRIVATE | MAP_ANON, int fd = -1, off_t offset = 0)
 {
 #if defined(__ia64__)
     /*
@@ -237,79 +366,229 @@ MapMemory(size_t length, int prot, int flags, int fd, off_t offset)
      */
     void *region = mmap((void*)0x0000070000000000, length, prot, flags, fd, offset);
     if (region == MAP_FAILED)
-        return MAP_FAILED;
+        return nullptr;
     /*
      * If the allocated memory doesn't have its upper 17 bits clear, consider it
      * as out of memory.
      */
     if ((uintptr_t(region) + (length - 1)) & 0xffff800000000000) {
-        JS_ALWAYS_TRUE(0 == munmap(region, length));
-        return MAP_FAILED;
+        if (munmap(region, length))
+            MOZ_ASSERT(errno == ENOMEM);
+        return nullptr;
     }
     return region;
 #else
-    return mmap(nullptr, length, prot, flags, fd, offset);
+    void *region = mmap(nullptr, length, prot, flags, fd, offset);
+    if (region == MAP_FAILED)
+        return nullptr;
+    return region;
 #endif
 }
 
 void *
 SystemPageAllocator::mapAlignedPages(size_t size, size_t alignment)
 {
-    JS_ASSERT(size >= alignment);
-    JS_ASSERT(size % alignment == 0);
-    JS_ASSERT(size % pageSize == 0);
-    JS_ASSERT(alignment % allocGranularity == 0);
+    MOZ_ASSERT(size >= alignment);
+    MOZ_ASSERT(size % alignment == 0);
+    MOZ_ASSERT(size % pageSize == 0);
+    MOZ_ASSERT(alignment % allocGranularity == 0);
 
-    int prot = PROT_READ | PROT_WRITE;
-    int flags = MAP_PRIVATE | MAP_ANON;
-
-    void *p = MapMemory(size, prot, flags, -1, 0);
-    if (p == MAP_FAILED)
-        return nullptr;
+    void *p = MapMemory(size);
 
     /* Special case: If we want page alignment, no further work is needed. */
     if (alignment == allocGranularity)
         return p;
 
-    if (uintptr_t(p) % alignment != 0) {
+    if (OffsetFromAligned(p, alignment) == 0)
+        return p;
+
+    void *retainedAddr;
+    size_t retainedSize;
+    getNewChunk(&p, &retainedAddr, &retainedSize, size, alignment);
+    if (retainedAddr)
+        unmapPages(retainedAddr, retainedSize);
+    if (p) {
+        if (OffsetFromAligned(p, alignment) == 0)
+            return p;
         unmapPages(p, size);
-        p = mapAlignedPagesSlow(size, alignment);
     }
 
-    JS_ASSERT(uintptr_t(p) % alignment == 0);
+    p = mapAlignedPagesSlow(size, alignment);
+    if (!p)
+        return mapAlignedPagesLastDitch(size, alignment);
+
+    MOZ_ASSERT(OffsetFromAligned(p, alignment) == 0);
     return p;
 }
 
 void *
 SystemPageAllocator::mapAlignedPagesSlow(size_t size, size_t alignment)
 {
-    int prot = PROT_READ | PROT_WRITE;
-    int flags = MAP_PRIVATE | MAP_ANON;
-
     /* Overallocate and unmap the region's edges. */
-    size_t reqSize = Min(size + 2 * alignment, 2 * size);
-    void *region = MapMemory(reqSize, prot, flags, -1, 0);
-    if (region == MAP_FAILED)
+    size_t reqSize = size + alignment - pageSize;
+    void *region = MapMemory(reqSize);
+    if (!region)
         return nullptr;
 
-    uintptr_t regionEnd = uintptr_t(region) + reqSize;
-    uintptr_t offset = uintptr_t(region) % alignment;
-    JS_ASSERT(offset < reqSize - size);
+    void *regionEnd = (void *)(uintptr_t(region) + reqSize);
+    void *front;
+    void *end;
+    if (growthDirection <= 0) {
+        size_t offset = OffsetFromAligned(regionEnd, alignment);
+        end = (void *)(uintptr_t(regionEnd) - offset);
+        front = (void *)(uintptr_t(end) - size);
+    } else {
+        size_t offset = OffsetFromAligned(region, alignment);
+        front = (void *)(uintptr_t(region) + (offset ? alignment - offset : 0));
+        end = (void *)(uintptr_t(front) + size);
+    }
 
-    void *front = (void *)AlignBytes(uintptr_t(region), alignment);
-    void *end = (void *)(uintptr_t(front) + size);
     if (front != region)
-        JS_ALWAYS_TRUE(0 == munmap(region, alignment - offset));
-    if (uintptr_t(end) != regionEnd)
-        JS_ALWAYS_TRUE(0 == munmap(end, regionEnd - uintptr_t(end)));
+        unmapPages(region, uintptr_t(front) - uintptr_t(region));
+    if (end != regionEnd)
+        unmapPages(end, uintptr_t(regionEnd) - uintptr_t(end));
 
     return front;
 }
 
+/*
+ * Even though there aren't any |size + alignment - pageSize| byte chunks left,
+ * the allocator may still be able to give us |size| byte chunks that are
+ * either already aligned, or *can* be aligned by allocating in the nearest
+ * aligned location. Since we can't tell the allocator to give us a different
+ * address each time, we temporarily hold onto the unaligned part of each chunk
+ * until the allocator gives us a chunk that either is, or can be aligned.
+ */
+void *
+SystemPageAllocator::mapAlignedPagesLastDitch(size_t size, size_t alignment)
+{
+    void *p = nullptr;
+    void *tempMaps[MaxLastDitchAttempts];
+    size_t tempSizes[MaxLastDitchAttempts];
+    int attempt = 0;
+    for (; attempt < MaxLastDitchAttempts; ++attempt) {
+        getNewChunk(&p, tempMaps + attempt, tempSizes + attempt, size, alignment);
+        if (OffsetFromAligned(p, alignment) == 0) {
+            if (tempMaps[attempt])
+                unmapPages(tempMaps[attempt], tempSizes[attempt]);
+            break;
+        }
+        if (!tempMaps[attempt]) {
+            /* getNewChunk failed, but we can still try the simpler method. */
+            tempMaps[attempt] = p;
+            tempSizes[attempt] = size;
+            p = nullptr;
+        }
+    }
+    if (OffsetFromAligned(p, alignment)) {
+        unmapPages(p, size);
+        p = nullptr;
+    }
+    while (--attempt >= 0)
+        unmapPages(tempMaps[attempt], tempSizes[attempt]);
+    return p;
+}
+
+/*
+ * mmap calls don't have to be matched with calls to munmap, so we can unmap
+ * just the pages we don't need. However, as we don't know a priori if addresses
+ * are handed out in increasing or decreasing order, we have to try both
+ * directions (depending on the environment, one will always fail).
+ */
+void
+SystemPageAllocator::getNewChunk(void **aAddress, void **aRetainedAddr, size_t *aRetainedSize,
+                                 size_t size, size_t alignment)
+{
+    void *address = *aAddress;
+    void *retainedAddr = nullptr;
+    size_t retainedSize = 0;
+    do {
+        bool addrsGrowDown = growthDirection <= 0;
+        /* Try the direction indicated by growthDirection. */
+        if (getNewChunkInner(&address, &retainedAddr, &retainedSize, size,
+                             alignment, addrsGrowDown)) {
+            break;
+        }
+        /* If that failed, try the opposite direction. */
+        if (getNewChunkInner(&address, &retainedAddr, &retainedSize, size,
+                             alignment, !addrsGrowDown)) {
+            break;
+        }
+        /* If retainedAddr is non-null here, we raced with another thread. */
+    } while (retainedAddr);
+    *aAddress = address;
+    *aRetainedAddr = retainedAddr;
+    *aRetainedSize = retainedSize;
+}
+
+#define SET_OUT_PARAMS_AND_RETURN(address_, retainedAddr_, retainedSize_, toReturn_)\
+    do {                                                                            \
+        *aAddress = address_; *aRetainedAddr = retainedAddr_;                       \
+        *aRetainedSize = retainedSize_; return toReturn_;                           \
+    } while(false)
+
+bool
+SystemPageAllocator::getNewChunkInner(void **aAddress, void **aRetainedAddr, size_t *aRetainedSize,
+                                      size_t size, size_t alignment, bool addrsGrowDown)
+{
+    void *initial = *aAddress;
+    if (!initial)
+        initial = MapMemory(size);
+    if (OffsetFromAligned(initial, alignment) == 0)
+        SET_OUT_PARAMS_AND_RETURN(initial, nullptr, 0, true);
+    /* Set the parameters based on whether addresses grow up or down. */
+    size_t offset;
+    void *discardedAddr;
+    void *retainedAddr;
+    int delta;
+    if (addrsGrowDown) {
+        offset = OffsetFromAligned(initial, alignment);
+        discardedAddr = initial;
+        retainedAddr = (void *)(uintptr_t(initial) + size - offset);
+        delta = -1;
+    } else {
+        offset = alignment - OffsetFromAligned(initial, alignment);
+        discardedAddr = (void*)(uintptr_t(initial) + offset);
+        retainedAddr = initial;
+        delta = 1;
+    }
+    /* Keep only the |offset| unaligned bytes. */
+    unmapPages(discardedAddr, size - offset);
+    void *address = MapMemory(size);
+    if (!address) {
+        /* Map the rest of the original chunk again in case we can recover. */
+        address = MapMemoryAt(initial, size - offset);
+        if (!address)
+            unmapPages(retainedAddr, offset);
+        SET_OUT_PARAMS_AND_RETURN(address, nullptr, 0, false);
+    }
+    if ((addrsGrowDown && address < retainedAddr) || (!addrsGrowDown && address > retainedAddr)) {
+        growthDirection += delta;
+        SET_OUT_PARAMS_AND_RETURN(address, retainedAddr, offset, true);
+    }
+    /* If we didn't choose the right direction, reduce its score. */
+    growthDirection -= delta;
+    /* Accept an aligned address if growthDirection didn't just flip. */
+    if (OffsetFromAligned(address, alignment) == 0 && growthDirection + delta != 0)
+        SET_OUT_PARAMS_AND_RETURN(address, retainedAddr, offset, true);
+    unmapPages(address, size);
+    /* Map the original chunk again since we chose the wrong direction. */
+    address = MapMemoryAt(initial, size - offset);
+    if (!address) {
+        /* Return non-null retainedAddr to indicate thread-related failure. */
+        unmapPages(retainedAddr, offset);
+        SET_OUT_PARAMS_AND_RETURN(nullptr, retainedAddr, 0, false);
+    }
+    SET_OUT_PARAMS_AND_RETURN(address, nullptr, 0, false);
+}
+
+#undef SET_OUT_PARAMS_AND_RETURN
+
 void
 SystemPageAllocator::unmapPages(void *p, size_t size)
 {
-    JS_ALWAYS_TRUE(0 == munmap(p, size));
+    if (munmap(p, size))
+        MOZ_ASSERT(errno == ENOMEM);
 }
 
 bool
@@ -318,7 +597,7 @@ SystemPageAllocator::markPagesUnused(void *p, size_t size)
     if (!decommitEnabled())
         return false;
 
-    JS_ASSERT(uintptr_t(p) % pageSize == 0);
+    MOZ_ASSERT(OffsetFromAligned(p, pageSize) == 0);
     int result = madvise(p, size, MADV_DONTNEED);
     return result != -1;
 }
@@ -326,7 +605,7 @@ SystemPageAllocator::markPagesUnused(void *p, size_t size)
 bool
 SystemPageAllocator::markPagesInUse(void *p, size_t size)
 {
-    JS_ASSERT(uintptr_t(p) % pageSize == 0);
+    MOZ_ASSERT(OffsetFromAligned(p, pageSize) == 0);
     return true;
 }
 
@@ -371,13 +650,13 @@ SystemPageAllocator::AllocateMappedContent(int fd, size_t offset, size_t length,
     pa_size = pa_end - pa_start;
 
     // Ask for a continuous memory location.
-    buf = (uint8_t *) MapMemory(pa_size, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANON, -1, 0);
-    if (buf == MAP_FAILED)
+    buf = (uint8_t *) MapMemory(pa_size);
+    if (!buf)
         return nullptr;
 
-    buf = (uint8_t *) mmap(buf, pa_size, PROT_READ | PROT_WRITE,
-                           MAP_PRIVATE | MAP_FIXED, fd, pa_start);
-    if (buf == MAP_FAILED)
+    buf = (uint8_t *) MapMemoryAt(buf, pa_size, PROT_READ | PROT_WRITE,
+                                  MAP_PRIVATE | MAP_FIXED, fd, pa_start);
+    if (!buf)
         return nullptr;
 
     // Reset the data before target file, which we don't need to see.
@@ -398,7 +677,8 @@ SystemPageAllocator::DeallocateMappedContent(void *p, size_t length)
 
     pa_start = (void *)(uintptr_t(p) & ~(page_size - 1));
     total_size = ((uintptr_t(p) + length) & ~(page_size - 1)) + page_size - uintptr_t(pa_start);
-    munmap(pa_start, total_size);
+    if (munmap(pa_start, total_size))
+        MOZ_ASSERT(errno == ENOMEM);
 }
 
 #else
diff --git a/js/src/gc/Memory.h b/js/src/gc/Memory.h
index 30ddf0c2a105..e92fe7dee230 100644
--- a/js/src/gc/Memory.h
+++ b/js/src/gc/Memory.h
@@ -50,6 +50,11 @@ class SystemPageAllocator
   private:
     bool decommitEnabled();
     void *mapAlignedPagesSlow(size_t size, size_t alignment);
+    void *mapAlignedPagesLastDitch(size_t size, size_t alignment);
+    void getNewChunk(void **aAddress, void **aRetainedAddr, size_t *aRetainedSize,
+                     size_t size, size_t alignment);
+    bool getNewChunkInner(void **aAddress, void **aRetainedAddr, size_t *aRetainedSize,
+                          size_t size, size_t alignment, bool addrsGrowDown);
 
     // The GC can only safely decommit memory when the page size of the
     // running process matches the compiled arena size.
@@ -57,6 +62,21 @@ class SystemPageAllocator
 
     // The OS allocation granularity may not match the page size.
     size_t              allocGranularity;
+
+#if defined(XP_UNIX)
+    // The addresses handed out by mmap may grow up or down.
+    int                 growthDirection;
+#endif
+
+    // The maximum number of unalignable chunks to temporarily keep alive in
+    // the last ditch allocation pass. OOM crash reports generally show <= 7
+    // unaligned chunks available (bug 1005844 comment #16).
+    static const int    MaxLastDitchAttempts = 8;
+
+public:
+    void *testMapAlignedPagesLastDitch(size_t size, size_t alignment) {
+        return mapAlignedPagesLastDitch(size, alignment);
+    }
 };
 
 } // namespace gc
diff --git a/js/src/gc/Statistics.cpp b/js/src/gc/Statistics.cpp
index 23bc64cc2dc5..16b3a20310e5 100644
--- a/js/src/gc/Statistics.cpp
+++ b/js/src/gc/Statistics.cpp
@@ -45,7 +45,7 @@ class gcstats::StatisticsSerializer
         AsText = false
     };
 
-    StatisticsSerializer(Mode asJSON)
+    explicit StatisticsSerializer(Mode asJSON)
       : buf_(), asJSON_(asJSON), needComma_(false), oom_(false)
     {}
 
diff --git a/js/src/gc/Statistics.h b/js/src/gc/Statistics.h
index 6f3194c3f00c..73dd2809f865 100644
--- a/js/src/gc/Statistics.h
+++ b/js/src/gc/Statistics.h
@@ -75,7 +75,7 @@ enum Stat {
 class StatisticsSerializer;
 
 struct Statistics {
-    Statistics(JSRuntime *rt);
+    explicit Statistics(JSRuntime *rt);
     ~Statistics();
 
     void beginPhase(Phase phase);
diff --git a/js/src/gc/Tracer.h b/js/src/gc/Tracer.h
index 35b1fef908c2..691ad0942ad7 100644
--- a/js/src/gc/Tracer.h
+++ b/js/src/gc/Tracer.h
@@ -54,7 +54,7 @@ class MarkStack
     size_t maxCapacity_;
 
   public:
-    MarkStack(size_t maxCapacity)
+    explicit MarkStack(size_t maxCapacity)
       : stack_(nullptr),
         tos_(nullptr),
         end_(nullptr),
diff --git a/js/src/gc/Zone.h b/js/src/gc/Zone.h
index 34fe2e3eb568..431fd0afccc7 100644
--- a/js/src/gc/Zone.h
+++ b/js/src/gc/Zone.h
@@ -93,7 +93,7 @@ struct Zone : public JS::shadow::Zone,
               public js::gc::GraphNodeBase<JS::Zone>,
               public js::MallocProvider<JS::Zone>
 {
-    Zone(JSRuntime *rt);
+    explicit Zone(JSRuntime *rt);
     ~Zone();
     bool init();
 
diff --git a/js/src/gdb/tests/test-Root.cpp b/js/src/gdb/tests/test-Root.cpp
index 004c0c059cb0..298cf43c2590 100644
--- a/js/src/gdb/tests/test-Root.cpp
+++ b/js/src/gdb/tests/test-Root.cpp
@@ -29,7 +29,7 @@ FRAGMENT(Root, handle) {
 
 FRAGMENT(Root, HeapSlot) {
   JS::Rooted<jsval> plinth(cx, STRING_TO_JSVAL(JS_NewStringCopyZ(cx, "plinth")));
-  JS::Rooted<JSObject *> array(cx, JS_NewArrayObject(cx, plinth));
+  JS::Rooted<JSObject *> array(cx, JS_NewArrayObject(cx, JS::HandleValueArray(plinth)));
 
   breakpoint();
 
diff --git a/js/src/irregexp/NativeRegExpMacroAssembler.cpp b/js/src/irregexp/NativeRegExpMacroAssembler.cpp
index c6f48579d29f..7d6eff8ef501 100644
--- a/js/src/irregexp/NativeRegExpMacroAssembler.cpp
+++ b/js/src/irregexp/NativeRegExpMacroAssembler.cpp
@@ -495,6 +495,15 @@ NativeRegExpMacroAssembler::Backtrack()
 {
     IonSpew(SPEW_PREFIX "Backtrack");
 
+    // Check for an interrupt.
+    Label noInterrupt;
+    masm.branch32(Assembler::Equal,
+                  AbsoluteAddress(&runtime->interrupt), Imm32(0),
+                  &noInterrupt);
+    masm.movePtr(ImmWord(RegExpRunStatus_Error), temp0);
+    masm.jump(&exit_label_);
+    masm.bind(&noInterrupt);
+
     // Pop code location from backtrack stack and jump to location.
     PopBacktrack(temp0);
     masm.jump(temp0);
diff --git a/js/src/irregexp/RegExpInterpreter.cpp b/js/src/irregexp/RegExpInterpreter.cpp
index 479283753168..d51a0ab1daa5 100644
--- a/js/src/irregexp/RegExpInterpreter.cpp
+++ b/js/src/irregexp/RegExpInterpreter.cpp
@@ -43,7 +43,7 @@ static const size_t kBitsPerByteLog2 = 3;
 class MOZ_STACK_CLASS RegExpStackCursor
 {
   public:
-    RegExpStackCursor(JSContext *cx)
+    explicit RegExpStackCursor(JSContext *cx)
       : cx(cx), cursor(base())
     {}
 
@@ -173,6 +173,8 @@ irregexp::InterpretCode(JSContext *cx, const uint8_t *byteCode,
             pc += BC_POP_CP_LENGTH;
             break;
           BYTECODE(POP_BT)
+            if (!CheckForInterrupt(cx))
+                return RegExpRunStatus_Error;
             pc = byteCode + stack.pop();
             break;
           BYTECODE(POP_REGISTER)
diff --git a/js/src/jit-test/tests/gc/bug-1014972.js b/js/src/jit-test/tests/gc/bug-1014972.js
new file mode 100644
index 000000000000..e43c6d375b02
--- /dev/null
+++ b/js/src/jit-test/tests/gc/bug-1014972.js
@@ -0,0 +1,14 @@
+if (getBuildConfiguration().parallelJS) {
+    Function("\
+        Array.buildPar(6947, (function() {\
+            return {\
+                a: new Function,\
+                b1: function() {},\
+                b2: function() {},\
+                b3: function() {},\
+                b4: function() {}\
+            }\
+        }));\
+        selectforgc(new Object);\
+    ")()
+}
diff --git a/js/src/jit-test/tests/ion/ceil.js b/js/src/jit-test/tests/ion/ceil.js
index ecb4f37f814e..203e354930dc 100644
--- a/js/src/jit-test/tests/ion/ceil.js
+++ b/js/src/jit-test/tests/ion/ceil.js
@@ -47,6 +47,7 @@ function testBailout(value) {
 
 var INT_MAX = Math.pow(2, 31) - 1;
 var INT_MIN = INT_MAX + 1 | 0;
+var UINT_MAX = Math.pow(2, 32) - 1;
 
 // Values in ]-1; -0]
 testBailout(-0);
@@ -55,5 +56,10 @@ testBailout(-.5);
 // single precision
 testBailout(INT_MAX + .5);
 testBailout(INT_MIN - 129);
+// (UINT_MAX; +inf] have special behavior on ARM
+testBailout(UINT_MAX);
+testBailout(UINT_MAX + .5);
+testBailout(UINT_MAX + 1);
+testBailout(UINT_MAX + 2);
 // BatNaN
 testBailout(NaN);
diff --git a/js/src/jit-test/tests/ion/dce-with-rinstructions.js b/js/src/jit-test/tests/ion/dce-with-rinstructions.js
index a37a26540249..89bb7858e22d 100644
--- a/js/src/jit-test/tests/ion/dce-with-rinstructions.js
+++ b/js/src/jit-test/tests/ion/dce-with-rinstructions.js
@@ -69,6 +69,44 @@ function rbitxor_object(i) {
     return i;
 }
 
+var uceFault_lsh_number = eval(uneval(uceFault).replace('uceFault', 'uceFault_lsh_number'));
+function rlsh_number(i) {
+    var x = i << 1;
+    if (uceFault_lsh_number(i) || uceFault_lsh_number(i))
+        assertEq(x, 198); /* 99 << 1 == 198 */
+    return i;
+}
+
+var uceFault_lsh_object = eval(uneval(uceFault).replace('uceFault', 'uceFault_lsh_object'));
+function rlsh_object(i) {
+    var t = i;
+    var o = { valueOf: function() { return t; } };
+    var x = o << 1;
+    t = 1000;
+    if (uceFault_lsh_object(i) || uceFault_lsh_object(i))
+        assertEq(x, 198);
+    return i;
+}
+
+var uceFault_rsh_number = eval(uneval(uceFault).replace('uceFault', 'uceFault_rsh_number'));
+function rrsh_number(i) {
+    var x = i >> 1;
+    if (uceFault_rsh_number(i) || uceFault_rsh_number(i))
+        assertEq(x, 49  /* = 99 >> 1 */);
+    return i;
+}
+
+var uceFault_rsh_object = eval(uneval(uceFault).replace('uceFault', 'uceFault_rsh_object'));
+function rrsh_object(i) {
+    var t = i;
+    var o = { valueOf: function () { return t; } };
+    var x = o >> 1; /* computed with t == i, not 1000 */
+    t = 1000;
+    if (uceFault_rsh_object(i) || uceFault_rsh_object(i))
+        assertEq(x, 49  /* = 99 >> 1 */);
+    return i;
+}
+
 var uceFault_ursh_number = eval(uneval(uceFault).replace('uceFault', 'uceFault_ursh_number'));
 function rursh_number(i) {
     var x = i >>> 1;
@@ -132,6 +170,10 @@ for (i = 0; i < 100; i++) {
     rbitor_object(i);
     rbitxor_number(i);
     rbitxor_object(i);
+    rlsh_number(i);
+    rlsh_object(i);
+    rrsh_number(i);
+    rrsh_object(i);
     rursh_number(i);
     rursh_object(i);
     radd_number(i);
diff --git a/js/src/jit/AliasAnalysis.cpp b/js/src/jit/AliasAnalysis.cpp
index 56a821ae4bd3..9af26acce844 100644
--- a/js/src/jit/AliasAnalysis.cpp
+++ b/js/src/jit/AliasAnalysis.cpp
@@ -64,7 +64,7 @@ class AliasSetIterator
     unsigned pos;
 
   public:
-    AliasSetIterator(AliasSet set)
+    explicit AliasSetIterator(AliasSet set)
       : flags(set.flags()), pos(0)
     {
         while (flags && (flags & 1) == 0) {
diff --git a/js/src/jit/AsmJS.cpp b/js/src/jit/AsmJS.cpp
index 58b9d4596fdb..91633b7fe3d3 100644
--- a/js/src/jit/AsmJS.cpp
+++ b/js/src/jit/AsmJS.cpp
@@ -387,7 +387,7 @@ class Type
 
   public:
     Type() : which_(Which(-1)) {}
-    Type(Which w) : which_(w) {}
+    MOZ_IMPLICIT Type(Which w) : which_(w) {}
 
     bool operator==(Type rhs) const { return which_ == rhs.which_; }
     bool operator!=(Type rhs) const { return which_ != rhs.which_; }
@@ -498,8 +498,8 @@ class RetType
 
   public:
     RetType() : which_(Which(-1)) {}
-    RetType(Which w) : which_(w) {}
-    RetType(AsmJSCoercion coercion) {
+    MOZ_IMPLICIT RetType(Which w) : which_(w) {}
+    MOZ_IMPLICIT RetType(AsmJSCoercion coercion) {
         switch (coercion) {
           case AsmJS_ToInt32: which_ = Signed; break;
           case AsmJS_ToNumber: which_ = Double; break;
@@ -572,9 +572,9 @@ class VarType
   public:
     VarType()
       : which_(Which(-1)) {}
-    VarType(Which w)
+    MOZ_IMPLICIT VarType(Which w)
       : which_(w) {}
-    VarType(AsmJSCoercion coercion) {
+    MOZ_IMPLICIT VarType(AsmJSCoercion coercion) {
         switch (coercion) {
           case AsmJS_ToInt32: which_ = Int; break;
           case AsmJS_ToNumber: which_ = Double; break;
@@ -647,7 +647,7 @@ class ABIArgIter
     void settle() { if (!done()) gen_.next(ToMIRType(types_[i_])); }
 
   public:
-    ABIArgIter(const VecT &types) : types_(types), i_(0) { settle(); }
+    explicit ABIArgIter(const VecT &types) : types_(types), i_(0) { settle(); }
     void operator++(int) { JS_ASSERT(!done()); i_++; settle(); }
     bool done() const { return i_ == types_.length(); }
 
@@ -671,7 +671,7 @@ class Signature
     RetType retType_;
 
   public:
-    Signature(LifoAlloc &alloc)
+    explicit Signature(LifoAlloc &alloc)
       : argTypes_(alloc) {}
     Signature(LifoAlloc &alloc, RetType retType)
       : argTypes_(alloc), retType_(retType) {}
@@ -881,7 +881,7 @@ class MOZ_STACK_CLASS ModuleCompiler
         friend class ModuleCompiler;
         friend class js::LifoAlloc;
 
-        Global(Which which) : which_(which) {}
+        explicit Global(Which which) : which_(which) {}
 
       public:
         Which which() const {
@@ -998,10 +998,10 @@ class MOZ_STACK_CLASS ModuleCompiler
         } u;
 
         MathBuiltin() : kind(Kind(-1)) {}
-        MathBuiltin(double cst) : kind(Constant) {
+        explicit MathBuiltin(double cst) : kind(Constant) {
             u.cst = cst;
         }
-        MathBuiltin(AsmJSMathBuiltinFunction func) : kind(Function) {
+        explicit MathBuiltin(AsmJSMathBuiltinFunction func) : kind(Function) {
             u.func = func;
         }
     };
@@ -1620,7 +1620,7 @@ class MOZ_STACK_CLASS ModuleCompiler
         for (size_t i = 0; i < masm_.numAsmJSAbsoluteLinks(); i++) {
             AsmJSAbsoluteLink src = masm_.asmJSAbsoluteLink(i);
             AsmJSModule::AbsoluteLink link;
-            link.patchAt = masm_.actualOffset(src.patchAt.offset());
+            link.patchAt = CodeOffsetLabel(masm_.actualOffset(src.patchAt.offset()));
             link.target = src.target;
             if (!module_->addAbsoluteLink(link))
                 return false;
@@ -2025,7 +2025,7 @@ class FunctionCompiler
         if (!newBlock(/* pred = */ nullptr, &curBlock_, fn_))
             return false;
 
-        for (ABIArgTypeIter i = argTypes; !i.done(); i++) {
+        for (ABIArgTypeIter i(argTypes); !i.done(); i++) {
             MAsmJSParameter *ins = MAsmJSParameter::New(alloc(), *i, i.mirType());
             curBlock_->add(ins);
             curBlock_->initSlot(info().localSlot(i.index()), ins);
@@ -5616,7 +5616,7 @@ struct ParallelGroupState
     int32_t outstandingJobs; // Good work, jobs!
     uint32_t compiledJobs;
 
-    ParallelGroupState(js::Vector<AsmJSParallelTask> &tasks)
+    explicit ParallelGroupState(js::Vector<AsmJSParallelTask> &tasks)
       : tasks(tasks), outstandingJobs(0), compiledJobs(0)
     { }
 };
@@ -5992,7 +5992,7 @@ static const RegisterSet NonVolatileRegs =
 static void
 LoadAsmJSActivationIntoRegister(MacroAssembler &masm, Register reg)
 {
-    masm.movePtr(AsmJSImm_Runtime, reg);
+    masm.movePtr(AsmJSImmPtr(AsmJSImm_Runtime), reg);
     size_t offset = offsetof(JSRuntime, mainThread) +
                     PerThreadData::offsetOfAsmJSActivationStackReadOnly();
     masm.loadPtr(Address(reg, offset), reg);
@@ -6388,16 +6388,16 @@ GenerateFFIInterpreterExit(ModuleCompiler &m, const ModuleCompiler::ExitDescript
     AssertStackAlignment(masm);
     switch (exit.sig().retType().which()) {
       case RetType::Void:
-        masm.callExit(AsmJSImm_InvokeFromAsmJS_Ignore, i.stackBytesConsumedSoFar());
+        masm.callExit(AsmJSImmPtr(AsmJSImm_InvokeFromAsmJS_Ignore), i.stackBytesConsumedSoFar());
         masm.branchTest32(Assembler::Zero, ReturnReg, ReturnReg, throwLabel);
         break;
       case RetType::Signed:
-        masm.callExit(AsmJSImm_InvokeFromAsmJS_ToInt32, i.stackBytesConsumedSoFar());
+        masm.callExit(AsmJSImmPtr(AsmJSImm_InvokeFromAsmJS_ToInt32), i.stackBytesConsumedSoFar());
         masm.branchTest32(Assembler::Zero, ReturnReg, ReturnReg, throwLabel);
         masm.unboxInt32(argv, ReturnReg);
         break;
       case RetType::Double:
-        masm.callExit(AsmJSImm_InvokeFromAsmJS_ToNumber, i.stackBytesConsumedSoFar());
+        masm.callExit(AsmJSImmPtr(AsmJSImm_InvokeFromAsmJS_ToNumber), i.stackBytesConsumedSoFar());
         masm.branchTest32(Assembler::Zero, ReturnReg, ReturnReg, throwLabel);
         masm.loadDouble(argv, ReturnFloatReg);
         break;
@@ -6463,12 +6463,12 @@ GenerateOOLConvert(ModuleCompiler &m, RetType retType, Label *throwLabel)
     AssertStackAlignment(masm);
     switch (retType.which()) {
       case RetType::Signed:
-        masm.callExit(AsmJSImm_CoerceInPlace_ToInt32, i.stackBytesConsumedSoFar());
+        masm.callExit(AsmJSImmPtr(AsmJSImm_CoerceInPlace_ToInt32), i.stackBytesConsumedSoFar());
         masm.branchTest32(Assembler::Zero, ReturnReg, ReturnReg, throwLabel);
         masm.unboxInt32(Address(StackPointer, offsetToArgv), ReturnReg);
         break;
       case RetType::Double:
-        masm.callExit(AsmJSImm_CoerceInPlace_ToNumber, i.stackBytesConsumedSoFar());
+        masm.callExit(AsmJSImmPtr(AsmJSImm_CoerceInPlace_ToNumber), i.stackBytesConsumedSoFar());
         masm.branchTest32(Assembler::Zero, ReturnReg, ReturnReg, throwLabel);
         masm.loadDouble(Address(StackPointer, offsetToArgv), ReturnFloatReg);
         break;
@@ -6537,10 +6537,10 @@ GenerateFFIIonExit(ModuleCompiler &m, const ModuleCompiler::ExitDescriptor &exit
     unsigned globalDataOffset = m.module().exitIndexToGlobalDataOffset(exitIndex);
 #if defined(JS_CODEGEN_X64)
     CodeOffsetLabel label2 = masm.leaRipRelative(callee);
-    m.masm().append(AsmJSGlobalAccess(label2.offset(), globalDataOffset));
+    m.masm().append(AsmJSGlobalAccess(CodeOffsetLabel(label2.offset()), globalDataOffset));
 #elif defined(JS_CODEGEN_X86)
     CodeOffsetLabel label2 = masm.movlWithPatch(Imm32(0), callee);
-    m.masm().append(AsmJSGlobalAccess(label2.offset(), globalDataOffset));
+    m.masm().append(AsmJSGlobalAccess(CodeOffsetLabel(label2.offset()), globalDataOffset));
 #else
     masm.lea(Operand(GlobalReg, globalDataOffset), callee);
 #endif
@@ -6771,7 +6771,7 @@ GenerateStackOverflowExit(ModuleCompiler &m, Label *throwLabel)
     JS_ASSERT(i.done());
 
     AssertStackAlignment(masm);
-    masm.callExit(AsmJSImm_ReportOverRecursed, i.stackBytesConsumedSoFar());
+    masm.callExit(AsmJSImmPtr(AsmJSImm_ReportOverRecursed), i.stackBytesConsumedSoFar());
 
     // Don't worry about restoring the stack; throwLabel will pop everything.
     masm.jump(throwLabel);
@@ -6829,7 +6829,7 @@ GenerateInterruptExit(ModuleCompiler &m, Label *throwLabel)
     LoadJSContextFromActivation(masm, activation, IntArgReg0);
 #endif
 
-    masm.call(AsmJSImm_HandleExecutionInterrupt);
+    masm.call(AsmJSImmPtr(AsmJSImm_HandleExecutionInterrupt));
     masm.branchIfFalseBool(ReturnReg, throwLabel);
 
     // Restore the StackPointer to it's position before the call.
diff --git a/js/src/jit/AsmJSLink.cpp b/js/src/jit/AsmJSLink.cpp
index bc305b26ad85..35560961beea 100644
--- a/js/src/jit/AsmJSLink.cpp
+++ b/js/src/jit/AsmJSLink.cpp
@@ -67,7 +67,7 @@ AsmJSFrameIterator::AsmJSFrameIterator(const AsmJSActivation *activation)
 struct GetCallSite
 {
     const AsmJSModule &module;
-    GetCallSite(const AsmJSModule &module) : module(module) {}
+    explicit GetCallSite(const AsmJSModule &module) : module(module) {}
     uint32_t operator[](size_t index) const {
         return module.callSite(index).returnAddressOffset();
     }
diff --git a/js/src/jit/AsmJSLink.h b/js/src/jit/AsmJSLink.h
index 2b80c1ff6460..22a73adff28a 100644
--- a/js/src/jit/AsmJSLink.h
+++ b/js/src/jit/AsmJSLink.h
@@ -29,7 +29,7 @@ class AsmJSFrameIterator
     void settle();
 
   public:
-    AsmJSFrameIterator(const AsmJSActivation *activation);
+    explicit AsmJSFrameIterator(const AsmJSActivation *activation);
     void operator++() { popFrame(); settle(); }
     bool done() const { return !callsite_; }
     JSAtom *functionDisplayAtom() const;
diff --git a/js/src/jit/AsmJSModule.cpp b/js/src/jit/AsmJSModule.cpp
index 1edd35133d2b..a5e8191f1cc8 100644
--- a/js/src/jit/AsmJSModule.cpp
+++ b/js/src/jit/AsmJSModule.cpp
@@ -277,7 +277,7 @@ AsmJSModule::restoreToInitialState(ArrayBufferObject *maybePrevBuffer, Exclusive
     // in staticallyLink are valid.
     for (size_t i = 0; i < staticLinkData_.absoluteLinks.length(); i++) {
         AbsoluteLink link = staticLinkData_.absoluteLinks[i];
-        Assembler::patchDataWithValueCheck(code_ + link.patchAt.offset(),
+        Assembler::patchDataWithValueCheck(CodeLocationLabel(code_ + link.patchAt.offset()),
                                            PatchedImmPtr((void*)-1),
                                            PatchedImmPtr(AddressOf(link.target, cx)));
     }
@@ -318,7 +318,7 @@ AsmJSModule::staticallyLink(ExclusiveContext *cx)
 
     for (size_t i = 0; i < staticLinkData_.absoluteLinks.length(); i++) {
         AbsoluteLink link = staticLinkData_.absoluteLinks[i];
-        Assembler::patchDataWithValueCheck(code_ + link.patchAt.offset(),
+        Assembler::patchDataWithValueCheck(CodeLocationLabel(code_ + link.patchAt.offset()),
                                            PatchedImmPtr(AddressOf(link.target, cx)),
                                            PatchedImmPtr((void*)-1));
     }
@@ -1079,7 +1079,7 @@ struct PropertyNameWrapper
     PropertyNameWrapper()
       : name(nullptr)
     {}
-    PropertyNameWrapper(PropertyName *name)
+    explicit PropertyNameWrapper(PropertyName *name)
       : name(name)
     {}
     size_t serializedSize() const {
@@ -1305,7 +1305,7 @@ struct ScopedCacheEntryOpenedForRead
     const uint8_t *memory;
     intptr_t handle;
 
-    ScopedCacheEntryOpenedForRead(ExclusiveContext *cx)
+    explicit ScopedCacheEntryOpenedForRead(ExclusiveContext *cx)
       : cx(cx), serializedSize(0), memory(nullptr), handle(0)
     {}
 
diff --git a/js/src/jit/AsmJSModule.h b/js/src/jit/AsmJSModule.h
index 73f03269451d..7d144a02739c 100644
--- a/js/src/jit/AsmJSModule.h
+++ b/js/src/jit/AsmJSModule.h
@@ -299,7 +299,7 @@ class AsmJSModule
         PropertyName *name_;
       public:
         Name() : name_(nullptr) {}
-        Name(PropertyName *name) : name_(name) {}
+        MOZ_IMPLICIT Name(PropertyName *name) : name_(name) {}
         PropertyName *name() const { return name_; }
         PropertyName *&name() { return name_; }
         size_t serializedSize() const;
diff --git a/js/src/jit/AsmJSSignalHandlers.cpp b/js/src/jit/AsmJSSignalHandlers.cpp
index a358704ae1c9..8846d58680ec 100644
--- a/js/src/jit/AsmJSSignalHandlers.cpp
+++ b/js/src/jit/AsmJSSignalHandlers.cpp
@@ -175,7 +175,7 @@ class AutoSetHandlingSignal
     JSRuntime *rt;
 
   public:
-    AutoSetHandlingSignal(JSRuntime *rt)
+    explicit AutoSetHandlingSignal(JSRuntime *rt)
       : rt(rt)
     {
         JS_ASSERT(!rt->handlingSignal);
diff --git a/js/src/jit/Bailouts.cpp b/js/src/jit/Bailouts.cpp
index cf005e0437f4..a696078d7d0b 100644
--- a/js/src/jit/Bailouts.cpp
+++ b/js/src/jit/Bailouts.cpp
@@ -69,6 +69,10 @@ IonBailoutIterator::dump() const
     }
 }
 
+// This address is a magic number made to cause crashes while indicating that we
+// are making an attempt to mark the stack during a bailout.
+static uint8_t * const FAKE_JIT_TOP_FOR_BAILOUT = reinterpret_cast<uint8_t *>(0xba1);
+
 uint32_t
 jit::Bailout(BailoutStack *sp, BaselineBailoutInfo **bailoutInfo)
 {
@@ -76,7 +80,10 @@ jit::Bailout(BailoutStack *sp, BaselineBailoutInfo **bailoutInfo)
     JS_ASSERT(bailoutInfo);
 
     // We don't have an exit frame.
-    cx->mainThread().jitTop = nullptr;
+    MOZ_ASSERT(size_t(FAKE_JIT_TOP_FOR_BAILOUT + sizeof(IonCommonFrameLayout)) < 0x1000 &&
+               size_t(FAKE_JIT_TOP_FOR_BAILOUT) >= 0,
+               "Fake jitTop pointer should be within the first page.");
+    cx->mainThread().jitTop = FAKE_JIT_TOP_FOR_BAILOUT;
     gc::AutoSuppressGC suppress(cx);
 
     JitActivationIterator jitActivations(cx->runtime());
@@ -124,7 +131,7 @@ jit::InvalidationBailout(InvalidationBailoutStack *sp, size_t *frameSizeOut,
     JSContext *cx = GetJSContextFromJitCode();
 
     // We don't have an exit frame.
-    cx->mainThread().jitTop = nullptr;
+    cx->mainThread().jitTop = FAKE_JIT_TOP_FOR_BAILOUT;
     gc::AutoSuppressGC suppress(cx);
 
     JitActivationIterator jitActivations(cx->runtime());
@@ -206,7 +213,7 @@ jit::ExceptionHandlerBailout(JSContext *cx, const InlineFrameIterator &frame,
     // operation callback like a timeout handler.
     MOZ_ASSERT_IF(!excInfo.propagatingIonExceptionForDebugMode(), cx->isExceptionPending());
 
-    cx->mainThread().jitTop = nullptr;
+    cx->mainThread().jitTop = FAKE_JIT_TOP_FOR_BAILOUT;
     gc::AutoSuppressGC suppress(cx);
 
     JitActivationIterator jitActivations(cx->runtime());
diff --git a/js/src/jit/BaselineCompiler.cpp b/js/src/jit/BaselineCompiler.cpp
index cc3580789f99..e4799ffb0433 100644
--- a/js/src/jit/BaselineCompiler.cpp
+++ b/js/src/jit/BaselineCompiler.cpp
@@ -350,7 +350,7 @@ BaselineCompiler::emitPrologue()
 
     // Record the offset of the prologue, because Ion can bailout before
     // the scope chain is initialized.
-    prologueOffset_ = masm.currentOffset();
+    prologueOffset_ = CodeOffsetLabel(masm.currentOffset());
 
     // Initialize the scope chain before any operation that may
     // call into the VM and trigger a GC.
@@ -380,7 +380,7 @@ BaselineCompiler::emitEpilogue()
 {
     // Record the offset of the epilogue, so we can do early return from
     // Debugger handlers during on-stack recompile.
-    epilogueOffset_ = masm.currentOffset();
+    epilogueOffset_ = CodeOffsetLabel(masm.currentOffset());
 
     masm.bind(&return_);
 
@@ -454,7 +454,7 @@ BaselineCompiler::emitIC(ICStub *stub, ICEntry::Kind kind)
 
     CodeOffsetLabel patchOffset;
     EmitCallIC(&patchOffset, masm);
-    entry->setReturnOffset(masm.currentOffset());
+    entry->setReturnOffset(CodeOffsetLabel(masm.currentOffset()));
     if (!addICLoadLabel(patchOffset))
         return false;
 
@@ -550,7 +550,7 @@ BaselineCompiler::emitDebugPrologue()
         masm.bind(&done);
     }
 
-    postDebugPrologueOffset_ = masm.currentOffset();
+    postDebugPrologueOffset_ = CodeOffsetLabel(masm.currentOffset());
 
     return true;
 }
@@ -726,7 +726,7 @@ BaselineCompiler::emitDebugTrap()
 
     // Add an IC entry for the return offset -> pc mapping.
     ICEntry icEntry(script->pcToOffset(pc), ICEntry::Kind_DebugTrap);
-    icEntry.setReturnOffset(masm.currentOffset());
+    icEntry.setReturnOffset(CodeOffsetLabel(masm.currentOffset()));
     if (!icEntries_.append(icEntry))
         return false;
 
diff --git a/js/src/jit/BaselineDebugModeOSR.cpp b/js/src/jit/BaselineDebugModeOSR.cpp
index 3dab78d3d9c6..f27c512a6c44 100644
--- a/js/src/jit/BaselineDebugModeOSR.cpp
+++ b/js/src/jit/BaselineDebugModeOSR.cpp
@@ -28,7 +28,7 @@ struct DebugModeOSREntry
     uint32_t pcOffset;
     ICEntry::Kind frameKind;
 
-    DebugModeOSREntry(JSScript *script)
+    explicit DebugModeOSREntry(JSScript *script)
       : script(script),
         oldBaselineScript(script->baselineScript()),
         oldStub(nullptr),
@@ -742,7 +742,7 @@ JitRuntime::generateBaselineDebugModeOSRHandler(JSContext *cx, uint32_t *noFrame
 
     // Not all patched baseline frames are returning from a situation where
     // the frame reg is already fixed up.
-    CodeOffsetLabel noFrameRegPopOffset = masm.currentOffset();
+    CodeOffsetLabel noFrameRegPopOffset(masm.currentOffset());
 
     // Record the stack pointer for syncing.
     masm.movePtr(StackPointer, syncedStackStart);
diff --git a/js/src/jit/BaselineIC.cpp b/js/src/jit/BaselineIC.cpp
index 76d4a1ff4441..90073d64febd 100644
--- a/js/src/jit/BaselineIC.cpp
+++ b/js/src/jit/BaselineIC.cpp
@@ -172,14 +172,14 @@ ICStub::trace(JSTracer *trc)
     // that references the same stub chain.
     if (isMonitoredFallback()) {
         ICTypeMonitor_Fallback *lastMonStub = toMonitoredFallbackStub()->fallbackMonitorStub();
-        for (ICStubConstIterator iter = lastMonStub->firstMonitorStub(); !iter.atEnd(); iter++) {
+        for (ICStubConstIterator iter(lastMonStub->firstMonitorStub()); !iter.atEnd(); iter++) {
             JS_ASSERT_IF(iter->next() == nullptr, *iter == lastMonStub);
             iter->trace(trc);
         }
     }
 
     if (isUpdated()) {
-        for (ICStubConstIterator iter = toUpdatedStub()->firstUpdateStub(); !iter.atEnd(); iter++) {
+        for (ICStubConstIterator iter(toUpdatedStub()->firstUpdateStub()); !iter.atEnd(); iter++) {
             JS_ASSERT_IF(iter->next() == nullptr, iter->isTypeUpdate_Fallback());
             iter->trace(trc);
         }
@@ -1170,7 +1170,7 @@ ICTypeMonitor_Fallback::addMonitorStubForValue(JSContext *cx, JSScript *script,
 
         // Check for existing TypeMonitor stub.
         ICTypeMonitor_PrimitiveSet *existingStub = nullptr;
-        for (ICStubConstIterator iter = firstMonitorStub(); !iter.atEnd(); iter++) {
+        for (ICStubConstIterator iter(firstMonitorStub()); !iter.atEnd(); iter++) {
             if (iter->isTypeMonitor_PrimitiveSet()) {
                 existingStub = iter->toTypeMonitor_PrimitiveSet();
                 if (existingStub->containsType(type))
@@ -1198,7 +1198,7 @@ ICTypeMonitor_Fallback::addMonitorStubForValue(JSContext *cx, JSScript *script,
         RootedObject obj(cx, &val.toObject());
 
         // Check for existing TypeMonitor stub.
-        for (ICStubConstIterator iter = firstMonitorStub(); !iter.atEnd(); iter++) {
+        for (ICStubConstIterator iter(firstMonitorStub()); !iter.atEnd(); iter++) {
             if (iter->isTypeMonitor_SingleObject() &&
                 iter->toTypeMonitor_SingleObject()->object() == obj)
             {
@@ -1222,7 +1222,7 @@ ICTypeMonitor_Fallback::addMonitorStubForValue(JSContext *cx, JSScript *script,
         RootedTypeObject type(cx, val.toObject().type());
 
         // Check for existing TypeMonitor stub.
-        for (ICStubConstIterator iter = firstMonitorStub(); !iter.atEnd(); iter++) {
+        for (ICStubConstIterator iter(firstMonitorStub()); !iter.atEnd(); iter++) {
             if (iter->isTypeMonitor_TypeObject() &&
                 iter->toTypeMonitor_TypeObject()->type() == type)
             {
@@ -1250,7 +1250,7 @@ ICTypeMonitor_Fallback::addMonitorStubForValue(JSContext *cx, JSScript *script,
         // only time that any main stubs' firstMonitorStub fields need to be updated to
         // refer to the newly added monitor stub.
         ICStub *firstStub = mainFallbackStub_->icEntry()->firstStub();
-        for (ICStubConstIterator iter = firstStub; !iter.atEnd(); iter++) {
+        for (ICStubConstIterator iter(firstStub); !iter.atEnd(); iter++) {
             // Non-monitored stubs are used if the result has always the same type,
             // e.g. a StringLength stub will always return int32.
             if (!iter->isMonitored())
@@ -1422,7 +1422,7 @@ ICUpdatedStub::addUpdateStubForValue(JSContext *cx, HandleScript script, HandleO
 
         // Check for existing TypeUpdate stub.
         ICTypeUpdate_PrimitiveSet *existingStub = nullptr;
-        for (ICStubConstIterator iter = firstUpdateStub_; !iter.atEnd(); iter++) {
+        for (ICStubConstIterator iter(firstUpdateStub_); !iter.atEnd(); iter++) {
             if (iter->isTypeUpdate_PrimitiveSet()) {
                 existingStub = iter->toTypeUpdate_PrimitiveSet();
                 if (existingStub->containsType(type))
@@ -1447,7 +1447,7 @@ ICUpdatedStub::addUpdateStubForValue(JSContext *cx, HandleScript script, HandleO
         RootedObject obj(cx, &val.toObject());
 
         // Check for existing TypeUpdate stub.
-        for (ICStubConstIterator iter = firstUpdateStub_; !iter.atEnd(); iter++) {
+        for (ICStubConstIterator iter(firstUpdateStub_); !iter.atEnd(); iter++) {
             if (iter->isTypeUpdate_SingleObject() &&
                 iter->toTypeUpdate_SingleObject()->object() == obj)
             {
@@ -1468,7 +1468,7 @@ ICUpdatedStub::addUpdateStubForValue(JSContext *cx, HandleScript script, HandleO
         RootedTypeObject type(cx, val.toObject().type());
 
         // Check for existing TypeUpdate stub.
-        for (ICStubConstIterator iter = firstUpdateStub_; !iter.atEnd(); iter++) {
+        for (ICStubConstIterator iter(firstUpdateStub_); !iter.atEnd(); iter++) {
             if (iter->isTypeUpdate_TypeObject() &&
                 iter->toTypeUpdate_TypeObject()->type() == type)
             {
@@ -7320,7 +7320,7 @@ DoSetPropFallback(JSContext *cx, BaselineFrame *frame, ICSetProp_Fallback *stub_
         if (!SetNameOperation(cx, script, pc, obj, rhs))
             return false;
     } else if (op == JSOP_SETALIASEDVAR) {
-        obj->as<ScopeObject>().setAliasedVar(cx, pc, name, rhs);
+        obj->as<ScopeObject>().setAliasedVar(cx, ScopeCoordinate(pc), name, rhs);
     } else {
         MOZ_ASSERT(op == JSOP_SETPROP);
         if (script->strict()) {
diff --git a/js/src/jit/BaselineIC.h b/js/src/jit/BaselineIC.h
index 16d80bc9dd3d..812fa9a75598 100644
--- a/js/src/jit/BaselineIC.h
+++ b/js/src/jit/BaselineIC.h
@@ -473,7 +473,7 @@ class ICStubConstIterator
     ICStub *currentStub_;
 
   public:
-    ICStubConstIterator(ICStub *currentStub) : currentStub_(currentStub) {}
+    explicit ICStubConstIterator(ICStub *currentStub) : currentStub_(currentStub) {}
 
     static ICStubConstIterator StartingAt(ICStub *stub) {
         return ICStubConstIterator(stub);
@@ -534,7 +534,7 @@ class ICStubIterator
     ICStub *currentStub_;
     bool unlinked_;
 
-    ICStubIterator(ICFallbackStub *fallbackStub, bool end=false);
+    explicit ICStubIterator(ICFallbackStub *fallbackStub, bool end=false);
   public:
 
     bool operator ==(const ICStubIterator &other) const {
@@ -1180,7 +1180,7 @@ class ICUseCount_Fallback : public ICFallbackStub
 {
     friend class ICStubSpace;
 
-    ICUseCount_Fallback(JitCode *stubCode)
+    explicit ICUseCount_Fallback(JitCode *stubCode)
       : ICFallbackStub(ICStub::UseCount_Fallback, stubCode)
     { }
 
@@ -1197,7 +1197,7 @@ class ICUseCount_Fallback : public ICFallbackStub
         bool generateStubCode(MacroAssembler &masm);
 
       public:
-        Compiler(JSContext *cx)
+        explicit Compiler(JSContext *cx)
           : ICStubCompiler(cx, ICStub::UseCount_Fallback)
         { }
 
@@ -1213,7 +1213,7 @@ class ICProfiler_Fallback : public ICFallbackStub
 {
     friend class ICStubSpace;
 
-    ICProfiler_Fallback(JitCode *stubCode)
+    explicit ICProfiler_Fallback(JitCode *stubCode)
       : ICFallbackStub(ICStub::Profiler_Fallback, stubCode)
     { }
 
@@ -1230,7 +1230,7 @@ class ICProfiler_Fallback : public ICFallbackStub
         bool generateStubCode(MacroAssembler &masm);
 
       public:
-        Compiler(JSContext *cx)
+        explicit Compiler(JSContext *cx)
           : ICStubCompiler(cx, ICStub::Profiler_Fallback)
         { }
 
@@ -1684,7 +1684,7 @@ class ICTypeUpdate_Fallback : public ICStub
 {
     friend class ICStubSpace;
 
-    ICTypeUpdate_Fallback(JitCode *stubCode)
+    explicit ICTypeUpdate_Fallback(JitCode *stubCode)
       : ICStub(ICStub::TypeUpdate_Fallback, stubCode)
     {}
 
@@ -1701,7 +1701,7 @@ class ICTypeUpdate_Fallback : public ICStub
         bool generateStubCode(MacroAssembler &masm);
 
       public:
-        Compiler(JSContext *cx)
+        explicit Compiler(JSContext *cx)
           : ICStubCompiler(cx, ICStub::TypeUpdate_Fallback)
         { }
 
@@ -1845,7 +1845,7 @@ class ICThis_Fallback : public ICFallbackStub
 {
     friend class ICStubSpace;
 
-    ICThis_Fallback(JitCode *stubCode)
+    explicit ICThis_Fallback(JitCode *stubCode)
       : ICFallbackStub(ICStub::This_Fallback, stubCode) {}
 
   public:
@@ -1861,7 +1861,7 @@ class ICThis_Fallback : public ICFallbackStub
         bool generateStubCode(MacroAssembler &masm);
 
       public:
-        Compiler(JSContext *cx)
+        explicit Compiler(JSContext *cx)
           : ICStubCompiler(cx, ICStub::This_Fallback) {}
 
         ICStub *getStub(ICStubSpace *space) {
@@ -1954,7 +1954,7 @@ class ICCompare_Fallback : public ICFallbackStub
 {
     friend class ICStubSpace;
 
-    ICCompare_Fallback(JitCode *stubCode)
+    explicit ICCompare_Fallback(JitCode *stubCode)
       : ICFallbackStub(ICStub::Compare_Fallback, stubCode) {}
 
   public:
@@ -1972,7 +1972,7 @@ class ICCompare_Fallback : public ICFallbackStub
         bool generateStubCode(MacroAssembler &masm);
 
       public:
-        Compiler(JSContext *cx)
+        explicit Compiler(JSContext *cx)
           : ICStubCompiler(cx, ICStub::Compare_Fallback) {}
 
         ICStub *getStub(ICStubSpace *space) {
@@ -1985,7 +1985,7 @@ class ICCompare_Int32 : public ICStub
 {
     friend class ICStubSpace;
 
-    ICCompare_Int32(JitCode *stubCode)
+    explicit ICCompare_Int32(JitCode *stubCode)
       : ICStub(ICStub::Compare_Int32, stubCode) {}
 
   public:
@@ -2014,7 +2014,7 @@ class ICCompare_Double : public ICStub
 {
     friend class ICStubSpace;
 
-    ICCompare_Double(JitCode *stubCode)
+    explicit ICCompare_Double(JitCode *stubCode)
       : ICStub(ICStub::Compare_Double, stubCode)
     {}
 
@@ -2089,7 +2089,7 @@ class ICCompare_String : public ICStub
 {
     friend class ICStubSpace;
 
-    ICCompare_String(JitCode *stubCode)
+    explicit ICCompare_String(JitCode *stubCode)
       : ICStub(ICStub::Compare_String, stubCode)
     {}
 
@@ -2119,7 +2119,7 @@ class ICCompare_Boolean : public ICStub
 {
     friend class ICStubSpace;
 
-    ICCompare_Boolean(JitCode *stubCode)
+    explicit ICCompare_Boolean(JitCode *stubCode)
       : ICStub(ICStub::Compare_Boolean, stubCode)
     {}
 
@@ -2149,7 +2149,7 @@ class ICCompare_Object : public ICStub
 {
     friend class ICStubSpace;
 
-    ICCompare_Object(JitCode *stubCode)
+    explicit ICCompare_Object(JitCode *stubCode)
       : ICStub(ICStub::Compare_Object, stubCode)
     {}
 
@@ -2179,7 +2179,7 @@ class ICCompare_ObjectWithUndefined : public ICStub
 {
     friend class ICStubSpace;
 
-    ICCompare_ObjectWithUndefined(JitCode *stubCode)
+    explicit ICCompare_ObjectWithUndefined(JitCode *stubCode)
       : ICStub(ICStub::Compare_ObjectWithUndefined, stubCode)
     {}
 
@@ -2272,7 +2272,7 @@ class ICToBool_Fallback : public ICFallbackStub
 {
     friend class ICStubSpace;
 
-    ICToBool_Fallback(JitCode *stubCode)
+    explicit ICToBool_Fallback(JitCode *stubCode)
       : ICFallbackStub(ICStub::ToBool_Fallback, stubCode) {}
 
   public:
@@ -2290,7 +2290,7 @@ class ICToBool_Fallback : public ICFallbackStub
         bool generateStubCode(MacroAssembler &masm);
 
       public:
-        Compiler(JSContext *cx)
+        explicit Compiler(JSContext *cx)
           : ICStubCompiler(cx, ICStub::ToBool_Fallback) {}
 
         ICStub *getStub(ICStubSpace *space) {
@@ -2303,7 +2303,7 @@ class ICToBool_Int32 : public ICStub
 {
     friend class ICStubSpace;
 
-    ICToBool_Int32(JitCode *stubCode)
+    explicit ICToBool_Int32(JitCode *stubCode)
       : ICStub(ICStub::ToBool_Int32, stubCode) {}
 
   public:
@@ -2319,7 +2319,7 @@ class ICToBool_Int32 : public ICStub
         bool generateStubCode(MacroAssembler &masm);
 
       public:
-        Compiler(JSContext *cx)
+        explicit Compiler(JSContext *cx)
           : ICStubCompiler(cx, ICStub::ToBool_Int32) {}
 
         ICStub *getStub(ICStubSpace *space) {
@@ -2332,7 +2332,7 @@ class ICToBool_String : public ICStub
 {
     friend class ICStubSpace;
 
-    ICToBool_String(JitCode *stubCode)
+    explicit ICToBool_String(JitCode *stubCode)
       : ICStub(ICStub::ToBool_String, stubCode) {}
 
   public:
@@ -2348,7 +2348,7 @@ class ICToBool_String : public ICStub
         bool generateStubCode(MacroAssembler &masm);
 
       public:
-        Compiler(JSContext *cx)
+        explicit Compiler(JSContext *cx)
           : ICStubCompiler(cx, ICStub::ToBool_String) {}
 
         ICStub *getStub(ICStubSpace *space) {
@@ -2361,7 +2361,7 @@ class ICToBool_NullUndefined : public ICStub
 {
     friend class ICStubSpace;
 
-    ICToBool_NullUndefined(JitCode *stubCode)
+    explicit ICToBool_NullUndefined(JitCode *stubCode)
       : ICStub(ICStub::ToBool_NullUndefined, stubCode) {}
 
   public:
@@ -2377,7 +2377,7 @@ class ICToBool_NullUndefined : public ICStub
         bool generateStubCode(MacroAssembler &masm);
 
       public:
-        Compiler(JSContext *cx)
+        explicit Compiler(JSContext *cx)
           : ICStubCompiler(cx, ICStub::ToBool_NullUndefined) {}
 
         ICStub *getStub(ICStubSpace *space) {
@@ -2390,7 +2390,7 @@ class ICToBool_Double : public ICStub
 {
     friend class ICStubSpace;
 
-    ICToBool_Double(JitCode *stubCode)
+    explicit ICToBool_Double(JitCode *stubCode)
       : ICStub(ICStub::ToBool_Double, stubCode) {}
 
   public:
@@ -2406,7 +2406,7 @@ class ICToBool_Double : public ICStub
         bool generateStubCode(MacroAssembler &masm);
 
       public:
-        Compiler(JSContext *cx)
+        explicit Compiler(JSContext *cx)
           : ICStubCompiler(cx, ICStub::ToBool_Double) {}
 
         ICStub *getStub(ICStubSpace *space) {
@@ -2419,7 +2419,7 @@ class ICToBool_Object : public ICStub
 {
     friend class ICStubSpace;
 
-    ICToBool_Object(JitCode *stubCode)
+    explicit ICToBool_Object(JitCode *stubCode)
       : ICStub(ICStub::ToBool_Object, stubCode) {}
 
   public:
@@ -2435,7 +2435,7 @@ class ICToBool_Object : public ICStub
         bool generateStubCode(MacroAssembler &masm);
 
       public:
-        Compiler(JSContext *cx)
+        explicit Compiler(JSContext *cx)
           : ICStubCompiler(cx, ICStub::ToBool_Object) {}
 
         ICStub *getStub(ICStubSpace *space) {
@@ -2451,7 +2451,7 @@ class ICToNumber_Fallback : public ICFallbackStub
 {
     friend class ICStubSpace;
 
-    ICToNumber_Fallback(JitCode *stubCode)
+    explicit ICToNumber_Fallback(JitCode *stubCode)
       : ICFallbackStub(ICStub::ToNumber_Fallback, stubCode) {}
 
   public:
@@ -2467,7 +2467,7 @@ class ICToNumber_Fallback : public ICFallbackStub
         bool generateStubCode(MacroAssembler &masm);
 
       public:
-        Compiler(JSContext *cx)
+        explicit Compiler(JSContext *cx)
           : ICStubCompiler(cx, ICStub::ToNumber_Fallback) {}
 
         ICStub *getStub(ICStubSpace *space) {
@@ -2485,7 +2485,7 @@ class ICBinaryArith_Fallback : public ICFallbackStub
 {
     friend class ICStubSpace;
 
-    ICBinaryArith_Fallback(JitCode *stubCode)
+    explicit ICBinaryArith_Fallback(JitCode *stubCode)
       : ICFallbackStub(BinaryArith_Fallback, stubCode)
     {
         extra_ = 0;
@@ -2522,7 +2522,7 @@ class ICBinaryArith_Fallback : public ICFallbackStub
         bool generateStubCode(MacroAssembler &masm);
 
       public:
-        Compiler(JSContext *cx)
+        explicit Compiler(JSContext *cx)
           : ICStubCompiler(cx, ICStub::BinaryArith_Fallback) {}
 
         ICStub *getStub(ICStubSpace *space) {
@@ -2580,7 +2580,7 @@ class ICBinaryArith_StringConcat : public ICStub
 {
     friend class ICStubSpace;
 
-    ICBinaryArith_StringConcat(JitCode *stubCode)
+    explicit ICBinaryArith_StringConcat(JitCode *stubCode)
       : ICStub(BinaryArith_StringConcat, stubCode)
     {}
 
@@ -2596,7 +2596,7 @@ class ICBinaryArith_StringConcat : public ICStub
         bool generateStubCode(MacroAssembler &masm);
 
       public:
-        Compiler(JSContext *cx)
+        explicit Compiler(JSContext *cx)
           : ICStubCompiler(cx, ICStub::BinaryArith_StringConcat)
         {}
 
@@ -2653,7 +2653,7 @@ class ICBinaryArith_Double : public ICStub
 {
     friend class ICStubSpace;
 
-    ICBinaryArith_Double(JitCode *stubCode)
+    explicit ICBinaryArith_Double(JitCode *stubCode)
       : ICStub(BinaryArith_Double, stubCode)
     {}
 
@@ -2792,7 +2792,7 @@ class ICUnaryArith_Fallback : public ICFallbackStub
 {
     friend class ICStubSpace;
 
-    ICUnaryArith_Fallback(JitCode *stubCode)
+    explicit ICUnaryArith_Fallback(JitCode *stubCode)
       : ICFallbackStub(UnaryArith_Fallback, stubCode)
     {
         extra_ = 0;
@@ -2820,7 +2820,7 @@ class ICUnaryArith_Fallback : public ICFallbackStub
         bool generateStubCode(MacroAssembler &masm);
 
       public:
-        Compiler(JSContext *cx)
+        explicit Compiler(JSContext *cx)
           : ICStubCompiler(cx, ICStub::UnaryArith_Fallback)
         {}
 
@@ -2834,7 +2834,7 @@ class ICUnaryArith_Int32 : public ICStub
 {
     friend class ICStubSpace;
 
-    ICUnaryArith_Int32(JitCode *stubCode)
+    explicit ICUnaryArith_Int32(JitCode *stubCode)
       : ICStub(UnaryArith_Int32, stubCode)
     {}
 
@@ -2864,7 +2864,7 @@ class ICUnaryArith_Double : public ICStub
 {
     friend class ICStubSpace;
 
-    ICUnaryArith_Double(JitCode *stubCode)
+    explicit ICUnaryArith_Double(JitCode *stubCode)
       : ICStub(UnaryArith_Double, stubCode)
     {}
 
@@ -2897,7 +2897,7 @@ class ICGetElem_Fallback : public ICMonitoredFallbackStub
 {
     friend class ICStubSpace;
 
-    ICGetElem_Fallback(JitCode *stubCode)
+    explicit ICGetElem_Fallback(JitCode *stubCode)
       : ICMonitoredFallbackStub(ICStub::GetElem_Fallback, stubCode)
     { }
 
@@ -2933,7 +2933,7 @@ class ICGetElem_Fallback : public ICMonitoredFallbackStub
         bool generateStubCode(MacroAssembler &masm);
 
       public:
-        Compiler(JSContext *cx)
+        explicit Compiler(JSContext *cx)
           : ICStubCompiler(cx, ICStub::GetElem_Fallback)
         { }
 
@@ -3308,7 +3308,7 @@ class ICGetElem_String : public ICStub
 {
     friend class ICStubSpace;
 
-    ICGetElem_String(JitCode *stubCode)
+    explicit ICGetElem_String(JitCode *stubCode)
       : ICStub(ICStub::GetElem_String, stubCode) {}
 
   public:
@@ -3324,7 +3324,7 @@ class ICGetElem_String : public ICStub
         bool generateStubCode(MacroAssembler &masm);
 
       public:
-        Compiler(JSContext *cx)
+        explicit Compiler(JSContext *cx)
           : ICStubCompiler(cx, ICStub::GetElem_String) {}
 
         ICStub *getStub(ICStubSpace *space) {
@@ -3510,7 +3510,7 @@ class ICSetElem_Fallback : public ICFallbackStub
 {
     friend class ICStubSpace;
 
-    ICSetElem_Fallback(JitCode *stubCode)
+    explicit ICSetElem_Fallback(JitCode *stubCode)
       : ICFallbackStub(ICStub::SetElem_Fallback, stubCode)
     { }
 
@@ -3536,7 +3536,7 @@ class ICSetElem_Fallback : public ICFallbackStub
         bool generateStubCode(MacroAssembler &masm);
 
       public:
-        Compiler(JSContext *cx)
+        explicit Compiler(JSContext *cx)
           : ICStubCompiler(cx, ICStub::SetElem_Fallback)
         { }
 
@@ -3776,7 +3776,7 @@ class ICIn_Fallback : public ICFallbackStub
 {
     friend class ICStubSpace;
 
-    ICIn_Fallback(JitCode *stubCode)
+    explicit ICIn_Fallback(JitCode *stubCode)
       : ICFallbackStub(ICStub::In_Fallback, stubCode)
     { }
 
@@ -3792,7 +3792,7 @@ class ICIn_Fallback : public ICFallbackStub
         bool generateStubCode(MacroAssembler &masm);
 
       public:
-        Compiler(JSContext *cx)
+        explicit Compiler(JSContext *cx)
           : ICStubCompiler(cx, ICStub::In_Fallback)
         { }
 
@@ -3809,7 +3809,7 @@ class ICGetName_Fallback : public ICMonitoredFallbackStub
 {
     friend class ICStubSpace;
 
-    ICGetName_Fallback(JitCode *stubCode)
+    explicit ICGetName_Fallback(JitCode *stubCode)
       : ICMonitoredFallbackStub(ICStub::GetName_Fallback, stubCode)
     { }
 
@@ -3827,7 +3827,7 @@ class ICGetName_Fallback : public ICMonitoredFallbackStub
         bool generateStubCode(MacroAssembler &masm);
 
       public:
-        Compiler(JSContext *cx)
+        explicit Compiler(JSContext *cx)
           : ICStubCompiler(cx, ICStub::GetName_Fallback)
         { }
 
@@ -3972,7 +3972,7 @@ class ICBindName_Fallback : public ICFallbackStub
 {
     friend class ICStubSpace;
 
-    ICBindName_Fallback(JitCode *stubCode)
+    explicit ICBindName_Fallback(JitCode *stubCode)
       : ICFallbackStub(ICStub::BindName_Fallback, stubCode)
     { }
 
@@ -3988,7 +3988,7 @@ class ICBindName_Fallback : public ICFallbackStub
         bool generateStubCode(MacroAssembler &masm);
 
       public:
-        Compiler(JSContext *cx)
+        explicit Compiler(JSContext *cx)
           : ICStubCompiler(cx, ICStub::BindName_Fallback)
         { }
 
@@ -4004,7 +4004,7 @@ class ICGetIntrinsic_Fallback : public ICMonitoredFallbackStub
 {
     friend class ICStubSpace;
 
-    ICGetIntrinsic_Fallback(JitCode *stubCode)
+    explicit ICGetIntrinsic_Fallback(JitCode *stubCode)
       : ICMonitoredFallbackStub(ICStub::GetIntrinsic_Fallback, stubCode)
     { }
 
@@ -4020,7 +4020,7 @@ class ICGetIntrinsic_Fallback : public ICMonitoredFallbackStub
         bool generateStubCode(MacroAssembler &masm);
 
       public:
-        Compiler(JSContext *cx)
+        explicit Compiler(JSContext *cx)
           : ICStubCompiler(cx, ICStub::GetIntrinsic_Fallback)
         { }
 
@@ -4080,7 +4080,7 @@ class ICGetProp_Fallback : public ICMonitoredFallbackStub
 {
     friend class ICStubSpace;
 
-    ICGetProp_Fallback(JitCode *stubCode)
+    explicit ICGetProp_Fallback(JitCode *stubCode)
       : ICMonitoredFallbackStub(ICStub::GetProp_Fallback, stubCode)
     { }
 
@@ -4117,7 +4117,7 @@ class ICGetProp_Fallback : public ICMonitoredFallbackStub
         bool postGenerateStubCode(MacroAssembler &masm, Handle<JitCode *> code);
 
       public:
-        Compiler(JSContext *cx)
+        explicit Compiler(JSContext *cx)
           : ICStubCompiler(cx, ICStub::GetProp_Fallback)
         { }
 
@@ -4135,7 +4135,7 @@ class ICGetProp_ArrayLength : public ICStub
 {
     friend class ICStubSpace;
 
-    ICGetProp_ArrayLength(JitCode *stubCode)
+    explicit ICGetProp_ArrayLength(JitCode *stubCode)
       : ICStub(GetProp_ArrayLength, stubCode)
     {}
 
@@ -4150,7 +4150,7 @@ class ICGetProp_ArrayLength : public ICStub
         bool generateStubCode(MacroAssembler &masm);
 
       public:
-        Compiler(JSContext *cx)
+        explicit Compiler(JSContext *cx)
           : ICStubCompiler(cx, ICStub::GetProp_ArrayLength)
         {}
 
@@ -4165,7 +4165,7 @@ class ICGetProp_TypedArrayLength : public ICStub
 {
     friend class ICStubSpace;
 
-    ICGetProp_TypedArrayLength(JitCode *stubCode)
+    explicit ICGetProp_TypedArrayLength(JitCode *stubCode)
       : ICStub(GetProp_TypedArrayLength, stubCode)
     {}
 
@@ -4180,7 +4180,7 @@ class ICGetProp_TypedArrayLength : public ICStub
         bool generateStubCode(MacroAssembler &masm);
 
       public:
-        Compiler(JSContext *cx)
+        explicit Compiler(JSContext *cx)
           : ICStubCompiler(cx, ICStub::GetProp_TypedArrayLength)
         {}
 
@@ -4266,7 +4266,7 @@ class ICGetProp_StringLength : public ICStub
 {
     friend class ICStubSpace;
 
-    ICGetProp_StringLength(JitCode *stubCode)
+    explicit ICGetProp_StringLength(JitCode *stubCode)
       : ICStub(GetProp_StringLength, stubCode)
     {}
 
@@ -4281,7 +4281,7 @@ class ICGetProp_StringLength : public ICStub
         bool generateStubCode(MacroAssembler &masm);
 
       public:
-        Compiler(JSContext *cx)
+        explicit Compiler(JSContext *cx)
           : ICStubCompiler(cx, ICStub::GetProp_StringLength)
         {}
 
@@ -4967,7 +4967,7 @@ class ICGetProp_ArgumentsLength : public ICStub
     enum Which { Normal, Strict, Magic };
 
   protected:
-    ICGetProp_ArgumentsLength(JitCode *stubCode)
+    explicit ICGetProp_ArgumentsLength(JitCode *stubCode)
       : ICStub(ICStub::GetProp_ArgumentsLength, stubCode)
     { }
 
@@ -5011,7 +5011,7 @@ class ICSetProp_Fallback : public ICFallbackStub
 {
     friend class ICStubSpace;
 
-    ICSetProp_Fallback(JitCode *stubCode)
+    explicit ICSetProp_Fallback(JitCode *stubCode)
       : ICFallbackStub(ICStub::SetProp_Fallback, stubCode)
     { }
 
@@ -5039,7 +5039,7 @@ class ICSetProp_Fallback : public ICFallbackStub
         bool postGenerateStubCode(MacroAssembler &masm, Handle<JitCode *> code);
 
       public:
-        Compiler(JSContext *cx)
+        explicit Compiler(JSContext *cx)
           : ICStubCompiler(cx, ICStub::SetProp_Fallback)
         { }
 
@@ -5917,7 +5917,7 @@ class ICIteratorNew_Fallback : public ICFallbackStub
 {
     friend class ICStubSpace;
 
-    ICIteratorNew_Fallback(JitCode *stubCode)
+    explicit ICIteratorNew_Fallback(JitCode *stubCode)
       : ICFallbackStub(ICStub::IteratorNew_Fallback, stubCode)
     { }
 
@@ -5933,7 +5933,7 @@ class ICIteratorNew_Fallback : public ICFallbackStub
         bool generateStubCode(MacroAssembler &masm);
 
       public:
-        Compiler(JSContext *cx)
+        explicit Compiler(JSContext *cx)
           : ICStubCompiler(cx, ICStub::IteratorNew_Fallback)
         { }
 
@@ -5948,7 +5948,7 @@ class ICIteratorMore_Fallback : public ICFallbackStub
 {
     friend class ICStubSpace;
 
-    ICIteratorMore_Fallback(JitCode *stubCode)
+    explicit ICIteratorMore_Fallback(JitCode *stubCode)
       : ICFallbackStub(ICStub::IteratorMore_Fallback, stubCode)
     { }
 
@@ -5964,7 +5964,7 @@ class ICIteratorMore_Fallback : public ICFallbackStub
         bool generateStubCode(MacroAssembler &masm);
 
       public:
-        Compiler(JSContext *cx)
+        explicit Compiler(JSContext *cx)
           : ICStubCompiler(cx, ICStub::IteratorMore_Fallback)
         { }
 
@@ -5979,7 +5979,7 @@ class ICIteratorMore_Native : public ICStub
 {
     friend class ICStubSpace;
 
-    ICIteratorMore_Native(JitCode *stubCode)
+    explicit ICIteratorMore_Native(JitCode *stubCode)
       : ICStub(ICStub::IteratorMore_Native, stubCode)
     { }
 
@@ -5995,7 +5995,7 @@ class ICIteratorMore_Native : public ICStub
         bool generateStubCode(MacroAssembler &masm);
 
       public:
-        Compiler(JSContext *cx)
+        explicit Compiler(JSContext *cx)
           : ICStubCompiler(cx, ICStub::IteratorMore_Native)
         { }
 
@@ -6010,7 +6010,7 @@ class ICIteratorNext_Fallback : public ICFallbackStub
 {
     friend class ICStubSpace;
 
-    ICIteratorNext_Fallback(JitCode *stubCode)
+    explicit ICIteratorNext_Fallback(JitCode *stubCode)
       : ICFallbackStub(ICStub::IteratorNext_Fallback, stubCode)
     { }
 
@@ -6034,7 +6034,7 @@ class ICIteratorNext_Fallback : public ICFallbackStub
         bool generateStubCode(MacroAssembler &masm);
 
       public:
-        Compiler(JSContext *cx)
+        explicit Compiler(JSContext *cx)
           : ICStubCompiler(cx, ICStub::IteratorNext_Fallback)
         { }
 
@@ -6049,7 +6049,7 @@ class ICIteratorNext_Native : public ICStub
 {
     friend class ICStubSpace;
 
-    ICIteratorNext_Native(JitCode *stubCode)
+    explicit ICIteratorNext_Native(JitCode *stubCode)
       : ICStub(ICStub::IteratorNext_Native, stubCode)
     { }
 
@@ -6065,7 +6065,7 @@ class ICIteratorNext_Native : public ICStub
         bool generateStubCode(MacroAssembler &masm);
 
       public:
-        Compiler(JSContext *cx)
+        explicit Compiler(JSContext *cx)
           : ICStubCompiler(cx, ICStub::IteratorNext_Native)
         { }
 
@@ -6080,7 +6080,7 @@ class ICIteratorClose_Fallback : public ICFallbackStub
 {
     friend class ICStubSpace;
 
-    ICIteratorClose_Fallback(JitCode *stubCode)
+    explicit ICIteratorClose_Fallback(JitCode *stubCode)
       : ICFallbackStub(ICStub::IteratorClose_Fallback, stubCode)
     { }
 
@@ -6096,7 +6096,7 @@ class ICIteratorClose_Fallback : public ICFallbackStub
         bool generateStubCode(MacroAssembler &masm);
 
       public:
-        Compiler(JSContext *cx)
+        explicit Compiler(JSContext *cx)
           : ICStubCompiler(cx, ICStub::IteratorClose_Fallback)
         { }
 
@@ -6112,7 +6112,7 @@ class ICInstanceOf_Fallback : public ICFallbackStub
 {
     friend class ICStubSpace;
 
-    ICInstanceOf_Fallback(JitCode *stubCode)
+    explicit ICInstanceOf_Fallback(JitCode *stubCode)
       : ICFallbackStub(ICStub::InstanceOf_Fallback, stubCode)
     { }
 
@@ -6128,7 +6128,7 @@ class ICInstanceOf_Fallback : public ICFallbackStub
         bool generateStubCode(MacroAssembler &masm);
 
       public:
-        Compiler(JSContext *cx)
+        explicit Compiler(JSContext *cx)
           : ICStubCompiler(cx, ICStub::InstanceOf_Fallback)
         { }
 
@@ -6145,7 +6145,7 @@ class ICTypeOf_Fallback : public ICFallbackStub
 {
     friend class ICStubSpace;
 
-    ICTypeOf_Fallback(JitCode *stubCode)
+    explicit ICTypeOf_Fallback(JitCode *stubCode)
       : ICFallbackStub(ICStub::TypeOf_Fallback, stubCode)
     { }
 
@@ -6161,7 +6161,7 @@ class ICTypeOf_Fallback : public ICFallbackStub
         bool generateStubCode(MacroAssembler &masm);
 
       public:
-        Compiler(JSContext *cx)
+        explicit Compiler(JSContext *cx)
           : ICStubCompiler(cx, ICStub::TypeOf_Fallback)
         { }
 
@@ -6262,7 +6262,7 @@ class ICRetSub_Fallback : public ICFallbackStub
 {
     friend class ICStubSpace;
 
-    ICRetSub_Fallback(JitCode *stubCode)
+    explicit ICRetSub_Fallback(JitCode *stubCode)
       : ICFallbackStub(ICStub::RetSub_Fallback, stubCode)
     { }
 
@@ -6280,7 +6280,7 @@ class ICRetSub_Fallback : public ICFallbackStub
         bool generateStubCode(MacroAssembler &masm);
 
       public:
-        Compiler(JSContext *cx)
+        explicit Compiler(JSContext *cx)
           : ICStubCompiler(cx, ICStub::RetSub_Fallback)
         { }
 
diff --git a/js/src/jit/BaselineInspector.h b/js/src/jit/BaselineInspector.h
index 083c429d950a..4dfcf8179e20 100644
--- a/js/src/jit/BaselineInspector.h
+++ b/js/src/jit/BaselineInspector.h
@@ -50,7 +50,7 @@ class BaselineInspector
     ICEntry *prevLookedUpEntry;
 
   public:
-    BaselineInspector(JSScript *script)
+    explicit BaselineInspector(JSScript *script)
       : script(script), prevLookedUpEntry(nullptr)
     {
         JS_ASSERT(script);
diff --git a/js/src/jit/BaselineJIT.cpp b/js/src/jit/BaselineJIT.cpp
index ac1c6c9f0668..ebe3674395bc 100644
--- a/js/src/jit/BaselineJIT.cpp
+++ b/js/src/jit/BaselineJIT.cpp
@@ -783,7 +783,7 @@ BaselineScript::toggleDebugTraps(JSScript *script, jsbytecode *pc)
                     script->hasBreakpointsAt(curPC);
 
                 // Patch the trap.
-                CodeLocationLabel label(method(), nativeOffset);
+                CodeLocationLabel label(method(), CodeOffsetLabel(nativeOffset));
                 Assembler::ToggleCall(label, enabled);
             }
 
diff --git a/js/src/jit/BitSet.h b/js/src/jit/BitSet.h
index b6bab6ec06bb..e018de4f188c 100644
--- a/js/src/jit/BitSet.h
+++ b/js/src/jit/BitSet.h
@@ -28,7 +28,7 @@ class BitSet : private TempObject
     }
 
   private:
-    BitSet(unsigned int numBits) :
+    explicit BitSet(unsigned int numBits) :
         bits_(nullptr),
         numBits_(numBits) {}
 
@@ -144,7 +144,7 @@ class BitSet::Iterator
     }
 
   public:
-    Iterator(BitSet &set) :
+    explicit Iterator(BitSet &set) :
       set_(set),
       index_(0),
       word_(0),
diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index 1a3ea180af90..d03cd93239c8 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -2866,7 +2866,7 @@ class CheckOverRecursedFailure : public OutOfLineCodeBase<CodeGenerator>
     LCheckOverRecursed *lir_;
 
   public:
-    CheckOverRecursedFailure(LCheckOverRecursed *lir)
+    explicit CheckOverRecursedFailure(LCheckOverRecursed *lir)
       : lir_(lir)
     { }
 
@@ -2973,7 +2973,7 @@ class CheckOverRecursedFailurePar : public OutOfLineCodeBase<CodeGenerator>
     LCheckOverRecursedPar *lir_;
 
   public:
-    CheckOverRecursedFailurePar(LCheckOverRecursedPar *lir)
+    explicit CheckOverRecursedFailurePar(LCheckOverRecursedPar *lir)
       : lir_(lir)
     { }
 
@@ -3047,7 +3047,7 @@ class OutOfLineInterruptCheckPar : public OutOfLineCodeBase<CodeGenerator>
   public:
     LInterruptCheckPar *const lir;
 
-    OutOfLineInterruptCheckPar(LInterruptCheckPar *lir)
+    explicit OutOfLineInterruptCheckPar(LInterruptCheckPar *lir)
       : lir(lir)
     { }
 
@@ -3450,7 +3450,7 @@ class OutOfLineNewArray : public OutOfLineCodeBase<CodeGenerator>
     LNewArray *lir_;
 
   public:
-    OutOfLineNewArray(LNewArray *lir)
+    explicit OutOfLineNewArray(LNewArray *lir)
       : lir_(lir)
     { }
 
@@ -3583,7 +3583,7 @@ class OutOfLineNewObject : public OutOfLineCodeBase<CodeGenerator>
     LNewObject *lir_;
 
   public:
-    OutOfLineNewObject(LNewObject *lir)
+    explicit OutOfLineNewObject(LNewObject *lir)
       : lir_(lir)
     { }
 
@@ -5593,7 +5593,7 @@ class OutOfLineStoreElementHole : public OutOfLineCodeBase<CodeGenerator>
     Label rejoinStore_;
 
   public:
-    OutOfLineStoreElementHole(LInstruction *ins)
+    explicit OutOfLineStoreElementHole(LInstruction *ins)
       : ins_(ins)
     {
         JS_ASSERT(ins->isStoreElementHoleV() || ins->isStoreElementHoleT());
@@ -6734,7 +6734,7 @@ class OutOfLineUnboxFloatingPoint : public OutOfLineCodeBase<CodeGenerator>
     LUnboxFloatingPoint *unboxFloatingPoint_;
 
   public:
-    OutOfLineUnboxFloatingPoint(LUnboxFloatingPoint *unboxFloatingPoint)
+    explicit OutOfLineUnboxFloatingPoint(LUnboxFloatingPoint *unboxFloatingPoint)
       : unboxFloatingPoint_(unboxFloatingPoint)
     { }
 
@@ -7524,7 +7524,7 @@ class OutOfLineTypeOfV : public OutOfLineCodeBase<CodeGenerator>
     LTypeOfV *ins_;
 
   public:
-    OutOfLineTypeOfV(LTypeOfV *ins)
+    explicit OutOfLineTypeOfV(LTypeOfV *ins)
       : ins_(ins)
     { }
 
@@ -8485,7 +8485,7 @@ CodeGenerator::visitAsmJSCall(LAsmJSCall *ins)
         masm.call(mir->desc(), ToRegister(ins->getOperand(mir->dynamicCalleeOperandIndex())));
         break;
       case MAsmJSCall::Callee::Builtin:
-        masm.call(mir->desc(), callee.builtin());
+        masm.call(mir->desc(), AsmJSImmPtr(callee.builtin()));
         break;
     }
 
diff --git a/js/src/jit/CompactBuffer.h b/js/src/jit/CompactBuffer.h
index 8481b8d18e0b..9c9e07158be3 100644
--- a/js/src/jit/CompactBuffer.h
+++ b/js/src/jit/CompactBuffer.h
@@ -51,7 +51,7 @@ class CompactBufferReader
       : buffer_(start),
         end_(end)
     { }
-    inline CompactBufferReader(const CompactBufferWriter &writer);
+    inline explicit CompactBufferReader(const CompactBufferWriter &writer);
     uint8_t readByte() {
         JS_ASSERT(buffer_ < end_);
         return *buffer_++;
diff --git a/js/src/jit/CompileWrappers.h b/js/src/jit/CompileWrappers.h
index 16e738f43d9d..9211dc02b429 100644
--- a/js/src/jit/CompileWrappers.h
+++ b/js/src/jit/CompileWrappers.h
@@ -128,7 +128,7 @@ class JitCompileOptions
 {
   public:
     JitCompileOptions();
-    JitCompileOptions(JSContext *cx);
+    explicit JitCompileOptions(JSContext *cx);
 
     bool cloneSingletons() const {
         return cloneSingletons_;
diff --git a/js/src/jit/CompilerRoot.h b/js/src/jit/CompilerRoot.h
index 4b3f2e34b722..f8b48c80d20d 100644
--- a/js/src/jit/CompilerRoot.h
+++ b/js/src/jit/CompilerRoot.h
@@ -25,7 +25,7 @@ template <typename T>
 class CompilerRoot : public CompilerRootNode
 {
   public:
-    CompilerRoot(T ptr)
+    explicit CompilerRoot(T ptr)
       : CompilerRootNode(nullptr)
     {
         if (ptr) {
diff --git a/js/src/jit/EffectiveAddressAnalysis.h b/js/src/jit/EffectiveAddressAnalysis.h
index f678d6aa4a16..00a0aa416544 100644
--- a/js/src/jit/EffectiveAddressAnalysis.h
+++ b/js/src/jit/EffectiveAddressAnalysis.h
@@ -17,7 +17,7 @@ class EffectiveAddressAnalysis
     MIRGraph &graph_;
 
   public:
-    EffectiveAddressAnalysis(MIRGraph &graph)
+    explicit EffectiveAddressAnalysis(MIRGraph &graph)
       : graph_(graph)
     {}
 
diff --git a/js/src/jit/InlineList.h b/js/src/jit/InlineList.h
index 195d11d14816..a02986b24eb4 100644
--- a/js/src/jit/InlineList.h
+++ b/js/src/jit/InlineList.h
@@ -20,7 +20,7 @@ class InlineForwardListNode
   public:
     InlineForwardListNode() : next(nullptr)
     { }
-    InlineForwardListNode(InlineForwardListNode<T> *n) : next(n)
+    explicit InlineForwardListNode(InlineForwardListNode<T> *n) : next(n)
     { }
 
   protected:
@@ -155,7 +155,7 @@ private:
 
     typedef InlineForwardListNode<T> Node;
 
-    InlineForwardListIterator<T>(const InlineForwardList<T> *owner)
+    explicit InlineForwardListIterator<T>(const InlineForwardList<T> *owner)
       : prev(const_cast<Node *>(static_cast<const Node *>(owner))),
         iter(owner ? owner->next : nullptr)
 #ifdef DEBUG
@@ -328,7 +328,7 @@ class InlineListIterator
 
     typedef InlineListNode<T> Node;
 
-    InlineListIterator(const Node *iter)
+    explicit InlineListIterator(const Node *iter)
       : iter(const_cast<Node *>(iter))
     { }
 
@@ -372,7 +372,7 @@ class InlineListReverseIterator
 
     typedef InlineListNode<T> Node;
 
-    InlineListReverseIterator(const Node *iter)
+    explicit InlineListReverseIterator(const Node *iter)
       : iter(const_cast<Node *>(iter))
     { }
 
@@ -458,7 +458,7 @@ class InlineConcatListIterator
 
     typedef InlineConcatList<T> Node;
 
-    InlineConcatListIterator(const Node *iter)
+    explicit InlineConcatListIterator(const Node *iter)
       : iter(const_cast<Node *>(iter))
     { }
 
diff --git a/js/src/jit/Ion.cpp b/js/src/jit/Ion.cpp
index 7d7e85727e61..8086b4d882b2 100644
--- a/js/src/jit/Ion.cpp
+++ b/js/src/jit/Ion.cpp
@@ -496,14 +496,14 @@ bool
 JitCompartment::ensureIonStubsExist(JSContext *cx)
 {
     if (!stringConcatStub_) {
-        stringConcatStub_ = generateStringConcatStub(cx, SequentialExecution);
+        stringConcatStub_.set(generateStringConcatStub(cx, SequentialExecution));
         if (!stringConcatStub_)
             return false;
     }
 
 #ifdef JS_THREADSAFE
     if (!parallelStringConcatStub_) {
-        parallelStringConcatStub_ = generateStringConcatStub(cx, ParallelExecution);
+        parallelStringConcatStub_.set(generateStringConcatStub(cx, ParallelExecution));
         if (!parallelStringConcatStub_)
             return false;
     }
@@ -645,10 +645,10 @@ JitCompartment::sweep(FreeOp *fop)
         baselineSetPropReturnAddr_ = nullptr;
 
     if (stringConcatStub_ && !IsJitCodeMarked(stringConcatStub_.unsafeGet()))
-        stringConcatStub_ = nullptr;
+        stringConcatStub_.set(nullptr);
 
     if (parallelStringConcatStub_ && !IsJitCodeMarked(parallelStringConcatStub_.unsafeGet()))
-        parallelStringConcatStub_ = nullptr;
+        parallelStringConcatStub_.set(nullptr);
 
     if (activeParallelEntryScripts_) {
         for (ScriptSet::Enum e(*activeParallelEntryScripts_); !e.empty(); e.popFront()) {
@@ -778,7 +778,7 @@ JitCode::togglePreBarriers(bool enabled)
 
     while (reader.more()) {
         size_t offset = reader.readUnsigned();
-        CodeLocationLabel loc(this, offset);
+        CodeLocationLabel loc(this, CodeOffsetLabel(offset));
         if (enabled)
             Assembler::ToggleToCmp(loc);
         else
@@ -2634,7 +2634,7 @@ InvalidateActivation(FreeOp *fop, uint8_t *jitTop, bool invalidateAll)
         Assembler::patchWrite_Imm32(dataLabelToMunge, Imm32(delta));
 
         CodeLocationLabel osiPatchPoint = SafepointReader::InvalidationPatchPoint(ionScript, si);
-        CodeLocationLabel invalidateEpilogue(ionCode, ionScript->invalidateEpilogueOffset());
+        CodeLocationLabel invalidateEpilogue(ionCode, CodeOffsetLabel(ionScript->invalidateEpilogueOffset()));
 
         IonSpew(IonSpew_Invalidate, "   ! Invalidate ionScript %p (ref %u) -> patching osipoint %p",
                 ionScript, ionScript->refcount(), (void *) osiPatchPoint.raw());
@@ -3017,10 +3017,12 @@ AutoFlushICache::setInhibit()
 // the respective AutoFlushICache dynamic context.
 //
 AutoFlushICache::AutoFlushICache(const char *nonce, bool inhibit)
+#if defined(JS_CODEGEN_ARM) || defined(JS_CODEGEN_MIPS)
   : start_(0),
     stop_(0),
     name_(nonce),
     inhibit_(inhibit)
+#endif
 {
 #if defined(JS_CODEGEN_ARM) || defined(JS_CODEGEN_MIPS)
     PerThreadData *pt = TlsPerThreadData.get();
diff --git a/js/src/jit/Ion.h b/js/src/jit/Ion.h
index 08bb1462da66..55a6a16586bd 100644
--- a/js/src/jit/Ion.h
+++ b/js/src/jit/Ion.h
@@ -50,7 +50,7 @@ class IonContext
     IonContext(JSContext *cx, TempAllocator *temp);
     IonContext(ExclusiveContext *cx, TempAllocator *temp);
     IonContext(CompileRuntime *rt, CompileCompartment *comp, TempAllocator *temp);
-    IonContext(CompileRuntime *rt);
+    explicit IonContext(CompileRuntime *rt);
     ~IonContext();
 
     // Running context when executing on the main thread. Not available during
diff --git a/js/src/jit/IonAllocPolicy.h b/js/src/jit/IonAllocPolicy.h
index fb60b53012e4..1c9ed9045998 100644
--- a/js/src/jit/IonAllocPolicy.h
+++ b/js/src/jit/IonAllocPolicy.h
@@ -27,7 +27,7 @@ class TempAllocator
     CompilerRootNode *rootList_;
 
   public:
-    TempAllocator(LifoAlloc *lifoAlloc)
+    explicit TempAllocator(LifoAlloc *lifoAlloc)
       : lifoScope_(lifoAlloc),
         rootList_(nullptr)
     { }
@@ -97,7 +97,7 @@ class IonAllocPolicy
     TempAllocator &alloc_;
 
   public:
-    IonAllocPolicy(TempAllocator &alloc)
+    MOZ_IMPLICIT IonAllocPolicy(TempAllocator &alloc)
       : alloc_(alloc)
     {}
     void *malloc_(size_t bytes) {
diff --git a/js/src/jit/IonAnalysis.h b/js/src/jit/IonAnalysis.h
index 1b12c7b68d0b..509f9ae9137b 100644
--- a/js/src/jit/IonAnalysis.h
+++ b/js/src/jit/IonAnalysis.h
@@ -99,7 +99,7 @@ struct LinearTerm
 class LinearSum
 {
   public:
-    LinearSum(TempAllocator &alloc)
+    explicit LinearSum(TempAllocator &alloc)
       : terms_(alloc),
         constant_(0)
     {
diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index e42523675392..9fbf2be9a6db 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -45,7 +45,7 @@ class jit::BaselineFrameInspector
     Vector<types::Type, 4, IonAllocPolicy> argTypes;
     Vector<types::Type, 4, IonAllocPolicy> varTypes;
 
-    BaselineFrameInspector(TempAllocator *temp)
+    explicit BaselineFrameInspector(TempAllocator *temp)
       : thisType(types::Type::UndefinedType()),
         singletonScopeChain(nullptr),
         argTypes(*temp),
@@ -8376,7 +8376,7 @@ IonBuilder::freezePropertiesForCommonPrototype(types::TemporaryTypeSet *types, P
             // Don't mark the proto. It will be held down by the shape
             // guard. This allows us to use properties found on prototypes
             // with properties unknown to TI.
-            if (type->proto() == foundProto)
+            if (type->proto() == TaggedProto(foundProto))
                 break;
             type = types::TypeObjectKey::get(type->proto().toObjectOrNull());
         }
diff --git a/js/src/jit/IonCaches.cpp b/js/src/jit/IonCaches.cpp
index 621f1c3cb404..3fc303a7a4aa 100644
--- a/js/src/jit/IonCaches.cpp
+++ b/js/src/jit/IonCaches.cpp
@@ -172,7 +172,7 @@ class IonCache::StubAttacher
     CodeOffsetLabel stubCodePatchOffset_;
 
   public:
-    StubAttacher(CodeLocationLabel rejoinLabel)
+    explicit StubAttacher(CodeLocationLabel rejoinLabel)
       : hasNextStubOffset_(false),
         hasStubCodePatchOffset_(false),
         rejoinLabel_(rejoinLabel),
@@ -261,7 +261,7 @@ class RepatchIonCache::RepatchStubAppender : public IonCache::StubAttacher
     RepatchIonCache &cache_;
 
   public:
-    RepatchStubAppender(RepatchIonCache &cache)
+    explicit RepatchStubAppender(RepatchIonCache &cache)
       : StubAttacher(cache.rejoinLabel()),
         cache_(cache)
     {
@@ -321,7 +321,7 @@ class DispatchIonCache::DispatchStubPrepender : public IonCache::StubAttacher
     DispatchIonCache &cache_;
 
   public:
-    DispatchStubPrepender(DispatchIonCache &cache)
+    explicit DispatchStubPrepender(DispatchIonCache &cache)
       : StubAttacher(cache.rejoinLabel_),
         cache_(cache)
     {
diff --git a/js/src/jit/IonCode.h b/js/src/jit/IonCode.h
index b56535c4ddd6..485d18160bc4 100644
--- a/js/src/jit/IonCode.h
+++ b/js/src/jit/IonCode.h
@@ -777,18 +777,20 @@ class JitRuntime;
 struct AutoFlushICache
 {
   private:
+#if defined(JS_CODEGEN_ARM) || defined(JS_CODEGEN_MIPS)
     uintptr_t start_;
     uintptr_t stop_;
     const char *name_;
     bool inhibit_;
     AutoFlushICache *prev_;
+#endif
 
   public:
     static void setRange(uintptr_t p, size_t len);
     static void flush(uintptr_t p, size_t len);
     static void setInhibit();
     ~AutoFlushICache();
-    AutoFlushICache(const char *nonce, bool inhibit=false);
+    explicit AutoFlushICache(const char *nonce, bool inhibit=false);
 };
 
 } // namespace jit
diff --git a/js/src/jit/IonFrames.cpp b/js/src/jit/IonFrames.cpp
index d4ade5011697..162c441765b3 100644
--- a/js/src/jit/IonFrames.cpp
+++ b/js/src/jit/IonFrames.cpp
@@ -557,7 +557,7 @@ HandleExceptionBaseline(JSContext *cx, const JitFrameIterator &frame, ResumeFrom
 struct AutoDeleteDebugModeOSRInfo
 {
     BaselineFrame *frame;
-    AutoDeleteDebugModeOSRInfo(BaselineFrame *frame) : frame(frame) { MOZ_ASSERT(frame); }
+    explicit AutoDeleteDebugModeOSRInfo(BaselineFrame *frame) : frame(frame) { MOZ_ASSERT(frame); }
     ~AutoDeleteDebugModeOSRInfo() { frame->deleteDebugModeOSRInfo(); }
 };
 
@@ -1864,7 +1864,7 @@ SnapshotIterator::warnUnreadableAllocation()
 }
 
 struct DumpOp {
-    DumpOp(unsigned int i) : i_(i) {}
+    explicit DumpOp(unsigned int i) : i_(i) {}
 
     unsigned int i_;
     void operator()(const Value& v) {
diff --git a/js/src/jit/IonLinker.h b/js/src/jit/IonLinker.h
index 6e85f6ffd8fd..760cdc5839c4 100644
--- a/js/src/jit/IonLinker.h
+++ b/js/src/jit/IonLinker.h
@@ -70,7 +70,7 @@ class Linker
     }
 
   public:
-    Linker(MacroAssembler &masm)
+    explicit Linker(MacroAssembler &masm)
       : masm(masm)
     {
         masm.finish();
diff --git a/js/src/jit/IonMacroAssembler.cpp b/js/src/jit/IonMacroAssembler.cpp
index 6872bbe1bd96..5627327e1f53 100644
--- a/js/src/jit/IonMacroAssembler.cpp
+++ b/js/src/jit/IonMacroAssembler.cpp
@@ -39,7 +39,7 @@ class TypeWrapper {
     types::Type t_;
 
   public:
-    TypeWrapper(types::Type t) : t_(t) {}
+    explicit TypeWrapper(types::Type t) : t_(t) {}
 
     inline bool unknown() const {
         return t_.isUnknown();
@@ -892,6 +892,24 @@ MacroAssembler::checkInterruptFlagPar(Register tempReg, Label *fail)
 #endif
 }
 
+// Save an exit frame (which must be aligned to the stack pointer) to
+// PerThreadData::jitTop of the main thread.
+void
+MacroAssembler::linkExitFrame()
+{
+    AbsoluteAddress jitTop(GetIonContext()->runtime->addressOfJitTop());
+    storePtr(StackPointer, jitTop);
+}
+
+// Save an exit frame to the thread data of the current thread, given a
+// register that holds a PerThreadData *.
+void
+MacroAssembler::linkParallelExitFrame(Register pt)
+{
+    Address jitTop(pt, offsetof(PerThreadData, jitTop));
+    storePtr(StackPointer, jitTop);
+}
+
 static void
 ReportOverRecursed(JSContext *cx)
 {
@@ -1924,10 +1942,10 @@ MacroAssembler::spsMarkJit(SPSProfiler *p, Register framePtr, Register temp)
     // and won't be regenerated when SPS state changes.
     spsProfileEntryAddressSafe(p, 0, temp, &stackFull);
 
-    storePtr(ImmPtr(enterJitLabel), Address(temp, ProfileEntry::offsetOfLabel()));
-    storePtr(framePtr,              Address(temp, ProfileEntry::offsetOfSpOrScript()));
-    store32(Imm32(ProfileEntry::NullPCOffset), Address(temp, ProfileEntry::offsetOfLineOrPc()));
-    store32(Imm32(ProfileEntry::IS_CPP_ENTRY), Address(temp, ProfileEntry::offsetOfFlags()));
+    storePtr(ImmPtr(enterJitLabel), Address(temp, ProfileEntry::offsetOfString()));
+    storePtr(framePtr,              Address(temp, ProfileEntry::offsetOfStackAddress()));
+    storePtr(ImmWord(uintptr_t(0)), Address(temp, ProfileEntry::offsetOfScript()));
+    store32(Imm32(ProfileEntry::NullPCIndex), Address(temp, ProfileEntry::offsetOfPCIdx()));
 
     /* Always increment the stack size, whether or not we actually pushed. */
     bind(&stackFull);
diff --git a/js/src/jit/IonMacroAssembler.h b/js/src/jit/IonMacroAssembler.h
index ca6257e429b0..e77a42c5715b 100644
--- a/js/src/jit/IonMacroAssembler.h
+++ b/js/src/jit/IonMacroAssembler.h
@@ -224,8 +224,8 @@ class MacroAssembler : public MacroAssemblerSpecific
 
     // This constructor should only be used when there is no IonContext active
     // (for example, Trampoline-$(ARCH).cpp and IonCaches.cpp).
-    MacroAssembler(JSContext *cx, IonScript *ion = nullptr,
-                   JSScript *script = nullptr, jsbytecode *pc = nullptr)
+    explicit MacroAssembler(JSContext *cx, IonScript *ion = nullptr,
+                            JSScript *script = nullptr, jsbytecode *pc = nullptr)
       : enoughMemory_(true),
         embedsNurseryPointers_(false),
         sps_(nullptr)
@@ -253,7 +253,7 @@ class MacroAssembler : public MacroAssemblerSpecific
 
     // asm.js compilation handles its own IonContet-pushing
     struct AsmJSToken {};
-    MacroAssembler(AsmJSToken)
+    explicit MacroAssembler(AsmJSToken)
       : enoughMemory_(true),
         embedsNurseryPointers_(false),
         sps_(nullptr)
@@ -850,6 +850,10 @@ class MacroAssembler : public MacroAssemblerSpecific
   private:
     CodeOffsetLabel exitCodePatch_;
 
+  private:
+    void linkExitFrame();
+    void linkParallelExitFrame(Register pt);
+
   public:
     void enterExitFrame(const VMFunction *f = nullptr) {
         linkExitFrame();
@@ -1012,14 +1016,9 @@ class MacroAssembler : public MacroAssemblerSpecific
             add32(Imm32(offset), temp);
         branch32(Assembler::GreaterThanOrEqual, temp, Imm32(p->maxSize()), full);
 
-        JS_STATIC_ASSERT(sizeof(ProfileEntry) == (2 * sizeof(void *)) + 8);
-        if (sizeof(void *) == 4) {
-            lshiftPtr(Imm32(4), temp);
-        } else {
-            lshiftPtr(Imm32(3), temp);
-            mulBy3(temp, temp);
-        }
-
+        // 4 * sizeof(void*) * idx = idx << (2 + log(sizeof(void*)))
+        JS_STATIC_ASSERT(sizeof(ProfileEntry) == 4 * sizeof(void*));
+        lshiftPtr(Imm32(2 + (sizeof(void*) == 4 ? 2 : 3)), temp);
         addPtr(ImmPtr(p->stack()), temp);
     }
 
@@ -1043,14 +1042,9 @@ class MacroAssembler : public MacroAssemblerSpecific
         // Test against max size.
         branch32(Assembler::LessThanOrEqual, AbsoluteAddress(p->addressOfMaxSize()), temp, full);
 
-        JS_STATIC_ASSERT(sizeof(ProfileEntry) == (2 * sizeof(void *)) + 8);
-        if (sizeof(void *) == 4) {
-            lshiftPtr(Imm32(4), temp);
-        } else {
-            lshiftPtr(Imm32(3), temp);
-            mulBy3(temp, temp);
-        }
-
+        // 4 * sizeof(void*) * idx = idx << (2 + log(sizeof(void*)))
+        JS_STATIC_ASSERT(sizeof(ProfileEntry) == 4 * sizeof(void*));
+        lshiftPtr(Imm32(2 + (sizeof(void*) == 4 ? 2 : 3)), temp);
         push(temp);
         loadPtr(AbsoluteAddress(p->addressOfStack()), temp);
         addPtr(Address(StackPointer, 0), temp);
@@ -1065,14 +1059,14 @@ class MacroAssembler : public MacroAssemblerSpecific
     void spsUpdatePCIdx(SPSProfiler *p, int32_t idx, Register temp) {
         Label stackFull;
         spsProfileEntryAddress(p, -1, temp, &stackFull);
-        store32(Imm32(idx), Address(temp, ProfileEntry::offsetOfLineOrPc()));
+        store32(Imm32(idx), Address(temp, ProfileEntry::offsetOfPCIdx()));
         bind(&stackFull);
     }
 
     void spsUpdatePCIdx(SPSProfiler *p, Register idx, Register temp) {
         Label stackFull;
         spsProfileEntryAddressSafe(p, -1, temp, &stackFull);
-        store32(idx, Address(temp, ProfileEntry::offsetOfLineOrPc()));
+        store32(idx, Address(temp, ProfileEntry::offsetOfPCIdx()));
         bind(&stackFull);
     }
 
@@ -1081,10 +1075,11 @@ class MacroAssembler : public MacroAssemblerSpecific
         Label stackFull;
         spsProfileEntryAddress(p, 0, temp, &stackFull);
 
-        storePtr(ImmPtr(str), Address(temp, ProfileEntry::offsetOfLabel()));
-        storePtr(ImmGCPtr(s), Address(temp, ProfileEntry::offsetOfSpOrScript()));
-        store32(Imm32(ProfileEntry::NullPCOffset), Address(temp, ProfileEntry::offsetOfLineOrPc()));
-        store32(Imm32(0), Address(temp, ProfileEntry::offsetOfFlags()));
+        storePtr(ImmPtr(str),  Address(temp, ProfileEntry::offsetOfString()));
+        storePtr(ImmGCPtr(s),  Address(temp, ProfileEntry::offsetOfScript()));
+        storePtr(ImmPtr((void*) ProfileEntry::SCRIPT_OPT_STACKPOINTER),
+                 Address(temp, ProfileEntry::offsetOfStackAddress()));
+        store32(Imm32(ProfileEntry::NullPCIndex), Address(temp, ProfileEntry::offsetOfPCIdx()));
 
         /* Always increment the stack size, whether or not we actually pushed. */
         bind(&stackFull);
@@ -1100,16 +1095,17 @@ class MacroAssembler : public MacroAssemblerSpecific
         spsProfileEntryAddressSafe(p, 0, temp, &stackFull);
 
         loadPtr(str, temp2);
-        storePtr(temp2, Address(temp, ProfileEntry::offsetOfLabel()));
+        storePtr(temp2, Address(temp, ProfileEntry::offsetOfString()));
 
         loadPtr(script, temp2);
-        storePtr(temp2, Address(temp, ProfileEntry::offsetOfSpOrScript()));
+        storePtr(temp2, Address(temp, ProfileEntry::offsetOfScript()));
+
+        storePtr(ImmPtr(nullptr), Address(temp, ProfileEntry::offsetOfStackAddress()));
 
         // Store 0 for PCIdx because that's what interpreter does.
         // (See probes::EnterScript, which calls spsProfiler.enter, which pushes an entry
         //  with 0 pcIdx).
-        store32(Imm32(0), Address(temp, ProfileEntry::offsetOfLineOrPc()));
-        store32(Imm32(0), Address(temp, ProfileEntry::offsetOfFlags()));
+        store32(Imm32(0), Address(temp, ProfileEntry::offsetOfPCIdx()));
 
         /* Always increment the stack size, whether or not we actually pushed. */
         bind(&stackFull);
@@ -1390,7 +1386,7 @@ class MacroAssembler : public MacroAssemblerSpecific
   public:
     class AfterICSaveLive {
         friend class MacroAssembler;
-        AfterICSaveLive(uint32_t initialStack)
+        explicit AfterICSaveLive(uint32_t initialStack)
 #ifdef JS_DEBUG
           : initialStack(initialStack)
 #endif
diff --git a/js/src/jit/JitFrameIterator.h b/js/src/jit/JitFrameIterator.h
index c10b736c8cec..0d9589d2b4bd 100644
--- a/js/src/jit/JitFrameIterator.h
+++ b/js/src/jit/JitFrameIterator.h
@@ -367,8 +367,8 @@ class SnapshotIterator
 
     SnapshotIterator(IonScript *ionScript, SnapshotOffset snapshotOffset,
                      IonJSFrameLayout *fp, const MachineState &machine);
-    SnapshotIterator(const JitFrameIterator &iter);
-    SnapshotIterator(const IonBailoutIterator &iter);
+    explicit SnapshotIterator(const JitFrameIterator &iter);
+    explicit SnapshotIterator(const IonBailoutIterator &iter);
     SnapshotIterator();
 
     Value read() {
diff --git a/js/src/jit/LIR-Common.h b/js/src/jit/LIR-Common.h
index 19cc5b54091f..7062e3d04a89 100644
--- a/js/src/jit/LIR-Common.h
+++ b/js/src/jit/LIR-Common.h
@@ -101,7 +101,7 @@ class LMoveGroup : public LInstructionHelper<0, 0, 0>
 {
     js::Vector<LMove, 2, IonAllocPolicy> moves_;
 
-    LMoveGroup(TempAllocator &alloc)
+    explicit LMoveGroup(TempAllocator &alloc)
       : moves_(alloc)
     { }
 
@@ -136,7 +136,7 @@ class LInteger : public LInstructionHelper<1, 0, 0>
   public:
     LIR_HEADER(Integer)
 
-    LInteger(int32_t i32)
+    explicit LInteger(int32_t i32)
       : i32_(i32)
     { }
 
@@ -161,7 +161,7 @@ class LPointer : public LInstructionHelper<1, 0, 0>
   public:
     LIR_HEADER(Pointer)
 
-    LPointer(gc::Cell *ptr)
+    explicit LPointer(gc::Cell *ptr)
       : ptr_(ptr), kind_(GC_THING)
     { }
 
@@ -192,7 +192,7 @@ class LDouble : public LInstructionHelper<1, 0, 0>
   public:
     LIR_HEADER(Double);
 
-    LDouble(double d) : d_(d)
+    explicit LDouble(double d) : d_(d)
     { }
     double getDouble() const {
         return d_;
@@ -206,7 +206,7 @@ class LFloat32 : public LInstructionHelper<1, 0, 0>
   public:
     LIR_HEADER(Float32);
 
-    LFloat32(float f)
+    explicit LFloat32(float f)
       : f_(f)
     { }
 
@@ -223,7 +223,7 @@ class LValue : public LInstructionHelper<BOX_PIECES, 0, 0>
   public:
     LIR_HEADER(Value)
 
-    LValue(const Value &v)
+    explicit LValue(const Value &v)
       : v_(v)
     { }
 
@@ -239,7 +239,7 @@ class LCloneLiteral : public LCallInstructionHelper<1, 1, 0>
   public:
     LIR_HEADER(CloneLiteral)
 
-    LCloneLiteral(const LAllocation &obj)
+    explicit LCloneLiteral(const LAllocation &obj)
     {
         setOperand(0, obj);
     }
@@ -292,7 +292,7 @@ class LGoto : public LControlInstructionHelper<1, 0, 0>
   public:
     LIR_HEADER(Goto)
 
-    LGoto(MBasicBlock *block)
+    explicit LGoto(MBasicBlock *block)
     {
          setSuccessor(0, block);
     }
@@ -307,7 +307,7 @@ class LNewArray : public LInstructionHelper<1, 0, 1>
   public:
     LIR_HEADER(NewArray)
 
-    LNewArray(const LDefinition &temp) {
+    explicit LNewArray(const LDefinition &temp) {
         setTemp(0, temp);
     }
 
@@ -329,7 +329,7 @@ class LNewObject : public LInstructionHelper<1, 0, 1>
   public:
     LIR_HEADER(NewObject)
 
-    LNewObject(const LDefinition &temp) {
+    explicit LNewObject(const LDefinition &temp) {
         setTemp(0, temp);
     }
 
@@ -425,7 +425,7 @@ class LNewDeclEnvObject : public LInstructionHelper<1, 0, 1>
   public:
     LIR_HEADER(NewDeclEnvObject);
 
-    LNewDeclEnvObject(const LDefinition &temp) {
+    explicit LNewDeclEnvObject(const LDefinition &temp) {
         setTemp(0, temp);
     }
 
@@ -450,7 +450,7 @@ class LNewCallObject : public LInstructionHelper<1, 0, 1>
   public:
     LIR_HEADER(NewCallObject)
 
-    LNewCallObject(const LDefinition &temp) {
+    explicit LNewCallObject(const LDefinition &temp) {
         setTemp(0, temp);
     }
 
@@ -476,7 +476,7 @@ class LNewSingletonCallObject : public LInstructionHelper<1, 0, 1>
   public:
     LIR_HEADER(NewSingletonCallObject)
 
-    LNewSingletonCallObject(const LDefinition &temp) {
+    explicit LNewSingletonCallObject(const LDefinition &temp) {
         setTemp(0, temp);
     }
 
@@ -582,7 +582,7 @@ class LInitElem : public LCallInstructionHelper<0, 1 + 2*BOX_PIECES, 0>
   public:
     LIR_HEADER(InitElem)
 
-    LInitElem(const LAllocation &object) {
+    explicit LInitElem(const LAllocation &object) {
         setOperand(0, object);
     }
 
@@ -626,7 +626,7 @@ class LMutateProto : public LCallInstructionHelper<0, 1 + BOX_PIECES, 0>
   public:
     LIR_HEADER(MutateProto)
 
-    LMutateProto(const LAllocation &object) {
+    explicit LMutateProto(const LAllocation &object) {
         setOperand(0, object);
     }
 
@@ -646,7 +646,7 @@ class LInitProp : public LCallInstructionHelper<0, 1 + BOX_PIECES, 0>
   public:
     LIR_HEADER(InitProp)
 
-    LInitProp(const LAllocation &object) {
+    explicit LInitProp(const LAllocation &object) {
         setOperand(0, object);
     }
 
@@ -761,7 +761,7 @@ class LDefVar : public LCallInstructionHelper<0, 1, 0>
   public:
     LIR_HEADER(DefVar)
 
-    LDefVar(const LAllocation &scopeChain)
+    explicit LDefVar(const LAllocation &scopeChain)
     {
         setOperand(0, scopeChain);
     }
@@ -779,7 +779,7 @@ class LDefFun : public LCallInstructionHelper<0, 1, 0>
   public:
     LIR_HEADER(DefFun)
 
-    LDefFun(const LAllocation &scopeChain)
+    explicit LDefFun(const LAllocation &scopeChain)
     {
         setOperand(0, scopeChain);
     }
@@ -797,7 +797,7 @@ class LTypeOfV : public LInstructionHelper<1, BOX_PIECES, 1>
   public:
     LIR_HEADER(TypeOfV)
 
-    LTypeOfV(const LDefinition &tempToUnbox) {
+    explicit LTypeOfV(const LDefinition &tempToUnbox) {
         setTemp(0, tempToUnbox);
     }
 
@@ -817,7 +817,7 @@ class LToIdV : public LInstructionHelper<BOX_PIECES, 2 * BOX_PIECES, 1>
   public:
     LIR_HEADER(ToIdV)
 
-    LToIdV(const LDefinition &temp)
+    explicit LToIdV(const LDefinition &temp)
     {
         setTemp(0, temp);
     }
@@ -841,7 +841,7 @@ class LCreateThis : public LCallInstructionHelper<BOX_PIECES, 1, 0>
   public:
     LIR_HEADER(CreateThis)
 
-    LCreateThis(const LAllocation &callee)
+    explicit LCreateThis(const LAllocation &callee)
     {
         setOperand(0, callee);
     }
@@ -887,7 +887,7 @@ class LCreateThisWithTemplate : public LInstructionHelper<1, 0, 1>
   public:
     LIR_HEADER(CreateThisWithTemplate)
 
-    LCreateThisWithTemplate(const LDefinition &temp) {
+    explicit LCreateThisWithTemplate(const LDefinition &temp) {
         setTemp(0, temp);
     }
 
@@ -972,7 +972,7 @@ class LReturnFromCtor : public LInstructionHelper<1, BOX_PIECES + 1, 0>
   public:
     LIR_HEADER(ReturnFromCtor)
 
-    LReturnFromCtor(const LAllocation &object)
+    explicit LReturnFromCtor(const LAllocation &object)
     {
         // Value set by useBox() during lowering.
         setOperand(LReturnFromCtor::ObjectIndex, object);
@@ -1005,7 +1005,7 @@ class LComputeThis : public LInstructionHelper<1, BOX_PIECES, 0>
 class LLoadArrowThis : public LInstructionHelper<BOX_PIECES, 1, 0>
 {
   public:
-    LLoadArrowThis(const LAllocation &callee) {
+    explicit LLoadArrowThis(const LAllocation &callee) {
         setOperand(0, callee);
     }
 
@@ -1050,7 +1050,7 @@ class LStackArgV : public LInstructionHelper<0, BOX_PIECES, 0>
   public:
     LIR_HEADER(StackArgV)
 
-    LStackArgV(uint32_t argslot)
+    explicit LStackArgV(uint32_t argslot)
       : argslot_(argslot)
     { }
 
@@ -1254,7 +1254,7 @@ class LGetDOMMember : public LInstructionHelper<BOX_PIECES, 1, 0>
 {
   public:
     LIR_HEADER(GetDOMMember);
-    LGetDOMMember(const LAllocation &object) {
+    explicit LGetDOMMember(const LAllocation &object) {
         setOperand(0, object);
     }
 
@@ -1481,7 +1481,7 @@ class LCallDirectEvalV : public LCallInstructionHelper<BOX_PIECES, 1 + (2 * BOX_
   public:
     LIR_HEADER(CallDirectEvalV)
 
-    LCallDirectEvalV(const LAllocation &scopeChain)
+    explicit LCallDirectEvalV(const LAllocation &scopeChain)
     {
         setOperand(0, scopeChain);
     }
@@ -1649,7 +1649,7 @@ class LFunctionDispatch : public LInstructionHelper<0, 1, 0>
   public:
     LIR_HEADER(FunctionDispatch);
 
-    LFunctionDispatch(const LAllocation &in) {
+    explicit LFunctionDispatch(const LAllocation &in) {
         setOperand(0, in);
     }
 
@@ -1921,7 +1921,7 @@ class LCompareB : public LInstructionHelper<1, BOX_PIECES + 1, 0>
   public:
     LIR_HEADER(CompareB)
 
-    LCompareB(const LAllocation &rhs) {
+    explicit LCompareB(const LAllocation &rhs) {
         setOperand(BOX_PIECES, rhs);
     }
 
@@ -2126,7 +2126,7 @@ class LEmulatesUndefined : public LInstructionHelper<1, 1, 0>
   public:
     LIR_HEADER(EmulatesUndefined)
 
-    LEmulatesUndefined(const LAllocation &input)
+    explicit LEmulatesUndefined(const LAllocation &input)
     {
         setOperand(0, input);
     }
@@ -2177,7 +2177,7 @@ class LNotI : public LInstructionHelper<1, 1, 0>
   public:
     LIR_HEADER(NotI)
 
-    LNotI(const LAllocation &input) {
+    explicit LNotI(const LAllocation &input) {
         setOperand(0, input);
     }
 };
@@ -2188,7 +2188,7 @@ class LNotD : public LInstructionHelper<1, 1, 0>
   public:
     LIR_HEADER(NotD)
 
-    LNotD(const LAllocation &input) {
+    explicit LNotD(const LAllocation &input) {
         setOperand(0, input);
     }
 
@@ -2203,7 +2203,7 @@ class LNotF : public LInstructionHelper<1, 1, 0>
   public:
     LIR_HEADER(NotF)
 
-    LNotF(const LAllocation &input) {
+    explicit LNotF(const LAllocation &input) {
         setOperand(0, input);
     }
 
@@ -2218,7 +2218,7 @@ class LNotO : public LInstructionHelper<1, 1, 0>
   public:
     LIR_HEADER(NotO)
 
-    LNotO(const LAllocation &input)
+    explicit LNotO(const LAllocation &input)
     {
         setOperand(0, input);
     }
@@ -2285,7 +2285,7 @@ class LBitOpI : public LInstructionHelper<1, 2, 0>
   public:
     LIR_HEADER(BitOpI)
 
-    LBitOpI(JSOp op)
+    explicit LBitOpI(JSOp op)
       : op_(op)
     { }
 
@@ -2308,7 +2308,7 @@ class LBitOpV : public LCallInstructionHelper<1, 2 * BOX_PIECES, 0>
   public:
     LIR_HEADER(BitOpV)
 
-    LBitOpV(JSOp jsop)
+    explicit LBitOpV(JSOp jsop)
       : jsop_(jsop)
     { }
 
@@ -2333,7 +2333,7 @@ class LShiftI : public LBinaryMath<0>
   public:
     LIR_HEADER(ShiftI)
 
-    LShiftI(JSOp op)
+    explicit LShiftI(JSOp op)
       : op_(op)
     { }
 
@@ -2440,7 +2440,7 @@ class LNegI : public LInstructionHelper<1, 1, 0>
 {
   public:
     LIR_HEADER(NegI);
-    LNegI(const LAllocation &num) {
+    explicit LNegI(const LAllocation &num) {
         setOperand(0, num);
     }
 };
@@ -2450,7 +2450,7 @@ class LNegD : public LInstructionHelper<1, 1, 0>
 {
   public:
     LIR_HEADER(NegD)
-    LNegD(const LAllocation &num) {
+    explicit LNegD(const LAllocation &num) {
         setOperand(0, num);
     }
 };
@@ -2460,7 +2460,7 @@ class LNegF : public LInstructionHelper<1, 1, 0>
 {
   public:
     LIR_HEADER(NegF)
-    LNegF(const LAllocation &num) {
+    explicit LNegF(const LAllocation &num) {
         setOperand(0, num);
     }
 };
@@ -2470,7 +2470,7 @@ class LAbsI : public LInstructionHelper<1, 1, 0>
 {
   public:
     LIR_HEADER(AbsI)
-    LAbsI(const LAllocation &num) {
+    explicit LAbsI(const LAllocation &num) {
         setOperand(0, num);
     }
 };
@@ -2480,7 +2480,7 @@ class LAbsD : public LInstructionHelper<1, 1, 0>
 {
   public:
     LIR_HEADER(AbsD)
-    LAbsD(const LAllocation &num) {
+    explicit LAbsD(const LAllocation &num) {
         setOperand(0, num);
     }
 };
@@ -2490,7 +2490,7 @@ class LAbsF : public LInstructionHelper<1, 1, 0>
 {
   public:
     LIR_HEADER(AbsF)
-    LAbsF(const LAllocation &num) {
+    explicit LAbsF(const LAllocation &num) {
         setOperand(0, num);
     }
 };
@@ -2500,7 +2500,7 @@ class LSqrtD : public LInstructionHelper<1, 1, 0>
 {
   public:
     LIR_HEADER(SqrtD)
-    LSqrtD(const LAllocation &num) {
+    explicit LSqrtD(const LAllocation &num) {
         setOperand(0, num);
     }
 };
@@ -2510,7 +2510,7 @@ class LSqrtF : public LInstructionHelper<1, 1, 0>
 {
   public:
     LIR_HEADER(SqrtF)
-    LSqrtF(const LAllocation &num) {
+    explicit LSqrtF(const LAllocation &num) {
         setOperand(0, num);
     }
 };
@@ -2726,7 +2726,7 @@ class LMathD : public LBinaryMath<0>
   public:
     LIR_HEADER(MathD)
 
-    LMathD(JSOp jsop)
+    explicit LMathD(JSOp jsop)
       : jsop_(jsop)
     { }
 
@@ -2747,7 +2747,7 @@ class LMathF: public LBinaryMath<0>
   public:
     LIR_HEADER(MathF)
 
-    LMathF(JSOp jsop)
+    explicit LMathF(JSOp jsop)
       : jsop_(jsop)
     { }
 
@@ -2786,7 +2786,7 @@ class LBinaryV : public LCallInstructionHelper<BOX_PIECES, 2 * BOX_PIECES, 0>
   public:
     LIR_HEADER(BinaryV)
 
-    LBinaryV(JSOp jsop)
+    explicit LBinaryV(JSOp jsop)
       : jsop_(jsop)
     { }
 
@@ -2910,7 +2910,7 @@ class LFromCharCode : public LInstructionHelper<1, 1, 0>
   public:
     LIR_HEADER(FromCharCode)
 
-    LFromCharCode(const LAllocation &code) {
+    explicit LFromCharCode(const LAllocation &code) {
         setOperand(0, code);
     }
 
@@ -2945,7 +2945,7 @@ class LInt32ToDouble : public LInstructionHelper<1, 1, 0>
   public:
     LIR_HEADER(Int32ToDouble)
 
-    LInt32ToDouble(const LAllocation &input) {
+    explicit LInt32ToDouble(const LAllocation &input) {
         setOperand(0, input);
     }
 };
@@ -2956,7 +2956,7 @@ class LFloat32ToDouble : public LInstructionHelper<1, 1, 0>
   public:
     LIR_HEADER(Float32ToDouble)
 
-    LFloat32ToDouble(const LAllocation &input) {
+    explicit LFloat32ToDouble(const LAllocation &input) {
         setOperand(0, input);
     }
 };
@@ -2967,7 +2967,7 @@ class LDoubleToFloat32 : public LInstructionHelper<1, 1, 0>
   public:
     LIR_HEADER(DoubleToFloat32)
 
-    LDoubleToFloat32(const LAllocation &input) {
+    explicit LDoubleToFloat32(const LAllocation &input) {
         setOperand(0, input);
     }
 };
@@ -2978,7 +2978,7 @@ class LInt32ToFloat32 : public LInstructionHelper<1, 1, 0>
   public:
     LIR_HEADER(Int32ToFloat32)
 
-    LInt32ToFloat32(const LAllocation &input) {
+    explicit LInt32ToFloat32(const LAllocation &input) {
         setOperand(0, input);
     }
 };
@@ -3069,7 +3069,7 @@ class LDoubleToInt32 : public LInstructionHelper<1, 1, 0>
   public:
     LIR_HEADER(DoubleToInt32)
 
-    LDoubleToInt32(const LAllocation &in) {
+    explicit LDoubleToInt32(const LAllocation &in) {
         setOperand(0, in);
     }
 
@@ -3087,7 +3087,7 @@ class LFloat32ToInt32 : public LInstructionHelper<1, 1, 0>
   public:
     LIR_HEADER(Float32ToInt32)
 
-    LFloat32ToInt32(const LAllocation &in) {
+    explicit LFloat32ToInt32(const LAllocation &in) {
         setOperand(0, in);
     }
 
@@ -3138,7 +3138,7 @@ class LBooleanToString : public LInstructionHelper<1, 1, 0>
   public:
     LIR_HEADER(BooleanToString)
 
-    LBooleanToString(const LAllocation &input) {
+    explicit LBooleanToString(const LAllocation &input) {
         setOperand(0, input);
     }
 
@@ -3153,7 +3153,7 @@ class LIntToString : public LInstructionHelper<1, 1, 0>
   public:
     LIR_HEADER(IntToString)
 
-    LIntToString(const LAllocation &input) {
+    explicit LIntToString(const LAllocation &input) {
         setOperand(0, input);
     }
 
@@ -3187,7 +3187,7 @@ class LPrimitiveToString : public LInstructionHelper<1, BOX_PIECES, 1>
   public:
     LIR_HEADER(PrimitiveToString)
 
-    LPrimitiveToString(const LDefinition &tempToUnbox)
+    explicit LPrimitiveToString(const LDefinition &tempToUnbox)
     {
         setTemp(0, tempToUnbox);
     }
@@ -3245,7 +3245,7 @@ class LOsrValue : public LInstructionHelper<BOX_PIECES, 1, 0>
   public:
     LIR_HEADER(OsrValue)
 
-    LOsrValue(const LAllocation &entry)
+    explicit LOsrValue(const LAllocation &entry)
     {
         setOperand(0, entry);
     }
@@ -3261,7 +3261,7 @@ class LOsrScopeChain : public LInstructionHelper<1, 1, 0>
   public:
     LIR_HEADER(OsrScopeChain)
 
-    LOsrScopeChain(const LAllocation &entry)
+    explicit LOsrScopeChain(const LAllocation &entry)
     {
         setOperand(0, entry);
     }
@@ -3277,7 +3277,7 @@ class LOsrReturnValue : public LInstructionHelper<BOX_PIECES, 1, 0>
   public:
     LIR_HEADER(OsrReturnValue)
 
-    LOsrReturnValue(const LAllocation &entry)
+    explicit LOsrReturnValue(const LAllocation &entry)
     {
         setOperand(0, entry);
     }
@@ -3293,7 +3293,7 @@ class LOsrArgumentsObject : public LInstructionHelper<1, 1, 0>
   public:
     LIR_HEADER(OsrArgumentsObject)
 
-    LOsrArgumentsObject(const LAllocation &entry)
+    explicit LOsrArgumentsObject(const LAllocation &entry)
     {
         setOperand(0, entry);
     }
@@ -3419,7 +3419,7 @@ class LLambdaForSingleton : public LCallInstructionHelper<1, 1, 0>
   public:
     LIR_HEADER(LambdaForSingleton)
 
-    LLambdaForSingleton(const LAllocation &scopeChain)
+    explicit LLambdaForSingleton(const LAllocation &scopeChain)
     {
         setOperand(0, scopeChain);
     }
@@ -3509,7 +3509,7 @@ class LImplicitThis : public LInstructionHelper<BOX_PIECES, 1, 0>
   public:
     LIR_HEADER(ImplicitThis)
 
-    LImplicitThis(const LAllocation &callee) {
+    explicit LImplicitThis(const LAllocation &callee) {
         setOperand(0, callee);
     }
 
@@ -3529,7 +3529,7 @@ class LSlots : public LInstructionHelper<1, 1, 0>
   public:
     LIR_HEADER(Slots)
 
-    LSlots(const LAllocation &object) {
+    explicit LSlots(const LAllocation &object) {
         setOperand(0, object);
     }
 
@@ -3546,7 +3546,7 @@ class LElements : public LInstructionHelper<1, 1, 0>
   public:
     LIR_HEADER(Elements)
 
-    LElements(const LAllocation &object) {
+    explicit LElements(const LAllocation &object) {
         setOperand(0, object);
     }
 
@@ -3561,7 +3561,7 @@ class LConvertElementsToDoubles : public LInstructionHelper<0, 1, 0>
   public:
     LIR_HEADER(ConvertElementsToDoubles)
 
-    LConvertElementsToDoubles(const LAllocation &elements) {
+    explicit LConvertElementsToDoubles(const LAllocation &elements) {
         setOperand(0, elements);
     }
 
@@ -3601,7 +3601,7 @@ class LInitializedLength : public LInstructionHelper<1, 1, 0>
   public:
     LIR_HEADER(InitializedLength)
 
-    LInitializedLength(const LAllocation &elements) {
+    explicit LInitializedLength(const LAllocation &elements) {
         setOperand(0, elements);
     }
 
@@ -3636,7 +3636,7 @@ class LArrayLength : public LInstructionHelper<1, 1, 0>
   public:
     LIR_HEADER(ArrayLength)
 
-    LArrayLength(const LAllocation &elements) {
+    explicit LArrayLength(const LAllocation &elements) {
         setOperand(0, elements);
     }
 
@@ -3671,7 +3671,7 @@ class LTypedArrayLength : public LInstructionHelper<1, 1, 0>
   public:
     LIR_HEADER(TypedArrayLength)
 
-    LTypedArrayLength(const LAllocation &obj) {
+    explicit LTypedArrayLength(const LAllocation &obj) {
         setOperand(0, obj);
     }
 
@@ -3686,7 +3686,7 @@ class LTypedArrayElements : public LInstructionHelper<1, 1, 0>
   public:
     LIR_HEADER(TypedArrayElements)
 
-    LTypedArrayElements(const LAllocation &object) {
+    explicit LTypedArrayElements(const LAllocation &object) {
         setOperand(0, object);
     }
     const LAllocation *object() {
@@ -3700,7 +3700,7 @@ class LTypedObjectElements : public LInstructionHelper<1, 1, 0>
   public:
     LIR_HEADER(TypedObjectElements)
 
-    LTypedObjectElements(const LAllocation &object) {
+    explicit LTypedObjectElements(const LAllocation &object) {
         setOperand(0, object);
     }
     const LAllocation *object() {
@@ -3805,7 +3805,7 @@ class LBoundsCheckLower : public LInstructionHelper<0, 1, 0>
   public:
     LIR_HEADER(BoundsCheckLower)
 
-    LBoundsCheckLower(const LAllocation &index)
+    explicit LBoundsCheckLower(const LAllocation &index)
     {
         setOperand(0, index);
     }
@@ -4240,7 +4240,7 @@ class LLoadTypedArrayElementStatic : public LInstructionHelper<1, 1, 0>
 {
   public:
     LIR_HEADER(LoadTypedArrayElementStatic);
-    LLoadTypedArrayElementStatic(const LAllocation &ptr) {
+    explicit LLoadTypedArrayElementStatic(const LAllocation &ptr) {
         setOperand(0, ptr);
     }
     MLoadTypedArrayElementStatic *mir() const {
@@ -4352,7 +4352,7 @@ class LClampIToUint8 : public LInstructionHelper<1, 1, 0>
   public:
     LIR_HEADER(ClampIToUint8)
 
-    LClampIToUint8(const LAllocation &in) {
+    explicit LClampIToUint8(const LAllocation &in) {
         setOperand(0, in);
     }
 };
@@ -4373,7 +4373,7 @@ class LClampVToUint8 : public LInstructionHelper<1, BOX_PIECES, 1>
   public:
     LIR_HEADER(ClampVToUint8)
 
-    LClampVToUint8(const LDefinition &tempFloat) {
+    explicit LClampVToUint8(const LDefinition &tempFloat) {
         setTemp(0, tempFloat);
     }
 
@@ -4393,7 +4393,7 @@ class LLoadFixedSlotV : public LInstructionHelper<BOX_PIECES, 1, 0>
   public:
     LIR_HEADER(LoadFixedSlotV)
 
-    LLoadFixedSlotV(const LAllocation &object) {
+    explicit LLoadFixedSlotV(const LAllocation &object) {
         setOperand(0, object);
     }
     const MLoadFixedSlot *mir() const {
@@ -4407,7 +4407,7 @@ class LLoadFixedSlotT : public LInstructionHelper<1, 1, 0>
   public:
     LIR_HEADER(LoadFixedSlotT)
 
-    LLoadFixedSlotT(const LAllocation &object) {
+    explicit LLoadFixedSlotT(const LAllocation &object) {
         setOperand(0, object);
     }
     const MLoadFixedSlot *mir() const {
@@ -4421,7 +4421,7 @@ class LStoreFixedSlotV : public LInstructionHelper<0, 1 + BOX_PIECES, 0>
   public:
     LIR_HEADER(StoreFixedSlotV)
 
-    LStoreFixedSlotV(const LAllocation &obj) {
+    explicit LStoreFixedSlotV(const LAllocation &obj) {
         setOperand(0, obj);
     }
 
@@ -4463,7 +4463,7 @@ class LGetNameCache : public LInstructionHelper<BOX_PIECES, 1, 0>
   public:
     LIR_HEADER(GetNameCache)
 
-    LGetNameCache(const LAllocation &scopeObj) {
+    explicit LGetNameCache(const LAllocation &scopeObj) {
         setOperand(0, scopeObj);
     }
     const LAllocation *scopeObj() {
@@ -4489,7 +4489,7 @@ class LCallsiteCloneCache : public LInstructionHelper<1, 1, 0>
   public:
     LIR_HEADER(CallsiteCloneCache);
 
-    LCallsiteCloneCache(const LAllocation &callee) {
+    explicit LCallsiteCloneCache(const LAllocation &callee) {
         setOperand(0, callee);
     }
     const LAllocation *callee() {
@@ -4507,7 +4507,7 @@ class LGetPropertyCacheV : public LInstructionHelper<BOX_PIECES, 1, 0>
   public:
     LIR_HEADER(GetPropertyCacheV)
 
-    LGetPropertyCacheV(const LAllocation &object) {
+    explicit LGetPropertyCacheV(const LAllocation &object) {
         setOperand(0, object);
     }
     const MGetPropertyCache *mir() const {
@@ -4541,7 +4541,7 @@ class LGetPropertyPolymorphicV : public LInstructionHelper<BOX_PIECES, 1, 0>
   public:
     LIR_HEADER(GetPropertyPolymorphicV)
 
-    LGetPropertyPolymorphicV(const LAllocation &obj) {
+    explicit LGetPropertyPolymorphicV(const LAllocation &obj) {
         setOperand(0, obj);
     }
     const LAllocation *obj() {
@@ -4644,7 +4644,7 @@ class LGetElementCacheV : public LInstructionHelper<BOX_PIECES, 1 + BOX_PIECES,
 
     static const size_t Index = 1;
 
-    LGetElementCacheV(const LAllocation &object) {
+    explicit LGetElementCacheV(const LAllocation &object) {
         setOperand(0, object);
     }
     const LAllocation *object() {
@@ -4688,7 +4688,7 @@ class LBindNameCache : public LInstructionHelper<1, 1, 0>
   public:
     LIR_HEADER(BindNameCache)
 
-    LBindNameCache(const LAllocation &scopeChain) {
+    explicit LBindNameCache(const LAllocation &scopeChain) {
         setOperand(0, scopeChain);
     }
     const LAllocation *scopeChain() {
@@ -4705,7 +4705,7 @@ class LLoadSlotV : public LInstructionHelper<BOX_PIECES, 1, 0>
   public:
     LIR_HEADER(LoadSlotV)
 
-    LLoadSlotV(const LAllocation &in) {
+    explicit LLoadSlotV(const LAllocation &in) {
         setOperand(0, in);
     }
     const MLoadSlot *mir() const {
@@ -4721,7 +4721,7 @@ class LLoadSlotT : public LInstructionHelper<1, 1, 0>
   public:
     LIR_HEADER(LoadSlotT)
 
-    LLoadSlotT(const LAllocation &in) {
+    explicit LLoadSlotT(const LAllocation &in) {
         setOperand(0, in);
     }
     const MLoadSlot *mir() const {
@@ -4735,7 +4735,7 @@ class LStoreSlotV : public LInstructionHelper<0, 1 + BOX_PIECES, 0>
   public:
     LIR_HEADER(StoreSlotV)
 
-    LStoreSlotV(const LAllocation &slots) {
+    explicit LStoreSlotV(const LAllocation &slots) {
         setOperand(0, slots);
     }
 
@@ -4781,7 +4781,7 @@ class LStringLength : public LInstructionHelper<1, 1, 0>
   public:
     LIR_HEADER(StringLength)
 
-    LStringLength(const LAllocation &string) {
+    explicit LStringLength(const LAllocation &string) {
         setOperand(0, string);
     }
 
@@ -4796,7 +4796,7 @@ class LFloor : public LInstructionHelper<1, 1, 0>
   public:
     LIR_HEADER(Floor)
 
-    LFloor(const LAllocation &num) {
+    explicit LFloor(const LAllocation &num) {
         setOperand(0, num);
     }
 };
@@ -4807,7 +4807,7 @@ class LFloorF : public LInstructionHelper<1, 1, 0>
   public:
     LIR_HEADER(FloorF)
 
-    LFloorF(const LAllocation &num) {
+    explicit LFloorF(const LAllocation &num) {
         setOperand(0, num);
     }
 };
@@ -4878,7 +4878,7 @@ class LFunctionEnvironment : public LInstructionHelper<1, 1, 0>
   public:
     LIR_HEADER(FunctionEnvironment)
 
-    LFunctionEnvironment(const LAllocation &function) {
+    explicit LFunctionEnvironment(const LAllocation &function) {
         setOperand(0, function);
     }
     const LAllocation *function() {
@@ -4891,7 +4891,7 @@ class LForkJoinContext : public LCallInstructionHelper<1, 0, 1>
   public:
     LIR_HEADER(ForkJoinContext);
 
-    LForkJoinContext(const LDefinition &temp1) {
+    explicit LForkJoinContext(const LDefinition &temp1) {
         setTemp(0, temp1);
     }
 
@@ -4987,7 +4987,7 @@ class LCallSetProperty : public LCallInstructionHelper<0, 1 + BOX_PIECES, 0>
   public:
     LIR_HEADER(CallSetProperty)
 
-    LCallSetProperty(const LAllocation &obj) {
+    explicit LCallSetProperty(const LAllocation &obj) {
         setOperand(0, obj);
     }
 
@@ -5159,7 +5159,7 @@ class LCallIteratorStart : public LCallInstructionHelper<1, 1, 0>
   public:
     LIR_HEADER(CallIteratorStart)
 
-    LCallIteratorStart(const LAllocation &object) {
+    explicit LCallIteratorStart(const LAllocation &object) {
         setOperand(0, object);
     }
     const LAllocation *object() {
@@ -5281,7 +5281,7 @@ class LGetFrameArgument : public LInstructionHelper<BOX_PIECES, 1, 0>
   public:
     LIR_HEADER(GetFrameArgument)
 
-    LGetFrameArgument(const LAllocation &index) {
+    explicit LGetFrameArgument(const LAllocation &index) {
         setOperand(0, index);
     }
     const LAllocation *index() {
@@ -5295,7 +5295,7 @@ class LSetFrameArgumentT : public LInstructionHelper<0, 1, 0>
   public:
     LIR_HEADER(SetFrameArgumentT)
 
-    LSetFrameArgumentT(const LAllocation &input) {
+    explicit LSetFrameArgumentT(const LAllocation &input) {
         setOperand(0, input);
     }
     MSetFrameArgument *mir() const {
@@ -5314,7 +5314,7 @@ class LSetFrameArgumentC : public LInstructionHelper<0, 0, 0>
   public:
     LIR_HEADER(SetFrameArgumentC)
 
-    LSetFrameArgumentC(const Value &val) {
+    explicit LSetFrameArgumentC(const Value &val) {
         val_ = val;
     }
     MSetFrameArgument *mir() const {
@@ -5447,7 +5447,7 @@ class LTypeBarrierV : public LInstructionHelper<0, BOX_PIECES, 1>
   public:
     LIR_HEADER(TypeBarrierV)
 
-    LTypeBarrierV(const LDefinition &temp) {
+    explicit LTypeBarrierV(const LDefinition &temp) {
         setTemp(0, temp);
     }
 
@@ -5488,7 +5488,7 @@ class LMonitorTypes : public LInstructionHelper<0, BOX_PIECES, 1>
   public:
     LIR_HEADER(MonitorTypes)
 
-    LMonitorTypes(const LDefinition &temp) {
+    explicit LMonitorTypes(const LDefinition &temp) {
         setTemp(0, temp);
     }
 
@@ -5559,7 +5559,7 @@ class LGuardObjectIdentity : public LInstructionHelper<0, 1, 0>
   public:
     LIR_HEADER(GuardObjectIdentity)
 
-    LGuardObjectIdentity(const LAllocation &in) {
+    explicit LGuardObjectIdentity(const LAllocation &in) {
         setOperand(0, in);
     }
     const MGuardObjectIdentity *mir() const {
@@ -5654,7 +5654,7 @@ class LIn : public LCallInstructionHelper<1, BOX_PIECES+1, 0>
 {
   public:
     LIR_HEADER(In)
-    LIn(const LAllocation &rhs) {
+    explicit LIn(const LAllocation &rhs) {
         setOperand(RHS, rhs);
     }
 
@@ -5673,7 +5673,7 @@ class LInstanceOfO : public LInstructionHelper<1, 1, 0>
 {
   public:
     LIR_HEADER(InstanceOfO)
-    LInstanceOfO(const LAllocation &lhs) {
+    explicit LInstanceOfO(const LAllocation &lhs) {
         setOperand(0, lhs);
     }
 
@@ -5708,7 +5708,7 @@ class LCallInstanceOf : public LCallInstructionHelper<1, BOX_PIECES+1, 0>
 {
   public:
     LIR_HEADER(CallInstanceOf)
-    LCallInstanceOf(const LAllocation &rhs) {
+    explicit LCallInstanceOf(const LAllocation &rhs) {
         setOperand(RHS, rhs);
     }
 
@@ -5731,7 +5731,7 @@ class LProfilerStackOp : public LInstructionHelper<0, 0, 1>
   public:
     LIR_HEADER(ProfilerStackOp)
 
-    LProfilerStackOp(const LDefinition &temp) {
+    explicit LProfilerStackOp(const LDefinition &temp) {
         setTemp(0, temp);
     }
 
@@ -5756,7 +5756,7 @@ class LIsCallable : public LInstructionHelper<1, 1, 0>
 {
   public:
     LIR_HEADER(IsCallable);
-    LIsCallable(const LAllocation &object) {
+    explicit LIsCallable(const LAllocation &object) {
         setOperand(0, object);
     }
 
@@ -5794,7 +5794,7 @@ class LHasClass : public LInstructionHelper<1, 1, 0>
 {
   public:
     LIR_HEADER(HasClass);
-    LHasClass(const LAllocation &lhs) {
+    explicit LHasClass(const LAllocation &lhs) {
         setOperand(0, lhs);
     }
 
@@ -5810,7 +5810,7 @@ class LAsmJSLoadHeap : public LInstructionHelper<1, 1, 0>
 {
   public:
     LIR_HEADER(AsmJSLoadHeap);
-    LAsmJSLoadHeap(const LAllocation &ptr) {
+    explicit LAsmJSLoadHeap(const LAllocation &ptr) {
         setOperand(0, ptr);
     }
     MAsmJSLoadHeap *mir() const {
@@ -5853,7 +5853,7 @@ class LAsmJSStoreGlobalVar : public LInstructionHelper<0, 1, 0>
 {
   public:
     LIR_HEADER(AsmJSStoreGlobalVar);
-    LAsmJSStoreGlobalVar(const LAllocation &value) {
+    explicit LAsmJSStoreGlobalVar(const LAllocation &value) {
         setOperand(0, value);
     }
     MAsmJSStoreGlobalVar *mir() const {
@@ -5895,7 +5895,7 @@ class LAsmJSPassStackArg : public LInstructionHelper<0, 1, 0>
 {
   public:
     LIR_HEADER(AsmJSPassStackArg);
-    LAsmJSPassStackArg(const LAllocation &arg) {
+    explicit LAsmJSPassStackArg(const LAllocation &arg) {
         setOperand(0, arg);
     }
     MAsmJSPassStackArg *mir() const {
@@ -5978,7 +5978,7 @@ class LAssertRangeI : public LInstructionHelper<0, 1, 0>
   public:
     LIR_HEADER(AssertRangeI)
 
-    LAssertRangeI(const LAllocation &input) {
+    explicit LAssertRangeI(const LAllocation &input) {
         setOperand(0, input);
     }
 
@@ -6084,7 +6084,7 @@ class LRecompileCheck : public LInstructionHelper<0, 0, 1>
   public:
     LIR_HEADER(RecompileCheck)
 
-    LRecompileCheck(const LDefinition &scratch) {
+    explicit LRecompileCheck(const LDefinition &scratch) {
         setTemp(0, scratch);
     }
 
diff --git a/js/src/jit/LIR.h b/js/src/jit/LIR.h
index a3f72e60a833..a2d736a2dae6 100644
--- a/js/src/jit/LIR.h
+++ b/js/src/jit/LIR.h
@@ -256,13 +256,13 @@ class LUse : public LAllocation
         set(policy, 0, usedAtStart);
         setVirtualRegister(vreg);
     }
-    LUse(Policy policy, bool usedAtStart = false) {
+    explicit LUse(Policy policy, bool usedAtStart = false) {
         set(policy, 0, usedAtStart);
     }
-    LUse(Register reg, bool usedAtStart = false) {
+    explicit LUse(Register reg, bool usedAtStart = false) {
         set(FIXED, reg.code(), usedAtStart);
     }
-    LUse(FloatRegister reg, bool usedAtStart = false) {
+    explicit LUse(FloatRegister reg, bool usedAtStart = false) {
         set(FIXED, reg.code(), usedAtStart);
     }
     LUse(Register reg, uint32_t virtualRegister) {
@@ -455,7 +455,7 @@ class LDefinition
         set(index, type, policy);
     }
 
-    LDefinition(Type type, Policy policy = DEFAULT) {
+    explicit LDefinition(Type type, Policy policy = DEFAULT) {
         set(0, type, policy);
     }
 
@@ -905,7 +905,7 @@ class LRecoverInfo : public TempObject
     // Cached offset where this resume point is encoded.
     RecoverOffset recoverOffset_;
 
-    LRecoverInfo(TempAllocator &alloc);
+    explicit LRecoverInfo(TempAllocator &alloc);
     bool init(MResumePoint *mir);
 
     // Fill the instruction vector such as all instructions needed for the
@@ -945,7 +945,7 @@ class LRecoverInfo : public TempObject
         size_t op_;
 
       public:
-        OperandIter(MNode **it)
+        explicit OperandIter(MNode **it)
           : it_(it), op_(0)
         { }
 
@@ -1133,7 +1133,7 @@ class LSafepoint : public TempObject
         JS_ASSERT((gcRegs().bits() & ~liveRegs().gprs().bits()) == 0);
     }
 
-    LSafepoint(TempAllocator &alloc)
+    explicit LSafepoint(TempAllocator &alloc)
       : safepointOffset_(INVALID_SAFEPOINT_OFFSET)
       , osiCallPointOffset_(0)
       , gcSlots_(alloc)
@@ -1423,7 +1423,7 @@ class LInstruction::InputIterator
     }
 
 public:
-    InputIterator(LInstruction &ins) :
+    explicit InputIterator(LInstruction &ins) :
       ins_(ins),
       idx_(0),
       snapshot_(false)
@@ -1506,7 +1506,7 @@ class LIRGraph
     MIRGraph &mir_;
 
   public:
-    LIRGraph(MIRGraph *mir);
+    explicit LIRGraph(MIRGraph *mir);
 
     bool init() {
         return constantPoolMap_.init();
diff --git a/js/src/jit/LinearScan.h b/js/src/jit/LinearScan.h
index cf194b9e20b9..3455ce9a0480 100644
--- a/js/src/jit/LinearScan.h
+++ b/js/src/jit/LinearScan.h
@@ -26,7 +26,7 @@ class LinearScanVirtualRegister : public VirtualRegister
     bool finished_ : 1;
 
   public:
-    LinearScanVirtualRegister(TempAllocator &alloc)
+    explicit LinearScanVirtualRegister(TempAllocator &alloc)
       : VirtualRegister(alloc)
     {}
     void setCanonicalSpill(LAllocation *alloc) {
diff --git a/js/src/jit/LiveRangeAllocator.h b/js/src/jit/LiveRangeAllocator.h
index 47ab3dd495f3..fdaee8a40cde 100644
--- a/js/src/jit/LiveRangeAllocator.h
+++ b/js/src/jit/LiveRangeAllocator.h
@@ -33,7 +33,7 @@ class Requirement
       : kind_(NONE)
     { }
 
-    Requirement(Kind kind)
+    explicit Requirement(Kind kind)
       : kind_(kind)
     {
         // These have dedicated constructors.
@@ -48,7 +48,7 @@ class Requirement
         JS_ASSERT(kind != FIXED && kind != SAME_AS_OTHER);
     }
 
-    Requirement(LAllocation fixed)
+    explicit Requirement(LAllocation fixed)
       : kind_(FIXED),
         allocation_(fixed)
     {
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index 6601a3e1abf8..013e38c61784 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -181,7 +181,7 @@ class MNode : public TempObject
       : block_(nullptr)
     { }
 
-    MNode(MBasicBlock *block)
+    explicit MNode(MBasicBlock *block)
       : block_(block)
     { }
 
@@ -256,7 +256,7 @@ class AliasSet {
         // Indicates load or store.
         Store_            = 1 << 31
     };
-    AliasSet(uint32_t flags)
+    explicit AliasSet(uint32_t flags)
       : flags_(flags)
     {
         JS_STATIC_ASSERT((1 << NumCategories) - 1 == Any);
@@ -722,7 +722,7 @@ class MUseDefIterator
     }
 
   public:
-    MUseDefIterator(MDefinition *def)
+    explicit MUseDefIterator(MDefinition *def)
       : def_(def),
         current_(search(def->usesBegin()))
     { }
@@ -819,7 +819,7 @@ class MNullaryInstruction : public MAryInstruction<0>
 class MUnaryInstruction : public MAryInstruction<1>
 {
   protected:
-    MUnaryInstruction(MDefinition *ins)
+    explicit MUnaryInstruction(MDefinition *ins)
     {
         initOperand(0, ins);
     }
@@ -960,7 +960,7 @@ class MStart : public MNullaryInstruction
     StartType startType_;
 
   private:
-    MStart(StartType startType)
+    explicit MStart(StartType startType)
       : startType_(startType)
     { }
 
@@ -1057,7 +1057,7 @@ class MConstant : public MNullaryInstruction
 
   protected:
     MConstant(const Value &v, types::CompilerConstraintList *constraints);
-    MConstant(JSObject *obj);
+    explicit MConstant(JSObject *obj);
 
   public:
     INSTRUCTION_HEADER(Constant)
@@ -1109,7 +1109,7 @@ class MCloneLiteral
     public ObjectPolicy<0>
 {
   protected:
-    MCloneLiteral(MDefinition *obj)
+    explicit MCloneLiteral(MDefinition *obj)
       : MUnaryInstruction(obj)
     {
         setResultType(MIRType_Object);
@@ -1382,7 +1382,7 @@ class MAryControlInstruction : public MControlInstruction
 // Jump to the start of another basic block.
 class MGoto : public MAryControlInstruction<0, 1>
 {
-    MGoto(MBasicBlock *target) {
+    explicit MGoto(MBasicBlock *target) {
         setSuccessor(0, target);
     }
 
@@ -1478,7 +1478,7 @@ class MReturn
   : public MAryControlInstruction<1, 0>,
     public BoxInputsPolicy
 {
-    MReturn(MDefinition *ins) {
+    explicit MReturn(MDefinition *ins) {
         initOperand(0, ins);
     }
 
@@ -1503,7 +1503,7 @@ class MThrow
   : public MAryControlInstruction<1, 0>,
     public BoxInputsPolicy
 {
-    MThrow(MDefinition *ins) {
+    explicit MThrow(MDefinition *ins) {
         initOperand(0, ins);
     }
 
@@ -2316,7 +2316,7 @@ class MFilterArgumentsOrEval
     public BoxExceptPolicy<0, MIRType_String>
 {
   protected:
-    MFilterArgumentsOrEval(MDefinition *string)
+    explicit MFilterArgumentsOrEval(MDefinition *string)
     {
         initOperand(0, string);
         setGuard();
@@ -2691,7 +2691,7 @@ class MUnbox : public MUnaryInstruction, public BoxInputsPolicy
 
 class MGuardObject : public MUnaryInstruction, public SingleObjectPolicy
 {
-    MGuardObject(MDefinition *ins)
+    explicit MGuardObject(MDefinition *ins)
       : MUnaryInstruction(ins)
     {
         setGuard();
@@ -2718,7 +2718,7 @@ class MGuardString
   : public MUnaryInstruction,
     public StringPolicy<0>
 {
-    MGuardString(MDefinition *ins)
+    explicit MGuardString(MDefinition *ins)
       : MUnaryInstruction(ins)
     {
         setGuard();
@@ -2860,7 +2860,7 @@ class MCreateThis
   : public MUnaryInstruction,
     public ObjectPolicy<0>
 {
-    MCreateThis(MDefinition *callee)
+    explicit MCreateThis(MDefinition *callee)
       : MUnaryInstruction(callee)
     {
         setResultType(MIRType_Value);
@@ -2894,7 +2894,7 @@ class MCreateArgumentsObject
   : public MUnaryInstruction,
     public ObjectPolicy<0>
 {
-    MCreateArgumentsObject(MDefinition *callObj)
+    explicit MCreateArgumentsObject(MDefinition *callObj)
       : MUnaryInstruction(callObj)
     {
         setResultType(MIRType_Object);
@@ -3076,7 +3076,7 @@ class MToDouble
 
     TruncateKind implicitTruncate_;
 
-    MToDouble(MDefinition *def, ConversionKind conversion = NonStringPrimitives)
+    explicit MToDouble(MDefinition *def, ConversionKind conversion = NonStringPrimitives)
       : MUnaryInstruction(def), conversion_(conversion), implicitTruncate_(NoTruncate)
     {
         setResultType(MIRType_Double);
@@ -3199,7 +3199,7 @@ class MToFloat32
 class MAsmJSUnsignedToDouble
   : public MUnaryInstruction
 {
-    MAsmJSUnsignedToDouble(MDefinition *def)
+    explicit MAsmJSUnsignedToDouble(MDefinition *def)
       : MUnaryInstruction(def)
     {
         setResultType(MIRType_Double);
@@ -3225,7 +3225,7 @@ class MAsmJSUnsignedToDouble
 class MAsmJSUnsignedToFloat32
   : public MUnaryInstruction
 {
-    MAsmJSUnsignedToFloat32(MDefinition *def)
+    explicit MAsmJSUnsignedToFloat32(MDefinition *def)
       : MUnaryInstruction(def)
     {
         setResultType(MIRType_Float32);
@@ -3319,7 +3319,7 @@ class MToInt32
 // operations. This is an infallible ValueToECMAInt32.
 class MTruncateToInt32 : public MUnaryInstruction
 {
-    MTruncateToInt32(MDefinition *def)
+    explicit MTruncateToInt32(MDefinition *def)
       : MUnaryInstruction(def)
     {
         setResultType(MIRType_Int32);
@@ -3360,7 +3360,7 @@ class MTruncateToInt32 : public MUnaryInstruction
 // Converts any type to a string
 class MToString : public MUnaryInstruction
 {
-    MToString(MDefinition *def)
+    explicit MToString(MDefinition *def)
       : MUnaryInstruction(def)
     {
         // Converting an object to a string might be effectful.
@@ -3396,7 +3396,7 @@ class MBitNot
     public BitwisePolicy
 {
   protected:
-    MBitNot(MDefinition *input)
+    explicit MBitNot(MDefinition *input)
       : MUnaryInstruction(input)
     {
         setResultType(MIRType_Int32);
@@ -3662,6 +3662,10 @@ class MLsh : public MShiftInstruction
     }
 
     void computeRange(TempAllocator &alloc);
+    bool writeRecoverData(CompactBufferWriter &writer) const;
+    bool canRecoverOnBailout() const {
+        return specialization_ != MIRType_None;
+    }
 };
 
 class MRsh : public MShiftInstruction
@@ -3681,6 +3685,11 @@ class MRsh : public MShiftInstruction
         return getOperand(0);
     }
     void computeRange(TempAllocator &alloc);
+
+    bool writeRecoverData(CompactBufferWriter &writer) const;
+    bool canRecoverOnBailout() const {
+        return specialization_ < MIRType_Object;
+    }
 };
 
 class MUrsh : public MShiftInstruction
@@ -4058,7 +4067,7 @@ class MPowHalf
     bool operandIsNeverNegativeZero_;
     bool operandIsNeverNaN_;
 
-    MPowHalf(MDefinition *input)
+    explicit MPowHalf(MDefinition *input)
       : MUnaryInstruction(input),
         operandIsNeverNegativeInfinity_(false),
         operandIsNeverNegativeZero_(false),
@@ -4643,7 +4652,7 @@ class MFromCharCode
   : public MUnaryInstruction,
     public IntPolicy<0>
 {
-    MFromCharCode(MDefinition *code)
+    explicit MFromCharCode(MDefinition *code)
       : MUnaryInstruction(code)
     {
         setMovable();
@@ -4653,6 +4662,9 @@ class MFromCharCode
   public:
     INSTRUCTION_HEADER(FromCharCode)
 
+    TypePolicy *typePolicy() {
+        return this;
+    }
     static MFromCharCode *New(TempAllocator &alloc, MDefinition *code) {
         return new(alloc) MFromCharCode(code);
     }
@@ -4717,7 +4729,7 @@ class MComputeThis
   : public MUnaryInstruction,
     public BoxPolicy<0>
 {
-    MComputeThis(MDefinition *def)
+    explicit MComputeThis(MDefinition *def)
       : MUnaryInstruction(def)
     {
         setResultType(MIRType_Object);
@@ -4749,7 +4761,7 @@ class MLoadArrowThis
   : public MUnaryInstruction,
     public SingleObjectPolicy
 {
-    MLoadArrowThis(MDefinition *callee)
+    explicit MLoadArrowThis(MDefinition *callee)
       : MUnaryInstruction(callee)
     {
         setResultType(MIRType_Value);
@@ -4991,7 +5003,7 @@ class MOsrValue : public MUnaryInstruction
 class MOsrScopeChain : public MUnaryInstruction
 {
   private:
-    MOsrScopeChain(MOsrEntry *entry)
+    explicit MOsrScopeChain(MOsrEntry *entry)
       : MUnaryInstruction(entry)
     {
         setResultType(MIRType_Object);
@@ -5013,7 +5025,7 @@ class MOsrScopeChain : public MUnaryInstruction
 class MOsrArgumentsObject : public MUnaryInstruction
 {
   private:
-    MOsrArgumentsObject(MOsrEntry *entry)
+    explicit MOsrArgumentsObject(MOsrEntry *entry)
       : MUnaryInstruction(entry)
     {
         setResultType(MIRType_Object);
@@ -5035,7 +5047,7 @@ class MOsrArgumentsObject : public MUnaryInstruction
 class MOsrReturnValue : public MUnaryInstruction
 {
   private:
-    MOsrReturnValue(MOsrEntry *entry)
+    explicit MOsrReturnValue(MOsrEntry *entry)
       : MUnaryInstruction(entry)
     {
         setResultType(MIRType_Value);
@@ -5067,7 +5079,7 @@ class MCheckOverRecursed : public MNullaryInstruction
 // Uses the per-thread recursion limit.
 class MCheckOverRecursedPar : public MUnaryInstruction
 {
-    MCheckOverRecursedPar(MDefinition *cx)
+    explicit MCheckOverRecursedPar(MDefinition *cx)
       : MUnaryInstruction(cx)
     {
         setResultType(MIRType_None);
@@ -5090,7 +5102,7 @@ class MCheckOverRecursedPar : public MUnaryInstruction
 // Check for an interrupt (or rendezvous) in parallel mode.
 class MInterruptCheckPar : public MUnaryInstruction
 {
-    MInterruptCheckPar(MDefinition *cx)
+    explicit MInterruptCheckPar(MDefinition *cx)
       : MUnaryInstruction(cx)
     {
         setResultType(MIRType_None);
@@ -5390,7 +5402,7 @@ struct LambdaFunctionInfo
     bool singletonType;
     bool useNewTypeForClone;
 
-    LambdaFunctionInfo(JSFunction *fun)
+    explicit LambdaFunctionInfo(JSFunction *fun)
       : fun(fun), flags(fun->flags()),
         scriptOrLazyScript(fun->hasScript()
                            ? (gc::Cell *) fun->nonLazyScript()
@@ -5510,6 +5522,10 @@ class MLambdaPar
         return getOperand(1);
     }
 
+    TypePolicy *typePolicy() {
+        return this;
+    }
+
     const LambdaFunctionInfo &info() const {
         return info_;
     }
@@ -5520,7 +5536,7 @@ class MImplicitThis
   : public MUnaryInstruction,
     public SingleObjectPolicy
 {
-    MImplicitThis(MDefinition *callee)
+    explicit MImplicitThis(MDefinition *callee)
       : MUnaryInstruction(callee)
     {
         setResultType(MIRType_Value);
@@ -5550,7 +5566,7 @@ class MSlots
   : public MUnaryInstruction,
     public SingleObjectPolicy
 {
-    MSlots(MDefinition *object)
+    explicit MSlots(MDefinition *object)
       : MUnaryInstruction(object)
     {
         setResultType(MIRType_Slots);
@@ -5583,7 +5599,7 @@ class MElements
   : public MUnaryInstruction,
     public SingleObjectPolicy
 {
-    MElements(MDefinition *object)
+    explicit MElements(MDefinition *object)
       : MUnaryInstruction(object)
     {
         setResultType(MIRType_Elements);
@@ -5617,7 +5633,7 @@ class MConstantElements : public MNullaryInstruction
     void *value_;
 
   protected:
-    MConstantElements(void *v)
+    explicit MConstantElements(void *v)
       : value_(v)
     {
         setResultType(MIRType_Elements);
@@ -5653,7 +5669,7 @@ class MConstantElements : public MNullaryInstruction
 class MConvertElementsToDoubles
   : public MUnaryInstruction
 {
-    MConvertElementsToDoubles(MDefinition *elements)
+    explicit MConvertElementsToDoubles(MDefinition *elements)
       : MUnaryInstruction(elements)
     {
         setGuard();
@@ -5731,7 +5747,7 @@ class MMaybeToDoubleElement
 class MInitializedLength
   : public MUnaryInstruction
 {
-    MInitializedLength(MDefinition *elements)
+    explicit MInitializedLength(MDefinition *elements)
       : MUnaryInstruction(elements)
     {
         setResultType(MIRType_Int32);
@@ -5790,7 +5806,7 @@ class MSetInitializedLength
 class MArrayLength
   : public MUnaryInstruction
 {
-    MArrayLength(MDefinition *elements)
+    explicit MArrayLength(MDefinition *elements)
       : MUnaryInstruction(elements)
     {
         setResultType(MIRType_Int32);
@@ -5850,7 +5866,7 @@ class MTypedArrayLength
   : public MUnaryInstruction,
     public SingleObjectPolicy
 {
-    MTypedArrayLength(MDefinition *obj)
+    explicit MTypedArrayLength(MDefinition *obj)
       : MUnaryInstruction(obj)
     {
         setResultType(MIRType_Int32);
@@ -5887,7 +5903,7 @@ class MTypedArrayElements
   : public MUnaryInstruction,
     public SingleObjectPolicy
 {
-    MTypedArrayElements(MDefinition *object)
+    explicit MTypedArrayElements(MDefinition *object)
       : MUnaryInstruction(object)
     {
         setResultType(MIRType_Elements);
@@ -5920,7 +5936,7 @@ class MNeuterCheck
   : public MUnaryInstruction
 {
   private:
-    MNeuterCheck(MDefinition *object)
+    explicit MNeuterCheck(MDefinition *object)
       : MUnaryInstruction(object)
     {
         JS_ASSERT(object->type() == MIRType_Object);
@@ -5958,7 +5974,7 @@ class MTypedObjectElements
     public SingleObjectPolicy
 {
   private:
-    MTypedObjectElements(MDefinition *object)
+    explicit MTypedObjectElements(MDefinition *object)
       : MUnaryInstruction(object)
     {
         setResultType(MIRType_Elements);
@@ -6033,7 +6049,7 @@ class MNot
     bool operandIsNeverNaN_;
 
   public:
-    MNot(MDefinition *input)
+    explicit MNot(MDefinition *input)
       : MUnaryInstruction(input),
         operandMightEmulateUndefined_(true),
         operandIsNeverNaN_(false)
@@ -6157,7 +6173,7 @@ class MBoundsCheckLower
     int32_t minimum_;
     bool fallible_;
 
-    MBoundsCheckLower(MDefinition *index)
+    explicit MBoundsCheckLower(MDefinition *index)
       : MUnaryInstruction(index), minimum_(0), fallible_(true)
     {
         setGuard();
@@ -6984,7 +7000,7 @@ class MClampToUint8
   : public MUnaryInstruction,
     public ClampPolicy
 {
-    MClampToUint8(MDefinition *input)
+    explicit MClampToUint8(MDefinition *input)
       : MUnaryInstruction(input)
     {
         setResultType(MIRType_Int32);
@@ -7953,7 +7969,7 @@ class MFunctionEnvironment
     public SingleObjectPolicy
 {
   public:
-    MFunctionEnvironment(MDefinition *function)
+    explicit MFunctionEnvironment(MDefinition *function)
         : MUnaryInstruction(function)
     {
         setResultType(MIRType_Object);
@@ -8014,7 +8030,7 @@ class MForkJoinContext
 class MForkJoinGetSlice
   : public MUnaryInstruction
 {
-    MForkJoinGetSlice(MDefinition *cx)
+    explicit MForkJoinGetSlice(MDefinition *cx)
       : MUnaryInstruction(cx)
     {
         setResultType(MIRType_Int32);
@@ -8146,7 +8162,7 @@ class MCallGetIntrinsicValue : public MNullaryInstruction
 {
     CompilerRootPropertyName name_;
 
-    MCallGetIntrinsicValue(PropertyName *name)
+    explicit MCallGetIntrinsicValue(PropertyName *name)
       : name_(name)
     {
         setResultType(MIRType_Value);
@@ -8729,7 +8745,7 @@ class MStringLength
   : public MUnaryInstruction,
     public StringPolicy<0>
 {
-    MStringLength(MDefinition *string)
+    explicit MStringLength(MDefinition *string)
       : MUnaryInstruction(string)
     {
         setResultType(MIRType_Int32);
@@ -8768,7 +8784,7 @@ class MFloor
   : public MUnaryInstruction,
     public FloatingPointPolicy<0>
 {
-    MFloor(MDefinition *num)
+    explicit MFloor(MDefinition *num)
       : MUnaryInstruction(num)
     {
         setResultType(MIRType_Int32);
@@ -8855,7 +8871,7 @@ class MRound
   : public MUnaryInstruction,
     public FloatingPointPolicy<0>
 {
-    MRound(MDefinition *num)
+    explicit MRound(MDefinition *num)
       : MUnaryInstruction(num)
     {
         setResultType(MIRType_Int32);
@@ -8928,7 +8944,7 @@ class MIteratorNext
   : public MUnaryInstruction,
     public SingleObjectPolicy
 {
-    MIteratorNext(MDefinition *iter)
+    explicit MIteratorNext(MDefinition *iter)
       : MUnaryInstruction(iter)
     {
         setResultType(MIRType_Value);
@@ -8953,7 +8969,7 @@ class MIteratorMore
   : public MUnaryInstruction,
     public SingleObjectPolicy
 {
-    MIteratorMore(MDefinition *iter)
+    explicit MIteratorMore(MDefinition *iter)
       : MUnaryInstruction(iter)
     {
         setResultType(MIRType_Boolean);
@@ -8978,7 +8994,7 @@ class MIteratorEnd
   : public MUnaryInstruction,
     public SingleObjectPolicy
 {
-    MIteratorEnd(MDefinition *iter)
+    explicit MIteratorEnd(MDefinition *iter)
       : MUnaryInstruction(iter)
     { }
 
@@ -9387,6 +9403,9 @@ class MGuardThreadExclusive
     AliasSet getAliasSet() const {
         return AliasSet::None();
     }
+    TypePolicy *typePolicy() {
+        return this;
+    }
     bool possiblyCalls() const {
         return true;
     }
@@ -9576,7 +9595,7 @@ class MNewDeclEnvObject : public MNullaryInstruction
 {
     CompilerRootObject templateObj_;
 
-    MNewDeclEnvObject(JSObject *templateObj)
+    explicit MNewDeclEnvObject(JSObject *templateObj)
       : MNullaryInstruction(),
         templateObj_(templateObj)
     {
@@ -9603,7 +9622,7 @@ class MNewCallObjectBase : public MNullaryInstruction
     CompilerRootObject templateObj_;
 
   protected:
-    MNewCallObjectBase(JSObject *templateObj)
+    explicit MNewCallObjectBase(JSObject *templateObj)
       : MNullaryInstruction(),
         templateObj_(templateObj)
     {
@@ -9624,7 +9643,7 @@ class MNewCallObject : public MNewCallObjectBase
   public:
     INSTRUCTION_HEADER(NewCallObject)
 
-    MNewCallObject(JSObject *templateObj)
+    explicit MNewCallObject(JSObject *templateObj)
       : MNewCallObjectBase(templateObj)
     {}
 
@@ -9640,7 +9659,7 @@ class MNewRunOnceCallObject : public MNewCallObjectBase
   public:
     INSTRUCTION_HEADER(NewRunOnceCallObject)
 
-    MNewRunOnceCallObject(JSObject *templateObj)
+    explicit MNewRunOnceCallObject(JSObject *templateObj)
       : MNewCallObjectBase(templateObj)
     {}
 
@@ -9766,7 +9785,7 @@ class MProfilerStackOp : public MNullaryInstruction
 // This is an alias for MLoadFixedSlot.
 class MEnclosingScope : public MLoadFixedSlot
 {
-    MEnclosingScope(MDefinition *obj)
+    explicit MEnclosingScope(MDefinition *obj)
       : MLoadFixedSlot(obj, ScopeObject::enclosingScopeSlot())
     {
         setResultType(MIRType_Object);
@@ -9939,7 +9958,7 @@ class MIsCallable
   : public MUnaryInstruction,
     public SingleObjectPolicy
 {
-    MIsCallable(MDefinition *object)
+    explicit MIsCallable(MDefinition *object)
       : MUnaryInstruction(object)
     {
         setResultType(MIRType_Boolean);
@@ -9953,6 +9972,9 @@ class MIsCallable
         return new(alloc) MIsCallable(obj);
     }
 
+    TypePolicy *typePolicy() {
+        return this;
+    }
     MDefinition *object() const {
         return getOperand(0);
     }
@@ -10012,6 +10034,9 @@ class MHasClass
         return new(alloc) MHasClass(obj, clasp);
     }
 
+    TypePolicy *typePolicy() {
+        return this;
+    }
     MDefinition *object() const {
         return getOperand(0);
     }
@@ -10230,7 +10255,7 @@ class MAsmJSLoadFuncPtr : public MUnaryInstruction
 
 class MAsmJSLoadFFIFunc : public MNullaryInstruction
 {
-    MAsmJSLoadFFIFunc(unsigned globalDataOffset)
+    explicit MAsmJSLoadFFIFunc(unsigned globalDataOffset)
       : globalDataOffset_(globalDataOffset)
     {
         setResultType(MIRType_Pointer);
@@ -10271,7 +10296,7 @@ class MAsmJSParameter : public MNullaryInstruction
 
 class MAsmJSReturn : public MAryControlInstruction<1, 0>
 {
-    MAsmJSReturn(MDefinition *ins) {
+    explicit MAsmJSReturn(MDefinition *ins) {
         initOperand(0, ins);
     }
 
@@ -10331,9 +10356,9 @@ class MAsmJSCall MOZ_FINAL : public MInstruction
         } u;
       public:
         Callee() {}
-        Callee(Label *callee) : which_(Internal) { u.internal_ = callee; }
-        Callee(MDefinition *callee) : which_(Dynamic) { u.dynamic_ = callee; }
-        Callee(AsmJSImmKind callee) : which_(Builtin) { u.builtin_ = callee; }
+        explicit Callee(Label *callee) : which_(Internal) { u.internal_ = callee; }
+        explicit Callee(MDefinition *callee) : which_(Dynamic) { u.dynamic_ = callee; }
+        explicit Callee(AsmJSImmKind callee) : which_(Builtin) { u.builtin_ = callee; }
         Which which() const { return which_; }
         Label *internal() const { JS_ASSERT(which_ == Internal); return u.internal_; }
         MDefinition *dynamic() const { JS_ASSERT(which_ == Dynamic); return u.dynamic_; }
diff --git a/js/src/jit/MIRGraph.h b/js/src/jit/MIRGraph.h
index 26cb9b0e2d66..72805a7f887f 100644
--- a/js/src/jit/MIRGraph.h
+++ b/js/src/jit/MIRGraph.h
@@ -545,7 +545,7 @@ class MIRGraph
     bool hasTryBlock_;
 
   public:
-    MIRGraph(TempAllocator *alloc)
+    explicit MIRGraph(TempAllocator *alloc)
       : alloc_(alloc),
         returnAccumulator_(nullptr),
         blockIdGen_(0),
@@ -698,7 +698,7 @@ class MDefinitionIterator
     }
 
   public:
-    MDefinitionIterator(MBasicBlock *block)
+    explicit MDefinitionIterator(MBasicBlock *block)
       : block_(block),
         phiIter_(block->phisBegin()),
         iter_(block->begin())
diff --git a/js/src/jit/ParallelSafetyAnalysis.cpp b/js/src/jit/ParallelSafetyAnalysis.cpp
index 01064227e113..4de76d2ac189 100644
--- a/js/src/jit/ParallelSafetyAnalysis.cpp
+++ b/js/src/jit/ParallelSafetyAnalysis.cpp
@@ -92,7 +92,7 @@ class ParallelSafetyVisitor : public MInstructionVisitor
     }
 
   public:
-    ParallelSafetyVisitor(MIRGraph &graph)
+    explicit ParallelSafetyVisitor(MIRGraph &graph)
       : graph_(graph),
         unsafe_(false),
         cx_(nullptr)
diff --git a/js/src/jit/RangeAnalysis.h b/js/src/jit/RangeAnalysis.h
index 544644187eab..74f6e794b5fc 100644
--- a/js/src/jit/RangeAnalysis.h
+++ b/js/src/jit/RangeAnalysis.h
@@ -366,7 +366,7 @@ class Range : public TempObject {
     // Construct a range from the given MDefinition. This differs from the
     // MDefinition's range() method in that it describes the range of values
     // *after* any bailout checks.
-    Range(const MDefinition *def);
+    explicit Range(const MDefinition *def);
 
     static Range *NewInt32Range(TempAllocator &alloc, int32_t l, int32_t h) {
         return new(alloc) Range(l, h, false, MaxInt32Exponent);
diff --git a/js/src/jit/Recover.cpp b/js/src/jit/Recover.cpp
index f28a03c54f5f..26455eb3743c 100644
--- a/js/src/jit/Recover.cpp
+++ b/js/src/jit/Recover.cpp
@@ -216,6 +216,60 @@ RBitXor::recover(JSContext *cx, SnapshotIterator &iter) const
     return true;
 }
 
+bool
+MLsh::writeRecoverData(CompactBufferWriter &writer) const
+{
+    MOZ_ASSERT(canRecoverOnBailout());
+    writer.writeUnsigned(uint32_t(RInstruction::Recover_Lsh));
+    return true;
+}
+
+RLsh::RLsh(CompactBufferReader &reader)
+{}
+
+bool
+RLsh::recover(JSContext *cx, SnapshotIterator &iter) const
+{
+    RootedValue lhs(cx, iter.read());
+    RootedValue rhs(cx, iter.read());
+    int32_t result;
+    MOZ_ASSERT(!lhs.isObject() && !rhs.isObject());
+
+    if (!js::BitLsh(cx, lhs, rhs, &result))
+        return false;
+
+    RootedValue asValue(cx, js::Int32Value(result));
+    iter.storeInstructionResult(asValue);
+    return true;
+}
+
+bool
+MRsh::writeRecoverData(CompactBufferWriter &writer) const
+{
+    MOZ_ASSERT(canRecoverOnBailout());
+    writer.writeUnsigned(uint32_t(RInstruction::Recover_Rsh));
+    return true;
+}
+
+RRsh::RRsh(CompactBufferReader &reader)
+{ }
+
+bool
+RRsh::recover(JSContext *cx, SnapshotIterator &iter) const
+{
+    RootedValue lhs(cx, iter.read());
+    RootedValue rhs(cx, iter.read());
+    MOZ_ASSERT(!lhs.isObject() && !rhs.isObject());
+
+    int32_t result;
+    if (!js::BitRsh(cx, lhs, rhs, &result))
+        return false;
+
+    RootedValue rootedResult(cx, js::Int32Value(result));
+    iter.storeInstructionResult(rootedResult);
+    return true;
+}
+
 bool
 MUrsh::writeRecoverData(CompactBufferWriter &writer) const
 {
diff --git a/js/src/jit/Recover.h b/js/src/jit/Recover.h
index c4d52726ab1d..7bdb45ff70da 100644
--- a/js/src/jit/Recover.h
+++ b/js/src/jit/Recover.h
@@ -21,6 +21,8 @@ namespace jit {
     _(BitNot)                                   \
     _(BitOr)                                    \
     _(BitXor)                                   \
+    _(Lsh)                                      \
+    _(Rsh)                                      \
     _(Ursh)                                     \
     _(Add)                                      \
     _(NewObject)                                \
@@ -67,7 +69,7 @@ class RInstruction
 #define RINSTRUCTION_HEADER_(op)                                        \
   private:                                                              \
     friend class RInstruction;                                          \
-    R##op(CompactBufferReader &reader);                                 \
+    explicit R##op(CompactBufferReader &reader);                        \
                                                                         \
   public:                                                               \
     Opcode opcode() const {                                             \
@@ -128,6 +130,30 @@ class RBitXor MOZ_FINAL : public RInstruction
     bool recover(JSContext *cx, SnapshotIterator &iter) const;
 };
 
+class RLsh MOZ_FINAL : public RInstruction
+{
+  public:
+    RINSTRUCTION_HEADER_(Lsh)
+
+    virtual uint32_t numOperands() const {
+        return 2;
+    }
+
+    bool recover(JSContext *cx, SnapshotIterator &iter) const;
+};
+
+class RRsh MOZ_FINAL : public RInstruction
+{
+  public:
+    RINSTRUCTION_HEADER_(Rsh)
+
+    virtual uint32_t numOperands() const {
+        return 2;
+    }
+
+    bool recover(JSContext *cx, SnapshotIterator &iter) const;
+};
+
 class RUrsh MOZ_FINAL : public RInstruction
 {
   public:
diff --git a/js/src/jit/RegisterAllocator.h b/js/src/jit/RegisterAllocator.h
index dfb3acbf2128..da593e9c3d55 100644
--- a/js/src/jit/RegisterAllocator.h
+++ b/js/src/jit/RegisterAllocator.h
@@ -138,7 +138,7 @@ struct AllocationIntegrityState
 class CodePosition
 {
   private:
-    MOZ_CONSTEXPR CodePosition(const uint32_t &bits)
+    MOZ_CONSTEXPR explicit CodePosition(const uint32_t &bits)
       : bits_(bits)
     { }
 
diff --git a/js/src/jit/RegisterSets.h b/js/src/jit/RegisterSets.h
index fdb085b5e1a0..3e8a168d938e 100644
--- a/js/src/jit/RegisterSets.h
+++ b/js/src/jit/RegisterSets.h
@@ -166,7 +166,7 @@ class TypedOrValueRegister
         dataTyped() = reg;
     }
 
-    TypedOrValueRegister(ValueOperand value)
+    MOZ_IMPLICIT TypedOrValueRegister(ValueOperand value)
       : type_(MIRType_Value)
     {
         dataValue() = value;
@@ -225,13 +225,13 @@ class ConstantOrRegister
     ConstantOrRegister()
     {}
 
-    ConstantOrRegister(Value value)
+    MOZ_IMPLICIT ConstantOrRegister(Value value)
       : constant_(true)
     {
         dataValue() = value;
     }
 
-    ConstantOrRegister(TypedOrValueRegister reg)
+    MOZ_IMPLICIT ConstantOrRegister(TypedOrValueRegister reg)
       : constant_(false)
     {
         dataReg() = reg;
@@ -631,7 +631,7 @@ class TypedRegisterIterator
     TypedRegisterSet<T> regset_;
 
   public:
-    TypedRegisterIterator(TypedRegisterSet<T> regset) : regset_(regset)
+    explicit TypedRegisterIterator(TypedRegisterSet<T> regset) : regset_(regset)
     { }
     TypedRegisterIterator(const TypedRegisterIterator &other) : regset_(other.regset_)
     { }
@@ -660,7 +660,7 @@ class TypedRegisterBackwardIterator
     TypedRegisterSet<T> regset_;
 
   public:
-    TypedRegisterBackwardIterator(TypedRegisterSet<T> regset) : regset_(regset)
+    explicit TypedRegisterBackwardIterator(TypedRegisterSet<T> regset) : regset_(regset)
     { }
     TypedRegisterBackwardIterator(const TypedRegisterBackwardIterator &other)
       : regset_(other.regset_)
@@ -690,7 +690,7 @@ class TypedRegisterForwardIterator
     TypedRegisterSet<T> regset_;
 
   public:
-    TypedRegisterForwardIterator(TypedRegisterSet<T> regset) : regset_(regset)
+    explicit TypedRegisterForwardIterator(TypedRegisterSet<T> regset) : regset_(regset)
     { }
     TypedRegisterForwardIterator(const TypedRegisterForwardIterator &other) : regset_(other.regset_)
     { }
@@ -731,7 +731,7 @@ class AnyRegisterIterator
     AnyRegisterIterator(GeneralRegisterSet genset, FloatRegisterSet floatset)
       : geniter_(genset), floatiter_(floatset)
     { }
-    AnyRegisterIterator(const RegisterSet &set)
+    explicit AnyRegisterIterator(const RegisterSet &set)
       : geniter_(set.gpr_), floatiter_(set.fpu_)
     { }
     AnyRegisterIterator(const AnyRegisterIterator &other)
@@ -770,9 +770,9 @@ class ABIArg
 
   public:
     ABIArg() : kind_(Kind(-1)) { u.offset_ = -1; }
-    ABIArg(Register gpr) : kind_(GPR) { u.gpr_ = gpr.code(); }
-    ABIArg(FloatRegister fpu) : kind_(FPU) { u.fpu_ = fpu.code(); }
-    ABIArg(uint32_t offset) : kind_(Stack) { u.offset_ = offset; }
+    explicit ABIArg(Register gpr) : kind_(GPR) { u.gpr_ = gpr.code(); }
+    explicit ABIArg(FloatRegister fpu) : kind_(FPU) { u.fpu_ = fpu.code(); }
+    explicit ABIArg(uint32_t offset) : kind_(Stack) { u.offset_ = offset; }
 
     Kind kind() const { return kind_; }
     Register gpr() const { JS_ASSERT(kind() == GPR); return Register::FromCode(u.gpr_); }
diff --git a/js/src/jit/RematerializedFrame.cpp b/js/src/jit/RematerializedFrame.cpp
index a0517decfa69..cd1c98ec7bc0 100644
--- a/js/src/jit/RematerializedFrame.cpp
+++ b/js/src/jit/RematerializedFrame.cpp
@@ -19,7 +19,7 @@ struct CopyValueToRematerializedFrame
 {
     Value *slots;
 
-    CopyValueToRematerializedFrame(Value *slots)
+    explicit CopyValueToRematerializedFrame(Value *slots)
       : slots(slots)
     { }
 
diff --git a/js/src/jit/Safepoints.cpp b/js/src/jit/Safepoints.cpp
index 89b53ba1e309..a34b759405f3 100644
--- a/js/src/jit/Safepoints.cpp
+++ b/js/src/jit/Safepoints.cpp
@@ -379,7 +379,7 @@ SafepointReader::InvalidationPatchPoint(IonScript *script, const SafepointIndex
 {
     SafepointReader reader(script, si);
 
-    return CodeLocationLabel(script->method(), reader.osiCallPointOffset());
+    return CodeLocationLabel(script->method(), CodeOffsetLabel(reader.osiCallPointOffset()));
 }
 
 void
diff --git a/js/src/jit/Snapshots.h b/js/src/jit/Snapshots.h
index 233b5af80959..421a972884d2 100644
--- a/js/src/jit/Snapshots.h
+++ b/js/src/jit/Snapshots.h
@@ -149,7 +149,7 @@ class RValueAllocation
     {
     }
 
-    RValueAllocation(Mode mode)
+    explicit RValueAllocation(Mode mode)
       : mode_(mode)
     {
     }
diff --git a/js/src/jit/TypePolicy.h b/js/src/jit/TypePolicy.h
index 1635c1b3aa1e..6c7d16688b78 100644
--- a/js/src/jit/TypePolicy.h
+++ b/js/src/jit/TypePolicy.h
@@ -100,7 +100,7 @@ class PowPolicy : public BoxInputsPolicy
     MIRType specialization_;
 
   public:
-    PowPolicy(MIRType specialization)
+    explicit PowPolicy(MIRType specialization)
       : specialization_(specialization)
     { }
 
diff --git a/js/src/jit/VMFunctions.h b/js/src/jit/VMFunctions.h
index 26b287b42072..dd51ddc3ce0a 100644
--- a/js/src/jit/VMFunctions.h
+++ b/js/src/jit/VMFunctions.h
@@ -242,7 +242,7 @@ struct VMFunction
 // A collection of VM functions for each execution mode.
 struct VMFunctionsModal
 {
-    VMFunctionsModal(const VMFunction &info) {
+    explicit VMFunctionsModal(const VMFunction &info) {
         add(info);
     }
     VMFunctionsModal(const VMFunction &info1, const VMFunction &info2) {
@@ -445,7 +445,7 @@ template <> struct MatchContext<ThreadSafeContext *> {
     static inline uint64_t argumentRootTypes() {                                        \
         return ForEachNb(COMPUTE_ARG_ROOT, SEP_OR, NOTHING);                            \
     }                                                                                   \
-    FunctionInfo(pf fun, PopValues extraValuesToPop = PopValues(0))                     \
+    explicit FunctionInfo(pf fun, PopValues extraValuesToPop = PopValues(0))            \
         : VMFunction(JS_FUNC_TO_DATA_PTR(void *, fun), explicitArgs(),                  \
                      argumentProperties(), argumentPassedInFloatRegs(),                 \
                      argumentRootTypes(), outParam(), outParamRootType(),               \
@@ -486,7 +486,7 @@ struct FunctionInfo<R (*)(Context)> : public VMFunction {
     static inline uint64_t argumentRootTypes() {
         return 0;
     }
-    FunctionInfo(pf fun)
+    explicit FunctionInfo(pf fun)
       : VMFunction(JS_FUNC_TO_DATA_PTR(void *, fun), explicitArgs(),
                    argumentProperties(), argumentPassedInFloatRegs(),
                    argumentRootTypes(), outParam(), outParamRootType(),
diff --git a/js/src/jit/arm/MacroAssembler-arm.cpp b/js/src/jit/arm/MacroAssembler-arm.cpp
index 684b183d2b8c..162c3ee03b1c 100644
--- a/js/src/jit/arm/MacroAssembler-arm.cpp
+++ b/js/src/jit/arm/MacroAssembler-arm.cpp
@@ -1299,10 +1299,10 @@ MacroAssemblerARM::ma_vpush(VFPRegister r)
 }
 
 // Branches when done from within arm-specific code.
-void
+BufferOffset
 MacroAssemblerARM::ma_b(Label *dest, Assembler::Condition c, bool isPatchable)
 {
-    as_b(dest, c, isPatchable);
+    return as_b(dest, c, isPatchable);
 }
 
 void
@@ -2047,7 +2047,7 @@ MacroAssemblerARMCompat::movePtr(AsmJSImmPtr imm, Register dest)
     else
         rs = L_LDR;
 
-    enoughMemory_ &= append(AsmJSAbsoluteLink(nextOffset().getOffset(), imm.kind()));
+    enoughMemory_ &= append(AsmJSAbsoluteLink(CodeOffsetLabel(nextOffset().getOffset()), imm.kind()));
     ma_movPatchable(Imm32(-1), dest, Always, rs);
 }
 void
@@ -3520,20 +3520,6 @@ MacroAssemblerARMCompat::storeTypeTag(ImmTag tag, Register base, Register index,
     ma_sub(base, Imm32(NUNBOX32_TYPE_OFFSET), base);
 }
 
-void
-MacroAssemblerARMCompat::linkExitFrame()
-{
-    uint8_t *dest = (uint8_t*)GetIonContext()->runtime->addressOfJitTop();
-    movePtr(ImmPtr(dest), ScratchRegister);
-    ma_str(StackPointer, Operand(ScratchRegister, 0));
-}
-
-void
-MacroAssemblerARMCompat::linkParallelExitFrame(Register pt)
-{
-    ma_str(StackPointer, Operand(pt, offsetof(PerThreadData, jitTop)));
-}
-
 // ARM says that all reads of pc will return 8 higher than the
 // address of the currently executing instruction.  This means we are
 // correctly storing the address of the instruction after the call
@@ -4243,9 +4229,10 @@ MacroAssemblerARMCompat::ceil(FloatRegister input, Register output, Label *bail)
     ma_vcvt_U32_F64(ScratchFloatReg, ScratchFloatReg);
     compareDouble(ScratchFloatReg, input);
     ma_add(output, Imm32(1), output, NoSetCond, NotEqual);
-    // Bail out if the add overflowed or the result is negative
+    // Bail out if the add overflowed or the result is non positive
     ma_mov(output, output, SetCond);
     ma_b(bail, Signed);
+    ma_b(bail, Zero);
 
     bind(&fin);
 }
@@ -4294,9 +4281,10 @@ MacroAssemblerARMCompat::ceilf(FloatRegister input, Register output, Label *bail
     ma_vcvt_U32_F32(ScratchFloatReg, ScratchFloatReg);
     compareFloat(ScratchFloatReg, input);
     ma_add(output, Imm32(1), output, NoSetCond, NotEqual);
-    // Bail out if the add overflowed or the result is negative
+    // Bail out if the add overflowed or the result is non positive
     ma_mov(output, output, SetCond);
     ma_b(bail, Signed);
+    ma_b(bail, Zero);
 
     bind(&fin);
 }
@@ -4305,8 +4293,9 @@ CodeOffsetLabel
 MacroAssemblerARMCompat::toggledJump(Label *label)
 {
     // Emit a B that can be toggled to a CMP. See ToggleToJmp(), ToggleToCmp().
-    CodeOffsetLabel ret(nextOffset().getOffset());
-    ma_b(label, Always, true);
+    
+    BufferOffset b = ma_b(label, Always, true);
+    CodeOffsetLabel ret(b.getOffset());
     return ret;
 }
 
diff --git a/js/src/jit/arm/MacroAssembler-arm.h b/js/src/jit/arm/MacroAssembler-arm.h
index 099917f7d200..119746cb314b 100644
--- a/js/src/jit/arm/MacroAssembler-arm.h
+++ b/js/src/jit/arm/MacroAssembler-arm.h
@@ -312,7 +312,7 @@ class MacroAssemblerARM : public Assembler
     void ma_vpush(VFPRegister r);
 
     // branches when done from within arm-specific code
-    void ma_b(Label *dest, Condition c = Always, bool isPatchable = false);
+    BufferOffset ma_b(Label *dest, Condition c = Always, bool isPatchable = false);
     void ma_bx(Register dest, Condition c = Always);
 
     void ma_b(void *target, Relocation::Kind reloc, Condition c = Always);
@@ -699,7 +699,7 @@ class MacroAssemblerARMCompat : public MacroAssemblerARM
     }
 
     CodeOffsetLabel movWithPatch(ImmWord imm, Register dest) {
-        CodeOffsetLabel label = currentOffset();
+        CodeOffsetLabel label = CodeOffsetLabel(currentOffset());
         ma_movPatchable(Imm32(imm.value), dest, Always, hasMOVWT() ? L_MOVWT : L_LDR);
         return label;
     }
@@ -1191,8 +1191,6 @@ class MacroAssemblerARMCompat : public MacroAssemblerARM
         ma_orr(Imm32(type), frameSizeReg);
     }
 
-    void linkExitFrame();
-    void linkParallelExitFrame(Register pt);
     void handleFailureWithHandler(void *handler);
     void handleFailureWithHandlerTail();
 
@@ -1429,9 +1427,6 @@ class MacroAssemblerARMCompat : public MacroAssemblerARM
     void addPtr(ImmPtr imm, const Register dest) {
         addPtr(ImmWord(uintptr_t(imm.value)), dest);
     }
-    void mulBy3(const Register &src, const Register &dest) {
-        as_add(dest, src, lsl(src, 1));
-    }
 
     void setStackArg(Register reg, uint32_t arg);
 
diff --git a/js/src/jit/mips/MacroAssembler-mips.cpp b/js/src/jit/mips/MacroAssembler-mips.cpp
index 322f9061ba6b..427ae882e6e7 100644
--- a/js/src/jit/mips/MacroAssembler-mips.cpp
+++ b/js/src/jit/mips/MacroAssembler-mips.cpp
@@ -2901,20 +2901,6 @@ MacroAssemblerMIPSCompat::storeTypeTag(ImmTag tag, Register base, Register index
     as_sw(ScratchRegister, SecondScratchReg, TAG_OFFSET);
 }
 
-void
-MacroAssemblerMIPSCompat::linkExitFrame()
-{
-    uint8_t *dest = (uint8_t*)GetIonContext()->runtime->addressOfJitTop();
-    movePtr(ImmPtr(dest), ScratchRegister);
-    ma_sw(StackPointer, Address(ScratchRegister, 0));
-}
-
-void
-MacroAssemblerMIPSCompat::linkParallelExitFrame(Register pt)
-{
-    ma_sw(StackPointer, Address(pt, offsetof(PerThreadData, jitTop)));
-}
-
 // This macrosintruction calls the ion code and pushes the return address to
 // the stack in the case when stack is alligned.
 void
diff --git a/js/src/jit/mips/MacroAssembler-mips.h b/js/src/jit/mips/MacroAssembler-mips.h
index 4cb38a656b5e..1eb2ccdcb29e 100644
--- a/js/src/jit/mips/MacroAssembler-mips.h
+++ b/js/src/jit/mips/MacroAssembler-mips.h
@@ -889,8 +889,6 @@ public:
         ma_or(frameSizeReg, frameSizeReg, Imm32(type));
     }
 
-    void linkExitFrame();
-    void linkParallelExitFrame(Register pt);
     void handleFailureWithHandler(void *handler);
     void handleFailureWithHandlerTail();
 
diff --git a/js/src/jit/shared/Assembler-shared.h b/js/src/jit/shared/Assembler-shared.h
index 3823aa3a6682..378f77ca2dd2 100644
--- a/js/src/jit/shared/Assembler-shared.h
+++ b/js/src/jit/shared/Assembler-shared.h
@@ -363,7 +363,7 @@ class CodeLabel
   public:
     CodeLabel()
     { }
-    CodeLabel(const AbsoluteLabel &dest)
+    explicit CodeLabel(const AbsoluteLabel &dest)
        : dest_(dest)
     { }
     AbsoluteLabel *dest() {
@@ -413,7 +413,7 @@ class CodeOffsetLabel
     size_t offset_;
 
   public:
-    CodeOffsetLabel(size_t offset) : offset_(offset) {}
+    explicit CodeOffsetLabel(size_t offset) : offset_(offset) {}
     CodeOffsetLabel() : offset_(0) {}
 
     size_t offset() const {
@@ -529,11 +529,11 @@ class CodeLocationLabel
         *this = base;
         repoint(code);
     }
-    CodeLocationLabel(JitCode *code) {
+    explicit CodeLocationLabel(JitCode *code) {
         raw_ = code->raw();
         setAbsolute();
     }
-    CodeLocationLabel(uint8_t *raw) {
+    explicit CodeLocationLabel(uint8_t *raw) {
         raw_ = raw;
         setAbsolute();
     }
@@ -757,7 +757,8 @@ class AsmJSImmPtr
     AsmJSImmKind kind_;
   public:
     AsmJSImmKind kind() const { return kind_; }
-    AsmJSImmPtr(AsmJSImmKind kind) : kind_(kind) { JS_ASSERT(IsCompilingAsmJS()); }
+    // This needs to be MOZ_IMPLICIT in order to make MacroAssember::CallWithABINoProfiling compile.
+    MOZ_IMPLICIT AsmJSImmPtr(AsmJSImmKind kind) : kind_(kind) { JS_ASSERT(IsCompilingAsmJS()); }
     AsmJSImmPtr() {}
 };
 
@@ -768,7 +769,7 @@ class AsmJSAbsoluteAddress
     AsmJSImmKind kind_;
   public:
     AsmJSImmKind kind() const { return kind_; }
-    AsmJSAbsoluteAddress(AsmJSImmKind kind) : kind_(kind) { JS_ASSERT(IsCompilingAsmJS()); }
+    explicit AsmJSAbsoluteAddress(AsmJSImmKind kind) : kind_(kind) { JS_ASSERT(IsCompilingAsmJS()); }
     AsmJSAbsoluteAddress() {}
 };
 
diff --git a/js/src/jit/shared/BaselineCompiler-shared.cpp b/js/src/jit/shared/BaselineCompiler-shared.cpp
index 675c7525bdc0..c7bfd00e1cd2 100644
--- a/js/src/jit/shared/BaselineCompiler-shared.cpp
+++ b/js/src/jit/shared/BaselineCompiler-shared.cpp
@@ -97,7 +97,7 @@ BaselineCompilerShared::callVM(const VMFunction &fun, CallVMPhase phase)
     // Add a fake ICEntry (without stubs), so that the return offset to
     // pc mapping works.
     ICEntry entry(script->pcToOffset(pc), ICEntry::Kind_CallVM);
-    entry.setReturnOffset(callOffset);
+    entry.setReturnOffset(CodeOffsetLabel(callOffset));
 
     return icEntries_.append(entry);
 }
diff --git a/js/src/jit/shared/CodeGenerator-shared.h b/js/src/jit/shared/CodeGenerator-shared.h
index c3c521985dd2..83ae41d60219 100644
--- a/js/src/jit/shared/CodeGenerator-shared.h
+++ b/js/src/jit/shared/CodeGenerator-shared.h
@@ -649,7 +649,7 @@ class StoreRegisterTo
     Register out_;
 
   public:
-    StoreRegisterTo(Register out)
+    explicit StoreRegisterTo(Register out)
       : out_(out)
     { }
 
@@ -669,7 +669,7 @@ class StoreFloatRegisterTo
     FloatRegister out_;
 
   public:
-    StoreFloatRegisterTo(FloatRegister out)
+    explicit StoreFloatRegisterTo(FloatRegister out)
       : out_(out)
     { }
 
@@ -690,7 +690,7 @@ class StoreValueTo_
     Output out_;
 
   public:
-    StoreValueTo_(const Output &out)
+    explicit StoreValueTo_(const Output &out)
       : out_(out)
     { }
 
@@ -803,7 +803,7 @@ class OutOfLinePropagateAbortPar : public OutOfLineCode
     LInstruction *lir_;
 
   public:
-    OutOfLinePropagateAbortPar(LInstruction *lir)
+    explicit OutOfLinePropagateAbortPar(LInstruction *lir)
       : lir_(lir)
     { }
 
diff --git a/js/src/jit/shared/CodeGenerator-x86-shared.cpp b/js/src/jit/shared/CodeGenerator-x86-shared.cpp
index 0fcaf4afb05f..f84f8f21b034 100644
--- a/js/src/jit/shared/CodeGenerator-x86-shared.cpp
+++ b/js/src/jit/shared/CodeGenerator-x86-shared.cpp
@@ -367,7 +367,7 @@ class BailoutJump {
     Assembler::Condition cond_;
 
   public:
-    BailoutJump(Assembler::Condition cond) : cond_(cond)
+    explicit BailoutJump(Assembler::Condition cond) : cond_(cond)
     { }
 #ifdef JS_CODEGEN_X86
     void operator()(MacroAssembler &masm, uint8_t *code) const {
@@ -383,7 +383,7 @@ class BailoutLabel {
     Label *label_;
 
   public:
-    BailoutLabel(Label *label) : label_(label)
+    explicit BailoutLabel(Label *label) : label_(label)
     { }
 #ifdef JS_CODEGEN_X86
     void operator()(MacroAssembler &masm, uint8_t *code) const {
@@ -616,7 +616,7 @@ class OutOfLineUndoALUOperation : public OutOfLineCodeBase<CodeGeneratorX86Share
     LInstruction *ins_;
 
   public:
-    OutOfLineUndoALUOperation(LInstruction *ins)
+    explicit OutOfLineUndoALUOperation(LInstruction *ins)
         : ins_(ins)
     { }
 
@@ -711,7 +711,7 @@ class MulNegativeZeroCheck : public OutOfLineCodeBase<CodeGeneratorX86Shared>
     LMulI *ins_;
 
   public:
-    MulNegativeZeroCheck(LMulI *ins)
+    explicit MulNegativeZeroCheck(LMulI *ins)
       : ins_(ins)
     { }
 
@@ -1446,7 +1446,7 @@ class OutOfLineTableSwitch : public OutOfLineCodeBase<CodeGeneratorX86Shared>
     }
 
   public:
-    OutOfLineTableSwitch(MTableSwitch *mir)
+    explicit OutOfLineTableSwitch(MTableSwitch *mir)
       : mir_(mir)
     {}
 
diff --git a/js/src/jit/shared/CodeGenerator-x86-shared.h b/js/src/jit/shared/CodeGenerator-x86-shared.h
index 93a80507a2b1..994f3ed63337 100644
--- a/js/src/jit/shared/CodeGenerator-x86-shared.h
+++ b/js/src/jit/shared/CodeGenerator-x86-shared.h
@@ -197,7 +197,7 @@ class OutOfLineBailout : public OutOfLineCodeBase<CodeGeneratorX86Shared>
     LSnapshot *snapshot_;
 
   public:
-    OutOfLineBailout(LSnapshot *snapshot)
+    explicit OutOfLineBailout(LSnapshot *snapshot)
       : snapshot_(snapshot)
     { }
 
diff --git a/js/src/jit/shared/IonAssemblerBufferWithConstantPools.h b/js/src/jit/shared/IonAssemblerBufferWithConstantPools.h
index 825977bf7f20..843b2e616d13 100644
--- a/js/src/jit/shared/IonAssemblerBufferWithConstantPools.h
+++ b/js/src/jit/shared/IonAssemblerBufferWithConstantPools.h
@@ -221,7 +221,7 @@ struct BufferSliceTail : public BufferSlice<SliceSize> {
     }
     bool isNextBranch() {
         unsigned int size = this->nodeSize;
-        if (size == InstBaseSize || size >= SliceSize)
+        if (size >= SliceSize)
             return false;
         int idx = size / InstBaseSize;
         return (isBranch[idx >> 3] >> (idx & 0x7)) & 1;
diff --git a/js/src/jit/shared/LIR-x86-shared.h b/js/src/jit/shared/LIR-x86-shared.h
index 5f98bd64edcc..c11e70fdde8a 100644
--- a/js/src/jit/shared/LIR-x86-shared.h
+++ b/js/src/jit/shared/LIR-x86-shared.h
@@ -192,7 +192,7 @@ class LPowHalfD : public LInstructionHelper<1, 1, 0>
 {
   public:
     LIR_HEADER(PowHalfD)
-    LPowHalfD(const LAllocation &input) {
+    explicit LPowHalfD(const LAllocation &input) {
         setOperand(0, input);
     }
 
@@ -274,7 +274,7 @@ class LGuardShape : public LInstructionHelper<0, 1, 0>
   public:
     LIR_HEADER(GuardShape)
 
-    LGuardShape(const LAllocation &in) {
+    explicit LGuardShape(const LAllocation &in) {
         setOperand(0, in);
     }
     const MGuardShape *mir() const {
@@ -287,7 +287,7 @@ class LGuardObjectType : public LInstructionHelper<0, 1, 0>
   public:
     LIR_HEADER(GuardObjectType)
 
-    LGuardObjectType(const LAllocation &in) {
+    explicit LGuardObjectType(const LAllocation &in) {
         setOperand(0, in);
     }
     const MGuardObjectType *mir() const {
diff --git a/js/src/jit/shared/Lowering-shared-inl.h b/js/src/jit/shared/Lowering-shared-inl.h
index 6b1d0c927d1e..59612193ab20 100644
--- a/js/src/jit/shared/Lowering-shared-inl.h
+++ b/js/src/jit/shared/Lowering-shared-inl.h
@@ -400,7 +400,7 @@ LIRGeneratorShared::useFixed(MDefinition *mir, FloatRegister reg)
 LUse
 LIRGeneratorShared::useFixed(MDefinition *mir, AnyRegister reg)
 {
-    return reg.isFloat() ? use(mir, reg.fpu()) : use(mir, reg.gpr());
+    return reg.isFloat() ? use(mir, LUse(reg.fpu())) : use(mir, LUse(reg.gpr()));
 }
 
 LDefinition
diff --git a/js/src/jit/shared/Lowering-shared.cpp b/js/src/jit/shared/Lowering-shared.cpp
index ad0f209356cb..cfb6c33c15fc 100644
--- a/js/src/jit/shared/Lowering-shared.cpp
+++ b/js/src/jit/shared/Lowering-shared.cpp
@@ -138,7 +138,7 @@ LIRGeneratorShared::buildSnapshot(LInstruction *ins, MResumePoint *rp, BailoutKi
             *payload = LConstantIndex::Bogus();
         } else if (ins->type() != MIRType_Value) {
             *type = LConstantIndex::Bogus();
-            *payload = use(ins, LUse::KEEPALIVE);
+            *payload = use(ins, LUse(LUse::KEEPALIVE));
         } else {
             *type = useType(ins, LUse::KEEPALIVE);
             *payload = usePayload(ins, LUse::KEEPALIVE);
diff --git a/js/src/jit/shared/MoveEmitter-x86-shared.h b/js/src/jit/shared/MoveEmitter-x86-shared.h
index a08f6b3b8316..fff7c937d710 100644
--- a/js/src/jit/shared/MoveEmitter-x86-shared.h
+++ b/js/src/jit/shared/MoveEmitter-x86-shared.h
@@ -51,7 +51,7 @@ class MoveEmitterX86
     void completeCycle(const MoveOperand &to, MoveOp::Type type);
 
   public:
-    MoveEmitterX86(MacroAssemblerSpecific &masm);
+    explicit MoveEmitterX86(MacroAssemblerSpecific &masm);
     ~MoveEmitterX86();
     void emit(const MoveResolver &moves);
     void finish();
diff --git a/js/src/jit/x64/Assembler-x64.cpp b/js/src/jit/x64/Assembler-x64.cpp
index 6c28a84ca659..c76283f6559a 100644
--- a/js/src/jit/x64/Assembler-x64.cpp
+++ b/js/src/jit/x64/Assembler-x64.cpp
@@ -215,7 +215,7 @@ class RelocationIterator
     uint32_t extOffset_;
 
   public:
-    RelocationIterator(CompactBufferReader &reader)
+    explicit RelocationIterator(CompactBufferReader &reader)
       : reader_(reader)
     {
         tableStart_ = reader_.readFixedUint32_t();
diff --git a/js/src/jit/x64/Assembler-x64.h b/js/src/jit/x64/Assembler-x64.h
index 8f2ebff0fca9..e6ffc72d6f03 100644
--- a/js/src/jit/x64/Assembler-x64.h
+++ b/js/src/jit/x64/Assembler-x64.h
@@ -299,7 +299,7 @@ class Assembler : public AssemblerX86Shared
 
     CodeOffsetLabel movWithPatch(ImmWord word, Register dest) {
         masm.movq_i64r(word.value, dest.code());
-        return masm.currentOffset();
+        return CodeOffsetLabel(masm.currentOffset());
     }
     CodeOffsetLabel movWithPatch(ImmPtr imm, Register dest) {
         return movWithPatch(ImmWord(uintptr_t(imm.value)), dest);
@@ -528,7 +528,7 @@ class Assembler : public AssemblerX86Shared
     }
     void mov(AsmJSImmPtr imm, Register dest) {
         masm.movq_i64r(-1, dest.code());
-        enoughMemory_ &= append(AsmJSAbsoluteLink(masm.currentOffset(), imm.kind()));
+        enoughMemory_ &= append(AsmJSAbsoluteLink(CodeOffsetLabel(masm.currentOffset()), imm.kind()));
     }
     void mov(const Operand &src, Register dest) {
         movq(src, dest);
diff --git a/js/src/jit/x64/CodeGenerator-x64.cpp b/js/src/jit/x64/CodeGenerator-x64.cpp
index b1d6b2b54df7..01f1cb3d295f 100644
--- a/js/src/jit/x64/CodeGenerator-x64.cpp
+++ b/js/src/jit/x64/CodeGenerator-x64.cpp
@@ -484,7 +484,7 @@ CodeGeneratorX64::visitAsmJSLoadGlobalVar(LAsmJSLoadGlobalVar *ins)
     else
         label = masm.loadRipRelativeDouble(ToFloatRegister(ins->output()));
 
-    return masm.append(AsmJSGlobalAccess(label.offset(), mir->globalDataOffset()));
+    return masm.append(AsmJSGlobalAccess(CodeOffsetLabel(label.offset()), mir->globalDataOffset()));
 }
 
 bool
@@ -501,7 +501,7 @@ CodeGeneratorX64::visitAsmJSStoreGlobalVar(LAsmJSStoreGlobalVar *ins)
     else
         label = masm.storeRipRelativeDouble(ToFloatRegister(ins->value()));
 
-    return masm.append(AsmJSGlobalAccess(label.offset(), mir->globalDataOffset()));
+    return masm.append(AsmJSGlobalAccess(CodeOffsetLabel(label.offset()), mir->globalDataOffset()));
 }
 
 bool
@@ -516,7 +516,7 @@ CodeGeneratorX64::visitAsmJSLoadFuncPtr(LAsmJSLoadFuncPtr *ins)
     CodeOffsetLabel label = masm.leaRipRelative(tmp);
     masm.loadPtr(Operand(tmp, index, TimesEight, 0), out);
 
-    return masm.append(AsmJSGlobalAccess(label.offset(), mir->globalDataOffset()));
+    return masm.append(AsmJSGlobalAccess(CodeOffsetLabel(label.offset()), mir->globalDataOffset()));
 }
 
 bool
@@ -526,7 +526,7 @@ CodeGeneratorX64::visitAsmJSLoadFFIFunc(LAsmJSLoadFFIFunc *ins)
 
     CodeOffsetLabel label = masm.loadRipRelativeInt64(ToRegister(ins->output()));
 
-    return masm.append(AsmJSGlobalAccess(label.offset(), mir->globalDataOffset()));
+    return masm.append(AsmJSGlobalAccess(CodeOffsetLabel(label.offset()), mir->globalDataOffset()));
 }
 
 void
diff --git a/js/src/jit/x64/LIR-x64.h b/js/src/jit/x64/LIR-x64.h
index b687fceac4d1..23550ffd3e1f 100644
--- a/js/src/jit/x64/LIR-x64.h
+++ b/js/src/jit/x64/LIR-x64.h
@@ -37,7 +37,7 @@ class LBox : public LInstructionHelper<1, 1, 0>
 class LUnboxBase : public LInstructionHelper<1, 1, 0>
 {
   public:
-    LUnboxBase(const LAllocation &input) {
+    explicit LUnboxBase(const LAllocation &input) {
         setOperand(0, input);
     }
 
@@ -52,7 +52,7 @@ class LUnbox : public LUnboxBase {
   public:
     LIR_HEADER(Unbox)
 
-    LUnbox(const LAllocation &input)
+    explicit LUnbox(const LAllocation &input)
       : LUnboxBase(input)
     { }
 
@@ -86,7 +86,7 @@ class LAsmJSUInt32ToDouble : public LInstructionHelper<1, 1, 0>
   public:
     LIR_HEADER(AsmJSUInt32ToDouble)
 
-    LAsmJSUInt32ToDouble(const LAllocation &input) {
+    explicit LAsmJSUInt32ToDouble(const LAllocation &input) {
         setOperand(0, input);
     }
 };
@@ -97,7 +97,7 @@ class LAsmJSUInt32ToFloat32 : public LInstructionHelper<1, 1, 0>
   public:
     LIR_HEADER(AsmJSUInt32ToFloat32)
 
-    LAsmJSUInt32ToFloat32(const LAllocation &input) {
+    explicit LAsmJSUInt32ToFloat32(const LAllocation &input) {
         setOperand(0, input);
     }
 };
diff --git a/js/src/jit/x64/MacroAssembler-x64.h b/js/src/jit/x64/MacroAssembler-x64.h
index 73c5972ca6a3..5f47074f7157 100644
--- a/js/src/jit/x64/MacroAssembler-x64.h
+++ b/js/src/jit/x64/MacroAssembler-x64.h
@@ -16,18 +16,18 @@ namespace jit {
 
 struct ImmShiftedTag : public ImmWord
 {
-    ImmShiftedTag(JSValueShiftedTag shtag)
+    explicit ImmShiftedTag(JSValueShiftedTag shtag)
       : ImmWord((uintptr_t)shtag)
     { }
 
-    ImmShiftedTag(JSValueType type)
+    explicit ImmShiftedTag(JSValueType type)
       : ImmWord(uintptr_t(JSValueShiftedTag(JSVAL_TYPE_TO_SHIFTED_TAG(type))))
     { }
 };
 
 struct ImmTag : public Imm32
 {
-    ImmTag(JSValueTag tag)
+    explicit ImmTag(JSValueTag tag)
       : Imm32(tag)
     { }
 };
@@ -50,7 +50,7 @@ class MacroAssemblerX64 : public MacroAssemblerX86Shared
     struct Double {
         double value;
         NonAssertingLabel uses;
-        Double(double value) : value(value) {}
+        explicit Double(double value) : value(value) {}
     };
     Vector<Double, 0, SystemAllocPolicy> doubles_;
 
@@ -60,7 +60,7 @@ class MacroAssemblerX64 : public MacroAssemblerX86Shared
     struct Float {
         float value;
         NonAssertingLabel uses;
-        Float(float value) : value(value) {}
+        explicit Float(float value) : value(value) {}
     };
     Vector<Float, 0, SystemAllocPolicy> floats_;
 
@@ -572,9 +572,6 @@ class MacroAssemblerX64 : public MacroAssemblerX86Shared
     void subPtr(Register src, const Address &dest) {
         subq(src, Operand(dest));
     }
-    void mulBy3(const Register &src, const Register &dest) {
-        lea(Operand(src, src, TimesTwo), dest);
-    }
 
     void branch32(Condition cond, AbsoluteAddress lhs, Imm32 rhs, Label *label) {
         if (JSC::X86Assembler::isAddressImmediate(lhs.addr)) {
@@ -1301,12 +1298,6 @@ class MacroAssemblerX64 : public MacroAssemblerX86Shared
         orq(Imm32(type), frameSizeReg);
     }
 
-    // Save an exit frame (which must be aligned to the stack pointer) to
-    // PerThreadData::jitTop of the main thread.
-    void linkExitFrame() {
-        storePtr(StackPointer, AbsoluteAddress(GetIonContext()->runtime->addressOfJitTop()));
-    }
-
     void callWithExitFrame(JitCode *target, Register dynStack) {
         addPtr(Imm32(framePushed()), dynStack);
         makeFrameDescriptor(dynStack, JitFrame_IonJS);
@@ -1314,12 +1305,6 @@ class MacroAssemblerX64 : public MacroAssemblerX86Shared
         call(target);
     }
 
-    // Save an exit frame to the thread data of the current thread, given a
-    // register that holds a PerThreadData *.
-    void linkParallelExitFrame(Register pt) {
-        storePtr(StackPointer, Address(pt, offsetof(PerThreadData, jitTop)));
-    }
-
     // See CodeGeneratorX64 calls to noteAsmJSGlobalAccess.
     void patchAsmJSGlobalAccess(CodeOffsetLabel patchAt, uint8_t *code, uint8_t *globalData,
                                 unsigned globalDataOffset)
diff --git a/js/src/jit/x86/Assembler-x86.h b/js/src/jit/x86/Assembler-x86.h
index 3ec968f49be2..6659e2be772e 100644
--- a/js/src/jit/x86/Assembler-x86.h
+++ b/js/src/jit/x86/Assembler-x86.h
@@ -202,7 +202,7 @@ class Assembler : public AssemblerX86Shared
 
     CodeOffsetLabel pushWithPatch(ImmWord word) {
         push(Imm32(word.value));
-        return masm.currentOffset();
+        return CodeOffsetLabel(masm.currentOffset());
     }
 
     void pop(FloatRegister src) {
@@ -212,7 +212,7 @@ class Assembler : public AssemblerX86Shared
 
     CodeOffsetLabel movWithPatch(ImmWord word, Register dest) {
         movl(Imm32(word.value), dest);
-        return masm.currentOffset();
+        return CodeOffsetLabel(masm.currentOffset());
     }
     CodeOffsetLabel movWithPatch(ImmPtr imm, Register dest) {
         return movWithPatch(ImmWord(uintptr_t(imm.value)), dest);
@@ -260,7 +260,7 @@ class Assembler : public AssemblerX86Shared
     }
     void mov(AsmJSImmPtr imm, Register dest) {
         masm.movl_i32r(-1, dest.code());
-        enoughMemory_ &= append(AsmJSAbsoluteLink(masm.currentOffset(), imm.kind()));
+        enoughMemory_ &= append(AsmJSAbsoluteLink(CodeOffsetLabel(masm.currentOffset()), imm.kind()));
     }
     void mov(const Operand &src, Register dest) {
         movl(src, dest);
@@ -341,11 +341,11 @@ class Assembler : public AssemblerX86Shared
     }
     void cmpl(AsmJSAbsoluteAddress lhs, Register rhs) {
         masm.cmpl_rm_force32(rhs.code(), (void*)-1);
-        enoughMemory_ &= append(AsmJSAbsoluteLink(masm.currentOffset(), lhs.kind()));
+        enoughMemory_ &= append(AsmJSAbsoluteLink(CodeOffsetLabel(masm.currentOffset()), lhs.kind()));
     }
     CodeOffsetLabel cmplWithPatch(Register lhs, Imm32 rhs) {
         masm.cmpl_ir_force32(rhs.value, lhs.code());
-        return masm.currentOffset();
+        return CodeOffsetLabel(masm.currentOffset());
     }
 
     void jmp(ImmPtr target, Relocation::Kind reloc = Relocation::HARDCODED) {
@@ -419,63 +419,63 @@ class Assembler : public AssemblerX86Shared
     // patched.
     CodeOffsetLabel movlWithPatch(Imm32 imm, Register dest) {
         masm.movl_i32r(imm.value, dest.code());
-        return masm.currentOffset();
+        return CodeOffsetLabel(masm.currentOffset());
     }
 
     // Load from *(base + disp32) where disp32 can be patched.
     CodeOffsetLabel movsblWithPatch(Address src, Register dest) {
         masm.movsbl_mr_disp32(src.offset, src.base.code(), dest.code());
-        return masm.currentOffset();
+        return CodeOffsetLabel(masm.currentOffset());
     }
     CodeOffsetLabel movzblWithPatch(Address src, Register dest) {
         masm.movzbl_mr_disp32(src.offset, src.base.code(), dest.code());
-        return masm.currentOffset();
+        return CodeOffsetLabel(masm.currentOffset());
     }
     CodeOffsetLabel movswlWithPatch(Address src, Register dest) {
         masm.movswl_mr_disp32(src.offset, src.base.code(), dest.code());
-        return masm.currentOffset();
+        return CodeOffsetLabel(masm.currentOffset());
     }
     CodeOffsetLabel movzwlWithPatch(Address src, Register dest) {
         masm.movzwl_mr_disp32(src.offset, src.base.code(), dest.code());
-        return masm.currentOffset();
+        return CodeOffsetLabel(masm.currentOffset());
     }
     CodeOffsetLabel movlWithPatch(Address src, Register dest) {
         masm.movl_mr_disp32(src.offset, src.base.code(), dest.code());
-        return masm.currentOffset();
+        return CodeOffsetLabel(masm.currentOffset());
     }
     CodeOffsetLabel movssWithPatch(Address src, FloatRegister dest) {
         JS_ASSERT(HasSSE2());
         masm.movss_mr_disp32(src.offset, src.base.code(), dest.code());
-        return masm.currentOffset();
+        return CodeOffsetLabel(masm.currentOffset());
     }
     CodeOffsetLabel movsdWithPatch(Address src, FloatRegister dest) {
         JS_ASSERT(HasSSE2());
         masm.movsd_mr_disp32(src.offset, src.base.code(), dest.code());
-        return masm.currentOffset();
+        return CodeOffsetLabel(masm.currentOffset());
     }
 
     // Store to *(base + disp32) where disp32 can be patched.
     CodeOffsetLabel movbWithPatch(Register src, Address dest) {
         masm.movb_rm_disp32(src.code(), dest.offset, dest.base.code());
-        return masm.currentOffset();
+        return CodeOffsetLabel(masm.currentOffset());
     }
     CodeOffsetLabel movwWithPatch(Register src, Address dest) {
         masm.movw_rm_disp32(src.code(), dest.offset, dest.base.code());
-        return masm.currentOffset();
+        return CodeOffsetLabel(masm.currentOffset());
     }
     CodeOffsetLabel movlWithPatch(Register src, Address dest) {
         masm.movl_rm_disp32(src.code(), dest.offset, dest.base.code());
-        return masm.currentOffset();
+        return CodeOffsetLabel(masm.currentOffset());
     }
     CodeOffsetLabel movssWithPatch(FloatRegister src, Address dest) {
         JS_ASSERT(HasSSE2());
         masm.movss_rm_disp32(src.code(), dest.offset, dest.base.code());
-        return masm.currentOffset();
+        return CodeOffsetLabel(masm.currentOffset());
     }
     CodeOffsetLabel movsdWithPatch(FloatRegister src, Address dest) {
         JS_ASSERT(HasSSE2());
         masm.movsd_rm_disp32(src.code(), dest.offset, dest.base.code());
-        return masm.currentOffset();
+        return CodeOffsetLabel(masm.currentOffset());
     }
 
     // Load from *(addr + index*scale) where addr can be patched.
@@ -483,63 +483,63 @@ class Assembler : public AssemblerX86Shared
                                   Register dest)
     {
         masm.movl_mr(addr.addr, index.code(), scale, dest.code());
-        return masm.currentOffset();
+        return CodeOffsetLabel(masm.currentOffset());
     }
 
     // Load from *src where src can be patched.
     CodeOffsetLabel movsblWithPatch(PatchedAbsoluteAddress src, Register dest) {
         masm.movsbl_mr(src.addr, dest.code());
-        return masm.currentOffset();
+        return CodeOffsetLabel(masm.currentOffset());
     }
     CodeOffsetLabel movzblWithPatch(PatchedAbsoluteAddress src, Register dest) {
         masm.movzbl_mr(src.addr, dest.code());
-        return masm.currentOffset();
+        return CodeOffsetLabel(masm.currentOffset());
     }
     CodeOffsetLabel movswlWithPatch(PatchedAbsoluteAddress src, Register dest) {
         masm.movswl_mr(src.addr, dest.code());
-        return masm.currentOffset();
+        return CodeOffsetLabel(masm.currentOffset());
     }
     CodeOffsetLabel movzwlWithPatch(PatchedAbsoluteAddress src, Register dest) {
         masm.movzwl_mr(src.addr, dest.code());
-        return masm.currentOffset();
+        return CodeOffsetLabel(masm.currentOffset());
     }
     CodeOffsetLabel movlWithPatch(PatchedAbsoluteAddress src, Register dest) {
         masm.movl_mr(src.addr, dest.code());
-        return masm.currentOffset();
+        return CodeOffsetLabel(masm.currentOffset());
     }
     CodeOffsetLabel movssWithPatch(PatchedAbsoluteAddress src, FloatRegister dest) {
         JS_ASSERT(HasSSE2());
         masm.movss_mr(src.addr, dest.code());
-        return masm.currentOffset();
+        return CodeOffsetLabel(masm.currentOffset());
     }
     CodeOffsetLabel movsdWithPatch(PatchedAbsoluteAddress src, FloatRegister dest) {
         JS_ASSERT(HasSSE2());
         masm.movsd_mr(src.addr, dest.code());
-        return masm.currentOffset();
+        return CodeOffsetLabel(masm.currentOffset());
     }
 
     // Store to *dest where dest can be patched.
     CodeOffsetLabel movbWithPatch(Register src, PatchedAbsoluteAddress dest) {
         masm.movb_rm(src.code(), dest.addr);
-        return masm.currentOffset();
+        return CodeOffsetLabel(masm.currentOffset());
     }
     CodeOffsetLabel movwWithPatch(Register src, PatchedAbsoluteAddress dest) {
         masm.movw_rm(src.code(), dest.addr);
-        return masm.currentOffset();
+        return CodeOffsetLabel(masm.currentOffset());
     }
     CodeOffsetLabel movlWithPatch(Register src, PatchedAbsoluteAddress dest) {
         masm.movl_rm(src.code(), dest.addr);
-        return masm.currentOffset();
+        return CodeOffsetLabel(masm.currentOffset());
     }
     CodeOffsetLabel movssWithPatch(FloatRegister src, PatchedAbsoluteAddress dest) {
         JS_ASSERT(HasSSE2());
         masm.movss_rm(src.code(), dest.addr);
-        return masm.currentOffset();
+        return CodeOffsetLabel(masm.currentOffset());
     }
     CodeOffsetLabel movsdWithPatch(FloatRegister src, PatchedAbsoluteAddress dest) {
         JS_ASSERT(HasSSE2());
         masm.movsd_rm(src.code(), dest.addr);
-        return masm.currentOffset();
+        return CodeOffsetLabel(masm.currentOffset());
     }
 
 };
diff --git a/js/src/jit/x86/CodeGenerator-x86.cpp b/js/src/jit/x86/CodeGenerator-x86.cpp
index 6e0cd7861c52..d7097c502bd3 100644
--- a/js/src/jit/x86/CodeGenerator-x86.cpp
+++ b/js/src/jit/x86/CodeGenerator-x86.cpp
@@ -634,7 +634,7 @@ CodeGeneratorX86::visitAsmJSLoadGlobalVar(LAsmJSLoadGlobalVar *ins)
     else
         label = masm.movsdWithPatch(PatchedAbsoluteAddress(), ToFloatRegister(ins->output()));
 
-    return masm.append(AsmJSGlobalAccess(label.offset(), mir->globalDataOffset()));
+    return masm.append(AsmJSGlobalAccess(CodeOffsetLabel(label.offset()), mir->globalDataOffset()));
 }
 
 bool
@@ -653,7 +653,7 @@ CodeGeneratorX86::visitAsmJSStoreGlobalVar(LAsmJSStoreGlobalVar *ins)
     else
         label = masm.movsdWithPatch(ToFloatRegister(ins->value()), PatchedAbsoluteAddress());
 
-    return masm.append(AsmJSGlobalAccess(label.offset(), mir->globalDataOffset()));
+    return masm.append(AsmJSGlobalAccess(CodeOffsetLabel(label.offset()), mir->globalDataOffset()));
 }
 
 bool
@@ -665,7 +665,7 @@ CodeGeneratorX86::visitAsmJSLoadFuncPtr(LAsmJSLoadFuncPtr *ins)
     Register out = ToRegister(ins->output());
     CodeOffsetLabel label = masm.movlWithPatch(PatchedAbsoluteAddress(), index, TimesFour, out);
 
-    return masm.append(AsmJSGlobalAccess(label.offset(), mir->globalDataOffset()));
+    return masm.append(AsmJSGlobalAccess(CodeOffsetLabel(label.offset()), mir->globalDataOffset()));
 }
 
 bool
@@ -676,7 +676,7 @@ CodeGeneratorX86::visitAsmJSLoadFFIFunc(LAsmJSLoadFFIFunc *ins)
     Register out = ToRegister(ins->output());
     CodeOffsetLabel label = masm.movlWithPatch(PatchedAbsoluteAddress(), out);
 
-    return masm.append(AsmJSGlobalAccess(label.offset(), mir->globalDataOffset()));
+    return masm.append(AsmJSGlobalAccess(CodeOffsetLabel(label.offset()), mir->globalDataOffset()));
 }
 
 void
diff --git a/js/src/jit/x86/MacroAssembler-x86.h b/js/src/jit/x86/MacroAssembler-x86.h
index bd67f29855b8..1cdb30c718ad 100644
--- a/js/src/jit/x86/MacroAssembler-x86.h
+++ b/js/src/jit/x86/MacroAssembler-x86.h
@@ -581,9 +581,6 @@ class MacroAssemblerX86 : public MacroAssemblerX86Shared
     void subPtr(Register src, const Address &dest) {
         subl(src, Operand(dest));
     }
-    void mulBy3(const Register &src, const Register &dest) {
-        lea(Operand(src, src, TimesTwo), dest);
-    }
 
     void branch32(Condition cond, AbsoluteAddress lhs, Imm32 rhs, Label *label) {
         cmpl(Operand(lhs), rhs);
@@ -1094,12 +1091,6 @@ class MacroAssemblerX86 : public MacroAssemblerX86Shared
         orl(Imm32(type), frameSizeReg);
     }
 
-    // Save an exit frame (which must be aligned to the stack pointer) to
-    // PerThreadData::jitTop of the main thread.
-    void linkExitFrame() {
-        movl(StackPointer, Operand(AbsoluteAddress(GetIonContext()->runtime->addressOfJitTop())));
-    }
-
     void callWithExitFrame(JitCode *target, Register dynStack) {
         addPtr(Imm32(framePushed()), dynStack);
         makeFrameDescriptor(dynStack, JitFrame_IonJS);
@@ -1114,12 +1105,6 @@ class MacroAssemblerX86 : public MacroAssemblerX86Shared
         call(CallSiteDesc::Exit(), target);
     }
 
-    // Save an exit frame to the thread data of the current thread, given a
-    // register that holds a PerThreadData *.
-    void linkParallelExitFrame(Register pt) {
-        movl(StackPointer, Operand(pt, offsetof(PerThreadData, jitTop)));
-    }
-
 #ifdef JSGC_GENERATIONAL
     void branchPtrInNurseryRange(Condition cond, Register ptr, Register temp, Label *label);
     void branchValueIsNurseryObject(Condition cond, ValueOperand value, Register temp, Label *label);
diff --git a/js/src/jsalloc.h b/js/src/jsalloc.h
index 9c87ff08782d..dc1b937979dd 100644
--- a/js/src/jsalloc.h
+++ b/js/src/jsalloc.h
@@ -52,8 +52,8 @@ class TempAllocPolicy
     JS_FRIEND_API(void *) onOutOfMemory(void *p, size_t nbytes);
 
   public:
-    TempAllocPolicy(JSContext *cx) : cx_((ContextFriendFields *) cx) {} // :(
-    TempAllocPolicy(ContextFriendFields *cx) : cx_(cx) {}
+    MOZ_IMPLICIT TempAllocPolicy(JSContext *cx) : cx_((ContextFriendFields *) cx) {} // :(
+    MOZ_IMPLICIT TempAllocPolicy(ContextFriendFields *cx) : cx_(cx) {}
 
     void *malloc_(size_t bytes) {
         void *p = js_malloc(bytes);
diff --git a/js/src/jsapi-tests/moz.build b/js/src/jsapi-tests/moz.build
index 1a8cceca05a3..dac0652f6b20 100644
--- a/js/src/jsapi-tests/moz.build
+++ b/js/src/jsapi-tests/moz.build
@@ -32,6 +32,7 @@ UNIFIED_SOURCES += [
     'testFreshGlobalEvalRedefinition.cpp',
     'testFuncCallback.cpp',
     'testFunctionProperties.cpp',
+    'testGCAllocator.cpp',
     'testGCExactRooting.cpp',
     'testGCFinalizeCallback.cpp',
     'testGCOutOfMemory.cpp',
diff --git a/js/src/jsapi-tests/testChromeBuffer.cpp b/js/src/jsapi-tests/testChromeBuffer.cpp
index 734fc3da0657..1d7a81f89dcd 100644
--- a/js/src/jsapi-tests/testChromeBuffer.cpp
+++ b/js/src/jsapi-tests/testChromeBuffer.cpp
@@ -97,7 +97,7 @@ BEGIN_TEST(testChromeBuffer)
                                        bytes, strlen(bytes), options));
 
         JS::RootedValue rval(cx);
-        CHECK(JS_CallFunction(cx, JS::NullPtr(), fun, v, &rval));
+        CHECK(JS_CallFunction(cx, JS::NullPtr(), fun, JS::HandleValueArray(v), &rval));
         CHECK(rval.toInt32() == 100);
     }
 
@@ -137,7 +137,7 @@ BEGIN_TEST(testChromeBuffer)
                                        bytes, strlen(bytes), options));
 
         JS::RootedValue rval(cx);
-        CHECK(JS_CallFunction(cx, JS::NullPtr(), fun, v, &rval));
+        CHECK(JS_CallFunction(cx, JS::NullPtr(), fun, JS::HandleValueArray(v), &rval));
         bool match;
         CHECK(JS_StringEqualsAscii(cx, rval.toString(), "From trusted: InternalError: too much recursion", &match));
         CHECK(match);
@@ -175,7 +175,7 @@ BEGIN_TEST(testChromeBuffer)
 
         JS::RootedValue arg(cx, JS::ObjectValue(*callTrusted));
         JS::RootedValue rval(cx);
-        CHECK(JS_CallFunction(cx, JS::NullPtr(), fun, arg, &rval));
+        CHECK(JS_CallFunction(cx, JS::NullPtr(), fun, JS::HandleValueArray(arg), &rval));
         CHECK(rval.toInt32() == 42);
     }
 
diff --git a/js/src/jsapi-tests/testCloneScript.cpp b/js/src/jsapi-tests/testCloneScript.cpp
index 8596f2493fcf..1ba384c44199 100644
--- a/js/src/jsapi-tests/testCloneScript.cpp
+++ b/js/src/jsapi-tests/testCloneScript.cpp
@@ -137,7 +137,7 @@ BEGIN_TEST(test_cloneScriptWithPrincipals)
 
         JS::RootedValue v(cx);
         JS::RootedValue arg(cx, JS::Int32Value(1));
-        CHECK(JS_CallFunctionValue(cx, B, clonedValue, arg, &v));
+        CHECK(JS_CallFunctionValue(cx, B, clonedValue, JS::HandleValueArray(arg), &v));
         CHECK(v.isObject());
 
         JSObject *funobj = &v.toObject();
diff --git a/js/src/jsapi-tests/testDebugger.cpp b/js/src/jsapi-tests/testDebugger.cpp
index 7d9c9b584a81..92f3f4f8bf2a 100644
--- a/js/src/jsapi-tests/testDebugger.cpp
+++ b/js/src/jsapi-tests/testDebugger.cpp
@@ -228,7 +228,7 @@ bool testIndirectEval(JS::HandleObject scope, const char *code)
         CHECK(codestr);
         JS::RootedValue arg(cx, JS::StringValue(codestr));
         JS::RootedValue v(cx);
-        CHECK(JS_CallFunctionName(cx, scope, "eval", arg, &v));
+        CHECK(JS_CallFunctionName(cx, scope, "eval", HandleValueArray(arg), &v));
     }
 
     JS::RootedValue hitsv(cx);
diff --git a/js/src/jsapi-tests/testGCAllocator.cpp b/js/src/jsapi-tests/testGCAllocator.cpp
new file mode 100644
index 000000000000..2b7137573040
--- /dev/null
+++ b/js/src/jsapi-tests/testGCAllocator.cpp
@@ -0,0 +1,308 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+* vim: set ts=8 sts=4 et sw=4 tw=99:
+*/
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "gc/Memory.h"
+#include "jsapi-tests/tests.h"
+
+#if defined(XP_WIN)
+#include "jswin.h"
+#include <psapi.h>
+#elif defined(SOLARIS)
+// This test doesn't apply to Solaris.
+#elif defined(XP_UNIX)
+#include <algorithm>
+#include <errno.h>
+#include <sys/mman.h>
+#include <sys/resource.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <unistd.h>
+#else
+#error "Memory mapping functions are not defined for your OS."
+#endif
+
+BEGIN_TEST(testGCAllocator)
+{
+#if defined(XP_WIN)
+    SYSTEM_INFO sysinfo;
+    GetSystemInfo(&sysinfo);
+    const size_t PageSize = sysinfo.dwPageSize;
+#elif defined(SOLARIS)
+    return true;
+#elif defined(XP_UNIX)
+    const size_t PageSize = size_t(sysconf(_SC_PAGESIZE));
+#else
+    return true;
+#endif
+    if (addressesGrowUp())
+        return testGCAllocatorUp(PageSize);
+    return testGCAllocatorDown(PageSize);
+}
+
+static const size_t Chunk = 512 * 1024;
+static const size_t Alignment = 2 * Chunk;
+static const int MaxTempChunks = 4096;
+static const size_t StagingSize = 16 * Chunk;
+
+bool
+addressesGrowUp()
+{
+    void *p1 = mapMemory(2 * Chunk);
+    void *p2 = mapMemory(2 * Chunk);
+    unmapPages(p1, 2 * Chunk);
+    unmapPages(p2, 2 * Chunk);
+    return p1 < p2;
+}
+
+size_t
+offsetFromAligned(void *p)
+{
+    return uintptr_t(p) % Alignment;
+}
+
+enum AllocType {
+   UseNormalAllocator,
+   UseLastDitchAllocator
+};
+
+bool
+testGCAllocatorUp(const size_t PageSize)
+{
+    const size_t UnalignedSize = StagingSize + Alignment - PageSize;
+    void *chunkPool[MaxTempChunks];
+    // Allocate a contiguous chunk that we can partition for testing.
+    void *stagingArea = mapMemory(UnalignedSize);
+    if (!stagingArea)
+        return false;
+    // Ensure that the staging area is aligned.
+    unmapPages(stagingArea, UnalignedSize);
+    if (offsetFromAligned(stagingArea)) {
+        const size_t Offset = offsetFromAligned(stagingArea);
+        // Place the area at the lowest aligned address.
+        stagingArea = (void *)(uintptr_t(stagingArea) + (Alignment - Offset));
+    }
+    mapMemoryAt(stagingArea, StagingSize);
+    // Make sure there are no available chunks below the staging area.
+    int tempChunks;
+    if (!fillSpaceBeforeStagingArea(tempChunks, stagingArea, chunkPool, false))
+        return false;
+    // Unmap the staging area so we can set it up for testing.
+    unmapPages(stagingArea, StagingSize);
+    // Reuse the same allocator so it learns the address growth direction.
+    js::gc::SystemPageAllocator GCAlloc;
+    // Check that the first chunk is used if it is aligned.
+    CHECK(positionIsCorrect("xxooxxx---------", stagingArea, chunkPool, tempChunks, GCAlloc));
+    // Check that the first chunk is used if it can be aligned.
+    CHECK(positionIsCorrect("x-ooxxx---------", stagingArea, chunkPool, tempChunks, GCAlloc));
+    // Check that an aligned chunk after a single unalignable chunk is used.
+    CHECK(positionIsCorrect("x--xooxxx-------", stagingArea, chunkPool, tempChunks, GCAlloc));
+    // Check that we fall back to the slow path after two unalignable chunks.
+    CHECK(positionIsCorrect("x--xx--xoo--xxx-", stagingArea, chunkPool, tempChunks, GCAlloc));
+    // Check that we also fall back after an unalignable and an alignable chunk.
+    CHECK(positionIsCorrect("x--xx---x-oo--x-", stagingArea, chunkPool, tempChunks, GCAlloc));
+    // Check that the last ditch allocator works as expected.
+    CHECK(positionIsCorrect("x--xx--xx-oox---", stagingArea, chunkPool, tempChunks, GCAlloc,
+                            UseLastDitchAllocator));
+
+    // Clean up.
+    while (--tempChunks >= 0)
+        unmapPages(chunkPool[tempChunks], 2 * Chunk);
+    return true;
+}
+
+bool
+testGCAllocatorDown(const size_t PageSize)
+{
+    const size_t UnalignedSize = StagingSize + Alignment - PageSize;
+    void *chunkPool[MaxTempChunks];
+    // Allocate a contiguous chunk that we can partition for testing.
+    void *stagingArea = mapMemory(UnalignedSize);
+    if (!stagingArea)
+        return false;
+    // Ensure that the staging area is aligned.
+    unmapPages(stagingArea, UnalignedSize);
+    if (offsetFromAligned(stagingArea)) {
+        void *stagingEnd = (void *)(uintptr_t(stagingArea) + UnalignedSize);
+        const size_t Offset = offsetFromAligned(stagingEnd);
+        // Place the area at the highest aligned address.
+        stagingArea = (void *)(uintptr_t(stagingEnd) - Offset - StagingSize);
+    }
+    mapMemoryAt(stagingArea, StagingSize);
+    // Make sure there are no available chunks above the staging area.
+    int tempChunks;
+    if (!fillSpaceBeforeStagingArea(tempChunks, stagingArea, chunkPool, true))
+        return false;
+    // Unmap the staging area so we can set it up for testing.
+    unmapPages(stagingArea, StagingSize);
+    // Reuse the same allocator so it learns the address growth direction.
+    js::gc::SystemPageAllocator GCAlloc;
+    // Check that the first chunk is used if it is aligned.
+    CHECK(positionIsCorrect("---------xxxooxx", stagingArea, chunkPool, tempChunks, GCAlloc));
+    // Check that the first chunk is used if it can be aligned.
+    CHECK(positionIsCorrect("---------xxxoo-x", stagingArea, chunkPool, tempChunks, GCAlloc));
+    // Check that an aligned chunk after a single unalignable chunk is used.
+    CHECK(positionIsCorrect("-------xxxoox--x", stagingArea, chunkPool, tempChunks, GCAlloc));
+    // Check that we fall back to the slow path after two unalignable chunks.
+    CHECK(positionIsCorrect("-xxx--oox--xx--x", stagingArea, chunkPool, tempChunks, GCAlloc));
+    // Check that we also fall back after an unalignable and an alignable chunk.
+    CHECK(positionIsCorrect("-x--oo-x---xx--x", stagingArea, chunkPool, tempChunks, GCAlloc));
+    // Check that the last ditch allocator works as expected.
+    CHECK(positionIsCorrect("---xoo-xx--xx--x", stagingArea, chunkPool, tempChunks, GCAlloc,
+                            UseLastDitchAllocator));
+
+    // Clean up.
+    while (--tempChunks >= 0)
+        unmapPages(chunkPool[tempChunks], 2 * Chunk);
+    return true;
+}
+
+bool
+fillSpaceBeforeStagingArea(int &tempChunks, void *stagingArea,
+                           void **chunkPool, bool addressesGrowDown)
+{
+    // Make sure there are no available chunks before the staging area.
+    tempChunks = 0;
+    chunkPool[tempChunks++] = mapMemory(2 * Chunk);
+    while (tempChunks < MaxTempChunks && chunkPool[tempChunks - 1] &&
+           (chunkPool[tempChunks - 1] < stagingArea) ^ addressesGrowDown) {
+        chunkPool[tempChunks++] = mapMemory(2 * Chunk);
+        if (!chunkPool[tempChunks - 1])
+            break; // We already have our staging area, so OOM here is okay.
+        if ((chunkPool[tempChunks - 1] < chunkPool[tempChunks - 2]) ^ addressesGrowDown)
+            break; // The address growth direction is inconsistent!
+    }
+    // OOM also means success in this case.
+    if (!chunkPool[tempChunks - 1]) {
+        --tempChunks;
+        return true;
+    }
+    // Bail if we can't guarantee the right address space layout.
+    if ((chunkPool[tempChunks - 1] < stagingArea) ^ addressesGrowDown || (tempChunks > 1 &&
+            (chunkPool[tempChunks - 1] < chunkPool[tempChunks - 2]) ^ addressesGrowDown))
+    {
+        while (--tempChunks >= 0)
+            unmapPages(chunkPool[tempChunks], 2 * Chunk);
+        unmapPages(stagingArea, StagingSize);
+        return false;
+    }
+    return true;
+}
+
+bool
+positionIsCorrect(const char *str, void *base, void **chunkPool, int tempChunks,
+                  js::gc::SystemPageAllocator& GCAlloc, AllocType allocator = UseNormalAllocator)
+{
+    // str represents a region of memory, with each character representing a
+    // region of Chunk bytes. str should contain only x, o and -, where
+    // x = mapped by the test to set up the initial conditions,
+    // o = mapped by the GC allocator, and
+    // - = unmapped.
+    // base should point to a region of contiguous free memory
+    // large enough to hold strlen(str) chunks of Chunk bytes.
+    int len = strlen(str);
+    int i;
+    // Find the index of the desired address.
+    for (i = 0; i < len && str[i] != 'o'; ++i);
+    void *desired = (void *)(uintptr_t(base) + i * Chunk);
+    // Map the regions indicated by str.
+    for (i = 0; i < len; ++i) {
+        if (str[i] == 'x')
+            mapMemoryAt((void *)(uintptr_t(base) +  i * Chunk), Chunk);
+    }
+    // Allocate using the GC's allocator.
+    void *result;
+    if (allocator == UseNormalAllocator)
+        result = GCAlloc.mapAlignedPages(2 * Chunk, Alignment);
+    else
+        result = GCAlloc.testMapAlignedPagesLastDitch(2 * Chunk, Alignment);
+    // Clean up the mapped regions.
+    if (result)
+        GCAlloc.unmapPages(result, 2 * Chunk);
+    for (--i; i >= 0; --i) {
+        if (str[i] == 'x')
+            unmapPages((void *)(uintptr_t(base) +  i * Chunk), Chunk);
+    }
+    // CHECK returns, so clean up on failure.
+    if (result != desired) {
+        while (--tempChunks >= 0)
+            unmapPages(chunkPool[tempChunks], 2 * Chunk);
+    }
+    return result == desired;
+}
+
+#if defined(XP_WIN)
+
+void *
+mapMemoryAt(void *desired, size_t length)
+{
+    return VirtualAlloc(desired, length, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
+}
+
+void *
+mapMemory(size_t length)
+{
+    return VirtualAlloc(nullptr, length, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
+}
+
+void
+unmapPages(void *p, size_t size)
+{
+    MOZ_ALWAYS_TRUE(VirtualFree(p, 0, MEM_RELEASE));
+}
+
+#elif defined(SOLARIS)
+// This test doesn't apply to Solaris.
+#elif defined(XP_UNIX)
+
+void *
+mapMemoryAt(void *desired, size_t length)
+{
+#if defined(__ia64__)
+    MOZ_ASSERT(0xffff800000000000ULL & (uintptr_t(desired) + length - 1) == 0);
+#endif
+    void *region = mmap(desired, length, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANON, -1, 0);
+    if (region == MAP_FAILED)
+        return nullptr;
+    if (region != desired) {
+        if (munmap(region, length))
+            MOZ_ASSERT(errno == ENOMEM);
+        return nullptr;
+    }
+    return region;
+}
+
+void *
+mapMemory(size_t length)
+{
+    void *hint = nullptr;
+#if defined(__ia64__)
+    hint = (void*)0x0000070000000000ULL;
+#endif
+    void *region = mmap(hint, length, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANON, -1, 0);
+    if (region == MAP_FAILED)
+        return nullptr;
+#if defined(__ia64__)
+    if ((uintptr_t(region) + (length - 1)) & 0xffff800000000000ULL) {
+        if (munmap(region, length))
+            MOZ_ASSERT(errno == ENOMEM);
+        return nullptr;
+    }
+#endif
+    return region;
+}
+
+void
+unmapPages(void *p, size_t size)
+{
+    if (munmap(p, size))
+        MOZ_ASSERT(errno == ENOMEM);
+}
+
+#else // !defined(XP_WIN) && !defined(SOLARIS) && !defined(XP_UNIX)
+#error "Memory mapping functions are not defined for your OS."
+#endif
+END_TEST(testGCAllocator)
diff --git a/js/src/jsapi-tests/testLooselyEqual.cpp b/js/src/jsapi-tests/testLooselyEqual.cpp
index e5a510b9704e..9527020b6c41 100644
--- a/js/src/jsapi-tests/testLooselyEqual.cpp
+++ b/js/src/jsapi-tests/testLooselyEqual.cpp
@@ -40,7 +40,7 @@ struct LooseEqualityData
     JS::RootedValue poszero;
     JS::RootedValue negzero;
 
-    LooseEqualityData(JSContext *cx)
+    explicit LooseEqualityData(JSContext *cx)
       : qNaN(cx),
         sNaN(cx),
         d42(cx),
diff --git a/js/src/jsapi-tests/testParseJSON.cpp b/js/src/jsapi-tests/testParseJSON.cpp
index 82e455e091bb..37b7a6bb1a4f 100644
--- a/js/src/jsapi-tests/testParseJSON.cpp
+++ b/js/src/jsapi-tests/testParseJSON.cpp
@@ -19,7 +19,7 @@ class AutoInflatedString {
     size_t length_;
 
   public:
-    AutoInflatedString(JSContext *cx) : cx(cx), chars_(nullptr), length_(0) { }
+    explicit AutoInflatedString(JSContext *cx) : cx(cx), chars_(nullptr), length_(0) { }
     ~AutoInflatedString() {
         JS_free(cx, chars_);
     }
diff --git a/js/src/jsapi-tests/testPersistentRooted.cpp b/js/src/jsapi-tests/testPersistentRooted.cpp
index 52a3e7108124..437245367fbf 100644
--- a/js/src/jsapi-tests/testPersistentRooted.cpp
+++ b/js/src/jsapi-tests/testPersistentRooted.cpp
@@ -40,7 +40,7 @@ const JSClass BarkWhenTracedClass::class_ = {
 
 struct Kennel {
     PersistentRootedObject obj;
-    Kennel(JSContext *cx) : obj(cx) { }
+    explicit Kennel(JSContext *cx) : obj(cx) { }
     Kennel(JSContext *cx, const HandleObject &woof) : obj(cx, woof) { };
 };
 
diff --git a/js/src/jsapi-tests/testResolveRecursion.cpp b/js/src/jsapi-tests/testResolveRecursion.cpp
index df56ecee3a8a..fe194b56fb53 100644
--- a/js/src/jsapi-tests/testResolveRecursion.cpp
+++ b/js/src/jsapi-tests/testResolveRecursion.cpp
@@ -67,7 +67,7 @@ unsigned resolveExitCount;
 
 struct AutoIncrCounters {
 
-    AutoIncrCounters(cls_testResolveRecursion *t) : t(t) {
+    explicit AutoIncrCounters(cls_testResolveRecursion *t) : t(t) {
         t->resolveEntryCount++;
     }
 
diff --git a/js/src/jsapi-tests/tests.cpp b/js/src/jsapi-tests/tests.cpp
index 9c0cb64445b6..2f3008b4c0a8 100644
--- a/js/src/jsapi-tests/tests.cpp
+++ b/js/src/jsapi-tests/tests.cpp
@@ -33,7 +33,7 @@ bool JSAPITest::exec(const char *bytes, const char *filename, int lineno)
     JS::RootedValue v(cx);
     JS::HandleObject global = JS::HandleObject::fromMarkedLocation(this->global.unsafeGet());
     return JS_EvaluateScript(cx, global, bytes, strlen(bytes), filename, lineno, &v) ||
-        fail(bytes, filename, lineno);
+        fail(JSAPITestString(bytes), filename, lineno);
 }
 
 bool JSAPITest::evaluate(const char *bytes, const char *filename, int lineno,
@@ -41,7 +41,7 @@ bool JSAPITest::evaluate(const char *bytes, const char *filename, int lineno,
 {
     JS::HandleObject global = JS::HandleObject::fromMarkedLocation(this->global.unsafeGet());
     return JS_EvaluateScript(cx, global, bytes, strlen(bytes), filename, lineno, vp) ||
-        fail(bytes, filename, lineno);
+        fail(JSAPITestString(bytes), filename, lineno);
 }
 
 bool JSAPITest::definePrint()
diff --git a/js/src/jsapi-tests/tests.h b/js/src/jsapi-tests/tests.h
index d08a3730556a..5de75f4df635 100644
--- a/js/src/jsapi-tests/tests.h
+++ b/js/src/jsapi-tests/tests.h
@@ -23,7 +23,7 @@ class JSAPITestString {
     js::Vector<char, 0, js::SystemAllocPolicy> chars;
   public:
     JSAPITestString() {}
-    JSAPITestString(const char *s) { *this += s; }
+    explicit JSAPITestString(const char *s) { *this += s; }
     JSAPITestString(const JSAPITestString &s) { *this += s; }
 
     const char *begin() const { return chars.begin(); }
@@ -203,7 +203,7 @@ class JSAPITest
 #define CHECK(expr) \
     do { \
         if (!(expr)) \
-            return fail("CHECK failed: " #expr, __FILE__, __LINE__); \
+            return fail(JSAPITestString("CHECK failed: " #expr), __FILE__, __LINE__); \
     } while (false)
 
     bool fail(JSAPITestString msg = JSAPITestString(), const char *filename = "-", int lineno = 0) {
@@ -408,7 +408,7 @@ class TempFile {
 class TestJSPrincipals : public JSPrincipals
 {
   public:
-    TestJSPrincipals(int rc = 0)
+    explicit TestJSPrincipals(int rc = 0)
       : JSPrincipals()
     {
         refcount = rc;
diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index bb41e714780e..0c491976ca46 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -1137,7 +1137,7 @@ JS_TransplantObject(JSContext *cx, HandleObject origobj, HandleObject target)
         JS_ASSERT(Wrapper::wrappedObject(newIdentityWrapper) == newIdentity);
         if (!JSObject::swap(cx, origobj, newIdentityWrapper))
             MOZ_CRASH();
-        origobj->compartment()->putWrapper(cx, ObjectValue(*newIdentity), origv);
+        origobj->compartment()->putWrapper(cx, CrossCompartmentKey(newIdentity), origv);
     }
 
     // The new identity object might be one of several things. Return it to avoid
@@ -4331,8 +4331,8 @@ JS_DefineFunctionById(JSContext *cx, HandleObject obj, HandleId id, JSNative cal
 
 struct AutoLastFrameCheck
 {
-    AutoLastFrameCheck(JSContext *cx
-                       MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
+    explicit AutoLastFrameCheck(JSContext *cx
+                                MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
       : cx(cx)
     {
         JS_ASSERT(cx);
diff --git a/js/src/jsapi.h b/js/src/jsapi.h
index 942161e9f0c4..43250519bc1e 100644
--- a/js/src/jsapi.h
+++ b/js/src/jsapi.h
@@ -142,8 +142,8 @@ class AutoValueArray : public AutoGCRooter
     Value elements_[N];
 
   public:
-    AutoValueArray(JSContext *cx
-                   MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
+    explicit AutoValueArray(JSContext *cx
+                            MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
       : AutoGCRooter(cx, VALARRAY), length_(N)
     {
         /* Always initialize in case we GC before assignment. */
@@ -600,16 +600,16 @@ class HandleValueArray
     HandleValueArray(size_t len, const Value *elements) : length_(len), elements_(elements) {}
 
   public:
-    HandleValueArray(const RootedValue& value) : length_(1), elements_(value.address()) {}
+    explicit HandleValueArray(const RootedValue& value) : length_(1), elements_(value.address()) {}
 
-    HandleValueArray(const AutoValueVector& values)
+    MOZ_IMPLICIT HandleValueArray(const AutoValueVector& values)
       : length_(values.length()), elements_(values.begin()) {}
 
     template <size_t N>
     HandleValueArray(const AutoValueArray<N>& values) : length_(N), elements_(values.begin()) {}
 
     /* CallArgs must already be rooted somewhere up the stack. */
-    HandleValueArray(const JS::CallArgs& args) : length_(args.length()), elements_(args.array()) {}
+    MOZ_IMPLICIT HandleValueArray(const JS::CallArgs& args) : length_(args.length()), elements_(args.array()) {}
 
     /* Use with care! Only call this if the data is guaranteed to be marked. */
     static HandleValueArray fromMarkedLocation(size_t len, const Value *elements) {
@@ -643,7 +643,7 @@ struct JSFreeOp {
     JSRuntime   *runtime_;
 
   protected:
-    JSFreeOp(JSRuntime *rt)
+    explicit JSFreeOp(JSRuntime *rt)
       : runtime_(rt) { }
 
   public:
@@ -1342,8 +1342,8 @@ AssertHeapIsIdle(JSContext *cx);
 class JSAutoRequest
 {
   public:
-    JSAutoRequest(JSContext *cx
-                  MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
+    explicit JSAutoRequest(JSContext *cx
+                           MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
       : mContext(cx)
     {
         MOZ_GUARD_OBJECT_NOTIFIER_INIT;
@@ -1367,8 +1367,8 @@ class JSAutoRequest
 class JSAutoCheckRequest
 {
   public:
-    JSAutoCheckRequest(JSContext *cx
-                       MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
+    explicit JSAutoCheckRequest(JSContext *cx
+                                MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
     {
 #if defined JS_THREADSAFE && defined JS_DEBUG
         mContext = cx;
@@ -1622,7 +1622,7 @@ ContextOptionsRef(JSContext *cx);
 
 class JS_PUBLIC_API(AutoSaveContextOptions) {
   public:
-    AutoSaveContextOptions(JSContext *cx)
+    explicit AutoSaveContextOptions(JSContext *cx)
       : cx_(cx),
         oldOptions_(ContextOptionsRef(cx_))
     {
@@ -1735,7 +1735,7 @@ class JS_PUBLIC_API(JSAutoNullCompartment)
     JSContext *cx_;
     JSCompartment *oldCompartment_;
   public:
-    JSAutoNullCompartment(JSContext *cx);
+    explicit JSAutoNullCompartment(JSContext *cx);
     ~JSAutoNullCompartment();
 };
 
@@ -4874,8 +4874,8 @@ UnhideScriptedCaller(JSContext *cx);
 class AutoHideScriptedCaller
 {
   public:
-    AutoHideScriptedCaller(JSContext *cx
-                           MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
+    explicit AutoHideScriptedCaller(JSContext *cx
+                                    MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
       : mContext(cx)
     {
         MOZ_GUARD_OBJECT_NOTIFIER_INIT;
@@ -5014,7 +5014,7 @@ class MOZ_STACK_CLASS JS_PUBLIC_API(ForOfIterator) {
     ForOfIterator &operator=(const ForOfIterator &) MOZ_DELETE;
 
   public:
-    ForOfIterator(JSContext *cx) : cx_(cx), iterator(cx_), index(NOT_ARRAY) { }
+    explicit ForOfIterator(JSContext *cx) : cx_(cx), iterator(cx_), index(NOT_ARRAY) { }
 
     enum NonIterableBehavior {
         ThrowOnNonIterable,
diff --git a/js/src/jsarray.cpp b/js/src/jsarray.cpp
index 9fd783881cb6..2087d2653982 100644
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -959,7 +959,7 @@ struct EmptySeparatorOp
 struct CharSeparatorOp
 {
     jschar sep;
-    CharSeparatorOp(jschar sep) : sep(sep) {};
+    explicit CharSeparatorOp(jschar sep) : sep(sep) {};
     bool operator()(JSContext *, StringBuffer &sb) { return sb.append(sep); }
 };
 
@@ -1510,7 +1510,7 @@ struct SortComparatorStrings
 {
     JSContext   *const cx;
 
-    SortComparatorStrings(JSContext *cx)
+    explicit SortComparatorStrings(JSContext *cx)
       : cx(cx) {}
 
     bool operator()(const Value &a, const Value &b, bool *lessOrEqualp) {
@@ -3081,7 +3081,7 @@ js_InitArrayClass(JSContext *cx, HandleObject obj)
     if (!proto)
         return nullptr;
 
-    RootedTypeObject type(cx, cx->getNewType(&ArrayObject::class_, proto.get()));
+    RootedTypeObject type(cx, cx->getNewType(&ArrayObject::class_, TaggedProto(proto)));
     if (!type)
         return nullptr;
 
@@ -3191,7 +3191,7 @@ NewArray(ExclusiveContext *cxArg, uint32_t length,
     if (!proto && !GetBuiltinPrototype(cxArg, JSProto_Array, &proto))
         return nullptr;
 
-    RootedTypeObject type(cxArg, cxArg->getNewType(&ArrayObject::class_, proto.get()));
+    RootedTypeObject type(cxArg, cxArg->getNewType(&ArrayObject::class_, TaggedProto(proto)));
     if (!type)
         return nullptr;
 
diff --git a/js/src/jsatom.h b/js/src/jsatom.h
index 025ffe8c0326..2402c50e3c5f 100644
--- a/js/src/jsatom.h
+++ b/js/src/jsatom.h
@@ -96,7 +96,7 @@ struct AtomHasher
         {
             hash = mozilla::HashString(chars, length);
         }
-        inline Lookup(const JSAtom *atom);
+        inline explicit Lookup(const JSAtom *atom);
     };
 
     static HashNumber hash(const Lookup &l) { return l.hash; }
diff --git a/js/src/jscntxt.h b/js/src/jscntxt.h
index 8c21024405f5..396ec82832f9 100644
--- a/js/src/jscntxt.h
+++ b/js/src/jscntxt.h
@@ -969,7 +969,7 @@ class AutoAssertNoException
 #endif
 
   public:
-    AutoAssertNoException(JSContext *cx)
+    explicit AutoAssertNoException(JSContext *cx)
 #ifdef DEBUG
       : cx(cx),
         hadException(cx->isExceptionPending())
@@ -991,7 +991,7 @@ class ContextAllocPolicy
     ThreadSafeContext *const cx_;
 
   public:
-    ContextAllocPolicy(ThreadSafeContext *cx) : cx_(cx) {}
+    MOZ_IMPLICIT ContextAllocPolicy(ThreadSafeContext *cx) : cx_(cx) {}
     ThreadSafeContext *context() const { return cx_; }
     void *malloc_(size_t bytes) { return cx_->malloc_(bytes); }
     void *calloc_(size_t bytes) { return cx_->calloc_(bytes); }
@@ -1047,11 +1047,11 @@ class AutoLockForExclusiveAccess
     }
 
   public:
-    AutoLockForExclusiveAccess(ExclusiveContext *cx MOZ_GUARD_OBJECT_NOTIFIER_PARAM) {
+    explicit AutoLockForExclusiveAccess(ExclusiveContext *cx MOZ_GUARD_OBJECT_NOTIFIER_PARAM) {
         MOZ_GUARD_OBJECT_NOTIFIER_INIT;
         init(cx->runtime_);
     }
-    AutoLockForExclusiveAccess(JSRuntime *rt MOZ_GUARD_OBJECT_NOTIFIER_PARAM) {
+    explicit AutoLockForExclusiveAccess(JSRuntime *rt MOZ_GUARD_OBJECT_NOTIFIER_PARAM) {
         MOZ_GUARD_OBJECT_NOTIFIER_INIT;
         init(rt);
     }
diff --git a/js/src/jscompartment.cpp b/js/src/jscompartment.cpp
index 0458f6d6ef54..99c0f4ce5b22 100644
--- a/js/src/jscompartment.cpp
+++ b/js/src/jscompartment.cpp
@@ -248,7 +248,7 @@ JSCompartment::putWrapper(JSContext *cx, const CrossCompartmentKey &wrapped, con
     JS_ASSERT(!IsPoisonedPtr(wrapper.toGCThing()));
     JS_ASSERT_IF(wrapped.kind == CrossCompartmentKey::StringWrapper, wrapper.isString());
     JS_ASSERT_IF(wrapped.kind != CrossCompartmentKey::StringWrapper, wrapper.isObject());
-    bool success = crossCompartmentWrappers.put(wrapped, wrapper);
+    bool success = crossCompartmentWrappers.put(wrapped, ReadBarriered<Value>(wrapper));
 
 #ifdef JSGC_GENERATIONAL
     /* There's no point allocating wrappers in the nursery since we will tenure them anyway. */
@@ -282,7 +282,7 @@ JSCompartment::wrap(JSContext *cx, JSString **strp)
 
     /* Check the cache. */
     RootedValue key(cx, StringValue(str));
-    if (WrapperMap::Ptr p = crossCompartmentWrappers.lookup(key)) {
+    if (WrapperMap::Ptr p = crossCompartmentWrappers.lookup(CrossCompartmentKey(key))) {
         *strp = p->value().get().toString();
         return true;
     }
@@ -305,7 +305,7 @@ JSCompartment::wrap(JSContext *cx, JSString **strp)
 
     if (!copy)
         return false;
-    if (!putWrapper(cx, key, StringValue(copy)))
+    if (!putWrapper(cx, CrossCompartmentKey(key), StringValue(copy)))
         return false;
 
     *strp = copy;
@@ -394,7 +394,7 @@ JSCompartment::wrap(JSContext *cx, MutableHandleObject obj, HandleObject existin
 
     // If we already have a wrapper for this value, use it.
     RootedValue key(cx, ObjectValue(*obj));
-    if (WrapperMap::Ptr p = crossCompartmentWrappers.lookup(key)) {
+    if (WrapperMap::Ptr p = crossCompartmentWrappers.lookup(CrossCompartmentKey(key))) {
         obj.set(&p->value().get().toObject());
         JS_ASSERT(obj->is<CrossCompartmentWrapperObject>());
         JS_ASSERT(obj->getParent() == global);
@@ -423,7 +423,7 @@ JSCompartment::wrap(JSContext *cx, MutableHandleObject obj, HandleObject existin
     // map is always directly wrapped by the value.
     JS_ASSERT(Wrapper::wrappedObject(obj) == &key.get().toObject());
 
-    return putWrapper(cx, key, ObjectValue(*obj));
+    return putWrapper(cx, CrossCompartmentKey(key), ObjectValue(*obj));
 }
 
 bool
@@ -567,12 +567,12 @@ JSCompartment::sweep(FreeOp *fop, bool releaseTypes)
         savedStacks_.sweep(rt);
 
         if (global_ && IsObjectAboutToBeFinalized(global_.unsafeGet()))
-            global_ = nullptr;
+            global_.set(nullptr);
 
         if (selfHostingScriptSource &&
             IsObjectAboutToBeFinalized((JSObject **) selfHostingScriptSource.unsafeGet()))
         {
-            selfHostingScriptSource = nullptr;
+            selfHostingScriptSource.set(nullptr);
         }
 
 #ifdef JS_ION
@@ -643,7 +643,7 @@ JSCompartment::purge()
 void
 JSCompartment::clearTables()
 {
-    global_ = nullptr;
+    global_.set(nullptr);
 
     // No scripts should have run in this compartment. This is used when
     // merging a compartment that has been used off thread into another
diff --git a/js/src/jscompartment.h b/js/src/jscompartment.h
index cb74a301ae5d..65d68457bdc3 100644
--- a/js/src/jscompartment.h
+++ b/js/src/jscompartment.h
@@ -75,15 +75,15 @@ struct CrossCompartmentKey
 
     CrossCompartmentKey()
       : kind(ObjectWrapper), debugger(nullptr), wrapped(nullptr) {}
-    CrossCompartmentKey(JSObject *wrapped)
+    explicit CrossCompartmentKey(JSObject *wrapped)
       : kind(ObjectWrapper), debugger(nullptr), wrapped(wrapped) {}
-    CrossCompartmentKey(JSString *wrapped)
+    explicit CrossCompartmentKey(JSString *wrapped)
       : kind(StringWrapper), debugger(nullptr), wrapped(wrapped) {}
-    CrossCompartmentKey(Value wrapped)
+    explicit CrossCompartmentKey(Value wrapped)
       : kind(wrapped.isString() ? StringWrapper : ObjectWrapper),
         debugger(nullptr),
         wrapped((js::gc::Cell *)wrapped.toGCThing()) {}
-    CrossCompartmentKey(const RootedValue &wrapped)
+    explicit CrossCompartmentKey(const RootedValue &wrapped)
       : kind(wrapped.get().isString() ? StringWrapper : ObjectWrapper),
         debugger(nullptr),
         wrapped((js::gc::Cell *)wrapped.get().toGCThing()) {}
@@ -322,7 +322,7 @@ struct JSCompartment
     bool putWrapper(JSContext *cx, const js::CrossCompartmentKey& wrapped, const js::Value& wrapper);
 
     js::WrapperMap::Ptr lookupWrapper(const js::Value& wrapped) {
-        return crossCompartmentWrappers.lookup(wrapped);
+        return crossCompartmentWrappers.lookup(js::CrossCompartmentKey(wrapped));
     }
 
     void removeWrapper(js::WrapperMap::Ptr p) {
@@ -330,7 +330,7 @@ struct JSCompartment
     }
 
     struct WrapperEnum : public js::WrapperMap::Enum {
-        WrapperEnum(JSCompartment *c) : js::WrapperMap::Enum(c->crossCompartmentWrappers) {}
+        explicit WrapperEnum(JSCompartment *c) : js::WrapperMap::Enum(c->crossCompartmentWrappers) {}
     };
 
     void trace(JSTracer *trc);
@@ -541,8 +541,8 @@ ExclusiveContext::global() const
 class AssertCompartmentUnchanged
 {
   public:
-    AssertCompartmentUnchanged(JSContext *cx
-                                MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
+    explicit AssertCompartmentUnchanged(JSContext *cx
+                                        MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
       : cx(cx), oldCompartment(cx->compartment())
     {
         MOZ_GUARD_OBJECT_NOTIFIER_INIT;
diff --git a/js/src/jscompartmentinlines.h b/js/src/jscompartmentinlines.h
index 559cc923b3d5..e541e6cd6d46 100644
--- a/js/src/jscompartmentinlines.h
+++ b/js/src/jscompartmentinlines.h
@@ -16,7 +16,7 @@ JSCompartment::initGlobal(js::GlobalObject &global)
 {
     JS_ASSERT(global.compartment() == this);
     JS_ASSERT(!global_);
-    global_ = &global;
+    global_.set(&global);
 }
 
 js::GlobalObject *
@@ -89,7 +89,7 @@ JSCompartment::wrap(JSContext *cx, JS::MutableHandleValue vp, JS::HandleObject e
     JS::RootedObject cacheResult(cx);
 #endif
     JS::RootedValue v(cx, vp);
-    if (js::WrapperMap::Ptr p = crossCompartmentWrappers.lookup(v)) {
+    if (js::WrapperMap::Ptr p = crossCompartmentWrappers.lookup(js::CrossCompartmentKey(v))) {
 #ifdef DEBUG
         cacheResult = &p->value().get().toObject();
 #else
diff --git a/js/src/jscrashformat.h b/js/src/jscrashformat.h
index bd9459e6b1c0..c2f7d083d110 100644
--- a/js/src/jscrashformat.h
+++ b/js/src/jscrashformat.h
@@ -33,7 +33,7 @@ struct CrashHeader
     /* id of the crash data, chosen from the enum above. */
     uint64_t id;
 
-    CrashHeader(uint64_t id) : id(id) { memcpy(cookie, crash_cookie, crash_cookie_len); }
+    explicit CrashHeader(uint64_t id) : id(id) { memcpy(cookie, crash_cookie, crash_cookie_len); }
 };
 
 struct CrashRegisters
@@ -45,7 +45,7 @@ static const int crash_buffer_size = 32 * 1024;
 
 struct CrashStack
 {
-    CrashStack(uint64_t id) : header(id) {}
+    explicit CrashStack(uint64_t id) : header(id) {}
 
     CrashHeader header;
     uint64_t snaptime;    /* Unix time when the stack was snapshotted. */
@@ -57,7 +57,7 @@ struct CrashStack
 
 struct CrashRing
 {
-    CrashRing(uint64_t id) : header(id), offset(0) { memset(buffer, 0, sizeof(buffer)); }
+    explicit CrashRing(uint64_t id) : header(id), offset(0) { memset(buffer, 0, sizeof(buffer)); }
 
     CrashHeader header;
     uint64_t offset; /* Next byte to be written in the buffer. */
diff --git a/js/src/jscrashreport.cpp b/js/src/jscrashreport.cpp
index f1bf2be26ef5..0fa8f68a38f6 100644
--- a/js/src/jscrashreport.cpp
+++ b/js/src/jscrashreport.cpp
@@ -149,7 +149,7 @@ namespace crash {
 class Stack : private CrashStack
 {
 public:
-    Stack(uint64_t id);
+    explicit Stack(uint64_t id);
 
     bool snapshot();
 };
@@ -169,7 +169,7 @@ Stack::snapshot()
 class Ring : private CrashRing
 {
 public:
-    Ring(uint64_t id);
+    explicit Ring(uint64_t id);
 
     void push(uint64_t tag, void *data, size_t size);
 
diff --git a/js/src/jscrashreport.h b/js/src/jscrashreport.h
index 4d0dca58b6dc..c3d8c219b54e 100644
--- a/js/src/jscrashreport.h
+++ b/js/src/jscrashreport.h
@@ -27,8 +27,8 @@ template<size_t size, unsigned char marker>
 class StackBuffer
 {
   public:
-    StackBuffer(void *data
-                MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
+    explicit StackBuffer(void *data
+                         MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
     {
         MOZ_GUARD_OBJECT_NOTIFIER_INIT;
 
diff --git a/js/src/jsexn.cpp b/js/src/jsexn.cpp
index 0783493c2156..c532eab63ef2 100644
--- a/js/src/jsexn.cpp
+++ b/js/src/jsexn.cpp
@@ -192,7 +192,7 @@ struct SuppressErrorsGuard
     JSErrorReporter prevReporter;
     JS::AutoSaveExceptionState prevState;
 
-    SuppressErrorsGuard(JSContext *cx)
+    explicit SuppressErrorsGuard(JSContext *cx)
       : cx(cx),
         prevReporter(JS_SetErrorReporter(cx, nullptr)),
         prevState(cx)
diff --git a/js/src/jsfriendapi.cpp b/js/src/jsfriendapi.cpp
index b69301bf6b96..0ce9fe376a0d 100644
--- a/js/src/jsfriendapi.cpp
+++ b/js/src/jsfriendapi.cpp
@@ -684,7 +684,7 @@ JS_SetAccumulateTelemetryCallback(JSRuntime *rt, JSAccumulateTelemetryDataCallba
 JS_FRIEND_API(JSObject *)
 JS_CloneObject(JSContext *cx, HandleObject obj, HandleObject protoArg, HandleObject parent)
 {
-    Rooted<js::TaggedProto> proto(cx, protoArg.get());
+    Rooted<TaggedProto> proto(cx, TaggedProto(protoArg.get()));
     return CloneObject(cx, obj, proto, parent);
 }
 
diff --git a/js/src/jsfriendapi.h b/js/src/jsfriendapi.h
index 24885127e568..9efa179655fb 100644
--- a/js/src/jsfriendapi.h
+++ b/js/src/jsfriendapi.h
@@ -1002,13 +1002,13 @@ struct ChromeCompartmentsOnly : public CompartmentFilter {
 
 struct SingleCompartment : public CompartmentFilter {
     JSCompartment *ours;
-    SingleCompartment(JSCompartment *c) : ours(c) {}
+    explicit SingleCompartment(JSCompartment *c) : ours(c) {}
     virtual bool match(JSCompartment *c) const { return c == ours; }
 };
 
 struct CompartmentsWithPrincipals : public CompartmentFilter {
     JSPrincipals *principals;
-    CompartmentsWithPrincipals(JSPrincipals *p) : principals(p) {}
+    explicit CompartmentsWithPrincipals(JSPrincipals *p) : principals(p) {}
     virtual bool match(JSCompartment *c) const {
         return JS_GetCompartmentPrincipals(c) == principals;
     }
diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp
index 4442331dc7b2..174f339672e8 100644
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -4350,7 +4350,7 @@ class AutoCopyFreeListToArenasForGC
     JSRuntime *runtime;
 
   public:
-    AutoCopyFreeListToArenasForGC(JSRuntime *rt) : runtime(rt) {
+    explicit AutoCopyFreeListToArenasForGC(JSRuntime *rt) : runtime(rt) {
         JS_ASSERT(rt->currentThreadHasExclusiveAccess());
         for (ZonesIter zone(rt, WithAtoms); !zone.done(); zone.next())
             zone->allocator.arenas.copyFreeListsToArenas();
@@ -4433,7 +4433,7 @@ namespace {
 
 class AutoGCSlice {
   public:
-    AutoGCSlice(JSRuntime *rt);
+    explicit AutoGCSlice(JSRuntime *rt);
     ~AutoGCSlice();
 
   private:
@@ -4773,7 +4773,7 @@ class AutoDisableStoreBuffer
     bool prior;
 
   public:
-    AutoDisableStoreBuffer(GCRuntime *gc) : sb(gc->storeBuffer) {
+    explicit AutoDisableStoreBuffer(GCRuntime *gc) : sb(gc->storeBuffer) {
         prior = sb.isEnabled();
         sb.disable();
     }
diff --git a/js/src/jsgc.h b/js/src/jsgc.h
index 5fb30c8d394a..56ba269fae09 100644
--- a/js/src/jsgc.h
+++ b/js/src/jsgc.h
@@ -979,7 +979,7 @@ class GCHelperThread {
     void doSweep();
 
   public:
-    GCHelperThread(JSRuntime *rt)
+    explicit GCHelperThread(JSRuntime *rt)
       : rt(rt),
         thread(nullptr),
         wakeup(nullptr),
@@ -1223,9 +1223,9 @@ class AutoSuppressGC
     int32_t &suppressGC_;
 
   public:
-    AutoSuppressGC(ExclusiveContext *cx);
-    AutoSuppressGC(JSCompartment *comp);
-    AutoSuppressGC(JSRuntime *rt);
+    explicit AutoSuppressGC(ExclusiveContext *cx);
+    explicit AutoSuppressGC(JSCompartment *comp);
+    explicit AutoSuppressGC(JSRuntime *rt);
 
     ~AutoSuppressGC()
     {
@@ -1271,7 +1271,7 @@ class AutoDisableProxyCheck
 #else
 struct AutoDisableProxyCheck
 {
-    AutoDisableProxyCheck(JSRuntime *rt) {}
+    explicit AutoDisableProxyCheck(JSRuntime *rt) {}
 };
 #endif
 
diff --git a/js/src/jsgcinlines.h b/js/src/jsgcinlines.h
index ac4da3a99f27..5c291cc86210 100644
--- a/js/src/jsgcinlines.h
+++ b/js/src/jsgcinlines.h
@@ -22,7 +22,7 @@ class Shape;
  */
 struct AutoMarkInDeadZone
 {
-    AutoMarkInDeadZone(JS::Zone *zone)
+    explicit AutoMarkInDeadZone(JS::Zone *zone)
       : zone(zone),
         scheduled(zone->scheduledForDestruction)
     {
@@ -243,7 +243,7 @@ class ArenaCellIterImpl
 class ArenaCellIterUnderGC : public ArenaCellIterImpl
 {
   public:
-    ArenaCellIterUnderGC(ArenaHeader *aheader) {
+    explicit ArenaCellIterUnderGC(ArenaHeader *aheader) {
         JS_ASSERT(aheader->zone->runtimeFromAnyThread()->isHeapBusy());
         init(aheader);
     }
@@ -252,7 +252,7 @@ class ArenaCellIterUnderGC : public ArenaCellIterImpl
 class ArenaCellIterUnderFinalize : public ArenaCellIterImpl
 {
   public:
-    ArenaCellIterUnderFinalize(ArenaHeader *aheader) {
+    explicit ArenaCellIterUnderFinalize(ArenaHeader *aheader) {
         initUnsynchronized(aheader);
     }
 };
@@ -319,7 +319,7 @@ class AutoAssertNoAlloc
 
   public:
     AutoAssertNoAlloc() : gc(nullptr) {}
-    AutoAssertNoAlloc(JSRuntime *rt) : gc(nullptr) {
+    explicit AutoAssertNoAlloc(JSRuntime *rt) : gc(nullptr) {
         disallowAlloc(rt);
     }
     void disallowAlloc(JSRuntime *rt) {
@@ -334,7 +334,7 @@ class AutoAssertNoAlloc
 #else
   public:
     AutoAssertNoAlloc() {}
-    AutoAssertNoAlloc(JSRuntime *) {}
+    explicit AutoAssertNoAlloc(JSRuntime *) {}
     void disallowAlloc(JSRuntime *rt) {}
 #endif
 };
@@ -394,7 +394,7 @@ class GCZonesIter
     ZonesIter zone;
 
   public:
-    GCZonesIter(JSRuntime *rt) : zone(rt, WithAtoms) {
+    explicit GCZonesIter(JSRuntime *rt) : zone(rt, WithAtoms) {
         if (!zone->isCollecting())
             next();
     }
@@ -425,7 +425,7 @@ class GCZoneGroupIter {
     JS::Zone *current;
 
   public:
-    GCZoneGroupIter(JSRuntime *rt) {
+    explicit GCZoneGroupIter(JSRuntime *rt) {
         JS_ASSERT(rt->isHeapBusy());
         current = rt->gc.currentZoneGroup;
     }
diff --git a/js/src/jsinfer.cpp b/js/src/jsinfer.cpp
index fb7327032c61..4a8144f002bc 100644
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -754,7 +754,7 @@ class types::CompilerConstraintList
 #endif
 
   public:
-    CompilerConstraintList(jit::TempAllocator &alloc)
+    explicit CompilerConstraintList(jit::TempAllocator &alloc)
       : failed_(false)
 #ifdef JS_ION
       , alloc_(alloc.lifoAlloc())
@@ -1089,7 +1089,7 @@ class TypeConstraintFreezeStack : public TypeConstraint
     JSScript *script_;
 
   public:
-    TypeConstraintFreezeStack(JSScript *script)
+    explicit TypeConstraintFreezeStack(JSScript *script)
         : script_(script)
     {}
 
@@ -1446,7 +1446,7 @@ class ConstraintDataFreezeObjectFlags
     // Flags we are watching for on this object.
     TypeObjectFlags flags;
 
-    ConstraintDataFreezeObjectFlags(TypeObjectFlags flags)
+    explicit ConstraintDataFreezeObjectFlags(TypeObjectFlags flags)
       : flags(flags)
     {
         JS_ASSERT(flags);
@@ -1572,7 +1572,7 @@ class ConstraintDataFreezeObjectForNewScriptTemplate
     JSObject *templateObject;
 
   public:
-    ConstraintDataFreezeObjectForNewScriptTemplate(JSObject *templateObject)
+    explicit ConstraintDataFreezeObjectForNewScriptTemplate(JSObject *templateObject)
       : templateObject(templateObject)
     {}
 
@@ -1603,7 +1603,7 @@ class ConstraintDataFreezeObjectForTypedArrayBuffer
     void *viewData;
 
   public:
-    ConstraintDataFreezeObjectForTypedArrayBuffer(void *viewData)
+    explicit ConstraintDataFreezeObjectForTypedArrayBuffer(void *viewData)
       : viewData(viewData)
     {}
 
@@ -1702,7 +1702,7 @@ class ConstraintDataFreezePropertyState
         NON_WRITABLE
     } which;
 
-    ConstraintDataFreezePropertyState(Which which)
+    explicit ConstraintDataFreezePropertyState(Which which)
       : which(which)
     {}
 
@@ -1980,7 +1980,7 @@ TemporaryTypeSet::getCommonPrototype()
 
         TaggedProto nproto = object->proto();
         if (proto) {
-            if (nproto != proto)
+            if (nproto != TaggedProto(proto))
                 return nullptr;
         } else {
             if (!nproto.isObject())
@@ -2449,7 +2449,8 @@ TypeCompartment::setTypeToHomogenousArray(ExclusiveContext *cx,
     } else {
         /* Make a new type to use for future arrays with the same elements. */
         RootedObject objProto(cx, obj->getProto());
-        TypeObject *objType = newTypeObject(cx, &ArrayObject::class_, objProto);
+        Rooted<TaggedProto> taggedProto(cx, TaggedProto(objProto));
+        TypeObject *objType = newTypeObject(cx, &ArrayObject::class_, taggedProto);
         if (!objType)
             return;
         obj->setType(objType);
@@ -2670,8 +2671,8 @@ TypeCompartment::fixObjectType(ExclusiveContext *cx, JSObject *obj)
     JS_ASSERT(ObjectTableKey::match(key, lookup));
 
     ObjectTableEntry entry;
-    entry.object = objType;
-    entry.shape = obj->lastProperty();
+    entry.object.set(objType);
+    entry.shape.set(obj->lastProperty());
     entry.types = types;
 
     obj->setType(objType);
@@ -3263,7 +3264,7 @@ class TypeConstraintClearDefiniteGetterSetter : public TypeConstraint
   public:
     TypeObject *object;
 
-    TypeConstraintClearDefiniteGetterSetter(TypeObject *object)
+    explicit TypeConstraintClearDefiniteGetterSetter(TypeObject *object)
         : object(object)
     {}
 
@@ -3327,7 +3328,7 @@ class TypeConstraintClearDefiniteSingle : public TypeConstraint
   public:
     TypeObject *object;
 
-    TypeConstraintClearDefiniteSingle(TypeObject *object)
+    explicit TypeConstraintClearDefiniteSingle(TypeObject *object)
         : object(object)
     {}
 
@@ -3665,8 +3666,9 @@ JSFunction::setTypeForScriptedFunction(ExclusiveContext *cx, HandleFunction fun,
             return false;
     } else {
         RootedObject funProto(cx, fun->getProto());
+        Rooted<TaggedProto> taggedProto(cx, TaggedProto(funProto));
         TypeObject *type =
-            cx->compartment()->types.newTypeObject(cx, &JSFunction::class_, funProto);
+            cx->compartment()->types.newTypeObject(cx, &JSFunction::class_, taggedProto);
         if (!type)
             return false;
 
@@ -3801,7 +3803,7 @@ JSObject::hasNewType(const Class *clasp, TypeObject *type)
     if (!table.initialized())
         return false;
 
-    TypeObjectWithNewScriptSet::Ptr p = table.lookup(TypeObjectWithNewScriptSet::Lookup(clasp, this, nullptr));
+    TypeObjectWithNewScriptSet::Ptr p = table.lookup(TypeObjectWithNewScriptSet::Lookup(clasp, TaggedProto(this), nullptr));
     return p && p->object == type;
 }
 #endif /* DEBUG */
@@ -3819,7 +3821,8 @@ JSObject::setNewTypeUnknown(JSContext *cx, const Class *clasp, HandleObject obj)
      */
     TypeObjectWithNewScriptSet &table = cx->compartment()->newTypeObjects;
     if (table.initialized()) {
-        if (TypeObjectWithNewScriptSet::Ptr p = table.lookup(TypeObjectWithNewScriptSet::Lookup(clasp, obj.get(), nullptr)))
+        Rooted<TaggedProto> taggedProto(cx, TaggedProto(obj));
+        if (TypeObjectWithNewScriptSet::Ptr p = table.lookup(TypeObjectWithNewScriptSet::Lookup(clasp, taggedProto, nullptr)))
             MarkTypeObjectUnknownProperties(cx, p->object);
     }
 
@@ -3851,11 +3854,11 @@ class NewTypeObjectsSetRef : public BufferableRef
         if (prior == proto)
             return;
 
-        TypeObjectWithNewScriptSet::Ptr p = set->lookup(TypeObjectWithNewScriptSet::Lookup(clasp, prior, proto, newFunction));
+        TypeObjectWithNewScriptSet::Ptr p = set->lookup(TypeObjectWithNewScriptSet::Lookup(clasp, TaggedProto(prior), TaggedProto(proto), newFunction));
         JS_ASSERT(p);  // newTypeObjects set must still contain original entry.
 
-        set->rekeyAs(TypeObjectWithNewScriptSet::Lookup(clasp, prior, proto, newFunction),
-                     TypeObjectWithNewScriptSet::Lookup(clasp, proto, newFunction), *p);
+        set->rekeyAs(TypeObjectWithNewScriptSet::Lookup(clasp, TaggedProto(prior), TaggedProto(proto), newFunction),
+                     TypeObjectWithNewScriptSet::Lookup(clasp, TaggedProto(proto), newFunction), *p);
     }
 };
 #endif
@@ -4399,7 +4402,7 @@ TypeZone::sweep(FreeOp *fop, bool releaseTypes, bool *oom)
             if (output.isValid()) {
                 JSScript *script = output.script();
                 if (IsScriptAboutToBeFinalized(&script)) {
-                    jit::GetIonScript(script, output.mode())->recompileInfoRef() = uint32_t(-1);
+                    jit::GetIonScript(script, output.mode())->recompileInfoRef() = RecompileInfo(uint32_t(-1));
                     output.invalidate();
                 } else {
                     output.setSweepIndex(newCompilerOutputCount++);
diff --git a/js/src/jsinfer.h b/js/src/jsinfer.h
index fcdbe4ae2a78..cee67c7a5a4b 100644
--- a/js/src/jsinfer.h
+++ b/js/src/jsinfer.h
@@ -34,7 +34,7 @@ class TaggedProto
     static JSObject * const LazyProto;
 
     TaggedProto() : proto(nullptr) {}
-    TaggedProto(JSObject *proto) : proto(proto) {}
+    explicit TaggedProto(JSObject *proto) : proto(proto) {}
 
     uintptr_t toWord() const { return uintptr_t(proto); }
 
@@ -223,7 +223,7 @@ class TypeObjectKey;
 class Type
 {
     uintptr_t data;
-    Type(uintptr_t data) : data(data) {}
+    explicit Type(uintptr_t data) : data(data) {}
 
   public:
 
@@ -674,7 +674,7 @@ class TemporaryTypeSet : public TypeSet
 {
   public:
     TemporaryTypeSet() {}
-    TemporaryTypeSet(Type type);
+    explicit TemporaryTypeSet(Type type);
 
     TemporaryTypeSet(uint32_t flags, TypeObjectKey **objectSet) {
         this->flags = flags;
@@ -799,7 +799,7 @@ struct Property
     /* Possible types for this property, including types inherited from prototypes. */
     HeapTypeSet types;
 
-    Property(jsid id)
+    explicit Property(jsid id)
       : id(id)
     {}
 
@@ -821,7 +821,7 @@ struct TypeObjectAddendum
         TypedObject
     };
 
-    TypeObjectAddendum(Kind kind);
+    explicit TypeObjectAddendum(Kind kind);
 
     const Kind kind;
 
@@ -905,7 +905,7 @@ struct TypeTypedObject : public TypeObjectAddendum
     HeapPtrObject descr_;
 
   public:
-    TypeTypedObject(Handle<TypeDescr*> descr);
+    explicit TypeTypedObject(Handle<TypeDescr*> descr);
 
     HeapPtrObject &descrHeapPtr() {
         return descr_;
@@ -1541,7 +1541,7 @@ class RecompileInfo
     uint32_t outputIndex;
 
   public:
-    RecompileInfo(uint32_t outputIndex = uint32_t(-1))
+    explicit RecompileInfo(uint32_t outputIndex = uint32_t(-1))
       : outputIndex(outputIndex)
     {}
 
@@ -1632,7 +1632,7 @@ struct TypeZone
     /* Pending recompilations to perform before execution of JIT code can resume. */
     Vector<RecompileInfo> *pendingRecompiles;
 
-    TypeZone(JS::Zone *zone);
+    explicit TypeZone(JS::Zone *zone);
     ~TypeZone();
 
     JS::Zone *zone() const { return zone_; }
diff --git a/js/src/jsinferinlines.h b/js/src/jsinferinlines.h
index 15a01573a742..d09f983e54e2 100644
--- a/js/src/jsinferinlines.h
+++ b/js/src/jsinferinlines.h
@@ -231,7 +231,7 @@ struct AutoEnterAnalysis
     JSCompartment *compartment;
     bool oldActiveAnalysis;
 
-    AutoEnterAnalysis(ExclusiveContext *cx)
+    explicit AutoEnterAnalysis(ExclusiveContext *cx)
       : suppressGC(cx)
     {
         init(cx->defaultFreeOp(), cx->compartment());
@@ -325,7 +325,7 @@ GetTypeNewObject(JSContext *cx, JSProtoKey key)
     RootedObject proto(cx);
     if (!GetBuiltinPrototype(cx, key, &proto))
         return nullptr;
-    return cx->getNewType(GetClassForProtoKey(key), proto.get());
+    return cx->getNewType(GetClassForProtoKey(key), TaggedProto(proto.get()));
 }
 
 /* Get a type object for the immediate allocation site within a native. */
diff --git a/js/src/jsiter.cpp b/js/src/jsiter.cpp
index 55ee8638548a..0b8b6aa82ae7 100644
--- a/js/src/jsiter.cpp
+++ b/js/src/jsiter.cpp
@@ -385,7 +385,7 @@ static inline PropertyIteratorObject *
 NewPropertyIteratorObject(JSContext *cx, unsigned flags)
 {
     if (flags & JSITER_ENUMERATE) {
-        RootedTypeObject type(cx, cx->getNewType(&PropertyIteratorObject::class_, nullptr));
+        RootedTypeObject type(cx, cx->getNewType(&PropertyIteratorObject::class_, TaggedProto(nullptr)));
         if (!type)
             return nullptr;
 
@@ -394,7 +394,7 @@ NewPropertyIteratorObject(JSContext *cx, unsigned flags)
             return nullptr;
 
         const Class *clasp = &PropertyIteratorObject::class_;
-        RootedShape shape(cx, EmptyShape::getInitialShape(cx, clasp, nullptr, nullptr, metadata,
+        RootedShape shape(cx, EmptyShape::getInitialShape(cx, clasp, TaggedProto(nullptr), nullptr, metadata,
                                                           ITERATOR_FINALIZE_KIND));
         if (!shape)
             return nullptr;
@@ -1121,7 +1121,7 @@ namespace {
 class SingleStringPredicate {
     Handle<JSFlatString*> str;
 public:
-    SingleStringPredicate(Handle<JSFlatString*> str) : str(str) {}
+    explicit SingleStringPredicate(Handle<JSFlatString*> str) : str(str) {}
 
     bool operator()(JSFlatString *str) { return EqualStrings(str, this->str); }
     bool matchesAtMostOne() { return true; }
diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index b63a3fd1a252..da6a104f4b71 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -1506,7 +1506,7 @@ js::NewObjectWithClassProtoCommon(ExclusiveContext *cxArg,
                                   gc::AllocKind allocKind, NewObjectKind newKind)
 {
     if (protoArg)
-        return NewObjectWithGivenProto(cxArg, clasp, protoArg, parentArg, allocKind, newKind);
+        return NewObjectWithGivenProto(cxArg, clasp, TaggedProto(protoArg), parentArg, allocKind, newKind);
 
     if (CanBeFinalizedInBackground(allocKind, clasp))
         allocKind = GetBackgroundAllocKind(allocKind);
@@ -1555,7 +1555,8 @@ js::NewObjectWithClassProtoCommon(ExclusiveContext *cxArg,
     if (!FindProto(cxArg, clasp, &proto))
         return nullptr;
 
-    types::TypeObject *type = cxArg->getNewType(clasp, proto.get());
+    Rooted<TaggedProto> taggedProto(cxArg, TaggedProto(proto));
+    types::TypeObject *type = cxArg->getNewType(clasp, taggedProto);
     if (!type)
         return nullptr;
 
@@ -1667,7 +1668,7 @@ CreateThisForFunctionWithType(JSContext *cx, HandleTypeObject type, JSObject *pa
         if (!res)
             return nullptr;
         if (newKind == SingletonObject) {
-            Rooted<TaggedProto> proto(cx, templateObject->getProto());
+            Rooted<TaggedProto> proto(cx, TaggedProto(templateObject->getProto()));
             if (!res->splicePrototype(cx, &JSObject::class_, proto))
                 return nullptr;
         } else {
@@ -1687,7 +1688,7 @@ js::CreateThisForFunctionWithProto(JSContext *cx, HandleObject callee, JSObject
     RootedObject res(cx);
 
     if (proto) {
-        RootedTypeObject type(cx, cx->getNewType(&JSObject::class_, proto, &callee->as<JSFunction>()));
+        RootedTypeObject type(cx, cx->getNewType(&JSObject::class_, TaggedProto(proto), &callee->as<JSFunction>()));
         if (!type)
             return nullptr;
         res = CreateThisForFunctionWithType(cx, type, callee->getParent(), newKind);
@@ -1954,7 +1955,7 @@ js::DeepCloneObjectLiteral(JSContext *cx, HandleObject obj, NewObjectKind newKin
         if (!typeObj)
             return nullptr;
         RootedObject parent(cx, obj->getParent());
-        clone = NewObjectWithGivenProto(cx, &JSObject::class_, typeObj->proto().toObject(),
+        clone = NewObjectWithGivenProto(cx, &JSObject::class_, TaggedProto(typeObj->proto().toObject()),
                                         parent, kind, newKind);
     }
 
@@ -2213,7 +2214,7 @@ JSObject *
 js::CloneObjectLiteral(JSContext *cx, HandleObject parent, HandleObject srcObj)
 {
     Rooted<TypeObject*> typeObj(cx);
-    typeObj = cx->getNewType(&JSObject::class_, cx->global()->getOrCreateObjectPrototype(cx));
+    typeObj = cx->getNewType(&JSObject::class_, TaggedProto(cx->global()->getOrCreateObjectPrototype(cx)));
 
     JS_ASSERT(srcObj->getClass() == &JSObject::class_);
     AllocKind kind = GetBackgroundAllocKind(GuessObjectGCKind(srcObj->numFixedSlots()));
@@ -2233,7 +2234,7 @@ struct JSObject::TradeGutsReserved {
     HeapSlot *newaslots;
     HeapSlot *newbslots;
 
-    TradeGutsReserved(JSContext *cx)
+    explicit TradeGutsReserved(JSContext *cx)
         : avals(cx), bvals(cx),
           newafixed(0), newbfixed(0),
           newashape(cx), newbshape(cx),
diff --git a/js/src/jsobjinlines.h b/js/src/jsobjinlines.h
index 22dcb1ccae7c..fef7f4a81c76 100644
--- a/js/src/jsobjinlines.h
+++ b/js/src/jsobjinlines.h
@@ -384,7 +384,7 @@ JSObject::clearType(JSContext *cx, js::HandleObject obj)
     JS_ASSERT(!obj->hasSingletonType());
     JS_ASSERT(cx->compartment() == obj->compartment());
 
-    js::types::TypeObject *type = cx->getNewType(obj->getClass(), nullptr);
+    js::types::TypeObject *type = cx->getNewType(obj->getClass(), js::TaggedProto(nullptr));
     if (!type)
         return false;
 
@@ -472,7 +472,8 @@ JSObject::setProto(JSContext *cx, JS::HandleObject obj, JS::HandleObject proto,
             return false;
     }
 
-    return SetClassAndProto(cx, obj, obj->getClass(), proto, succeeded);
+    JS::Rooted<js::TaggedProto> taggedProto(cx, js::TaggedProto(proto));
+    return SetClassAndProto(cx, obj, obj->getClass(), taggedProto, succeeded);
 }
 
 inline bool
@@ -774,7 +775,7 @@ IsInternalFunctionObject(JSObject *funobj)
 class AutoPropDescArrayRooter : private AutoGCRooter
 {
   public:
-    AutoPropDescArrayRooter(JSContext *cx)
+    explicit AutoPropDescArrayRooter(JSContext *cx)
       : AutoGCRooter(cx, DESCRIPTORS), descriptors(cx)
     { }
 
diff --git a/js/src/jsonparser.h b/js/src/jsonparser.h
index d7fd54a72462..48bfc4906720 100644
--- a/js/src/jsonparser.h
+++ b/js/src/jsonparser.h
@@ -75,11 +75,11 @@ class MOZ_STACK_CLASS JSONParser : private AutoGCRooter
             return * static_cast<PropertyVector *>(vector);
         }
 
-        StackEntry(ElementVector *elements)
+        explicit StackEntry(ElementVector *elements)
           : state(FinishArrayElement), vector(elements)
         {}
 
-        StackEntry(PropertyVector *properties)
+        explicit StackEntry(PropertyVector *properties)
           : state(FinishObjectMember), vector(properties)
         {}
 
diff --git a/js/src/jspropertytree.cpp b/js/src/jspropertytree.cpp
index 49feb9ff7f35..149b011cdbee 100644
--- a/js/src/jspropertytree.cpp
+++ b/js/src/jspropertytree.cpp
@@ -48,8 +48,8 @@ HashChildren(Shape *kid1, Shape *kid2)
         return nullptr;
     }
 
-    JS_ALWAYS_TRUE(hash->putNew(kid1, kid1));
-    JS_ALWAYS_TRUE(hash->putNew(kid2, kid2));
+    JS_ALWAYS_TRUE(hash->putNew(StackShape(kid1), kid1));
+    JS_ALWAYS_TRUE(hash->putNew(StackShape(kid2), kid2));
     return hash;
 }
 
@@ -85,7 +85,7 @@ PropertyTree::insertChild(ExclusiveContext *cx, Shape *parent, Shape *child)
         return true;
     }
 
-    if (!kidp->toHash()->putNew(child, child)) {
+    if (!kidp->toHash()->putNew(StackShape(child), child)) {
         js_ReportOutOfMemory(cx);
         return false;
     }
@@ -112,7 +112,7 @@ Shape::removeChild(Shape *child)
     KidsHash *hash = kidp->toHash();
     JS_ASSERT(hash->count() >= 2);      /* otherwise kidp->isShape() should be true */
 
-    hash->remove(child);
+    hash->remove(StackShape(child));
     child->parent = nullptr;
 
     if (hash->count() == 1) {
@@ -276,7 +276,7 @@ KidsPointer::checkConsistency(Shape *aKid) const
     } else {
         JS_ASSERT(isHash());
         KidsHash *hash = toHash();
-        KidsHash::Ptr ptr = hash->lookup(aKid);
+        KidsHash::Ptr ptr = hash->lookup(StackShape(aKid));
         JS_ASSERT(*ptr == aKid);
     }
 }
diff --git a/js/src/jspropertytree.h b/js/src/jspropertytree.h
index 362c45c6d02c..40b509be9ab8 100644
--- a/js/src/jspropertytree.h
+++ b/js/src/jspropertytree.h
@@ -89,7 +89,7 @@ class PropertyTree
         MAX_HEIGHT_WITH_ELEMENTS_ACCESS = 128
     };
 
-    PropertyTree(JSCompartment *comp)
+    explicit PropertyTree(JSCompartment *comp)
         : compartment_(comp)
     {
     }
diff --git a/js/src/jspubtd.h b/js/src/jspubtd.h
index 0a80feec7048..4950a9e7c350 100644
--- a/js/src/jspubtd.h
+++ b/js/src/jspubtd.h
@@ -180,7 +180,7 @@ struct Runtime
 #endif
 
   public:
-    Runtime(
+    explicit Runtime(
 #ifdef JSGC_GENERATIONAL
         js::gc::StoreBuffer *storeBuffer
 #endif
diff --git a/js/src/jsscript.cpp b/js/src/jsscript.cpp
index 9ce1dbbe0484..45f2b2a91852 100644
--- a/js/src/jsscript.cpp
+++ b/js/src/jsscript.cpp
@@ -117,7 +117,7 @@ Bindings::initWithTemporaryStorage(ExclusiveContext *cx, InternalBindingsHandle
 
     // Start with the empty shape and then append one shape per aliased binding.
     RootedShape shape(cx,
-        EmptyShape::getInitialShape(cx, &CallObject::class_, nullptr, nullptr, nullptr,
+        EmptyShape::getInitialShape(cx, &CallObject::class_, TaggedProto(nullptr), nullptr, nullptr,
                                     nfixed, BaseShape::VAROBJ | BaseShape::DELEGATE));
     if (!shape)
         return false;
@@ -2974,7 +2974,7 @@ js::CloneScript(JSContext *cx, HandleObject enclosingScope, HandleFunction fun,
             ScriptSourceObject *obj = frontend::CreateScriptSourceObject(cx, options);
             if (!obj)
                 return nullptr;
-            cx->compartment()->selfHostingScriptSource = obj;
+            cx->compartment()->selfHostingScriptSource.set(obj);
         }
         sourceObject = cx->compartment()->selfHostingScriptSource;
     } else {
@@ -3515,8 +3515,8 @@ js::SetFrameArgumentsObject(JSContext *cx, AbstractFramePtr frame,
         // Note that here and below, it is insufficient to only check for
         // JS_OPTIMIZED_ARGUMENTS, as Ion could have optimized out the
         // arguments slot.
-        if (IsOptimizedPlaceholderMagicValue(frame.callObj().as<ScopeObject>().aliasedVar(pc)))
-            frame.callObj().as<ScopeObject>().setAliasedVar(cx, pc, cx->names().arguments, ObjectValue(*argsobj));
+        if (IsOptimizedPlaceholderMagicValue(frame.callObj().as<ScopeObject>().aliasedVar(ScopeCoordinate(pc))))
+            frame.callObj().as<ScopeObject>().setAliasedVar(cx, ScopeCoordinate(pc), cx->names().arguments, ObjectValue(*argsobj));
     } else {
         if (IsOptimizedPlaceholderMagicValue(frame.unaliasedLocal(var)))
             frame.unaliasedLocal(var) = ObjectValue(*argsobj);
diff --git a/js/src/jsscript.h b/js/src/jsscript.h
index f2a61622bc7f..4a12cdfc3959 100644
--- a/js/src/jsscript.h
+++ b/js/src/jsscript.h
@@ -1904,7 +1904,7 @@ struct ScriptBytecodeHasher
         jsbytecode          *code;
         uint32_t            length;
 
-        Lookup(SharedScriptData *ssd) : code(ssd->data), length(ssd->length) {}
+        explicit Lookup(SharedScriptData *ssd) : code(ssd->data), length(ssd->length) {}
     };
     static HashNumber hash(const Lookup &l) { return mozilla::HashBytes(l.code, l.length); }
     static bool match(SharedScriptData *entry, const Lookup &lookup) {
diff --git a/js/src/jsstr.cpp b/js/src/jsstr.cpp
index 24f8706f661e..828f82b1b96f 100644
--- a/js/src/jsstr.cpp
+++ b/js/src/jsstr.cpp
@@ -1202,7 +1202,7 @@ class StringSegmentRange
     }
 
   public:
-    StringSegmentRange(JSContext *cx)
+    explicit StringSegmentRange(JSContext *cx)
       : stack(cx), cur(cx)
     {}
 
@@ -1707,7 +1707,7 @@ class FlatMatch
     friend class StringRegExpGuard;
 
   public:
-    FlatMatch(JSContext *cx) : patstr(cx) {}
+    explicit FlatMatch(JSContext *cx) : patstr(cx) {}
     JSLinearString *pattern() const { return patstr; }
     size_t patternLength() const { return patlen; }
 
@@ -1793,7 +1793,7 @@ class MOZ_STACK_CLASS StringRegExpGuard
     }
 
   public:
-    StringRegExpGuard(JSContext *cx)
+    explicit StringRegExpGuard(JSContext *cx)
       : re_(cx), fm(cx), obj_(cx)
     { }
 
@@ -2221,7 +2221,7 @@ class RopeBuilder {
     void operator=(const RopeBuilder &other) MOZ_DELETE;
 
   public:
-    RopeBuilder(JSContext *cx)
+    explicit RopeBuilder(JSContext *cx)
       : cx(cx), res(cx, cx->runtime()->emptyString)
     {}
 
@@ -2239,7 +2239,7 @@ namespace {
 
 struct ReplaceData
 {
-    ReplaceData(JSContext *cx)
+    explicit ReplaceData(JSContext *cx)
       : str(cx), g(cx), lambda(cx), elembase(cx), repstr(cx),
         fig(cx, NullValue()), sb(cx)
     {}
diff --git a/js/src/jsworkers.cpp b/js/src/jsworkers.cpp
index c0b9e5955c57..df4bd5ae4ccf 100644
--- a/js/src/jsworkers.cpp
+++ b/js/src/jsworkers.cpp
@@ -669,7 +669,7 @@ GlobalWorkerThreadState::finishParseTask(JSContext *maybecx, JSRuntime *rt, void
         JSObject *newProto = GetBuiltinPrototypePure(global, key);
         JS_ASSERT(newProto);
 
-        object->setProtoUnchecked(newProto);
+        object->setProtoUnchecked(TaggedProto(newProto));
     }
 
     // Move the parsed script and all its contents into the desired compartment.
diff --git a/js/src/jsworkers.h b/js/src/jsworkers.h
index aceb37189d0b..d7cf1329fa82 100644
--- a/js/src/jsworkers.h
+++ b/js/src/jsworkers.h
@@ -370,7 +370,7 @@ struct AsmJSParallelTask
     jit::LIRGraph *lir;     // Passed from worker to main thread.
     unsigned compileTime;
 
-    AsmJSParallelTask(size_t defaultChunkSize)
+    explicit AsmJSParallelTask(size_t defaultChunkSize)
       : runtime(nullptr), lifo(defaultChunkSize), func(nullptr), mir(nullptr), lir(nullptr), compileTime(0)
     { }
 
diff --git a/js/src/jswrapper.cpp b/js/src/jswrapper.cpp
index a2b3ed36c0fb..fea1d54d1dfb 100644
--- a/js/src/jswrapper.cpp
+++ b/js/src/jswrapper.cpp
@@ -999,7 +999,7 @@ js::RemapWrapper(JSContext *cx, JSObject *wobjArg, JSObject *newTargetArg)
     // Update the entry in the compartment's wrapper map to point to the old
     // wrapper, which has now been updated (via reuse or swap).
     JS_ASSERT(wobj->is<WrapperObject>());
-    wcompartment->putWrapper(cx, ObjectValue(*newTarget), ObjectValue(*wobj));
+    wcompartment->putWrapper(cx, CrossCompartmentKey(newTarget), ObjectValue(*wobj));
     return true;
 }
 
diff --git a/js/src/jswrapper.h b/js/src/jswrapper.h
index d7c64eaf7a71..ec67447f8e1a 100644
--- a/js/src/jswrapper.h
+++ b/js/src/jswrapper.h
@@ -27,8 +27,8 @@ class MOZ_STACK_CLASS WrapperOptions : public ProxyOptions {
                        proto_()
     {}
 
-    WrapperOptions(JSContext *cx) : ProxyOptions(false, nullptr),
-                                    proto_()
+    explicit WrapperOptions(JSContext *cx) : ProxyOptions(false, nullptr),
+                                             proto_()
     {
         proto_.construct(cx);
     }
@@ -103,7 +103,7 @@ WrapperOptions::proto() const
 class JS_FRIEND_API(CrossCompartmentWrapper) : public Wrapper
 {
   public:
-    CrossCompartmentWrapper(unsigned flags, bool hasPrototype = false);
+    explicit CrossCompartmentWrapper(unsigned flags, bool hasPrototype = false);
 
     virtual ~CrossCompartmentWrapper();
 
@@ -167,7 +167,7 @@ template <class Base>
 class JS_FRIEND_API(SecurityWrapper) : public Base
 {
   public:
-    SecurityWrapper(unsigned flags);
+    explicit SecurityWrapper(unsigned flags);
 
     virtual bool isExtensible(JSContext *cx, HandleObject wrapper, bool *extensible) MOZ_OVERRIDE;
     virtual bool preventExtensions(JSContext *cx, HandleObject wrapper) MOZ_OVERRIDE;
@@ -321,8 +321,8 @@ RecomputeWrappers(JSContext *cx, const CompartmentFilter &sourceFilter,
 struct JS_FRIEND_API(AutoMaybeTouchDeadZones)
 {
     // The version that takes an object just uses it for its runtime.
-    AutoMaybeTouchDeadZones(JSContext *cx);
-    AutoMaybeTouchDeadZones(JSObject *obj);
+    explicit AutoMaybeTouchDeadZones(JSContext *cx);
+    explicit AutoMaybeTouchDeadZones(JSObject *obj);
     ~AutoMaybeTouchDeadZones();
 
   private:
diff --git a/js/src/perf/jsperf.h b/js/src/perf/jsperf.h
index 0043f422b5a2..60c572f559d4 100644
--- a/js/src/perf/jsperf.h
+++ b/js/src/perf/jsperf.h
@@ -88,7 +88,7 @@ class JS_FRIEND_API(PerfMeasurement)
      * then the eventsMeasured bitmask will only include the subset of
      * |toMeasure| corresponding to the events that can be measured.
      */
-    PerfMeasurement(EventMask toMeasure);
+    explicit PerfMeasurement(EventMask toMeasure);
 
     /* Done with this set of measurements, tear down OS-level state. */
     ~PerfMeasurement();
diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
index 6cf82b574292..d93a09c18e8f 100644
--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -221,7 +221,7 @@ class ShellPrincipals: public JSPrincipals {
     }
 
   public:
-    ShellPrincipals(uint32_t bits, int32_t refcount = 0) : bits(bits) {
+    explicit ShellPrincipals(uint32_t bits, int32_t refcount = 0) : bits(bits) {
         this->refcount = refcount;
     }
 
@@ -1086,7 +1086,7 @@ class AutoSaveFrameChain
     bool saved_;
 
   public:
-    AutoSaveFrameChain(JSContext *cx)
+    explicit AutoSaveFrameChain(JSContext *cx)
       : cx_(cx),
         saved_(false)
     {}
@@ -3782,7 +3782,7 @@ struct FreeOnReturn
     const char *ptr;
     MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
 
-    FreeOnReturn(JSContext *cx, const char *ptr = nullptr
+    explicit FreeOnReturn(JSContext *cx, const char *ptr = nullptr
                  MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
       : cx(cx), ptr(ptr)
     {
@@ -3936,7 +3936,7 @@ class AutoCStringVector
 {
     Vector<char *> argv_;
   public:
-    AutoCStringVector(JSContext *cx) : argv_(cx) {}
+    explicit AutoCStringVector(JSContext *cx) : argv_(cx) {}
     ~AutoCStringVector() {
         for (size_t i = 0; i < argv_.length(); i++)
             js_free(argv_[i]);
@@ -4347,7 +4347,7 @@ class ShellSourceHook: public SourceHook {
         RootedValue filenameValue(cx, StringValue(str));
 
         RootedValue result(cx);
-        if (!Call(cx, UndefinedHandleValue, fun, filenameValue, &result))
+        if (!Call(cx, UndefinedHandleValue, fun, HandleValueArray(filenameValue), &result))
             return false;
 
         str = JS::ToString(cx, result);
diff --git a/js/src/shell/jsheaptools.cpp b/js/src/shell/jsheaptools.cpp
index 05036cf918fd..ea07438e1c3d 100644
--- a/js/src/shell/jsheaptools.cpp
+++ b/js/src/shell/jsheaptools.cpp
@@ -509,7 +509,7 @@ ReferenceFinder::addReferrer(jsval referrerArg, Path *path)
         return false;
     if (v.isUndefined()) {
         /* Create an array to accumulate referents under this path. */
-        JSObject *array = JS_NewArrayObject(context, referrer);
+        JSObject *array = JS_NewArrayObject(context, HandleValueArray(referrer));
         if (!array)
             return false;
         v.setObject(*array);
diff --git a/js/src/vm/ArgumentsObject.cpp b/js/src/vm/ArgumentsObject.cpp
index 7df3478b3e8d..825a6d3f83eb 100644
--- a/js/src/vm/ArgumentsObject.cpp
+++ b/js/src/vm/ArgumentsObject.cpp
@@ -67,7 +67,7 @@ struct CopyFrameArgs
 {
     AbstractFramePtr frame_;
 
-    CopyFrameArgs(AbstractFramePtr frame)
+    explicit CopyFrameArgs(AbstractFramePtr frame)
       : frame_(frame)
     { }
 
@@ -129,7 +129,7 @@ struct CopyScriptFrameIterArgs
 {
     ScriptFrameIter &iter_;
 
-    CopyScriptFrameIterArgs(ScriptFrameIter &iter)
+    explicit CopyScriptFrameIterArgs(ScriptFrameIter &iter)
       : iter_(iter)
     { }
 
@@ -173,7 +173,7 @@ ArgumentsObject::create(JSContext *cx, HandleScript script, HandleFunction calle
     bool strict = callee->strict();
     const Class *clasp = strict ? &StrictArgumentsObject::class_ : &NormalArgumentsObject::class_;
 
-    RootedTypeObject type(cx, cx->getNewType(clasp, proto.get()));
+    RootedTypeObject type(cx, cx->getNewType(clasp, TaggedProto(proto.get())));
     if (!type)
         return nullptr;
 
diff --git a/js/src/vm/ArrayBufferObject.cpp b/js/src/vm/ArrayBufferObject.cpp
index cee3573d858d..3982a56b1423 100644
--- a/js/src/vm/ArrayBufferObject.cpp
+++ b/js/src/vm/ArrayBufferObject.cpp
@@ -970,8 +970,10 @@ ArrayBufferViewObject::bufferObject(JSContext *cx, Handle<ArrayBufferViewObject
         Rooted<TypedArrayObject *> typedArray(cx, &thisObject->as<TypedArrayObject>());
         if (!TypedArrayObject::ensureHasBuffer(cx, typedArray))
             return nullptr;
+        return thisObject->as<TypedArrayObject>().buffer();
     }
-    return &thisObject->getFixedSlot(BUFFER_SLOT).toObject().as<ArrayBufferObject>();
+    MOZ_ASSERT(thisObject->is<DataViewObject>());
+    return &thisObject->as<DataViewObject>().arrayBuffer();
 }
 
 /* JS Friend API */
diff --git a/js/src/vm/ArrayBufferObject.h b/js/src/vm/ArrayBufferObject.h
index 51824cc52524..8e5061f9a42a 100644
--- a/js/src/vm/ArrayBufferObject.h
+++ b/js/src/vm/ArrayBufferObject.h
@@ -321,13 +321,13 @@ struct uint8_clamped {
     uint8_clamped(const uint8_clamped& other) : val(other.val) { }
 
     // invoke our assignment helpers for constructor conversion
-    uint8_clamped(uint8_t x)    { *this = x; }
-    uint8_clamped(uint16_t x)   { *this = x; }
-    uint8_clamped(uint32_t x)   { *this = x; }
-    uint8_clamped(int8_t x)     { *this = x; }
-    uint8_clamped(int16_t x)    { *this = x; }
-    uint8_clamped(int32_t x)    { *this = x; }
-    uint8_clamped(double x)     { *this = x; }
+    explicit uint8_clamped(uint8_t x)    { *this = x; }
+    explicit uint8_clamped(uint16_t x)   { *this = x; }
+    explicit uint8_clamped(uint32_t x)   { *this = x; }
+    explicit uint8_clamped(int8_t x)     { *this = x; }
+    explicit uint8_clamped(int16_t x)    { *this = x; }
+    explicit uint8_clamped(int32_t x)    { *this = x; }
+    explicit uint8_clamped(double x)     { *this = x; }
 
     uint8_clamped& operator=(const uint8_clamped& x) {
         val = x.val;
diff --git a/js/src/vm/Debugger.cpp b/js/src/vm/Debugger.cpp
index 76cae7930ce3..5453dc218872 100644
--- a/js/src/vm/Debugger.cpp
+++ b/js/src/vm/Debugger.cpp
@@ -181,7 +181,7 @@ class Debugger::FrameRange
      * Similarly, if stack frames are added to or removed from frontDebugger(),
      * then the range's front is invalid until popFront is called.
      */
-    FrameRange(AbstractFramePtr frame, GlobalObject *global = nullptr)
+    explicit FrameRange(AbstractFramePtr frame, GlobalObject *global = nullptr)
       : frame(frame)
     {
         nextDebugger = 0;
@@ -1329,7 +1329,7 @@ Debugger::onSingleStep(JSContext *cx, MutableHandleValue vp)
         RootedValue savedIterValue;
 
       public:
-        PreserveIterValue(JSContext *cx) : cx(cx), savedIterValue(cx, cx->iterValue) {
+        explicit PreserveIterValue(JSContext *cx) : cx(cx), savedIterValue(cx, cx->iterValue) {
             cx->iterValue.setMagic(JS_NO_ITER_VALUE);
         }
         ~PreserveIterValue() {
@@ -3361,7 +3361,7 @@ class FlowGraphSummary {
         size_t column_;
     };
 
-    FlowGraphSummary(JSContext *cx) : entries_(cx) {}
+    explicit FlowGraphSummary(JSContext *cx) : entries_(cx) {}
 
     Entry &operator[](size_t index) {
         return entries_[index];
diff --git a/js/src/vm/ForkJoin.cpp b/js/src/vm/ForkJoin.cpp
index 948cee1b8dab..24f932f1c75d 100644
--- a/js/src/vm/ForkJoin.cpp
+++ b/js/src/vm/ForkJoin.cpp
@@ -435,14 +435,14 @@ class AutoEnterWarmup
     JSRuntime *runtime_;
 
   public:
-    AutoEnterWarmup(JSRuntime *runtime) : runtime_(runtime) { runtime_->forkJoinWarmup++; }
+    explicit AutoEnterWarmup(JSRuntime *runtime) : runtime_(runtime) { runtime_->forkJoinWarmup++; }
     ~AutoEnterWarmup() { runtime_->forkJoinWarmup--; }
 };
 
 class AutoSetForkJoinContext
 {
   public:
-    AutoSetForkJoinContext(ForkJoinContext *threadCx) {
+    explicit AutoSetForkJoinContext(ForkJoinContext *threadCx) {
         ForkJoinContext::tlsForkJoinContext.set(threadCx);
     }
 
diff --git a/js/src/vm/ForkJoin.h b/js/src/vm/ForkJoin.h
index 58d379b531b6..fac1a93cfefc 100644
--- a/js/src/vm/ForkJoin.h
+++ b/js/src/vm/ForkJoin.h
@@ -225,7 +225,7 @@ class ForkJoinActivation : public Activation
     gc::AutoStopVerifyingBarriers av_;
 
   public:
-    ForkJoinActivation(JSContext *cx);
+    explicit ForkJoinActivation(JSContext *cx);
     ~ForkJoinActivation();
 };
 
@@ -446,7 +446,7 @@ class LockedJSContext
     JSContext *jscx_;
 
   public:
-    LockedJSContext(ForkJoinContext *cx)
+    explicit LockedJSContext(ForkJoinContext *cx)
 #if defined(JS_THREADSAFE) && defined(JS_ION)
       : cx_(cx),
         jscx_(cx->acquireJSContext())
diff --git a/js/src/vm/Interpreter.cpp b/js/src/vm/Interpreter.cpp
index e07fda324750..1eb2ed945fd4 100644
--- a/js/src/vm/Interpreter.cpp
+++ b/js/src/vm/Interpreter.cpp
@@ -425,7 +425,7 @@ js::RunScript(JSContext *cx, RunState &state)
 struct AutoGCIfNeeded
 {
     JSContext *cx_;
-    AutoGCIfNeeded(JSContext *cx) : cx_(cx) {}
+    explicit AutoGCIfNeeded(JSContext *cx) : cx_(cx) {}
     ~AutoGCIfNeeded() { js::gc::GCIfNeeded(cx_); }
 };
 
diff --git a/js/src/vm/MatchPairs.h b/js/src/vm/MatchPairs.h
index 644d536501e5..7ee3bc840062 100644
--- a/js/src/vm/MatchPairs.h
+++ b/js/src/vm/MatchPairs.h
@@ -124,7 +124,7 @@ class ScopedMatchPairs : public MatchPairs
 
   public:
     /* Constructs an implicit LifoAllocScope. */
-    ScopedMatchPairs(LifoAlloc *lifoAlloc)
+    explicit ScopedMatchPairs(LifoAlloc *lifoAlloc)
       : lifoScope_(lifoAlloc)
     { }
 
diff --git a/js/src/vm/MemoryMetrics.cpp b/js/src/vm/MemoryMetrics.cpp
index ea6793dea24a..9231e6ac2f63 100644
--- a/js/src/vm/MemoryMetrics.cpp
+++ b/js/src/vm/MemoryMetrics.cpp
@@ -651,7 +651,7 @@ AddSizeOfTab(JSRuntime *rt, HandleObject obj, MallocSizeOf mallocSizeOf, ObjectP
     class SimpleJSRuntimeStats : public JS::RuntimeStats
     {
       public:
-        SimpleJSRuntimeStats(MallocSizeOf mallocSizeOf)
+        explicit SimpleJSRuntimeStats(MallocSizeOf mallocSizeOf)
           : JS::RuntimeStats(mallocSizeOf)
         {}
 
diff --git a/js/src/vm/Monitor.h b/js/src/vm/Monitor.h
index 807343e5982c..b41003560271 100644
--- a/js/src/vm/Monitor.h
+++ b/js/src/vm/Monitor.h
@@ -59,7 +59,7 @@ class AutoLockMonitor
 #endif
 
   public:
-    AutoLockMonitor(Monitor &monitor)
+    explicit AutoLockMonitor(Monitor &monitor)
 #ifdef JS_THREADSAFE
       : monitor(monitor)
     {
@@ -132,7 +132,7 @@ class AutoUnlockMonitor
 #endif
 
   public:
-    AutoUnlockMonitor(Monitor &monitor)
+    explicit AutoUnlockMonitor(Monitor &monitor)
 #ifdef JS_THREADSAFE
       : monitor(monitor)
     {
diff --git a/js/src/vm/OldDebugAPI.cpp b/js/src/vm/OldDebugAPI.cpp
index 0039f394ce55..4caf9b95b8a9 100644
--- a/js/src/vm/OldDebugAPI.cpp
+++ b/js/src/vm/OldDebugAPI.cpp
@@ -979,7 +979,7 @@ class AutoPropertyDescArray
     JSPropertyDescArray descArray_;
 
   public:
-    AutoPropertyDescArray(JSContext *cx)
+    explicit AutoPropertyDescArray(JSContext *cx)
       : cx_(cx)
     {
         PodZero(&descArray_);
diff --git a/js/src/vm/PIC.h b/js/src/vm/PIC.h
index d889fe43f63a..8aa04f7706b2 100644
--- a/js/src/vm/PIC.h
+++ b/js/src/vm/PIC.h
@@ -40,10 +40,10 @@ class PICStub
     CatStub *next_;
 
     PICStub() : next_(nullptr) {}
-    PICStub(const CatStub *next) : next_(next) {
+    explicit PICStub(const CatStub *next) : next_(next) {
         JS_ASSERT(next_);
     }
-    PICStub(const CatStub &other) : next_(other.next_) {}
+    explicit PICStub(const CatStub &other) : next_(other.next_) {}
 
   public:
     CatStub *next() const {
@@ -139,7 +139,7 @@ struct ForOfPIC
         Shape *shape_;
 
       public:
-        Stub(Shape *shape)
+        explicit Stub(Shape *shape)
           : BaseStub(),
             shape_(shape)
         {
diff --git a/js/src/vm/RegExpObject.cpp b/js/src/vm/RegExpObject.cpp
index 683ac02e1baa..8b66f69773d3 100644
--- a/js/src/vm/RegExpObject.cpp
+++ b/js/src/vm/RegExpObject.cpp
@@ -936,7 +936,7 @@ RegExpCompartment::createMatchResultTemplateObject(JSContext *cx)
     JS_ASSERT(shape->slot() == 1 &&
               shape->propidRef() == NameToId(cx->names().input));
 
-    matchResultTemplateObject_ = templateObject;
+    matchResultTemplateObject_.set(templateObject);
 
     return matchResultTemplateObject_;
 }
@@ -984,7 +984,7 @@ RegExpCompartment::sweep(JSRuntime *rt)
     if (matchResultTemplateObject_ &&
         IsObjectAboutToBeFinalized(matchResultTemplateObject_.unsafeGet()))
     {
-        matchResultTemplateObject_ = nullptr;
+        matchResultTemplateObject_.set(nullptr);
     }
 }
 
diff --git a/js/src/vm/RegExpObject.h b/js/src/vm/RegExpObject.h
index 4d920d3af1e9..0e0908191f95 100644
--- a/js/src/vm/RegExpObject.h
+++ b/js/src/vm/RegExpObject.h
@@ -77,7 +77,7 @@ class RegExpObjectBuilder
     bool getOrCreateClone(HandleTypeObject type);
 
   public:
-    RegExpObjectBuilder(ExclusiveContext *cx, RegExpObject *reobj = nullptr);
+    explicit RegExpObjectBuilder(ExclusiveContext *cx, RegExpObject *reobj = nullptr);
 
     RegExpObject *reobj() { return reobj_; }
 
@@ -270,7 +270,7 @@ class RegExpGuard : public JS::CustomAutoRooter
     void operator=(const RegExpGuard &) MOZ_DELETE;
 
   public:
-    RegExpGuard(ExclusiveContext *cx)
+    explicit RegExpGuard(ExclusiveContext *cx)
       : CustomAutoRooter(cx), re_(nullptr)
     {}
 
@@ -345,7 +345,7 @@ class RegExpCompartment
     JSObject *createMatchResultTemplateObject(JSContext *cx);
 
   public:
-    RegExpCompartment(JSRuntime *rt);
+    explicit RegExpCompartment(JSRuntime *rt);
     ~RegExpCompartment();
 
     bool init(JSContext *cx);
diff --git a/js/src/vm/Runtime.h b/js/src/vm/Runtime.h
index 7f48875f73a4..0a0c2b1c83b7 100644
--- a/js/src/vm/Runtime.h
+++ b/js/src/vm/Runtime.h
@@ -143,7 +143,7 @@ struct EvalCacheEntry
 
 struct EvalCacheLookup
 {
-    EvalCacheLookup(JSContext *cx) : str(cx), callerScript(cx) {}
+    explicit EvalCacheLookup(JSContext *cx) : str(cx), callerScript(cx) {}
     RootedLinearString str;
     RootedScript callerScript;
     JSVersion version;
@@ -580,7 +580,7 @@ class PerThreadData : public PerThreadDataFriendFields
     // Number of active bytecode compilation on this thread.
     unsigned activeCompilations;
 
-    PerThreadData(JSRuntime *runtime);
+    explicit PerThreadData(JSRuntime *runtime);
     ~PerThreadData();
 
     bool init();
@@ -692,7 +692,7 @@ struct JSRuntime : public JS::shadow::Runtime,
     class AutoLockForInterrupt {
         JSRuntime *rt;
       public:
-        AutoLockForInterrupt(JSRuntime *rt MOZ_GUARD_OBJECT_NOTIFIER_PARAM) : rt(rt) {
+        explicit AutoLockForInterrupt(JSRuntime *rt MOZ_GUARD_OBJECT_NOTIFIER_PARAM) : rt(rt) {
             MOZ_GUARD_OBJECT_NOTIFIER_INIT;
             rt->assertCanLock(js::InterruptLock);
 #ifdef JS_THREADSAFE
@@ -1691,7 +1691,7 @@ class RuntimeAllocPolicy
     JSRuntime *const runtime;
 
   public:
-    RuntimeAllocPolicy(JSRuntime *rt) : runtime(rt) {}
+    MOZ_IMPLICIT RuntimeAllocPolicy(JSRuntime *rt) : runtime(rt) {}
     void *malloc_(size_t bytes) { return runtime->malloc_(bytes); }
     void *calloc_(size_t bytes) { return runtime->calloc_(bytes); }
     void *realloc_(void *p, size_t bytes) { return runtime->realloc_(p, bytes); }
diff --git a/js/src/vm/SPSProfiler.cpp b/js/src/vm/SPSProfiler.cpp
index ea78760ab67c..a3e95e6ebd95 100644
--- a/js/src/vm/SPSProfiler.cpp
+++ b/js/src/vm/SPSProfiler.cpp
@@ -162,11 +162,11 @@ SPSProfiler::enter(JSScript *script, JSFunction *maybeFun)
     if (*size_ > 0 && *size_ - 1 < max_) {
         size_t start = (*size_ > 4) ? *size_ - 4 : 0;
         for (size_t i = start; i < *size_ - 1; i++)
-            MOZ_ASSERT_IF(stack_[i].isJs(), stack_[i].pc() != nullptr);
+            MOZ_ASSERT_IF(stack_[i].js(), stack_[i].pc() != nullptr);
     }
 #endif
 
-    push(str, nullptr, script, script->code(), /* copy = */ true);
+    push(str, nullptr, script, script->code());
     return true;
 }
 
@@ -183,18 +183,18 @@ SPSProfiler::exit(JSScript *script, JSFunction *maybeFun)
         JS_ASSERT(str != nullptr);
 
         // Bug 822041
-        if (!stack_[*size_].isJs()) {
+        if (!stack_[*size_].js()) {
             fprintf(stderr, "--- ABOUT TO FAIL ASSERTION ---\n");
             fprintf(stderr, " stack=%p size=%d/%d\n", (void*) stack_, *size_, max_);
             for (int32_t i = *size_; i >= 0; i--) {
-                if (stack_[i].isJs())
+                if (stack_[i].js())
                     fprintf(stderr, "  [%d] JS %s\n", i, stack_[i].label());
                 else
                     fprintf(stderr, "  [%d] C line %d %s\n", i, stack_[i].line(), stack_[i].label());
             }
         }
 
-        JS_ASSERT(stack_[*size_].isJs());
+        JS_ASSERT(stack_[*size_].js());
         JS_ASSERT(stack_[*size_].script() == script);
         JS_ASSERT(strcmp((const char*) stack_[*size_].label(), str) == 0);
         stack_[*size_].setLabel(nullptr);
@@ -214,17 +214,16 @@ SPSProfiler::enterNative(const char *string, void *sp)
     JS_ASSERT(enabled());
     if (current < max_) {
         stack[current].setLabel(string);
-        stack[current].setCppFrame(sp, 0);
+        stack[current].setStackAddress(sp);
+        stack[current].setScript(nullptr);
+        stack[current].setLine(0);
     }
     *size = current + 1;
 }
 
 void
-SPSProfiler::push(const char *string, void *sp, JSScript *script, jsbytecode *pc, bool copy)
+SPSProfiler::push(const char *string, void *sp, JSScript *script, jsbytecode *pc)
 {
-    JS_ASSERT_IF(sp != nullptr, script == nullptr && pc == nullptr);
-    JS_ASSERT_IF(sp == nullptr, script != nullptr && pc != nullptr);
-
     /* these operations cannot be re-ordered, so volatile-ize operations */
     volatile ProfileEntry *stack = stack_;
     volatile uint32_t *size = size_;
@@ -232,19 +231,10 @@ SPSProfiler::push(const char *string, void *sp, JSScript *script, jsbytecode *pc
 
     JS_ASSERT(installed());
     if (current < max_) {
-        volatile ProfileEntry &entry = stack[current];
-        entry.setLabel(string);
-
-        if (sp != nullptr)
-            entry.setCppFrame(sp, 0);
-        else
-            entry.setJsFrame(script, pc);
-
-        // Track if mLabel needs a copy.
-        if (copy)
-            entry.setFlag(js::ProfileEntry::FRAME_LABEL_COPY);
-        else
-            entry.unsetFlag(js::ProfileEntry::FRAME_LABEL_COPY);
+        stack[current].setLabel(string);
+        stack[current].setStackAddress(sp);
+        stack[current].setScript(script);
+        stack[current].setPC(pc);
     }
     *size = current + 1;
 }
@@ -323,8 +313,9 @@ SPSEntryMarker::SPSEntryMarker(JSRuntime *rt
         return;
     }
     size_before = *profiler->size_;
-    profiler->push("js::RunScript", this, nullptr, nullptr, /* copy = */ false);
+    profiler->pushNoCopy("js::RunScript", this, nullptr, nullptr);
 }
+
 SPSEntryMarker::~SPSEntryMarker()
 {
     if (profiler != nullptr) {
@@ -336,15 +327,13 @@ SPSEntryMarker::~SPSEntryMarker()
 JS_FRIEND_API(jsbytecode*)
 ProfileEntry::pc() const volatile
 {
-    MOZ_ASSERT(isJs());
-    return lineOrPc == NullPCOffset ? nullptr : script()->offsetToPC(lineOrPc);
+    return idx == NullPCIndex ? nullptr : script()->offsetToPC(idx);
 }
 
 JS_FRIEND_API(void)
 ProfileEntry::setPC(jsbytecode *pc) volatile
 {
-    MOZ_ASSERT(isJs());
-    lineOrPc = pc == nullptr ? NullPCOffset : script()->pcToOffset(pc);
+    idx = pc == nullptr ? NullPCIndex : script()->pcToOffset(pc);
 }
 
 JS_FRIEND_API(void)
diff --git a/js/src/vm/SPSProfiler.h b/js/src/vm/SPSProfiler.h
index 6efde94a6a1a..99ac27a1f2a4 100644
--- a/js/src/vm/SPSProfiler.h
+++ b/js/src/vm/SPSProfiler.h
@@ -128,11 +128,17 @@ class SPSProfiler
     void                (*eventMarker_)(const char *);
 
     const char *allocProfileString(JSScript *script, JSFunction *function);
-    void push(const char *string, void *sp, JSScript *script, jsbytecode *pc, bool copy);
+    void push(const char *string, void *sp, JSScript *script, jsbytecode *pc);
+    void pushNoCopy(const char *string, void *sp,
+                    JSScript *script, jsbytecode *pc) {
+        push(string, reinterpret_cast<void*>(
+            reinterpret_cast<uintptr_t>(sp) | ProfileEntry::NoCopyBit),
+            script, pc);
+    }
     void pop();
 
   public:
-    SPSProfiler(JSRuntime *rt);
+    explicit SPSProfiler(JSRuntime *rt);
     ~SPSProfiler();
 
     bool init();
@@ -209,7 +215,7 @@ class AutoSPSLock
 {
   public:
 #ifdef JS_THREADSAFE
-    AutoSPSLock(PRLock *lock)
+    explicit AutoSPSLock(PRLock *lock)
     {
         MOZ_ASSERT(lock, "Parameter should not be null!");
         lock_ = lock;
@@ -217,7 +223,7 @@ class AutoSPSLock
     }
     ~AutoSPSLock() { PR_Unlock(lock_); }
 #else
-    AutoSPSLock(PRLock *) {}
+    explicit AutoSPSLock(PRLock *) {}
 #endif
 
   private:
@@ -246,7 +252,7 @@ SPSProfiler::stringsReset()
 class SPSEntryMarker
 {
   public:
-    SPSEntryMarker(JSRuntime *rt
+    explicit SPSEntryMarker(JSRuntime *rt
                    MOZ_GUARD_OBJECT_NOTIFIER_PARAM);
     ~SPSEntryMarker();
 
@@ -297,7 +303,7 @@ class SPSInstrumentation
      * Creates instrumentation which writes information out the the specified
      * profiler's stack and constituent fields.
      */
-    SPSInstrumentation(SPSProfiler *profiler)
+    explicit SPSInstrumentation(SPSProfiler *profiler)
       : profiler_(profiler), frame(nullptr)
     {
         enterInlineFrame(nullptr);
@@ -431,7 +437,7 @@ class SPSInstrumentation
             return;
 
         if (!inlinedFunction)
-            masm.spsUpdatePCIdx(profiler_, ProfileEntry::NullPCOffset, scratch);
+            masm.spsUpdatePCIdx(profiler_, ProfileEntry::NullPCIndex, scratch);
 
         setPushed(script);
     }
@@ -472,8 +478,8 @@ class SPSInstrumentation
         if (frame->skipNext) {
             frame->skipNext = false;
         } else {
-            if (!inlinedFunction)
-                masm.spsUpdatePCIdx(profiler_, ProfileEntry::NullPCOffset, scratch);
+             if (!inlinedFunction)
+                 masm.spsUpdatePCIdx(profiler_, ProfileEntry::NullPCIndex, scratch);
         }
     }
 
diff --git a/js/src/vm/ScopeObject.cpp b/js/src/vm/ScopeObject.cpp
index cdc49aecf704..3b503fd68abf 100644
--- a/js/src/vm/ScopeObject.cpp
+++ b/js/src/vm/ScopeObject.cpp
@@ -161,7 +161,7 @@ CallObject::createSingleton(JSContext *cx, HandleShape shape)
     MOZ_ASSERT(CanBeFinalizedInBackground(kind, &CallObject::class_));
     kind = gc::GetBackgroundAllocKind(kind);
 
-    RootedTypeObject type(cx, cx->getSingletonType(&class_, nullptr));
+    RootedTypeObject type(cx, cx->getSingletonType(&class_, TaggedProto(nullptr)));
     if (!type)
         return nullptr;
     RootedObject obj(cx, JSObject::create(cx, kind, gc::TenuredHeap, shape, type));
@@ -185,7 +185,7 @@ CallObject::createTemplateObject(JSContext *cx, HandleScript script, gc::Initial
     RootedShape shape(cx, script->bindings.callObjShape());
     JS_ASSERT(shape->getObjectClass() == &class_);
 
-    RootedTypeObject type(cx, cx->getNewType(&class_, nullptr));
+    RootedTypeObject type(cx, cx->getNewType(&class_, TaggedProto(nullptr)));
     if (!type)
         return nullptr;
 
@@ -317,12 +317,12 @@ DeclEnvObject::createTemplateObject(JSContext *cx, HandleFunction fun, gc::Initi
 {
     JS_ASSERT(IsNurseryAllocable(FINALIZE_KIND));
 
-    RootedTypeObject type(cx, cx->getNewType(&class_, nullptr));
+    RootedTypeObject type(cx, cx->getNewType(&class_, TaggedProto(nullptr)));
     if (!type)
         return nullptr;
 
     RootedShape emptyDeclEnvShape(cx);
-    emptyDeclEnvShape = EmptyShape::getInitialShape(cx, &class_, nullptr,
+    emptyDeclEnvShape = EmptyShape::getInitialShape(cx, &class_, TaggedProto(nullptr),
                                                     cx->global(), nullptr, FINALIZE_KIND,
                                                     BaseShape::DELEGATE);
     if (!emptyDeclEnvShape)
@@ -385,7 +385,7 @@ js::XDRStaticWithObject(XDRState<XDR_DECODE> *, HandleObject, StaticWithObject *
 StaticWithObject *
 StaticWithObject::create(ExclusiveContext *cx)
 {
-    RootedTypeObject type(cx, cx->getNewType(&class_, nullptr));
+    RootedTypeObject type(cx, cx->getNewType(&class_, TaggedProto(nullptr)));
     if (!type)
         return nullptr;
 
@@ -418,7 +418,7 @@ DynamicWithObject::create(JSContext *cx, HandleObject object, HandleObject enclo
                           HandleObject staticWith)
 {
     JS_ASSERT(staticWith->is<StaticWithObject>());
-    RootedTypeObject type(cx, cx->getNewType(&class_, staticWith.get()));
+    RootedTypeObject type(cx, cx->getNewType(&class_, TaggedProto(staticWith.get())));
     if (!type)
         return nullptr;
 
@@ -619,7 +619,7 @@ ClonedBlockObject::create(JSContext *cx, Handle<StaticBlockObject *> block, Abst
     assertSameCompartment(cx, frame);
     JS_ASSERT(block->getClass() == &BlockObject::class_);
 
-    RootedTypeObject type(cx, cx->getNewType(&BlockObject::class_, block.get()));
+    RootedTypeObject type(cx, cx->getNewType(&BlockObject::class_, TaggedProto(block.get())));
     if (!type)
         return nullptr;
 
@@ -674,12 +674,12 @@ ClonedBlockObject::copyUnaliasedValues(AbstractFramePtr frame)
 StaticBlockObject *
 StaticBlockObject::create(ExclusiveContext *cx)
 {
-    RootedTypeObject type(cx, cx->getNewType(&BlockObject::class_, nullptr));
+    RootedTypeObject type(cx, cx->getNewType(&BlockObject::class_, TaggedProto(nullptr)));
     if (!type)
         return nullptr;
 
     RootedShape emptyBlockShape(cx);
-    emptyBlockShape = EmptyShape::getInitialShape(cx, &BlockObject::class_, nullptr, nullptr,
+    emptyBlockShape = EmptyShape::getInitialShape(cx, &BlockObject::class_, TaggedProto(nullptr), nullptr,
                                                   nullptr, FINALIZE_KIND, BaseShape::DELEGATE);
     if (!emptyBlockShape)
         return nullptr;
@@ -1912,7 +1912,7 @@ DebugScopes::hasDebugScope(JSContext *cx, const ScopeIter &si)
     if (!scopes)
         return nullptr;
 
-    if (MissingScopeMap::Ptr p = scopes->missingScopes.lookup(si)) {
+    if (MissingScopeMap::Ptr p = scopes->missingScopes.lookup(ScopeIterKey(si))) {
         JS_ASSERT(CanUseDebugScopeMaps(cx));
         return p->value();
     }
@@ -1933,15 +1933,15 @@ DebugScopes::addDebugScope(JSContext *cx, const ScopeIter &si, DebugScopeObject
     if (!scopes)
         return false;
 
-    JS_ASSERT(!scopes->missingScopes.has(si));
-    if (!scopes->missingScopes.put(si, &debugScope)) {
+    JS_ASSERT(!scopes->missingScopes.has(ScopeIterKey(si)));
+    if (!scopes->missingScopes.put(ScopeIterKey(si), ReadBarriered<DebugScopeObject*>(&debugScope))) {
         js_ReportOutOfMemory(cx);
         return false;
     }
-    missingScopesPostWriteBarrier(cx->runtime(), &scopes->missingScopes, si);
+    missingScopesPostWriteBarrier(cx->runtime(), &scopes->missingScopes, ScopeIterKey(si));
 
     JS_ASSERT(!scopes->liveScopes.has(&debugScope.scope()));
-    if (!scopes->liveScopes.put(&debugScope.scope(), si)) {
+    if (!scopes->liveScopes.put(&debugScope.scope(), ScopeIterVal(si))) {
         js_ReportOutOfMemory(cx);
         return false;
     }
@@ -1976,7 +1976,7 @@ DebugScopes::onPopCall(AbstractFramePtr frame, JSContext *cx)
             debugScope = &p->value()->as<DebugScopeObject>();
     } else {
         ScopeIter si(frame, frame.script()->main(), cx);
-        if (MissingScopeMap::Ptr p = scopes->missingScopes.lookup(si)) {
+        if (MissingScopeMap::Ptr p = scopes->missingScopes.lookup(ScopeIterKey(si))) {
             debugScope = p->value();
             scopes->liveScopes.remove(&debugScope->scope().as<CallObject>());
             scopes->missingScopes.remove(p);
@@ -2056,7 +2056,7 @@ DebugScopes::onPopBlock(JSContext *cx, const ScopeIter &si)
         clone.copyUnaliasedValues(si.frame());
         scopes->liveScopes.remove(&clone);
     } else {
-        if (MissingScopeMap::Ptr p = scopes->missingScopes.lookup(si)) {
+        if (MissingScopeMap::Ptr p = scopes->missingScopes.lookup(ScopeIterKey(si))) {
             ClonedBlockObject &clone = p->value()->scope().as<ClonedBlockObject>();
             clone.copyUnaliasedValues(si.frame());
             scopes->liveScopes.remove(&clone);
@@ -2132,7 +2132,7 @@ DebugScopes::updateLiveScopes(JSContext *cx)
                 DebugScopes *scopes = ensureCompartmentData(cx);
                 if (!scopes)
                     return false;
-                if (!scopes->liveScopes.put(&si.scope(), si))
+                if (!scopes->liveScopes.put(&si.scope(), ScopeIterVal(si)))
                     return false;
                 liveScopesPostWriteBarrier(cx->runtime(), &scopes->liveScopes, &si.scope());
             }
diff --git a/js/src/vm/ScopeObject.h b/js/src/vm/ScopeObject.h
index 2faee42f867a..3a9da034e8f3 100644
--- a/js/src/vm/ScopeObject.h
+++ b/js/src/vm/ScopeObject.h
@@ -71,7 +71,7 @@ class StaticScopeIter
                      obj->is<JSFunction>());
     }
 
-    StaticScopeIter(JSObject *obj)
+    explicit StaticScopeIter(JSObject *obj)
       : obj((ExclusiveContext *) nullptr, obj), onNamedLambda(false)
     {
         JS_STATIC_ASSERT(allowGC == NoGC);
@@ -116,7 +116,7 @@ class ScopeCoordinate
     static_assert(SCOPECOORD_SLOT_BITS <= 32, "We have enough bits below");
 
   public:
-    inline ScopeCoordinate(jsbytecode *pc)
+    explicit inline ScopeCoordinate(jsbytecode *pc)
       : hops_(GET_SCOPECOORD_HOPS(pc)), slot_(GET_SCOPECOORD_SLOT(pc + SCOPECOORD_HOPS_LEN))
     {
         JS_ASSERT(JOF_OPTYPE(*pc) == JOF_SCOPECOORD);
@@ -691,7 +691,7 @@ class ScopeIterKey
     bool hasScopeObject_;
 
   public:
-    ScopeIterKey(const ScopeIter &si)
+    explicit ScopeIterKey(const ScopeIter &si)
       : frame_(si.frame()), cur_(si.cur_), staticScope_(si.staticScope_), type_(si.type_),
         hasScopeObject_(si.hasScopeObject_) {}
 
@@ -732,7 +732,7 @@ class ScopeIterVal
     static void staticAsserts();
 
   public:
-    ScopeIterVal(const ScopeIter &si)
+    explicit ScopeIterVal(const ScopeIter &si)
       : frame_(si.frame()), cur_(si.cur_), staticScope_(si.staticScope_), type_(si.type_),
         hasScopeObject_(si.hasScopeObject_) {}
 
@@ -843,7 +843,7 @@ class DebugScopes
                                                             ScopeObject *key);
 
   public:
-    DebugScopes(JSContext *c);
+    explicit DebugScopes(JSContext *c);
     ~DebugScopes();
 
   private:
diff --git a/js/src/vm/SelfHosting.cpp b/js/src/vm/SelfHosting.cpp
index 52493739aafa..a20a43c6e297 100644
--- a/js/src/vm/SelfHosting.cpp
+++ b/js/src/vm/SelfHosting.cpp
@@ -1157,7 +1157,7 @@ CloneObject(JSContext *cx, HandleObject selfHostedObject)
         clone = NewDenseEmptyArray(cx, nullptr, TenuredObject);
     } else {
         JS_ASSERT(selfHostedObject->isNative());
-        clone = NewObjectWithGivenProto(cx, selfHostedObject->getClass(), nullptr, cx->global(),
+        clone = NewObjectWithGivenProto(cx, selfHostedObject->getClass(), TaggedProto(nullptr), cx->global(),
                                         selfHostedObject->tenuredGetAllocKind(),
                                         SingletonObject);
     }
diff --git a/js/src/vm/Shape.cpp b/js/src/vm/Shape.cpp
index aa3085d55340..6a5aab059d66 100644
--- a/js/src/vm/Shape.cpp
+++ b/js/src/vm/Shape.cpp
@@ -1724,7 +1724,7 @@ EmptyShape::getInitialShape(ExclusiveContext *cx, const Class *clasp, TaggedProt
     new (shape) EmptyShape(nbase, nfixed);
 
     Lookup lookup(clasp, protoRoot, parentRoot, metadataRoot, nfixed, objectFlags);
-    if (!p.add(cx, table, lookup, InitialShapeEntry(shape, protoRoot)))
+    if (!p.add(cx, table, lookup, InitialShapeEntry(ReadBarrieredShape(shape), protoRoot)))
         return nullptr;
 
 #ifdef JSGC_GENERATIONAL
@@ -1761,7 +1761,7 @@ NewObjectCache::invalidateEntriesForShape(JSContext *cx, HandleShape shape, Hand
         kind = GetBackgroundAllocKind(kind);
 
     Rooted<GlobalObject *> global(cx, &shape->getObjectParent()->global());
-    Rooted<types::TypeObject *> type(cx, cx->getNewType(clasp, proto.get()));
+    Rooted<types::TypeObject *> type(cx, cx->getNewType(clasp, TaggedProto(proto)));
 
     EntryIndex entry;
     if (lookupGlobal(clasp, global, kind, &entry))
@@ -1792,7 +1792,7 @@ EmptyShape::insertInitialShape(ExclusiveContext *cx, HandleShape shape, HandleOb
     JS_ASSERT(nshape == entry.shape);
 #endif
 
-    entry.shape = shape.get();
+    entry.shape = ReadBarrieredShape(shape);
 
     /*
      * This affects the shape that will be produced by the various NewObject
@@ -1830,7 +1830,8 @@ JSCompartment::sweepInitialShapeTable()
                 JS_ASSERT(parent == shape->getObjectParent());
 #endif
                 if (shape != entry.shape || proto != entry.proto.raw()) {
-                    InitialShapeEntry newKey(shape, proto);
+                    ReadBarrieredShape readBarrieredShape(shape);
+                    InitialShapeEntry newKey(readBarrieredShape, TaggedProto(proto));
                     e.rekeyFront(newKey.getLookup(), newKey);
                 }
             }
diff --git a/js/src/vm/Shape.h b/js/src/vm/Shape.h
index 9dac174902fb..b2f56c306da6 100644
--- a/js/src/vm/Shape.h
+++ b/js/src/vm/Shape.h
@@ -158,7 +158,7 @@ struct PropDesc {
     /* Or maybe this represents a property's absence, and it's undefined. */
     bool isUndefined_ : 1;
 
-    PropDesc(const Value &v)
+    explicit PropDesc(const Value &v)
       : pd_(UndefinedValue()),
         value_(v),
         get_(UndefinedValue()), set_(UndefinedValue()),
@@ -410,7 +410,7 @@ struct ShapeTable {
                                            object */
     js::Shape       **entries;          /* table of ptrs to shared tree nodes */
 
-    ShapeTable(uint32_t nentries)
+    explicit ShapeTable(uint32_t nentries)
       : hashShift(HASH_BITS - MIN_SIZE_LOG2),
         entryCount(nentries),
         removedCount(0),
@@ -651,7 +651,7 @@ class BaseShape : public gc::BarrieredCell<BaseShape>
         this->compartment_ = comp;
     }
 
-    inline BaseShape(const StackBaseShape &base);
+    explicit inline BaseShape(const StackBaseShape &base);
 
     /* Not defined: BaseShapes must not be stack allocated. */
     ~BaseShape();
@@ -832,7 +832,7 @@ struct StackBaseShape
 
     inline StackBaseShape(ThreadSafeContext *cx, const Class *clasp,
                           JSObject *parent, JSObject *metadata, uint32_t objectFlags);
-    inline StackBaseShape(Shape *shape);
+    explicit inline StackBaseShape(Shape *shape);
 
     void updateGetterSetter(uint8_t attrs, PropertyOp rawGetter, StrictPropertyOp rawSetter) {
         flags &= ~(BaseShape::HAS_GETTER_OBJECT | BaseShape::HAS_SETTER_OBJECT);
@@ -1015,7 +1015,7 @@ class Shape : public gc::BarrieredCell<Shape>
             JS_STATIC_ASSERT(allowGC == CanGC);
         }
 
-        Range(Shape *shape) : cursor((ExclusiveContext *) nullptr, shape) {
+        explicit Range(Shape *shape) : cursor((ExclusiveContext *) nullptr, shape) {
             JS_STATIC_ASSERT(allowGC == NoGC);
         }
 
@@ -1470,7 +1470,7 @@ struct StackShape
         JS_ASSERT(slot <= SHAPE_INVALID_SLOT);
     }
 
-    StackShape(Shape *shape)
+    explicit StackShape(Shape *shape)
       : base(shape->base()->unowned()),
         propid(shape->propidRef()),
         slot_(shape->maybeSlot()),
diff --git a/js/src/vm/Stack-inl.h b/js/src/vm/Stack-inl.h
index eff936197531..edd18ef067f3 100644
--- a/js/src/vm/Stack-inl.h
+++ b/js/src/vm/Stack-inl.h
@@ -150,14 +150,14 @@ InterpreterFrame::unaliasedForEachActual(Op op)
 struct CopyTo
 {
     Value *dst;
-    CopyTo(Value *dst) : dst(dst) {}
+    explicit CopyTo(Value *dst) : dst(dst) {}
     void operator()(const Value &src) { *dst++ = src; }
 };
 
 struct CopyToHeap
 {
     HeapValue *dst;
-    CopyToHeap(HeapValue *dst) : dst(dst) {}
+    explicit CopyToHeap(HeapValue *dst) : dst(dst) {}
     void operator()(const Value &src) { dst->init(src); ++dst; }
 };
 
diff --git a/js/src/vm/Stack.h b/js/src/vm/Stack.h
index a62fd378ba30..eb62c659784a 100644
--- a/js/src/vm/Stack.h
+++ b/js/src/vm/Stack.h
@@ -117,19 +117,19 @@ class AbstractFramePtr
       : ptr_(0)
     {}
 
-    AbstractFramePtr(InterpreterFrame *fp)
+    MOZ_IMPLICIT AbstractFramePtr(InterpreterFrame *fp)
       : ptr_(fp ? uintptr_t(fp) | Tag_InterpreterFrame : 0)
     {
         MOZ_ASSERT_IF(fp, asInterpreterFrame() == fp);
     }
 
-    AbstractFramePtr(jit::BaselineFrame *fp)
+    MOZ_IMPLICIT AbstractFramePtr(jit::BaselineFrame *fp)
       : ptr_(fp ? uintptr_t(fp) | Tag_BaselineFrame : 0)
     {
         MOZ_ASSERT_IF(fp, asBaselineFrame() == fp);
     }
 
-    AbstractFramePtr(jit::RematerializedFrame *fp)
+    MOZ_IMPLICIT AbstractFramePtr(jit::RematerializedFrame *fp)
       : ptr_(fp ? uintptr_t(fp) | Tag_RematerializedFrame : 0)
     {
         MOZ_ASSERT_IF(fp, asRematerializedFrame() == fp);
@@ -1102,7 +1102,7 @@ class InvokeArgs : public JS::CallArgs
     AutoValueVector v_;
 
   public:
-    InvokeArgs(JSContext *cx) : v_(cx) {}
+    explicit InvokeArgs(JSContext *cx) : v_(cx) {}
 
     bool init(unsigned argc) {
         if (!v_.resize(2 + argc))
@@ -1356,7 +1356,7 @@ class JitActivation : public Activation
 
   public:
     JitActivation(JSContext *cx, bool firstFrameIsConstructing, bool active = true);
-    JitActivation(ForkJoinContext *cx);
+    explicit JitActivation(ForkJoinContext *cx);
     ~JitActivation();
 
     bool isActive() const {
@@ -1595,12 +1595,12 @@ class FrameIter
         Data(const Data &other);
     };
 
-    FrameIter(ThreadSafeContext *cx, SavedOption = STOP_AT_SAVED);
+    MOZ_IMPLICIT FrameIter(ThreadSafeContext *cx, SavedOption = STOP_AT_SAVED);
     FrameIter(ThreadSafeContext *cx, ContextOption, SavedOption);
     FrameIter(JSContext *cx, ContextOption, SavedOption, JSPrincipals *);
     FrameIter(const FrameIter &iter);
-    FrameIter(const Data &data);
-    FrameIter(AbstractFramePtr frame);
+    MOZ_IMPLICIT FrameIter(const Data &data);
+    MOZ_IMPLICIT FrameIter(AbstractFramePtr frame);
 
     bool done() const { return data_.state_ == DONE; }
 
@@ -1730,7 +1730,7 @@ class ScriptFrameIter : public FrameIter
     }
 
   public:
-    ScriptFrameIter(ThreadSafeContext *cx, SavedOption savedOption = STOP_AT_SAVED)
+    explicit ScriptFrameIter(ThreadSafeContext *cx, SavedOption savedOption = STOP_AT_SAVED)
       : FrameIter(cx, savedOption)
     {
         settle();
@@ -1754,8 +1754,8 @@ class ScriptFrameIter : public FrameIter
     }
 
     ScriptFrameIter(const ScriptFrameIter &iter) : FrameIter(iter) { settle(); }
-    ScriptFrameIter(const FrameIter::Data &data) : FrameIter(data) { settle(); }
-    ScriptFrameIter(AbstractFramePtr frame) : FrameIter(frame) { settle(); }
+    explicit ScriptFrameIter(const FrameIter::Data &data) : FrameIter(data) { settle(); }
+    explicit ScriptFrameIter(AbstractFramePtr frame) : FrameIter(frame) { settle(); }
 
     ScriptFrameIter &operator++() {
         FrameIter::operator++();
@@ -1780,8 +1780,8 @@ class NonBuiltinFrameIter : public FrameIter
     void settle();
 
   public:
-    NonBuiltinFrameIter(ThreadSafeContext *cx,
-                        FrameIter::SavedOption opt = FrameIter::STOP_AT_SAVED)
+    explicit NonBuiltinFrameIter(ThreadSafeContext *cx,
+                                 FrameIter::SavedOption opt = FrameIter::STOP_AT_SAVED)
       : FrameIter(cx, opt)
     {
         settle();
@@ -1804,7 +1804,7 @@ class NonBuiltinFrameIter : public FrameIter
         settle();
     }
 
-    NonBuiltinFrameIter(const FrameIter::Data &data)
+    explicit NonBuiltinFrameIter(const FrameIter::Data &data)
       : FrameIter(data)
     {}
 
@@ -1821,7 +1821,7 @@ class NonBuiltinScriptFrameIter : public ScriptFrameIter
     void settle();
 
   public:
-    NonBuiltinScriptFrameIter(ThreadSafeContext *cx,
+    explicit NonBuiltinScriptFrameIter(ThreadSafeContext *cx,
                               ScriptFrameIter::SavedOption opt = ScriptFrameIter::STOP_AT_SAVED)
       : ScriptFrameIter(cx, opt)
     {
@@ -1845,7 +1845,7 @@ class NonBuiltinScriptFrameIter : public ScriptFrameIter
         settle();
     }
 
-    NonBuiltinScriptFrameIter(const ScriptFrameIter::Data &data)
+    explicit NonBuiltinScriptFrameIter(const ScriptFrameIter::Data &data)
       : ScriptFrameIter(data)
     {}
 
@@ -1863,7 +1863,7 @@ class NonBuiltinScriptFrameIter : public ScriptFrameIter
 class AllFramesIter : public ScriptFrameIter
 {
   public:
-    AllFramesIter(ThreadSafeContext *cx)
+    explicit AllFramesIter(ThreadSafeContext *cx)
       : ScriptFrameIter(cx, ScriptFrameIter::ALL_CONTEXTS, ScriptFrameIter::GO_THROUGH_SAVED)
     {}
 };
diff --git a/js/src/vm/String.h b/js/src/vm/String.h
index 826cdd1b73b4..8baac8a2b9e8 100644
--- a/js/src/vm/String.h
+++ b/js/src/vm/String.h
@@ -896,7 +896,7 @@ class ScopedThreadSafeStringInspector
     const jschar *chars_;
 
   public:
-    ScopedThreadSafeStringInspector(JSString *str)
+    explicit ScopedThreadSafeStringInspector(JSString *str)
       : str_(str),
         chars_(nullptr)
     { }
diff --git a/js/src/vm/StructuredClone.cpp b/js/src/vm/StructuredClone.cpp
index 85bf2548a986..d351f2923d78 100644
--- a/js/src/vm/StructuredClone.cpp
+++ b/js/src/vm/StructuredClone.cpp
@@ -1137,7 +1137,7 @@ class Chars {
     JSContext *cx;
     jschar *p;
   public:
-    Chars(JSContext *cx) : cx(cx), p(nullptr) {}
+    explicit Chars(JSContext *cx) : cx(cx), p(nullptr) {}
     ~Chars() { js_free(p); }
 
     bool allocate(size_t len) {
diff --git a/js/src/vm/ThreadPool.h b/js/src/vm/ThreadPool.h
index ca2ed4aae707..047d94b88677 100644
--- a/js/src/vm/ThreadPool.h
+++ b/js/src/vm/ThreadPool.h
@@ -210,7 +210,7 @@ class ThreadPool : public Monitor
 
     static const uint16_t MAX_SLICE_ID = UINT16_MAX;
 
-    ThreadPool(JSRuntime *rt);
+    explicit ThreadPool(JSRuntime *rt);
     ~ThreadPool();
 
     bool init();
diff --git a/js/src/vm/TypedArrayObject.cpp b/js/src/vm/TypedArrayObject.cpp
index 12f3b6c7fc59..c76c94785f90 100644
--- a/js/src/vm/TypedArrayObject.cpp
+++ b/js/src/vm/TypedArrayObject.cpp
@@ -249,7 +249,7 @@ class TypedArrayObjectTemplate : public TypedArrayObject
         if (!obj)
             return nullptr;
 
-        types::TypeObject *type = cx->getNewType(obj->getClass(), proto.get());
+        types::TypeObject *type = cx->getNewType(obj->getClass(), TaggedProto(proto.get()));
         if (!type)
             return nullptr;
         obj->setType(type);
@@ -896,13 +896,13 @@ class TypedArrayObjectTemplate : public TypedArrayObject
     infallibleValueToNative(const Value &v)
     {
         if (v.isInt32())
-            return v.toInt32();
+            return NativeType(v.toInt32());
         if (v.isDouble())
             return doubleToNative(v.toDouble());
         if (v.isBoolean())
-            return v.toBoolean();
+            return NativeType(v.toBoolean());
         if (v.isNull())
-            return 0;
+            return NativeType(0);
 
         MOZ_ASSERT(v.isUndefined());
         return ArrayTypeIsFloatingPoint() ? NativeType(GenericNaN()) : NativeType(0);
diff --git a/js/src/vm/TypedArrayObject.h b/js/src/vm/TypedArrayObject.h
index b904f829a94f..bc07337566c1 100644
--- a/js/src/vm/TypedArrayObject.h
+++ b/js/src/vm/TypedArrayObject.h
@@ -367,8 +367,7 @@ template <>
 inline bool
 JSObject::is<js::ArrayBufferViewObject>() const
 {
-    return is<js::DataViewObject>() || is<js::TypedArrayObject>() ||
-           IsTypedObjectClass(getClass());
+    return is<js::DataViewObject>() || is<js::TypedArrayObject>();
 }
 
 #endif /* vm_TypedArrayObject_h */
diff --git a/js/src/vm/Xdr.h b/js/src/vm/Xdr.h
index 062a9e259c83..acf4ae8eb3e6 100644
--- a/js/src/vm/Xdr.h
+++ b/js/src/vm/Xdr.h
@@ -27,7 +27,7 @@ static const uint32_t XDR_BYTECODE_VERSION = uint32_t(0xb973c0de - 172);
 
 class XDRBuffer {
   public:
-    XDRBuffer(JSContext *cx)
+    explicit XDRBuffer(JSContext *cx)
       : context(cx), base(nullptr), cursor(nullptr), limit(nullptr) { }
 
     JSContext *cx() const {
@@ -97,7 +97,7 @@ class XDRState {
   protected:
     JSPrincipals *originPrincipals_;
 
-    XDRState(JSContext *cx)
+    explicit XDRState(JSContext *cx)
       : buf(cx), originPrincipals_(nullptr) {
     }
 
@@ -233,7 +233,7 @@ class XDRState {
 
 class XDREncoder : public XDRState<XDR_ENCODE> {
   public:
-    XDREncoder(JSContext *cx)
+    explicit XDREncoder(JSContext *cx)
       : XDRState<XDR_ENCODE>(cx) {
     }
 
diff --git a/js/xpconnect/src/XPCComponents.cpp b/js/xpconnect/src/XPCComponents.cpp
index 9da28aaae75b..3915a4bb5f35 100644
--- a/js/xpconnect/src/XPCComponents.cpp
+++ b/js/xpconnect/src/XPCComponents.cpp
@@ -2146,7 +2146,7 @@ nsXPCConstructor::CallOrConstruct(nsIXPConnectWrappedNative *wrapper,JSContext *
 
     JS::Rooted<JS::Value> arg(cx, ObjectValue(*iidObj));
     RootedValue rval(cx);
-    if (!JS_CallFunctionName(cx, cidObj, "createInstance", arg, &rval) ||
+    if (!JS_CallFunctionName(cx, cidObj, "createInstance", JS::HandleValueArray(arg), &rval) ||
         rval.isPrimitive()) {
         // createInstance will have thrown an exception
         *_retval = false;
@@ -3371,7 +3371,7 @@ nsXPCComponents_Utils::GetIncumbentGlobal(HandleValue aCallback,
     // Invoke the callback, if passed.
     if (aCallback.isObject()) {
         RootedValue ignored(aCx);
-        if (!JS_CallFunctionValue(aCx, JS::NullPtr(), aCallback, globalVal, &ignored))
+        if (!JS_CallFunctionValue(aCx, JS::NullPtr(), aCallback, JS::HandleValueArray(globalVal), &ignored))
             return NS_ERROR_FAILURE;
     }
 
diff --git a/js/xpconnect/src/XPCWrappedJSClass.cpp b/js/xpconnect/src/XPCWrappedJSClass.cpp
index c7015b5011a1..a5b6e1d5b471 100644
--- a/js/xpconnect/src/XPCWrappedJSClass.cpp
+++ b/js/xpconnect/src/XPCWrappedJSClass.cpp
@@ -222,7 +222,7 @@ nsXPCWrappedJSClass::CallQueryInterfaceOnJSObject(JSContext* cx,
             AutoSaveContextOptions asco(cx);
             ContextOptionsRef(cx).setDontReportUncaught(true);
             RootedValue arg(cx, JS::ObjectValue(*id));
-            success = JS_CallFunctionValue(cx, jsobj, fun, arg, &retval);
+            success = JS_CallFunctionValue(cx, jsobj, fun, HandleValueArray(arg), &retval);
         }
 
         if (!success && JS_IsExceptionPending(cx)) {
@@ -1344,9 +1344,21 @@ pre_call_clean_up:
                 break;
         }
 
-        if (!XPCConvert::JSData2Native(&pv->val, val, type,
-                                       !param.IsDipper(), &param_iid, nullptr))
-            break;
+// see bug #961488
+#if (defined(XP_UNIX) && !defined(XP_MACOSX) && !defined(_AIX)) && \
+    ((defined(__sparc) && !defined(__sparcv9) && !defined(__sparcv9__)) || \
+    (defined(__powerpc__) && !defined (__powerpc64__)))
+        if (type_tag == nsXPTType::T_JSVAL) {
+            if (!XPCConvert::JSData2Native(*(void**)(&pv->val), val, type,
+                                           !param.IsDipper(), &param_iid, nullptr))
+                break;
+        } else
+#endif
+        {
+            if (!XPCConvert::JSData2Native(&pv->val, val, type,
+                                           !param.IsDipper(), &param_iid, nullptr))
+                break;
+        }
     }
 
     // if any params were dependent, then we must iterate again to convert them.
diff --git a/js/xpconnect/tests/mochitest/test_bug870423.html b/js/xpconnect/tests/mochitest/test_bug870423.html
index b951585b602c..97e75195066e 100644
--- a/js/xpconnect/tests/mochitest/test_bug870423.html
+++ b/js/xpconnect/tests/mochitest/test_bug870423.html
@@ -22,7 +22,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=870423
     check(window, sowin, 'Window', function(win) { return win; });
     check(window, sowin, 'Location', function(win) { return win.location; });
 
-    todo(xowin instanceof Window, "Cross-origin instanceof should work");
+    ok(xowin instanceof Window, "Cross-origin instanceof should work");
     todo(xowin.location instanceof Location, "Cross-origin instanceof should work");
 
     SimpleTest.finish();
diff --git a/layout/base/crashtests/crashtests.list b/layout/base/crashtests/crashtests.list
index e9fffe84ba0a..f30be184f6b7 100644
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -312,12 +312,12 @@ load 497519-2.xhtml
 load 499741-1.xhtml
 load 499841-1.xhtml
 load 499858-1.xhtml
-skip-if(Android&&AndroidVersion==10) load 500467-1.html # bug 978254
+load 500467-1.html
 load 501878-1.html
 load 503936-1.html
 load 507119.html
 load 514104-1.xul
-skip-if(Android&&AndroidVersion==10) load 522374-1.html # bug 978265
+load 522374-1.html
 load 522374-2.html
 load 526378-1.xul
 load 534367-1.xhtml
diff --git a/layout/base/nsDocumentViewer.cpp b/layout/base/nsDocumentViewer.cpp
index 981d7591868e..46f18639fa9c 100644
--- a/layout/base/nsDocumentViewer.cpp
+++ b/layout/base/nsDocumentViewer.cpp
@@ -566,19 +566,23 @@ nsDocumentViewer::LoadStart(nsIDocument* aDocument)
 nsresult
 nsDocumentViewer::SyncParentSubDocMap()
 {
-  nsCOMPtr<nsIDocShellTreeItem> item(mContainer);
-  nsCOMPtr<nsPIDOMWindow> pwin(do_GetInterface(item));
-  nsCOMPtr<nsIContent> content;
-
-  if (mDocument && pwin) {
-    content = do_QueryInterface(pwin->GetFrameElementInternal());
+  nsCOMPtr<nsIDocShell> docShell(mContainer);
+  if (!docShell) {
+    return NS_OK;
   }
 
-  if (content) {
-    nsCOMPtr<nsIDocShellTreeItem> parent;
-    item->GetParent(getter_AddRefs(parent));
+  nsCOMPtr<nsPIDOMWindow> pwin(docShell->GetWindow());
+  nsCOMPtr<Element> element;
 
-    nsCOMPtr<nsIDOMWindow> parent_win(do_GetInterface(parent));
+  if (mDocument && pwin) {
+    element = pwin->GetFrameElementInternal();
+  }
+
+  if (element) {
+    nsCOMPtr<nsIDocShellTreeItem> parent;
+    docShell->GetParent(getter_AddRefs(parent));
+
+    nsCOMPtr<nsIDOMWindow> parent_win = parent ? parent->GetWindow() : nullptr;
 
     if (parent_win) {
       nsCOMPtr<nsIDOMDocument> dom_doc;
@@ -588,11 +592,11 @@ nsDocumentViewer::SyncParentSubDocMap()
 
       if (parent_doc) {
         if (mDocument &&
-            parent_doc->GetSubDocumentFor(content) != mDocument) {
+            parent_doc->GetSubDocumentFor(element) != mDocument) {
           mDocument->SuppressEventHandling(nsIDocument::eEvents,
                                            parent_doc->EventHandlingSuppressed());
         }
-        return parent_doc->SetSubDocumentFor(content->AsElement(), mDocument);
+        return parent_doc->SetSubDocumentFor(element, mDocument);
       }
     }
   }
@@ -1795,7 +1799,7 @@ nsDocumentViewer::SetDocumentInternal(nsIDocument* aDocument,
 
     // Set the script global object on the new document
     nsCOMPtr<nsPIDOMWindow> window =
-      do_GetInterface(static_cast<nsIDocShell*>(mContainer.get()));
+      mContainer ? mContainer->GetWindow() : nullptr;
     if (window) {
       window->SetNewDocument(aDocument, nullptr, aForceReuseInnerWindow);
     }
@@ -2453,21 +2457,19 @@ nsDocumentViewer::FindContainerView()
   nsView* containerView = nullptr;
 
   if (mContainer) {
-    nsCOMPtr<nsIDocShellTreeItem> docShellItem(mContainer);
-    nsCOMPtr<nsPIDOMWindow> pwin(do_GetInterface(docShellItem));
+    nsCOMPtr<nsIDocShell> docShell(mContainer);
+    nsCOMPtr<nsPIDOMWindow> pwin(docShell->GetWindow());
     if (pwin) {
-      nsCOMPtr<nsIContent> containerElement = do_QueryInterface(pwin->GetFrameElementInternal());
+      nsCOMPtr<Element> containerElement = pwin->GetFrameElementInternal();
       if (!containerElement) {
         return nullptr;
       }
       nsCOMPtr<nsIPresShell> parentPresShell;
-      if (docShellItem) {
-        nsCOMPtr<nsIDocShellTreeItem> parentDocShellItem;
-        docShellItem->GetParent(getter_AddRefs(parentDocShellItem));
-        if (parentDocShellItem) {
-          nsCOMPtr<nsIDocShell> parentDocShell = do_QueryInterface(parentDocShellItem);
-          parentPresShell = parentDocShell->GetPresShell();
-        }
+      nsCOMPtr<nsIDocShellTreeItem> parentDocShellItem;
+      docShell->GetParent(getter_AddRefs(parentDocShellItem));
+      if (parentDocShellItem) {
+        nsCOMPtr<nsIDocShell> parentDocShell = do_QueryInterface(parentDocShellItem);
+        parentPresShell = parentDocShell->GetPresShell();
       }
       if (!parentPresShell) {
         nsCOMPtr<nsIDocument> parentDoc = containerElement->GetCurrentDoc();
@@ -4330,10 +4332,11 @@ nsDocumentViewer::OnDonePrinting()
     // We are done printing, now cleanup 
     if (mDeferredWindowClose) {
       mDeferredWindowClose = false;
-      nsCOMPtr<nsIDOMWindow> win =
-        do_GetInterface(static_cast<nsIDocShell*>(mContainer));
-      if (win)
-        win->Close();
+      if (mContainer) {
+        nsCOMPtr<nsIDOMWindow> win = mContainer->GetWindow();
+        if (win)
+          win->Close();
+      }
     } else if (mClosingWhilePrinting) {
       if (mDocument) {
         mDocument->SetScriptGlobalObject(nullptr);
diff --git a/layout/base/nsLayoutUtils.cpp b/layout/base/nsLayoutUtils.cpp
index a779c82e48b2..bbc3233abc9f 100644
--- a/layout/base/nsLayoutUtils.cpp
+++ b/layout/base/nsLayoutUtils.cpp
@@ -5392,7 +5392,7 @@ nsLayoutUtils::GetDeviceContextForScreenInfo(nsPIDOMWindow* aWindow)
     // context does the right thing on multi-monitor systems when we return it to
     // the caller.  It will also make sure that our prescontext has been created,
     // if we're supposed to have one.
-    nsCOMPtr<nsPIDOMWindow> win = do_GetInterface(docShell);
+    nsCOMPtr<nsPIDOMWindow> win = docShell->GetWindow();
     if (!win) {
       // No reason to go on
       return nullptr;
diff --git a/layout/base/nsPresContext.cpp b/layout/base/nsPresContext.cpp
index 9ee5a45d92e9..6d214d0d2381 100644
--- a/layout/base/nsPresContext.cpp
+++ b/layout/base/nsPresContext.cpp
@@ -1642,7 +1642,11 @@ nsPresContext::IsTopLevelWindowInactive()
 
   nsCOMPtr<nsIDocShellTreeItem> rootItem;
   treeItem->GetRootTreeItem(getter_AddRefs(rootItem));
-  nsCOMPtr<nsPIDOMWindow> domWindow(do_GetInterface(rootItem));
+  if (!rootItem) {
+    return false;
+  }
+
+  nsCOMPtr<nsPIDOMWindow> domWindow = rootItem->GetWindow();
 
   return domWindow && !domWindow->IsActive();
 }
@@ -1778,33 +1782,46 @@ nsPresContext::UIResolutionChangedInternal()
     chromeWindow->GetMessageManager(getter_AddRefs(windowMM));
   }
   if (windowMM) {
-    uint32_t tabChildCount = 0;
-    windowMM->GetChildCount(&tabChildCount);
-    for (uint32_t j = 0; j < tabChildCount; ++j) {
-      nsCOMPtr<nsIMessageListenerManager> childMM;
-      windowMM->GetChildAt(j, getter_AddRefs(childMM));
-      if (!childMM) {
-        continue;
-      }
-      nsCOMPtr<nsIMessageSender> tabMM = do_QueryInterface(childMM);
-
-      mozilla::dom::ipc::MessageManagerCallback* cb =
-       static_cast<nsFrameMessageManager*>(tabMM.get())->GetCallback();
-      if (cb) {
-        nsFrameLoader* fl = static_cast<nsFrameLoader*>(cb);
-        PBrowserParent* remoteBrowser = fl->GetRemoteBrowser();
-        TabParent* remote = static_cast<TabParent*>(remoteBrowser);
-        if (remote) {
-          remote->UIResolutionChanged();
-        }
-      }
-    }
+    NotifyUIResolutionChanged(windowMM);
   }
 
   mDocument->EnumerateSubDocuments(UIResolutionChangedSubdocumentCallback,
                                    nullptr);
 }
 
+void
+nsPresContext::NotifyUIResolutionChanged(nsIMessageBroadcaster* aManager)
+{
+  uint32_t tabChildCount = 0;
+  aManager->GetChildCount(&tabChildCount);
+  for (uint32_t j = 0; j < tabChildCount; ++j) {
+    nsCOMPtr<nsIMessageListenerManager> childMM;
+    aManager->GetChildAt(j, getter_AddRefs(childMM));
+    if (!childMM) {
+      continue;
+    }
+
+    nsCOMPtr<nsIMessageBroadcaster> nonLeafMM = do_QueryInterface(childMM);
+    if (nonLeafMM) {
+      NotifyUIResolutionChanged(nonLeafMM);
+      continue;
+    }
+
+    nsCOMPtr<nsIMessageSender> tabMM = do_QueryInterface(childMM);
+
+    mozilla::dom::ipc::MessageManagerCallback* cb =
+     static_cast<nsFrameMessageManager*>(tabMM.get())->GetCallback();
+    if (cb) {
+      nsFrameLoader* fl = static_cast<nsFrameLoader*>(cb);
+      PBrowserParent* remoteBrowser = fl->GetRemoteBrowser();
+      TabParent* remote = static_cast<TabParent*>(remoteBrowser);
+      if (remote) {
+        remote->UIResolutionChanged();
+      }
+    }
+  }
+}
+
 void
 nsPresContext::EmulateMedium(const nsAString& aMediaType)
 {
diff --git a/layout/base/nsPresContext.h b/layout/base/nsPresContext.h
index c8eefcbdcdb7..2300bb846b39 100644
--- a/layout/base/nsPresContext.h
+++ b/layout/base/nsPresContext.h
@@ -36,6 +36,7 @@
 #include "prclist.h"
 #include "nsThreadUtils.h"
 #include "ScrollbarStyles.h"
+#include "nsIMessageManager.h"
 
 class nsBidiPresUtils;
 class nsAString;
@@ -784,6 +785,12 @@ public:
    */
   NS_HIDDEN_(void) UIResolutionChanged();
 
+  /**
+   * Recursively notify all remote leaf descendants of a given message manager
+   * that the resolution of the user interface has changed.
+   */
+  NS_HIDDEN_(void) NotifyUIResolutionChanged(nsIMessageBroadcaster* aManager);
+
   /*
    * Notify the pres context that a system color has changed
    */
diff --git a/layout/base/nsPresShell.cpp b/layout/base/nsPresShell.cpp
index b283323ebcd8..f43197649862 100644
--- a/layout/base/nsPresShell.cpp
+++ b/layout/base/nsPresShell.cpp
@@ -5151,12 +5151,15 @@ PresShell::AddCanvasBackgroundColorItem(nsDisplayListBuilder& aBuilder,
 
 static bool IsTransparentContainerElement(nsPresContext* aPresContext)
 {
-  nsCOMPtr<nsIDocShellTreeItem> docShellItem = aPresContext->GetDocShell();
-  nsCOMPtr<nsPIDOMWindow> pwin(do_GetInterface(docShellItem));
+  nsCOMPtr<nsIDocShell> docShell = aPresContext->GetDocShell();
+  if (!docShell) {
+    return false;
+  }
+
+  nsCOMPtr<nsPIDOMWindow> pwin = docShell->GetWindow();
   if (!pwin)
     return false;
-  nsCOMPtr<nsIContent> containerElement =
-    do_QueryInterface(pwin->GetFrameElementInternal());
+  nsCOMPtr<Element> containerElement = pwin->GetFrameElementInternal();
   return containerElement &&
          containerElement->HasAttr(kNameSpaceID_None, nsGkAtoms::transparent);
 }
@@ -7067,8 +7070,11 @@ PresShell::GetTouchEventTargetDocument()
   nsCOMPtr<nsIDocShellTreeItem> item;
   owner->GetPrimaryContentShell(getter_AddRefs(item));
   nsCOMPtr<nsIDocShell> childDocShell = do_QueryInterface(item);
-  nsCOMPtr<nsIDocument> result = do_GetInterface(childDocShell);
-  return result;
+  if (!childDocShell) {
+    return nullptr;
+  }
+
+  return childDocShell->GetDocument();
 }
 #endif
 
@@ -8938,13 +8944,13 @@ LogVerifyMessage(nsIFrame* k1, nsIFrame* k2, const char* aMsg)
   if (k1) {
     k1->GetFrameName(n1);
   } else {
-    n1.AssignLiteral("(null)");
+    n1.AssignLiteral(MOZ_UTF16("(null)"));
   }
 
   if (k2) {
     k2->GetFrameName(n2);
   } else {
-    n2.AssignLiteral("(null)");
+    n2.AssignLiteral(MOZ_UTF16("(null)"));
   }
 
   printf("verifyreflow: %s %p != %s %p  %s\n",
diff --git a/layout/generic/crashtests/crashtests.list b/layout/generic/crashtests/crashtests.list
index 7cba2c4ce0d8..2d98ffa9c108 100644
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@@ -125,7 +125,7 @@ load 385344-2.html
 load 385414-1.html
 load 385414-2.html
 load 385426-1.html
-skip-if(B2G) skip-if(Android&&AndroidVersion==10) load 385526.html # Bug 891347
+skip-if(B2G) load 385526.html # Bug 891347
 load 385681.html
 load 385885-1.xul
 load 386799-1.html
diff --git a/layout/generic/moz.build b/layout/generic/moz.build
index dcafd0480b5c..b8d4252e3df2 100644
--- a/layout/generic/moz.build
+++ b/layout/generic/moz.build
@@ -32,6 +32,7 @@ EXPORTS += [
     'nsQueryFrame.h',
     'nsSplittableFrame.h',
     'nsSubDocumentFrame.h',
+    'nsTextRunTransformations.h',
     'ScrollbarActivity.h',
     'Selection.h',
     'WritingModes.h',
diff --git a/layout/generic/nsFrameState.cpp b/layout/generic/nsFrameState.cpp
index d48ce4e21dd1..61ee67d442bf 100644
--- a/layout/generic/nsFrameState.cpp
+++ b/layout/generic/nsFrameState.cpp
@@ -35,7 +35,7 @@ GetFrameState(nsIFrame* aFrame)
   nsFrameState state = aFrame->GetStateBits();
 
   if (state == nsFrameState(0)) {
-    result.AssignLiteral("0");
+    result.Assign('0');
     return result;
   }
 
diff --git a/layout/generic/nsGfxScrollFrame.cpp b/layout/generic/nsGfxScrollFrame.cpp
index 5d2f3d5ba852..067f7a7da787 100644
--- a/layout/generic/nsGfxScrollFrame.cpp
+++ b/layout/generic/nsGfxScrollFrame.cpp
@@ -730,11 +730,10 @@ GetBrowserRoot(nsIContent* aContent)
     nsIDocument* doc = aContent->GetCurrentDoc();
     nsPIDOMWindow* win = doc->GetWindow();
     if (win) {
-      nsCOMPtr<nsIContent> frameContent =
-        do_QueryInterface(win->GetFrameElementInternal());
-      if (frameContent &&
-          frameContent->NodeInfo()->Equals(nsGkAtoms::browser, kNameSpaceID_XUL))
-        return frameContent;
+      nsCOMPtr<Element> frameElement = win->GetFrameElementInternal();
+      if (frameElement &&
+          frameElement->NodeInfo()->Equals(nsGkAtoms::browser, kNameSpaceID_XUL))
+        return frameElement;
     }
   }
 
diff --git a/layout/generic/nsTextFrame.cpp b/layout/generic/nsTextFrame.cpp
index 7098fa703838..d64e6af7832b 100644
--- a/layout/generic/nsTextFrame.cpp
+++ b/layout/generic/nsTextFrame.cpp
@@ -1834,7 +1834,6 @@ BuildTextRunsScanner::BuildTextRunForFrames(void* aTextBuffer)
   gfxSkipChars skipChars;
 
   const void* textPtr = aTextBuffer;
-  bool anySmallcapsStyle = false;
   bool anyTextTransformStyle = false;
   bool anyMathMLStyling = false;
   uint8_t sstyScriptLevel = 0;
@@ -1912,9 +1911,6 @@ BuildTextRunsScanner::BuildTextRunForFrames(void* aTextBuffer)
       textFlags |= gfxTextRunFactory::TEXT_ENABLE_SPACING;
     }
     fontStyle = f->StyleFont();
-    if (NS_STYLE_FONT_VARIANT_SMALL_CAPS == fontStyle->mFont.variant) {
-      anySmallcapsStyle = true;
-    }
     if (NS_MATHML_MATHVARIANT_NONE != fontStyle->mMathVariant) {
       anyMathMLStyling = true;
     } else if (mLineContainer->GetStateBits() & NS_FRAME_IS_IN_SINGLE_CHAR_MI) {
@@ -2079,9 +2075,6 @@ BuildTextRunsScanner::BuildTextRunForFrames(void* aTextBuffer)
 
   // Setup factory chain
   nsAutoPtr<nsTransformingTextRunFactory> transformingFactory;
-  if (anySmallcapsStyle) {
-    transformingFactory = new nsFontVariantTextRunFactory();
-  }
   if (anyTextTransformStyle) {
     transformingFactory =
       new nsCaseTransformTextRunFactory(transformingFactory.forget());
diff --git a/layout/generic/nsTextRunTransformations.cpp b/layout/generic/nsTextRunTransformations.cpp
index 3794f05e451c..ec37c297f695 100644
--- a/layout/generic/nsTextRunTransformations.cpp
+++ b/layout/generic/nsTextRunTransformations.cpp
@@ -10,6 +10,7 @@
 #include "nsGkAtoms.h"
 #include "nsStyleConsts.h"
 #include "nsStyleContext.h"
+#include "nsUnicharUtils.h"
 #include "nsUnicodeProperties.h"
 #include "nsSpecialCasingData.h"
 #include "mozilla/gfx/2D.h"
@@ -28,288 +29,6 @@
 #define GREEK_SMALL_LETTER_FINAL_SIGMA         0x03C2
 #define GREEK_SMALL_LETTER_SIGMA               0x03C3
 
-// Custom uppercase mapping for Greek; see bug 307039 for details
-#define GREEK_LOWER_ALPHA                      0x03B1
-#define GREEK_LOWER_ALPHA_TONOS                0x03AC
-#define GREEK_LOWER_ALPHA_OXIA                 0x1F71
-#define GREEK_LOWER_EPSILON                    0x03B5
-#define GREEK_LOWER_EPSILON_TONOS              0x03AD
-#define GREEK_LOWER_EPSILON_OXIA               0x1F73
-#define GREEK_LOWER_ETA                        0x03B7
-#define GREEK_LOWER_ETA_TONOS                  0x03AE
-#define GREEK_LOWER_ETA_OXIA                   0x1F75
-#define GREEK_LOWER_IOTA                       0x03B9
-#define GREEK_LOWER_IOTA_TONOS                 0x03AF
-#define GREEK_LOWER_IOTA_OXIA                  0x1F77
-#define GREEK_LOWER_IOTA_DIALYTIKA             0x03CA
-#define GREEK_LOWER_IOTA_DIALYTIKA_TONOS       0x0390
-#define GREEK_LOWER_IOTA_DIALYTIKA_OXIA        0x1FD3
-#define GREEK_LOWER_OMICRON                    0x03BF
-#define GREEK_LOWER_OMICRON_TONOS              0x03CC
-#define GREEK_LOWER_OMICRON_OXIA               0x1F79
-#define GREEK_LOWER_UPSILON                    0x03C5
-#define GREEK_LOWER_UPSILON_TONOS              0x03CD
-#define GREEK_LOWER_UPSILON_OXIA               0x1F7B
-#define GREEK_LOWER_UPSILON_DIALYTIKA          0x03CB
-#define GREEK_LOWER_UPSILON_DIALYTIKA_TONOS    0x03B0
-#define GREEK_LOWER_UPSILON_DIALYTIKA_OXIA     0x1FE3
-#define GREEK_LOWER_OMEGA                      0x03C9
-#define GREEK_LOWER_OMEGA_TONOS                0x03CE
-#define GREEK_LOWER_OMEGA_OXIA                 0x1F7D
-#define GREEK_UPPER_ALPHA                      0x0391
-#define GREEK_UPPER_EPSILON                    0x0395
-#define GREEK_UPPER_ETA                        0x0397
-#define GREEK_UPPER_IOTA                       0x0399
-#define GREEK_UPPER_IOTA_DIALYTIKA             0x03AA
-#define GREEK_UPPER_OMICRON                    0x039F
-#define GREEK_UPPER_UPSILON                    0x03A5
-#define GREEK_UPPER_UPSILON_DIALYTIKA          0x03AB
-#define GREEK_UPPER_OMEGA                      0x03A9
-#define GREEK_UPPER_ALPHA_TONOS                0x0386
-#define GREEK_UPPER_ALPHA_OXIA                 0x1FBB
-#define GREEK_UPPER_EPSILON_TONOS              0x0388
-#define GREEK_UPPER_EPSILON_OXIA               0x1FC9
-#define GREEK_UPPER_ETA_TONOS                  0x0389
-#define GREEK_UPPER_ETA_OXIA                   0x1FCB
-#define GREEK_UPPER_IOTA_TONOS                 0x038A
-#define GREEK_UPPER_IOTA_OXIA                  0x1FDB
-#define GREEK_UPPER_OMICRON_TONOS              0x038C
-#define GREEK_UPPER_OMICRON_OXIA               0x1FF9
-#define GREEK_UPPER_UPSILON_TONOS              0x038E
-#define GREEK_UPPER_UPSILON_OXIA               0x1FEB
-#define GREEK_UPPER_OMEGA_TONOS                0x038F
-#define GREEK_UPPER_OMEGA_OXIA                 0x1FFB
-#define COMBINING_ACUTE_ACCENT                 0x0301
-#define COMBINING_DIAERESIS                    0x0308
-#define COMBINING_ACUTE_TONE_MARK              0x0341
-#define COMBINING_GREEK_DIALYTIKA_TONOS        0x0344
-
-// When doing an Uppercase transform in Greek, we need to keep track of the
-// current state while iterating through the string, to recognize and process
-// diphthongs correctly. For clarity, we define a state for each vowel and
-// each vowel with accent, although a few of these do not actually need any
-// special treatment and could be folded into kStart.
-enum GreekCasingState {
-  kStart,
-  kAlpha,
-  kEpsilon,
-  kEta,
-  kIota,
-  kOmicron,
-  kUpsilon,
-  kOmega,
-  kAlphaAcc,
-  kEpsilonAcc,
-  kEtaAcc,
-  kIotaAcc,
-  kOmicronAcc,
-  kUpsilonAcc,
-  kOmegaAcc,
-  kOmicronUpsilon,
-  kDiaeresis
-};
-
-static uint32_t
-GreekUpperCase(uint32_t aCh, GreekCasingState* aState)
-{
-  switch (aCh) {
-  case GREEK_UPPER_ALPHA:
-  case GREEK_LOWER_ALPHA:
-    *aState = kAlpha;
-    return GREEK_UPPER_ALPHA;
-
-  case GREEK_UPPER_EPSILON:
-  case GREEK_LOWER_EPSILON:
-    *aState = kEpsilon;
-    return GREEK_UPPER_EPSILON;
-
-  case GREEK_UPPER_ETA:
-  case GREEK_LOWER_ETA:
-    *aState = kEta;
-    return GREEK_UPPER_ETA;
-
-  case GREEK_UPPER_IOTA:
-    *aState = kIota;
-    return GREEK_UPPER_IOTA;
-
-  case GREEK_UPPER_OMICRON:
-  case GREEK_LOWER_OMICRON:
-    *aState = kOmicron;
-    return GREEK_UPPER_OMICRON;
-
-  case GREEK_UPPER_UPSILON:
-    switch (*aState) {
-    case kOmicron:
-      *aState = kOmicronUpsilon;
-      break;
-    default:
-      *aState = kUpsilon;
-      break;
-    }
-    return GREEK_UPPER_UPSILON;
-
-  case GREEK_UPPER_OMEGA:
-  case GREEK_LOWER_OMEGA:
-    *aState = kOmega;
-    return GREEK_UPPER_OMEGA;
-
-  // iota and upsilon may be the second vowel of a diphthong
-  case GREEK_LOWER_IOTA:
-    switch (*aState) {
-    case kAlphaAcc:
-    case kEpsilonAcc:
-    case kOmicronAcc:
-    case kUpsilonAcc:
-      *aState = kStart;
-      return GREEK_UPPER_IOTA_DIALYTIKA;
-    default:
-      break;
-    }
-    *aState = kIota;
-    return GREEK_UPPER_IOTA;
-
-  case GREEK_LOWER_UPSILON:
-    switch (*aState) {
-    case kAlphaAcc:
-    case kEpsilonAcc:
-    case kEtaAcc:
-    case kOmicronAcc:
-      *aState = kStart;
-      return GREEK_UPPER_UPSILON_DIALYTIKA;
-    case kOmicron:
-      *aState = kOmicronUpsilon;
-      break;
-    default:
-      *aState = kUpsilon;
-      break;
-    }
-    return GREEK_UPPER_UPSILON;
-
-  case GREEK_UPPER_IOTA_DIALYTIKA:
-  case GREEK_LOWER_IOTA_DIALYTIKA:
-  case GREEK_UPPER_UPSILON_DIALYTIKA:
-  case GREEK_LOWER_UPSILON_DIALYTIKA:
-  case COMBINING_DIAERESIS:
-    *aState = kDiaeresis;
-    return ToUpperCase(aCh);
-
-  // remove accent if it follows a vowel or diaeresis,
-  // and set appropriate state for diphthong detection
-  case COMBINING_ACUTE_ACCENT:
-  case COMBINING_ACUTE_TONE_MARK:
-    switch (*aState) {
-    case kAlpha:
-      *aState = kAlphaAcc;
-      return uint32_t(-1); // omit this char from result string
-    case kEpsilon:
-      *aState = kEpsilonAcc;
-      return uint32_t(-1);
-    case kEta:
-      *aState = kEtaAcc;
-      return uint32_t(-1);
-    case kIota:
-      *aState = kIotaAcc;
-      return uint32_t(-1);
-    case kOmicron:
-      *aState = kOmicronAcc;
-      return uint32_t(-1);
-    case kUpsilon:
-      *aState = kUpsilonAcc;
-      return uint32_t(-1);
-    case kOmicronUpsilon:
-      *aState = kStart; // this completed a diphthong
-      return uint32_t(-1);
-    case kOmega:
-      *aState = kOmegaAcc;
-      return uint32_t(-1);
-    case kDiaeresis:
-      *aState = kStart;
-      return uint32_t(-1);
-    default:
-      break;
-    }
-    break;
-
-  // combinations with dieresis+accent just strip the accent,
-  // and reset to start state (don't form diphthong with following vowel)
-  case GREEK_LOWER_IOTA_DIALYTIKA_TONOS:
-  case GREEK_LOWER_IOTA_DIALYTIKA_OXIA:
-    *aState = kStart;
-    return GREEK_UPPER_IOTA_DIALYTIKA;
-
-  case GREEK_LOWER_UPSILON_DIALYTIKA_TONOS:
-  case GREEK_LOWER_UPSILON_DIALYTIKA_OXIA:
-    *aState = kStart;
-    return GREEK_UPPER_UPSILON_DIALYTIKA;
-
-  case COMBINING_GREEK_DIALYTIKA_TONOS:
-    *aState = kStart;
-    return COMBINING_DIAERESIS;
-
-  // strip accents from vowels, and note the vowel seen so that we can detect
-  // diphthongs where diaeresis needs to be added
-  case GREEK_LOWER_ALPHA_TONOS:
-  case GREEK_LOWER_ALPHA_OXIA:
-  case GREEK_UPPER_ALPHA_TONOS:
-  case GREEK_UPPER_ALPHA_OXIA:
-    *aState = kAlphaAcc;
-    return GREEK_UPPER_ALPHA;
-
-  case GREEK_LOWER_EPSILON_TONOS:
-  case GREEK_LOWER_EPSILON_OXIA:
-  case GREEK_UPPER_EPSILON_TONOS:
-  case GREEK_UPPER_EPSILON_OXIA:
-    *aState = kEpsilonAcc;
-    return GREEK_UPPER_EPSILON;
-
-  case GREEK_LOWER_ETA_TONOS:
-  case GREEK_LOWER_ETA_OXIA:
-  case GREEK_UPPER_ETA_TONOS:
-  case GREEK_UPPER_ETA_OXIA:
-    *aState = kEtaAcc;
-    return GREEK_UPPER_ETA;
-
-  case GREEK_LOWER_IOTA_TONOS:
-  case GREEK_LOWER_IOTA_OXIA:
-  case GREEK_UPPER_IOTA_TONOS:
-  case GREEK_UPPER_IOTA_OXIA:
-    *aState = kIotaAcc;
-    return GREEK_UPPER_IOTA;
-
-  case GREEK_LOWER_OMICRON_TONOS:
-  case GREEK_LOWER_OMICRON_OXIA:
-  case GREEK_UPPER_OMICRON_TONOS:
-  case GREEK_UPPER_OMICRON_OXIA:
-    *aState = kOmicronAcc;
-    return GREEK_UPPER_OMICRON;
-
-  case GREEK_LOWER_UPSILON_TONOS:
-  case GREEK_LOWER_UPSILON_OXIA:
-  case GREEK_UPPER_UPSILON_TONOS:
-  case GREEK_UPPER_UPSILON_OXIA:
-    switch (*aState) {
-    case kOmicron:
-      *aState = kStart; // this completed a diphthong
-      break;
-    default:
-      *aState = kUpsilonAcc;
-      break;
-    }
-    return GREEK_UPPER_UPSILON;
-
-  case GREEK_LOWER_OMEGA_TONOS:
-  case GREEK_LOWER_OMEGA_OXIA:
-  case GREEK_UPPER_OMEGA_TONOS:
-  case GREEK_UPPER_OMEGA_OXIA:
-    *aState = kOmegaAcc;
-    return GREEK_UPPER_OMEGA;
-  }
-
-  // all other characters just reset the state, and use standard mappings
-  *aState = kStart;
-  return ToUpperCase(aCh);
-}
-
 nsTransformedTextRun *
 nsTransformedTextRun::Create(const gfxTextRunFactory::Parameters* aParams,
                              nsTransformingTextRunFactory* aFactory,
@@ -498,210 +217,95 @@ GetParametersForInner(nsTransformedTextRun* aTextRun, uint32_t* aFlags,
   return params;
 }
 
-void
-nsFontVariantTextRunFactory::RebuildTextRun(nsTransformedTextRun* aTextRun,
-    gfxContext* aRefContext)
+// Some languages have special casing conventions that differ from the
+// default Unicode mappings.
+// The enum values here are named for well-known exemplar languages that
+// exhibit the behavior in question; multiple lang tags may map to the
+// same setting here, if the behavior is shared by other languages.
+enum LanguageSpecificCasingBehavior {
+  eLSCB_None,    // default non-lang-specific behavior
+  eLSCB_Turkish, // preserve dotted/dotless-i distinction in uppercase
+  eLSCB_Dutch,   // treat "ij" digraph as a unit for capitalization
+  eLSCB_Greek    // strip accent when uppercasing Greek vowels
+};
+
+static LanguageSpecificCasingBehavior
+GetCasingFor(const nsIAtom* aLang)
 {
-  gfxFontGroup* fontGroup = aTextRun->GetFontGroup();
-  gfxFontStyle fontStyle = *fontGroup->GetStyle();
-  fontStyle.size *= 0.8;
-  nsRefPtr<gfxFontGroup> smallFont = fontGroup->Copy(&fontStyle);
-  if (!smallFont)
-    return;
-
-  uint32_t flags;
-  gfxTextRunFactory::Parameters innerParams =
-      GetParametersForInner(aTextRun, &flags, aRefContext);
-
-  uint32_t length = aTextRun->GetLength();
-  const char16_t* str = aTextRun->mString.BeginReading();
-  nsRefPtr<nsStyleContext>* styles = aTextRun->mStyles.Elements();
-  // Create a textrun so we can check cluster-start properties
-  nsAutoPtr<gfxTextRun> inner(fontGroup->MakeTextRun(str, length, &innerParams, flags));
-  if (!inner.get())
-    return;
-
-  nsCaseTransformTextRunFactory uppercaseFactory(nullptr, true);
-
-  aTextRun->ResetGlyphRuns();
-
-  uint32_t runStart = 0;
-  nsAutoTArray<nsStyleContext*,50> styleArray;
-  nsAutoTArray<uint8_t,50> canBreakBeforeArray;
-
-  enum RunCaseState {
-    kUpperOrCaseless, // will be untouched by font-variant:small-caps
-    kLowercase,       // will be uppercased and reduced
-    kSpecialUpper     // specials: don't shrink, but apply uppercase mapping
-  };
-  RunCaseState runCase = kUpperOrCaseless;
-
-  // Note that this loop runs from 0 to length *inclusive*, so the last
-  // iteration is in effect beyond the end of the input text, to give a
-  // chance to finish the last casing run we've found.
-  // The last iteration, when i==length, must not attempt to look at the
-  // character position [i] or the style data for styles[i], as this would
-  // be beyond the valid length of the textrun or its style array.
-  for (uint32_t i = 0; i <= length; ++i) {
-    RunCaseState chCase = kUpperOrCaseless;
-    // Unless we're at the end, figure out what treatment the current
-    // character will need.
-    if (i < length) {
-      nsStyleContext* styleContext = styles[i];
-      // Characters that aren't the start of a cluster are ignored here. They
-      // get added to whatever lowercase/non-lowercase run we're in.
-      if (!inner->IsClusterStart(i)) {
-        chCase = runCase;
-      } else {
-        if (styleContext->StyleFont()->mFont.variant == NS_STYLE_FONT_VARIANT_SMALL_CAPS) {
-          uint32_t ch = str[i];
-          if (NS_IS_HIGH_SURROGATE(ch) && i < length - 1 && NS_IS_LOW_SURROGATE(str[i + 1])) {
-            ch = SURROGATE_TO_UCS4(ch, str[i + 1]);
-          }
-          uint32_t ch2 = ToUpperCase(ch);
-          if (ch != ch2 || mozilla::unicode::SpecialUpper(ch)) {
-            chCase = kLowercase;
-          } else if (styleContext->StyleFont()->mLanguage == nsGkAtoms::el) {
-            // In Greek, check for characters that will be modified by the
-            // GreekUpperCase mapping - this catches accented capitals where
-            // the accent is to be removed (bug 307039). These are handled by
-            // a transformed child run using the full-size font.
-            GreekCasingState state = kStart; // don't need exact context here
-            ch2 = GreekUpperCase(ch, &state);
-            if (ch != ch2) {
-              chCase = kSpecialUpper;
-            }
-          }
-        } else {
-          // Don't transform the character! I.e., pretend that it's not lowercase
-        }
-      }
-    }
-
-    // At the end of the text, or when the current character needs different
-    // casing treatment from the current run, finish the run-in-progress
-    // and prepare to accumulate a new run.
-    // Note that we do not look at any source data for offset [i] here,
-    // as that would be invalid in the case where i==length.
-    if ((i == length || runCase != chCase) && runStart < i) {
-      nsAutoPtr<nsTransformedTextRun> transformedChild;
-      nsAutoPtr<gfxTextRun> cachedChild;
-      gfxTextRun* child;
-
-      switch (runCase) {
-      case kUpperOrCaseless:
-        cachedChild =
-          fontGroup->MakeTextRun(str + runStart, i - runStart, &innerParams,
-                                 flags);
-        child = cachedChild.get();
-        break;
-      case kLowercase:
-        transformedChild =
-          uppercaseFactory.MakeTextRun(str + runStart, i - runStart,
-                                       &innerParams, smallFont, flags,
-                                       styleArray.Elements(), false);
-        child = transformedChild;
-        break;
-      case kSpecialUpper:
-        transformedChild =
-          uppercaseFactory.MakeTextRun(str + runStart, i - runStart,
-                                       &innerParams, fontGroup, flags,
-                                       styleArray.Elements(), false);
-        child = transformedChild;
-        break;
-      }
-      if (!child)
-        return;
-      // Copy potential linebreaks into child so they're preserved
-      // (and also child will be shaped appropriately)
-      NS_ASSERTION(canBreakBeforeArray.Length() == i - runStart,
-                   "lost some break-before values?");
-      child->SetPotentialLineBreaks(0, canBreakBeforeArray.Length(),
-          canBreakBeforeArray.Elements(), aRefContext);
-      if (transformedChild) {
-        transformedChild->FinishSettingProperties(aRefContext);
-      }
-      aTextRun->CopyGlyphDataFrom(child, 0, child->GetLength(), runStart);
-
-      runStart = i;
-      styleArray.Clear();
-      canBreakBeforeArray.Clear();
-    }
-
-    if (i < length) {
-      runCase = chCase;
-      styleArray.AppendElement(styles[i]);
-      canBreakBeforeArray.AppendElement(aTextRun->CanBreakLineBefore(i));
-    }
+  if (aLang == nsGkAtoms::tr ||
+      aLang == nsGkAtoms::az ||
+      aLang == nsGkAtoms::ba ||
+      aLang == nsGkAtoms::crh ||
+      aLang == nsGkAtoms::tt) {
+    return eLSCB_Turkish;
   }
+  if (aLang == nsGkAtoms::nl) {
+    return eLSCB_Dutch;
+  }
+  if (aLang == nsGkAtoms::el) {
+    return eLSCB_Greek;
+  }
+  return eLSCB_None;
 }
 
-void
-nsCaseTransformTextRunFactory::RebuildTextRun(nsTransformedTextRun* aTextRun,
-    gfxContext* aRefContext)
+bool
+nsCaseTransformTextRunFactory::TransformString(
+    const nsAString& aString,
+    nsString& aConvertedString,
+    bool aAllUppercase,
+    const nsIAtom* aLanguage,
+    nsTArray<bool>& aCharsToMergeArray,
+    nsTArray<bool>& aDeletedCharsArray,
+    nsTransformedTextRun* aTextRun,
+    nsTArray<uint8_t>* aCanBreakBeforeArray,
+    nsTArray<nsStyleContext*>* aStyleArray)
 {
-  uint32_t length = aTextRun->GetLength();
-  const char16_t* str = aTextRun->mString.BeginReading();
-  nsRefPtr<nsStyleContext>* styles = aTextRun->mStyles.Elements();
+  NS_PRECONDITION(!aTextRun || (aCanBreakBeforeArray && aStyleArray),
+                  "either none or all three optional parameters required");
+
+  uint32_t length = aString.Length();
+  const char16_t* str = aString.BeginReading();
 
-  nsAutoString convertedString;
-  nsAutoTArray<bool,50> charsToMergeArray;
-  nsAutoTArray<bool,50> deletedCharsArray;
-  nsAutoTArray<nsStyleContext*,50> styleArray;
-  nsAutoTArray<uint8_t,50> canBreakBeforeArray;
   bool mergeNeeded = false;
 
-  // Some languages have special casing conventions that differ from the
-  // default Unicode mappings.
-  // The enum values here are named for well-known exemplar languages that
-  // exhibit the behavior in question; multiple lang tags may map to the
-  // same setting here, if the behavior is shared by other languages.
-  enum {
-    eNone,    // default non-lang-specific behavior
-    eTurkish, // preserve dotted/dotless-i distinction in uppercase
-    eDutch,   // treat "ij" digraph as a unit for capitalization
-    eGreek    // strip accent when uppercasing Greek vowels
-  } languageSpecificCasing = eNone;
-
-  const nsIAtom* lang = nullptr;
   bool capitalizeDutchIJ = false;
   bool prevIsLetter = false;
   uint32_t sigmaIndex = uint32_t(-1);
   nsIUGenCategory::nsUGenCategory cat;
-  GreekCasingState greekState = kStart;
-  uint32_t i;
-  for (i = 0; i < length; ++i) {
-    uint32_t ch = str[i];
-    nsStyleContext* styleContext = styles[i];
 
-    uint8_t style = mAllUppercase ? NS_STYLE_TEXT_TRANSFORM_UPPERCASE
-      : styleContext->StyleText()->mTextTransform;
+  uint8_t style = aAllUppercase ? NS_STYLE_TEXT_TRANSFORM_UPPERCASE : 0;
+  const nsIAtom* lang = aLanguage;
+
+  LanguageSpecificCasingBehavior languageSpecificCasing = GetCasingFor(lang);
+  GreekCasing::State greekState;
+
+  for (uint32_t i = 0; i < length; ++i) {
+    uint32_t ch = str[i];
+
+    nsStyleContext* styleContext;
+    if (aTextRun) {
+      styleContext = aTextRun->mStyles[i];
+      style = aAllUppercase ? NS_STYLE_TEXT_TRANSFORM_UPPERCASE :
+        styleContext->StyleText()->mTextTransform;
+
+      if (lang != styleContext->StyleFont()->mLanguage) {
+        lang = styleContext->StyleFont()->mLanguage;
+        languageSpecificCasing = GetCasingFor(lang);
+        greekState.Reset();
+      }
+    }
+
     int extraChars = 0;
     const mozilla::unicode::MultiCharMapping *mcm;
 
-    if (NS_IS_HIGH_SURROGATE(ch) && i < length - 1 && NS_IS_LOW_SURROGATE(str[i + 1])) {
+    if (NS_IS_HIGH_SURROGATE(ch) && i < length - 1 &&
+        NS_IS_LOW_SURROGATE(str[i + 1])) {
       ch = SURROGATE_TO_UCS4(ch, str[i + 1]);
     }
 
-    if (lang != styleContext->StyleFont()->mLanguage) {
-      lang = styleContext->StyleFont()->mLanguage;
-      if (lang == nsGkAtoms::tr || lang == nsGkAtoms::az ||
-          lang == nsGkAtoms::ba || lang == nsGkAtoms::crh ||
-          lang == nsGkAtoms::tt) {
-        languageSpecificCasing = eTurkish;
-      } else if (lang == nsGkAtoms::nl) {
-        languageSpecificCasing = eDutch;
-      } else if (lang == nsGkAtoms::el) {
-        languageSpecificCasing = eGreek;
-        greekState = kStart;
-      } else {
-        languageSpecificCasing = eNone;
-      }
-    }
-
     switch (style) {
     case NS_STYLE_TEXT_TRANSFORM_LOWERCASE:
-      if (languageSpecificCasing == eTurkish) {
+      if (languageSpecificCasing == eLSCB_Turkish) {
         if (ch == 'I') {
           ch = LATIN_SMALL_LETTER_DOTLESS_I;
           prevIsLetter = true;
@@ -741,7 +345,7 @@ nsCaseTransformTextRunFactory::RebuildTextRun(nsTransformedTextRun* aTextRun,
       // need to change it to SMALL SIGMA.
       if (sigmaIndex != uint32_t(-1)) {
         if (cat == nsIUGenCategory::kLetter) {
-          convertedString.SetCharAt(GREEK_SMALL_LETTER_SIGMA, sigmaIndex);
+          aConvertedString.SetCharAt(GREEK_SMALL_LETTER_SIGMA, sigmaIndex);
         }
       }
 
@@ -751,7 +355,7 @@ nsCaseTransformTextRunFactory::RebuildTextRun(nsTransformedTextRun* aTextRun,
         // to standard SMALL SIGMA later if another letter follows
         if (prevIsLetter) {
           ch = GREEK_SMALL_LETTER_FINAL_SIGMA;
-          sigmaIndex = convertedString.Length();
+          sigmaIndex = aConvertedString.Length();
         } else {
           // CAPITAL SIGMA not preceded by a letter is unconditionally mapped
           // to SMALL SIGMA
@@ -774,7 +378,7 @@ nsCaseTransformTextRunFactory::RebuildTextRun(nsTransformedTextRun* aTextRun,
       if (mcm) {
         int j = 0;
         while (j < 2 && mcm->mMappedChars[j + 1]) {
-          convertedString.Append(mcm->mMappedChars[j]);
+          aConvertedString.Append(mcm->mMappedChars[j]);
           ++extraChars;
           ++j;
         }
@@ -786,13 +390,13 @@ nsCaseTransformTextRunFactory::RebuildTextRun(nsTransformedTextRun* aTextRun,
       break;
 
     case NS_STYLE_TEXT_TRANSFORM_UPPERCASE:
-      if (languageSpecificCasing == eTurkish && ch == 'i') {
+      if (languageSpecificCasing == eLSCB_Turkish && ch == 'i') {
         ch = LATIN_CAPITAL_LETTER_I_WITH_DOT_ABOVE;
         break;
       }
 
-      if (languageSpecificCasing == eGreek) {
-        ch = GreekUpperCase(ch, &greekState);
+      if (languageSpecificCasing == eLSCB_Greek) {
+        ch = GreekCasing::UpperCase(ch, greekState);
         break;
       }
 
@@ -800,7 +404,7 @@ nsCaseTransformTextRunFactory::RebuildTextRun(nsTransformedTextRun* aTextRun,
       if (mcm) {
         int j = 0;
         while (j < 2 && mcm->mMappedChars[j + 1]) {
-          convertedString.Append(mcm->mMappedChars[j]);
+          aConvertedString.Append(mcm->mMappedChars[j]);
           ++extraChars;
           ++j;
         }
@@ -812,36 +416,38 @@ nsCaseTransformTextRunFactory::RebuildTextRun(nsTransformedTextRun* aTextRun,
       break;
 
     case NS_STYLE_TEXT_TRANSFORM_CAPITALIZE:
-      if (capitalizeDutchIJ && ch == 'j') {
-        ch = 'J';
+      if (aTextRun) {
+        if (capitalizeDutchIJ && ch == 'j') {
+          ch = 'J';
+          capitalizeDutchIJ = false;
+          break;
+        }
         capitalizeDutchIJ = false;
-        break;
-      }
-      capitalizeDutchIJ = false;
-      if (i < aTextRun->mCapitalize.Length() && aTextRun->mCapitalize[i]) {
-        if (languageSpecificCasing == eTurkish && ch == 'i') {
-          ch = LATIN_CAPITAL_LETTER_I_WITH_DOT_ABOVE;
-          break;
-        }
-        if (languageSpecificCasing == eDutch && ch == 'i') {
-          ch = 'I';
-          capitalizeDutchIJ = true;
-          break;
-        }
-
-        mcm = mozilla::unicode::SpecialTitle(ch);
-        if (mcm) {
-          int j = 0;
-          while (j < 2 && mcm->mMappedChars[j + 1]) {
-            convertedString.Append(mcm->mMappedChars[j]);
-            ++extraChars;
-            ++j;
+        if (i < aTextRun->mCapitalize.Length() && aTextRun->mCapitalize[i]) {
+          if (languageSpecificCasing == eLSCB_Turkish && ch == 'i') {
+            ch = LATIN_CAPITAL_LETTER_I_WITH_DOT_ABOVE;
+            break;
+          }
+          if (languageSpecificCasing == eLSCB_Dutch && ch == 'i') {
+            ch = 'I';
+            capitalizeDutchIJ = true;
+            break;
           }
-          ch = mcm->mMappedChars[j];
-          break;
-        }
 
-        ch = ToTitleCase(ch);
+          mcm = mozilla::unicode::SpecialTitle(ch);
+          if (mcm) {
+            int j = 0;
+            while (j < 2 && mcm->mMappedChars[j + 1]) {
+              aConvertedString.Append(mcm->mMappedChars[j]);
+              ++extraChars;
+              ++j;
+            }
+            ch = mcm->mMappedChars[j];
+            break;
+          }
+
+          ch = ToTitleCase(ch);
+        }
       }
       break;
 
@@ -854,34 +460,61 @@ nsCaseTransformTextRunFactory::RebuildTextRun(nsTransformedTextRun* aTextRun,
     }
 
     if (ch == uint32_t(-1)) {
-      deletedCharsArray.AppendElement(true);
+      aDeletedCharsArray.AppendElement(true);
       mergeNeeded = true;
     } else {
-      deletedCharsArray.AppendElement(false);
-      charsToMergeArray.AppendElement(false);
-      styleArray.AppendElement(styleContext);
-      canBreakBeforeArray.AppendElement(aTextRun->CanBreakLineBefore(i));
+      aDeletedCharsArray.AppendElement(false);
+      aCharsToMergeArray.AppendElement(false);
+      if (aTextRun) {
+        aStyleArray->AppendElement(styleContext);
+        aCanBreakBeforeArray->AppendElement(aTextRun->CanBreakLineBefore(i));
+      }
 
       if (IS_IN_BMP(ch)) {
-        convertedString.Append(ch);
+        aConvertedString.Append(ch);
       } else {
-        convertedString.Append(H_SURROGATE(ch));
-        convertedString.Append(L_SURROGATE(ch));
+        aConvertedString.Append(H_SURROGATE(ch));
+        aConvertedString.Append(L_SURROGATE(ch));
         ++i;
-        deletedCharsArray.AppendElement(true); // not exactly deleted, but the
-                                               // trailing surrogate is skipped
+        aDeletedCharsArray.AppendElement(true); // not exactly deleted, but the
+                                                // trailing surrogate is skipped
         ++extraChars;
       }
 
       while (extraChars-- > 0) {
         mergeNeeded = true;
-        charsToMergeArray.AppendElement(true);
-        styleArray.AppendElement(styleContext);
-        canBreakBeforeArray.AppendElement(false);
+        aCharsToMergeArray.AppendElement(true);
+        if (aTextRun) {
+          aStyleArray->AppendElement(styleContext);
+          aCanBreakBeforeArray->AppendElement(false);
+        }
       }
     }
   }
 
+  return mergeNeeded;
+}
+
+void
+nsCaseTransformTextRunFactory::RebuildTextRun(nsTransformedTextRun* aTextRun,
+    gfxContext* aRefContext)
+{
+  nsAutoString convertedString;
+  nsAutoTArray<bool,50> charsToMergeArray;
+  nsAutoTArray<bool,50> deletedCharsArray;
+  nsAutoTArray<uint8_t,50> canBreakBeforeArray;
+  nsAutoTArray<nsStyleContext*,50> styleArray;
+
+  bool mergeNeeded = TransformString(aTextRun->mString,
+                                     convertedString,
+                                     mAllUppercase,
+                                     nullptr,
+                                     charsToMergeArray,
+                                     deletedCharsArray,
+                                     aTextRun,
+                                     &canBreakBeforeArray,
+                                     &styleArray);
+
   uint32_t flags;
   gfxTextRunFactory::Parameters innerParams =
       GetParametersForInner(aTextRun, &flags, aRefContext);
diff --git a/layout/generic/nsTextRunTransformations.h b/layout/generic/nsTextRunTransformations.h
index 22b80b00c6f3..844ea2244e67 100644
--- a/layout/generic/nsTextRunTransformations.h
+++ b/layout/generic/nsTextRunTransformations.h
@@ -9,9 +9,9 @@
 #include "mozilla/Attributes.h"
 #include "mozilla/MemoryReporting.h"
 #include "gfxFont.h"
+#include "nsStyleContext.h"
 
 class nsTransformedTextRun;
-class nsStyleContext;
 
 class nsTransformingTextRunFactory {
 public:
@@ -30,15 +30,6 @@ public:
   virtual void RebuildTextRun(nsTransformedTextRun* aTextRun, gfxContext* aRefContext) = 0;
 };
 
-/**
- * Builds textruns that render their text using a font-variant (i.e.,
- * smallcaps).
- */
-class nsFontVariantTextRunFactory : public nsTransformingTextRunFactory {
-public:
-  virtual void RebuildTextRun(nsTransformedTextRun* aTextRun, gfxContext* aRefContext) MOZ_OVERRIDE;
-};
-
 /**
  * Builds textruns that transform the text in some way (e.g., capitalize)
  * and then render the text using some other textrun implementation.
@@ -59,6 +50,26 @@ public:
 
   virtual void RebuildTextRun(nsTransformedTextRun* aTextRun, gfxContext* aRefContext) MOZ_OVERRIDE;
 
+  // Perform a transformation on the given string, writing the result into
+  // aConvertedString. If aAllUppercase is true, the transform is (global)
+  // upper-casing, and aLanguage is used to determine any language-specific
+  // behavior; otherwise, an nsTransformedTextRun should be passed in
+  // as aTextRun and its styles will be used to determine the transform(s)
+  // to be applied.
+  // If such an input textrun is provided, then its line-breaks and styles
+  // will be copied to the output arrays, which must also be provided by
+  // the caller. For the global upper-casing usage (no input textrun),
+  // these are ignored.
+  static bool TransformString(const nsAString& aString,
+                              nsString& aConvertedString,
+                              bool aAllUppercase,
+                              const nsIAtom* aLanguage,
+                              nsTArray<bool>& aCharsToMergeArray,
+                              nsTArray<bool>& aDeletedCharsArray,
+                              nsTransformedTextRun* aTextRun = nullptr,
+                              nsTArray<uint8_t>* aCanBreakBeforeArray = nullptr,
+                              nsTArray<nsStyleContext*>* aStyleArray = nullptr);
+
 protected:
   nsAutoPtr<nsTransformingTextRunFactory> mInnerTransformingTextRunFactory;
   bool                                    mAllUppercase;
diff --git a/layout/ipc/RenderFrameParent.cpp b/layout/ipc/RenderFrameParent.cpp
index 7e7750ceff11..febb91e75efb 100644
--- a/layout/ipc/RenderFrameParent.cpp
+++ b/layout/ipc/RenderFrameParent.cpp
@@ -931,13 +931,14 @@ RenderFrameParent::OwnerContentChanged(nsIContent* aContent)
   BuildViewMap();
 }
 
-void
+nsEventStatus
 RenderFrameParent::NotifyInputEvent(WidgetInputEvent& aEvent,
                                     ScrollableLayerGuid* aOutTargetGuid)
 {
   if (GetApzcTreeManager()) {
-    GetApzcTreeManager()->ReceiveInputEvent(aEvent, aOutTargetGuid);
+    return GetApzcTreeManager()->ReceiveInputEvent(aEvent, aOutTargetGuid);
   }
+  return nsEventStatus_eIgnore;
 }
 
 void
diff --git a/layout/ipc/RenderFrameParent.h b/layout/ipc/RenderFrameParent.h
index 3135ea4a1e2d..2d98dcc2c5b3 100644
--- a/layout/ipc/RenderFrameParent.h
+++ b/layout/ipc/RenderFrameParent.h
@@ -109,8 +109,8 @@ public:
    *        of the APZC instance that handled the event, if one was found. This
    *        argument may be null.
    */
-  void NotifyInputEvent(WidgetInputEvent& aEvent,
-                        ScrollableLayerGuid* aOutTargetGuid);
+  nsEventStatus NotifyInputEvent(WidgetInputEvent& aEvent,
+                                 ScrollableLayerGuid* aOutTargetGuid);
 
   void ZoomToRect(uint32_t aPresShellId, ViewID aViewId, const CSSRect& aRect);
 
diff --git a/layout/printing/nsPrintEngine.cpp b/layout/printing/nsPrintEngine.cpp
index 91d89cf1d4b5..d60f6296918b 100644
--- a/layout/printing/nsPrintEngine.cpp
+++ b/layout/printing/nsPrintEngine.cpp
@@ -343,9 +343,13 @@ nsPrintEngine::InstallPrintPreviewListener()
 {
   if (!mPrt->mPPEventListeners) {
     nsCOMPtr<nsIDocShell> docShell = do_QueryReferent(mContainer);
-    nsCOMPtr<nsPIDOMWindow> win(do_GetInterface(docShell));
+    if (!docShell) {
+      return;
+    }
+
+    nsCOMPtr<nsPIDOMWindow> win(docShell->GetWindow());
     if (win) {
-      nsCOMPtr<EventTarget> target = do_QueryInterface(win->GetFrameElementInternal());
+      nsCOMPtr<EventTarget> target = win->GetFrameElementInternal();
       mPrt->mPPEventListeners = new nsPrintPreviewListener(target);
       mPrt->mPPEventListeners->AddListeners();
     }
@@ -1141,8 +1145,7 @@ nsPrintEngine::IsParentAFrameSet(nsIDocShell * aParent)
   bool isFrameSet = false;
   // only check to see if there is a frameset if there is
   // NO parent doc for this doc. meaning this parent is the root doc
-  nsCOMPtr<nsIDOMDocument> domDoc = do_GetInterface(aParent);
-  nsCOMPtr<nsIDocument> doc = do_QueryInterface(domDoc);
+  nsCOMPtr<nsIDocument> doc = aParent->GetDocument();
   if (doc) {
     nsIContent *rootElement = doc->GetRootElement();
     if (rootElement) {
@@ -1392,7 +1395,8 @@ nsPrintEngine::IsThereAnIFrameSelected(nsIDocShell* aDocShell,
       if (aDOMWin) {
         // Get the main docshell's DOMWin to see if it matches 
         // the frame that is selected
-        nsCOMPtr<nsIDOMWindow> domWin = do_GetInterface(aDocShell);
+        nsCOMPtr<nsIDOMWindow> domWin =
+         aDocShell ? aDocShell->GetWindow() : nullptr;
         if (domWin != aDOMWin) {
           iFrameIsSelected = true; // we have a selected IFRAME
         }
@@ -3300,7 +3304,7 @@ nsPrintEngine::EnablePOsForPrinting()
         for (uint32_t i=0;i<mPrt->mPrintDocList.Length();i++) {
           nsPrintObject* po = mPrt->mPrintDocList.ElementAt(i);
           NS_ASSERTION(po, "nsPrintObject can't be null!");
-          nsCOMPtr<nsIDOMWindow> domWin = do_GetInterface(po->mDocShell);
+          nsCOMPtr<nsIDOMWindow> domWin = po->mDocShell->GetWindow();
           if (IsThereARangeSelection(domWin)) {
             mPrt->mCurrentFocusWin = domWin;
             SetPrintPO(po, true);
diff --git a/layout/printing/nsPrintObject.cpp b/layout/printing/nsPrintObject.cpp
index c12dab35c784..6506891db9c8 100644
--- a/layout/printing/nsPrintObject.cpp
+++ b/layout/printing/nsPrintObject.cpp
@@ -78,7 +78,7 @@ nsPrintObject::Init(nsIDocShell* aDocShell, nsIDOMDocument* aDoc,
   if (mParent) {
     nsCOMPtr<nsPIDOMWindow> window = doc->GetWindow();
     if (window) {
-      mContent = do_QueryInterface(window->GetFrameElementInternal());
+      mContent = window->GetFrameElementInternal();
     }
     mDocument = doc;
     return NS_OK;
diff --git a/layout/reftests/canvas/reftest.list b/layout/reftests/canvas/reftest.list
index 506d56d8683a..4fbbcf064dc0 100644
--- a/layout/reftests/canvas/reftest.list
+++ b/layout/reftests/canvas/reftest.list
@@ -48,6 +48,7 @@ fuzzy-if(azureSkiaGL,10,400) == text-not-in-doc-test.html text-not-in-doc-ref.ht
 skip-if(B2G) != text-font-lang.html text-font-lang-notref.html
 
 == text-measure.html text-measure-ref.html
+== text-small-caps-1.html text-small-caps-1-ref.html
 
 random-if(!d2d) != text-subpixel-1.html text-subpixel-1-ref.html
 
diff --git a/layout/reftests/canvas/text-small-caps-1-ref.html b/layout/reftests/canvas/text-small-caps-1-ref.html
new file mode 100644
index 000000000000..4464352739c9
--- /dev/null
+++ b/layout/reftests/canvas/text-small-caps-1-ref.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<style>
+</style>
+</head>
+<body>
+<canvas id="canvas1" width="400" height="400"></canvas>
+<script type="text/javascript">
+var ctx = document.getElementById('canvas1').getContext('2d');
+ctx.font = "40px arial, helvetica, roboto, droid sans, sans-serif";
+ctx.fillText("lowercase", 50, 50);
+ctx.font = "32px arial, helvetica, roboto, droid sans, sans-serif";
+ctx.fillText("SMALLCAPS", 50, 100);
+ctx.font = "40px arial, helvetica, roboto, droid sans, sans-serif";
+ctx.fillText("CAPITALS", 50, 150);
+</script>
+</body>
diff --git a/layout/reftests/canvas/text-small-caps-1.html b/layout/reftests/canvas/text-small-caps-1.html
new file mode 100644
index 000000000000..12a343c4bf41
--- /dev/null
+++ b/layout/reftests/canvas/text-small-caps-1.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<style>
+</style>
+</head>
+<body>
+<canvas id="canvas1" width="400" height="400"></canvas>
+<script type="text/javascript">
+var ctx = document.getElementById('canvas1').getContext('2d');
+ctx.font = "40px arial, helvetica, roboto, droid sans, sans-serif";
+ctx.fillText("lowercase", 50, 50);
+ctx.font = "small-caps 40px arial, helvetica, roboto, droid sans, sans-serif";
+ctx.fillText("smallcaps", 50, 100);
+ctx.font = "small-caps 40px arial, helvetica, roboto, droid sans, sans-serif";
+ctx.fillText("CAPITALS", 50, 150);
+</script>
+</body>
diff --git a/layout/reftests/font-face/color-1-notref.html b/layout/reftests/font-face/color-1-notref.html
new file mode 100644
index 000000000000..85a9e74df548
--- /dev/null
+++ b/layout/reftests/font-face/color-1-notref.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8"/>
+<style>
+@font-face {
+  font-family: emoji;
+  src: url("../fonts/emoji.ttf");
+}
+
+span {
+  font-family: emoji;
+  font-size: 25pt;
+}
+</style>
+</head>
+<body>
+<span>&#xe000;</span>
+</body>
+</html>
diff --git a/layout/reftests/font-face/color-1-ref.html b/layout/reftests/font-face/color-1-ref.html
new file mode 100644
index 000000000000..6c3eaf44b846
--- /dev/null
+++ b/layout/reftests/font-face/color-1-ref.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8"/>
+<style>
+@font-face {
+  font-family: emoji;
+  src: url("../fonts/emoji.ttf");
+}
+
+span {
+  font-family: emoji;
+  font-size: 25pt;
+  color: yellow;
+}
+</style>
+</head>
+<body>
+<span>&#xe000;</span>
+</body>
+</html>
diff --git a/layout/reftests/font-face/color-1a.html b/layout/reftests/font-face/color-1a.html
new file mode 100644
index 000000000000..28b4034a5725
--- /dev/null
+++ b/layout/reftests/font-face/color-1a.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8"/>
+<style>
+@font-face {
+  font-family: emojiyellow;
+  src: url("../fonts/emoji-yellow.ttf");
+}
+
+span {
+  font-family: emojiyellow;
+  font-size: 25pt;
+}
+</style>
+</head>
+<body>
+<span>&#xe000;</span>
+</body>
+</html>
diff --git a/layout/reftests/font-face/color-1b.html b/layout/reftests/font-face/color-1b.html
new file mode 100644
index 000000000000..8e2eefd2c98e
--- /dev/null
+++ b/layout/reftests/font-face/color-1b.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8"/>
+<style>
+@font-face {
+  font-family: emojiyellow;
+  src: url("../fonts/emoji-yellow.ttf");
+}
+
+span {
+  font-family: emojiyellow;
+  font-size: 25pt;
+  color: red;
+}
+</style>
+</head>
+<body>
+<span>&#xe000;</span>
+</body>
+</html>
diff --git a/layout/reftests/font-face/reftest.list b/layout/reftests/font-face/reftest.list
index 2148bac4a7a8..39885d068625 100644
--- a/layout/reftests/font-face/reftest.list
+++ b/layout/reftests/font-face/reftest.list
@@ -158,3 +158,8 @@ HTTP(..) == font-redirect.html order-1-ref.html
 == dynamic-duplicate-rule-1a.html dynamic-duplicate-rule-1-ref.html
 == dynamic-duplicate-rule-1b.html dynamic-duplicate-rule-1-ref.html
 == dynamic-duplicate-rule-1c.html dynamic-duplicate-rule-1-ref.html
+
+# Test for COLR and CPAL support
+HTTP(..) == color-1a.html color-1-ref.html
+HTTP(..) != color-1a.html color-1-notref.html
+HTTP(..) == color-1b.html color-1-ref.html
diff --git a/layout/reftests/fonts/emoji-yellow.ttf b/layout/reftests/fonts/emoji-yellow.ttf
new file mode 100644
index 000000000000..9feeb86c01b5
Binary files /dev/null and b/layout/reftests/fonts/emoji-yellow.ttf differ
diff --git a/layout/reftests/fonts/emoji.ttf b/layout/reftests/fonts/emoji.ttf
new file mode 100644
index 000000000000..0444270c931f
Binary files /dev/null and b/layout/reftests/fonts/emoji.ttf differ
diff --git a/layout/reftests/xul/reftest.list b/layout/reftests/xul/reftest.list
index fbb05108459b..698f1ee3b9ee 100644
--- a/layout/reftests/xul/reftest.list
+++ b/layout/reftests/xul/reftest.list
@@ -7,3 +7,4 @@ skip-if(B2G&&browserIsRemote) == textbox-overflow-1.xul textbox-overflow-1-ref.x
 skip-if(cocoaWidget) skip-if(B2G&&browserIsRemote) == accesskey.xul accesskey-ref.xul
 fails-if(cocoaWidget) skip-if(B2G&&browserIsRemote) == tree-row-outline-1.xul tree-row-outline-1-ref.xul
 skip-if(B2G&&browserIsRemote) != tree-row-outline-1.xul tree-row-outline-1-notref.xul
+skip-if(B2G&&browserIsRemote) == text-small-caps-1.xul text-small-caps-1-ref.xul
diff --git a/layout/reftests/xul/text-small-caps-1-ref.xul b/layout/reftests/xul/text-small-caps-1-ref.xul
new file mode 100644
index 000000000000..12b66928d2fd
--- /dev/null
+++ b/layout/reftests/xul/text-small-caps-1-ref.xul
@@ -0,0 +1,8 @@
+<?xml version="1.0"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" align="left">
+<hbox style="font: 40px arial, helvetica, roboto, droid sans, sans-serif;" align="baseline">
+  <label value="lowercase"/>
+  <label value="SMALLCAPS" style="font-size: 32px;"/>
+  <label value="CAPITALS"/>
+</hbox>
+</window>
diff --git a/layout/reftests/xul/text-small-caps-1.xul b/layout/reftests/xul/text-small-caps-1.xul
new file mode 100644
index 000000000000..9db9dd77da58
--- /dev/null
+++ b/layout/reftests/xul/text-small-caps-1.xul
@@ -0,0 +1,8 @@
+<?xml version="1.0"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" align="left">
+<hbox style="font: 40px arial, helvetica, roboto, droid sans, sans-serif;">
+  <label value="lowercase" style="font-variant: normal;"/>
+  <label value="smallcaps" style="font-variant: small-caps;"/>
+  <label value="CAPITALS" style="font-variant: small-caps;"/>
+</hbox>
+</window>
diff --git a/layout/style/nsComputedDOMStyle.cpp b/layout/style/nsComputedDOMStyle.cpp
index 24e2bee3a036..90150200d50a 100644
--- a/layout/style/nsComputedDOMStyle.cpp
+++ b/layout/style/nsComputedDOMStyle.cpp
@@ -2292,7 +2292,7 @@ nsComputedDOMStyle::GetGridLineNames(const nsTArray<nsString>& aLineNames)
   nsROCSSPrimitiveValue *val = new nsROCSSPrimitiveValue;
   nsAutoString lineNamesString;
   uint32_t i_end = aLineNames.Length();
-  lineNamesString.AssignLiteral("(");
+  lineNamesString.Assign('(');
   if (i_end > 0) {
     for (uint32_t i = 0;;) {
       nsStyleUtil::AppendEscapedCSSIdent(aLineNames[i], lineNamesString);
diff --git a/layout/style/nsROCSSPrimitiveValue.cpp b/layout/style/nsROCSSPrimitiveValue.cpp
index c5c23d3d1477..e17f11d26f16 100644
--- a/layout/style/nsROCSSPrimitiveValue.cpp
+++ b/layout/style/nsROCSSPrimitiveValue.cpp
@@ -113,7 +113,7 @@ nsROCSSPrimitiveValue::GetCssText(nsAString& aCssText)
           // 'about:invalid' as the default value for url attributes,
           // so let's also use it here as the default computed value
           // for invalid URLs.
-          tmpStr.AssignLiteral("url(about:invalid)");
+          tmpStr.AssignLiteral(MOZ_UTF16("url(about:invalid)"));
         }
         break;
       }
diff --git a/layout/svg/nsSVGOuterSVGFrame.cpp b/layout/svg/nsSVGOuterSVGFrame.cpp
index 3b346e8d0125..77ca8da20926 100644
--- a/layout/svg/nsSVGOuterSVGFrame.cpp
+++ b/layout/svg/nsSVGOuterSVGFrame.cpp
@@ -851,8 +851,12 @@ nsSVGOuterSVGFrame::IsRootOfReplacedElementSubDoc(nsIFrame **aEmbeddingFrame)
 {
   if (!mContent->GetParent()) {
     // Our content is the document element
-    nsCOMPtr<nsISupports> container = PresContext()->GetContainerWeak();
-    nsCOMPtr<nsIDOMWindow> window = do_GetInterface(container);
+    nsCOMPtr<nsIDocShell> docShell = PresContext()->GetDocShell();
+    nsCOMPtr<nsIDOMWindow> window;
+    if (docShell) {
+      window = docShell->GetWindow();
+    }
+
     if (window) {
       nsCOMPtr<nsIDOMElement> frameElement;
       window->GetFrameElement(getter_AddRefs(frameElement));
diff --git a/layout/xul/nsXULPopupManager.cpp b/layout/xul/nsXULPopupManager.cpp
index 2990b4dead41..8a55d5afefa8 100644
--- a/layout/xul/nsXULPopupManager.cpp
+++ b/layout/xul/nsXULPopupManager.cpp
@@ -1572,7 +1572,11 @@ nsXULPopupManager::MayShowPopup(nsMenuPopupFrame* aPopup)
     // only allow popups in active windows
     nsCOMPtr<nsIDocShellTreeItem> root;
     dsti->GetRootTreeItem(getter_AddRefs(root));
-    nsCOMPtr<nsIDOMWindow> rootWin = do_GetInterface(root);
+    if (!root) {
+      return false;
+    }
+
+    nsCOMPtr<nsIDOMWindow> rootWin = root->GetWindow();
 
     nsIFocusManager* fm = nsFocusManager::GetFocusManager();
     if (!fm || !rootWin)
diff --git a/modules/libpref/src/init/all.js b/modules/libpref/src/init/all.js
index 2a90283f7a0d..0de624fc2bd1 100644
--- a/modules/libpref/src/init/all.js
+++ b/modules/libpref/src/init/all.js
@@ -780,7 +780,7 @@ pref("dom.webapps.useCurrentProfile", false);
 
 pref("dom.cycle_collector.incremental", true);
 
-pref("dom.window_experimental_bindings", false);
+pref("dom.window_experimental_bindings", true);
 
 // Parsing perf prefs. For now just mimic what the old code did.
 #ifndef XP_WIN
diff --git a/netwerk/base/src/Dashboard.cpp b/netwerk/base/src/Dashboard.cpp
index fae996e5ceea..ac1d04599a4d 100644
--- a/netwerk/base/src/Dashboard.cpp
+++ b/netwerk/base/src/Dashboard.cpp
@@ -191,7 +191,7 @@ ConnectionData::Notify(nsITimer *aTimer)
 
     mTimer = nullptr;
 
-    mStatus.AssignLiteral("NS_ERROR_NET_TIMEOUT");
+    mStatus.AssignLiteral(MOZ_UTF16("NS_ERROR_NET_TIMEOUT"));
     nsCOMPtr<nsIRunnable> event =
         NS_NewRunnableMethodWithArg<nsRefPtr<ConnectionData> >
         (mDashboard, &Dashboard::GetConnectionStatus, this);
@@ -754,19 +754,19 @@ HttpConnInfo::SetHTTP1ProtocolVersion(uint8_t pv)
 {
     switch (pv) {
     case NS_HTTP_VERSION_0_9:
-        protocolVersion.AssignLiteral("http/0.9");
+        protocolVersion.AssignLiteral(MOZ_UTF16("http/0.9"));
         break;
     case NS_HTTP_VERSION_1_0:
-        protocolVersion.AssignLiteral("http/1.0");
+        protocolVersion.AssignLiteral(MOZ_UTF16("http/1.0"));
         break;
     case NS_HTTP_VERSION_1_1:
-        protocolVersion.AssignLiteral("http/1.1");
+        protocolVersion.AssignLiteral(MOZ_UTF16("http/1.1"));
         break;
     case NS_HTTP_VERSION_2_0:
-        protocolVersion.AssignLiteral("http/2.0");
+        protocolVersion.AssignLiteral(MOZ_UTF16("http/2.0"));
         break;
     default:
-        protocolVersion.AssignLiteral("unknown protocol version");
+        protocolVersion.AssignLiteral(MOZ_UTF16("unknown protocol version"));
     }
 }
 
@@ -774,9 +774,9 @@ void
 HttpConnInfo::SetHTTP2ProtocolVersion(uint8_t pv)
 {
     if (pv == SPDY_VERSION_3) {
-        protocolVersion.AssignLiteral("spdy/3");
+        protocolVersion.AssignLiteral(MOZ_UTF16("spdy/3"));
     } else if (pv == SPDY_VERSION_31) {
-        protocolVersion.AssignLiteral("spdy/3.1");
+        protocolVersion.AssignLiteral(MOZ_UTF16("spdy/3.1"));
     } else {
         MOZ_ASSERT (pv == NS_HTTP2_DRAFT_VERSION);
         protocolVersion.Assign(NS_LITERAL_STRING(NS_HTTP2_DRAFT_TOKEN));
diff --git a/netwerk/cache2/CacheFileIOManager.cpp b/netwerk/cache2/CacheFileIOManager.cpp
index f614b02a9ef0..41fd9b43ef08 100644
--- a/netwerk/cache2/CacheFileIOManager.cpp
+++ b/netwerk/cache2/CacheFileIOManager.cpp
@@ -3298,7 +3298,7 @@ CacheFileIOManager::CreateFile(CacheFileHandle *aHandle)
 void
 CacheFileIOManager::HashToStr(const SHA1Sum::Hash *aHash, nsACString &_retval)
 {
-  _retval.AssignLiteral("");
+  _retval.Truncate();
   const char hexChars[] = {'0', '1', '2', '3', '4', '5', '6', '7',
                            '8', '9', 'A', 'B', 'C', 'D', 'E', 'F'};
   for (uint32_t i=0 ; i<sizeof(SHA1Sum::Hash) ; i++) {
diff --git a/netwerk/protocol/http/Http2Stream.cpp b/netwerk/protocol/http/Http2Stream.cpp
index 2f9b8364ba39..43bc1e30c371 100644
--- a/netwerk/protocol/http/Http2Stream.cpp
+++ b/netwerk/protocol/http/Http2Stream.cpp
@@ -386,7 +386,7 @@ Http2Stream::ParseHttpRequestHeaders(const char *buf,
       return NS_ERROR_UNEXPECTED;
     }
     authorityHeader = ci->GetHost();
-    authorityHeader.AppendLiteral(":");
+    authorityHeader.Append(':');
     authorityHeader.AppendInt(ci->Port());
   }
 
diff --git a/netwerk/protocol/http/SpdyStream3.cpp b/netwerk/protocol/http/SpdyStream3.cpp
index be9c5abb59c2..efc2b3e06668 100644
--- a/netwerk/protocol/http/SpdyStream3.cpp
+++ b/netwerk/protocol/http/SpdyStream3.cpp
@@ -492,7 +492,7 @@ SpdyStream3::ParseHttpRequestHeaders(const char *buf,
     }
     nsAutoCString route;
     route = ci->GetHost();
-    route.AppendLiteral(":");
+    route.Append(':');
     route.AppendInt(ci->Port());
     CompressToFrame(route);
   }
diff --git a/netwerk/protocol/http/SpdyStream31.cpp b/netwerk/protocol/http/SpdyStream31.cpp
index c1a3601f4dab..f8a32c8f2943 100644
--- a/netwerk/protocol/http/SpdyStream31.cpp
+++ b/netwerk/protocol/http/SpdyStream31.cpp
@@ -498,7 +498,7 @@ SpdyStream31::ParseHttpRequestHeaders(const char *buf,
     }
     nsAutoCString route;
     route = ci->GetHost();
-    route.AppendLiteral(":");
+    route.Append(':');
     route.AppendInt(ci->Port());
     CompressToFrame(route);
   }
diff --git a/parser/htmlparser/src/nsParser.cpp b/parser/htmlparser/src/nsParser.cpp
index d0b162f7dcda..6e88d8631c57 100644
--- a/parser/htmlparser/src/nsParser.cpp
+++ b/parser/htmlparser/src/nsParser.cpp
@@ -1336,7 +1336,7 @@ nsParser::ParseFragment(const nsAString& aSourceBuffer,
   if (theCount == 0) {
     // Ensure that the buffer is not empty. Because none of the DTDs care
     // about leading whitespace, this doesn't change the result.
-    theContext.AssignLiteral(" ");
+    theContext.Assign(' ');
   }
 
   // First, parse the context to build up the DTD's tag stack. Note that we
diff --git a/rdf/base/src/rdfTriplesSerializer.cpp b/rdf/base/src/rdfTriplesSerializer.cpp
index 43a1d8e5e7a5..ff899afdc8bc 100644
--- a/rdf/base/src/rdfTriplesSerializer.cpp
+++ b/rdf/base/src/rdfTriplesSerializer.cpp
@@ -77,7 +77,7 @@ TriplesVisitor::Visit(nsIRDFNode *aSubject, nsIRDFResource *aPredicate,
         const char16_t *value;
         lit->GetValueConst(&value);
         nsAutoCString object;
-        object.AppendLiteral("\"");
+        object.Append('"');
         AppendUTF16toUTF8(value, object);
         object.AppendLiteral("\" ");
         uint32_t writeCount = object.Length();
diff --git a/security/manager/ssl/src/ScopedNSSTypes.h b/security/manager/ssl/src/ScopedNSSTypes.h
index 638b4a21ad18..779b2c96c06f 100644
--- a/security/manager/ssl/src/ScopedNSSTypes.h
+++ b/security/manager/ssl/src/ScopedNSSTypes.h
@@ -16,6 +16,7 @@
 #include "cert.h"
 #include "cms.h"
 #include "keyhi.h"
+#include "cryptohi.h"
 #include "pk11pub.h"
 #include "sechash.h"
 #include "secpkcs7.h"
@@ -120,11 +121,27 @@ PK11_DestroyContext_true(PK11Context * ctx) {
   PK11_DestroyContext(ctx, true);
 }
 
+inline void
+SGN_DestroyContext_true(SGNContext* ctx) {
+  SGN_DestroyContext(ctx, true);
+}
+
+inline void
+VFY_DestroyContext_true(VFYContext * ctx) {
+  VFY_DestroyContext(ctx, true);
+}
+
 } // namespace mozilla::psm
 
 MOZ_TYPE_SPECIFIC_SCOPED_POINTER_TEMPLATE(ScopedPK11Context,
                                           PK11Context,
                                           mozilla::psm::PK11_DestroyContext_true)
+MOZ_TYPE_SPECIFIC_SCOPED_POINTER_TEMPLATE(ScopedSGNContext,
+                                          SGNContext,
+                                          mozilla::psm::SGN_DestroyContext_true)
+MOZ_TYPE_SPECIFIC_SCOPED_POINTER_TEMPLATE(ScopedVFYContext,
+                                          VFYContext,
+                                          mozilla::psm::VFY_DestroyContext_true)
 
 /** A more convenient way of dealing with digests calculated into
  *  stack-allocated buffers. NSS must be initialized on the main thread before
diff --git a/testing/mochitest/android23.json b/testing/mochitest/android23.json
index 220ef9142e17..d4f4f371bbc1 100644
--- a/testing/mochitest/android23.json
+++ b/testing/mochitest/android23.json
@@ -3,14 +3,8 @@
 "excludetests": {
   "robocop": "TIMED_OUT",
   "content/canvas/test/webgl-conformance": "bug 865443 - separate suite -- mochitest-gl",
-  "content/canvas/test/webgl-mochitest/test_no_arr_points.html": "Android 2.3 only; bug 975487",
-  "content/html/content/test/test_ignoreuserfocus.html": "Android 2.3 only; bug 981895",
   "content/media/test": "Android 2.3 only; bug 981898",
   "content/media/webaudio/test": "Android 2.3 only; bug 981889",
-  "content/media/webspeech": "Android 2.3 only; bug 981886",
-  "dom/media/tests/mochitest":"Android 2.3 only; bug 981881",
-  "image/test/mochitest/test_bug512435.html":"Android 2.3 only; bug 910533",
-  "image/test/mochitest/test_bug767779.html":"Android 2.3 only; bug 943367",
-  "layout/style/test/test_media_queries.html": "Android 2.3 only; bug 981881"
+  "dom/media/tests/mochitest":"Android 2.3 only; bug 981881"
   }
 }
diff --git a/testing/mozbase/mozdevice/setup.py b/testing/mozbase/mozdevice/setup.py
index 751285652508..9a6c791634ef 100644
--- a/testing/mozbase/mozdevice/setup.py
+++ b/testing/mozbase/mozdevice/setup.py
@@ -5,7 +5,7 @@
 from setuptools import setup
 
 PACKAGE_NAME = 'mozdevice'
-PACKAGE_VERSION = '0.34'
+PACKAGE_VERSION = '0.35'
 
 deps = ['mozfile >= 1.0',
         'mozlog',
diff --git a/toolkit/components/satchel/nsFormFillController.cpp b/toolkit/components/satchel/nsFormFillController.cpp
index cafdbb2a6357..d753959acc7e 100644
--- a/toolkit/components/satchel/nsFormFillController.cpp
+++ b/toolkit/components/satchel/nsFormFillController.cpp
@@ -1148,14 +1148,13 @@ nsFormFillController::StopControllingInput()
 nsIDocShell *
 nsFormFillController::GetDocShellForInput(nsIDOMHTMLInputElement *aInput)
 {
-  nsCOMPtr<nsIDOMDocument> domDoc;
-  nsCOMPtr<nsIDOMElement> element = do_QueryInterface(aInput);
-  element->GetOwnerDocument(getter_AddRefs(domDoc));
-  nsCOMPtr<nsIDocument> doc = do_QueryInterface(domDoc);
-  NS_ENSURE_TRUE(doc, nullptr);
-  nsCOMPtr<nsIWebNavigation> webNav = do_GetInterface(doc->GetWindow());
-  nsCOMPtr<nsIDocShell> docShell = do_QueryInterface(webNav);
-  return docShell;
+  nsCOMPtr<nsINode> node = do_QueryInterface(aInput);
+  NS_ENSURE_TRUE(node, nullptr);
+
+  nsCOMPtr<nsPIDOMWindow> win = node->OwnerDoc()->GetWindow();
+  NS_ENSURE_TRUE(win, nullptr);
+
+  return win->GetDocShell();
 }
 
 nsIDOMWindow *
diff --git a/toolkit/crashreporter/nsExceptionHandler.cpp b/toolkit/crashreporter/nsExceptionHandler.cpp
index 34e539827c39..e3f3254636e7 100644
--- a/toolkit/crashreporter/nsExceptionHandler.cpp
+++ b/toolkit/crashreporter/nsExceptionHandler.cpp
@@ -1905,7 +1905,7 @@ static nsresult PrefSubmitReports(bool* aSubmitReports, bool writePref)
     regKey->Create(nsIWindowsRegKey::ROOT_KEY_CURRENT_USER,
                    NS_ConvertUTF8toUTF16(regPath),
                    nsIWindowsRegKey::ACCESS_SET_VALUE);
-    regPath.AppendLiteral("\\");
+    regPath.Append('\\');
   }
 
   // Create appName key
@@ -1913,7 +1913,7 @@ static nsresult PrefSubmitReports(bool* aSubmitReports, bool writePref)
   regKey->Create(nsIWindowsRegKey::ROOT_KEY_CURRENT_USER,
                  NS_ConvertUTF8toUTF16(regPath),
                  nsIWindowsRegKey::ACCESS_SET_VALUE);
-  regPath.AppendLiteral("\\");
+  regPath.Append('\\');
 
   // Create Crash Reporter key
   regPath.AppendLiteral("Crash Reporter");
diff --git a/toolkit/mozapps/downloads/content/downloads.xul b/toolkit/mozapps/downloads/content/downloads.xul
index fffd8ee4259d..5ca9eec2d428 100644
--- a/toolkit/mozapps/downloads/content/downloads.xul
+++ b/toolkit/mozapps/downloads/content/downloads.xul
@@ -25,7 +25,7 @@
 <window xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
         xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
         id="downloadManager" windowtype="Download:Manager"
-        orient="vertical" title="&downloads.title;"
+        orient="vertical" title="&downloads.title;" statictitle="&downloads.title;"
         width="&window.width2;" height="&window.height;" screenX="10" screenY="10"
         persist="width height screenX screenY sizemode"
         onload="Startup();" onunload="Shutdown();"
diff --git a/toolkit/mozapps/extensions/amInstallTrigger.js b/toolkit/mozapps/extensions/amInstallTrigger.js
index ff529b6b5879..7e7cef002a30 100644
--- a/toolkit/mozapps/extensions/amInstallTrigger.js
+++ b/toolkit/mozapps/extensions/amInstallTrigger.js
@@ -137,7 +137,8 @@ InstallTrigger.prototype = {
       let item = installs[name];
       if (typeof item === "string") {
         item = { URL: item };
-      } else if (!("URL" in item) || !item.URL) {
+      }
+      if (!item.URL) {
         throw new this._window.DOMError("Error", "Missing URL property for '" + name + "'");
       }
 
@@ -147,20 +148,15 @@ InstallTrigger.prototype = {
       }
 
       let iconUrl = null;
-      if ("IconURL" in item && typeof item.IconURL == "string" && item.IconURL) {
+      if (item.IconURL) {
         iconUrl = this._resolveURL(item.IconURL);
         if (!this._checkLoadURIFromScript(iconUrl)) {
           iconUrl = null; // If page can't load the icon, just ignore it
         }
       }
 
-      let hash = null;
-      if ("Hash" in item && typeof item.Hash === "string" && item.Hash) {
-        hash = item.Hash;
-      }
-
       installData.uris.push(url.spec);
-      installData.hashes.push(hash);
+      installData.hashes.push(item.Hash || null);
       installData.names.push(name);
       installData.icons.push(iconUrl ? iconUrl.spec : null);
     }
diff --git a/toolkit/xre/nsNativeAppSupportWin.cpp b/toolkit/xre/nsNativeAppSupportWin.cpp
index 7111fbaf8ba3..c65f30fd5cf0 100644
--- a/toolkit/xre/nsNativeAppSupportWin.cpp
+++ b/toolkit/xre/nsNativeAppSupportWin.cpp
@@ -1484,7 +1484,8 @@ nsNativeAppSupportWin::OpenBrowserWindow()
           if ( navItem ) {
             nsCOMPtr<nsIDocShellTreeItem> rootItem;
             navItem->GetRootTreeItem( getter_AddRefs( rootItem ) );
-            nsCOMPtr<nsIDOMWindow> rootWin( do_GetInterface( rootItem ) );
+            nsCOMPtr<nsIDOMWindow> rootWin =
+              rootItem ? rootItem->GetWindow() : nullptr;
             nsCOMPtr<nsIDOMChromeWindow> chromeWin(do_QueryInterface(rootWin));
             if ( chromeWin )
               chromeWin->GetBrowserDOMWindow( getter_AddRefs ( bwin ) );
diff --git a/toolkit/xre/nsXREDirProvider.cpp b/toolkit/xre/nsXREDirProvider.cpp
index 8a509efa450c..c7b1fa0d87b8 100644
--- a/toolkit/xre/nsXREDirProvider.cpp
+++ b/toolkit/xre/nsXREDirProvider.cpp
@@ -1071,7 +1071,7 @@ nsXREDirProvider::GetUpdateRootDir(nsIFile* *aResult)
   rv = GetShellFolderPath(CSIDL_PROGRAM_FILES, programFiles);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  programFiles.AppendLiteral("\\");
+  programFiles.Append('\\');
   uint32_t programFilesLen = programFiles.Length();
 
   nsAutoString programName;
diff --git a/tools/profiler/BreakpadSampler.cpp b/tools/profiler/BreakpadSampler.cpp
index f5067d09a641..a188cc3de7d1 100644
--- a/tools/profiler/BreakpadSampler.cpp
+++ b/tools/profiler/BreakpadSampler.cpp
@@ -97,7 +97,7 @@ void genProfileEntry(/*MODIFIED*/UnwinderThreadBuffer* utb,
       // Cast to *((void**) to pass the text data to a void*
       utb__addEntry( utb, ProfileEntry('d', *((void**)(&text[0]))) );
     }
-    if (entry.isJs()) {
+    if (entry.js()) {
       if (!entry.pc()) {
         // The JIT only allows the top-most entry to have a nullptr pc
         MOZ_ASSERT(&entry == &stack->mStack[stack->stackSize() - 1]);
@@ -227,7 +227,7 @@ void populateBuffer(UnwinderThreadBuffer* utb, TickSample* sample,
       MOZ_CRASH();
   }
 
-  if (recordSample) {
+  if (recordSample) {    
     // add a "flush now" hint
     utb__addEntry( utb, ProfileEntry('h'/*hint*/, 'F'/*flush*/) );
   }
diff --git a/tools/profiler/PseudoStack.h b/tools/profiler/PseudoStack.h
index b7be0df44b1a..5c7ec5507431 100644
--- a/tools/profiler/PseudoStack.h
+++ b/tools/profiler/PseudoStack.h
@@ -85,6 +85,26 @@ static inline uint32_t sMin(uint32_t l, uint32_t r) {
 // of the two representations are consistent.
 class StackEntry : public js::ProfileEntry
 {
+public:
+
+  bool isCopyLabel() const volatile {
+    return !((uintptr_t)stackAddress() & 0x1);
+  }
+
+  void setStackAddressCopy(void *sparg, bool copy) volatile {
+    // Tagged pointer. Less significant bit used to track if mLabel needs a
+    // copy. Note that we don't need the last bit of the stack address for
+    // proper ordering. This is optimized for encoding within the JS engine's
+    // instrumentation, so we do the extra work here of encoding a bit.
+    // Last bit 1 = Don't copy, Last bit 0 = Copy.
+    if (copy) {
+      setStackAddress(reinterpret_cast<void*>(
+                        reinterpret_cast<uintptr_t>(sparg) & ~NoCopyBit));
+    } else {
+      setStackAddress(reinterpret_cast<void*>(
+                        reinterpret_cast<uintptr_t>(sparg) | NoCopyBit));
+    }
+  }
 };
 
 class ProfilerMarkerPayload;
@@ -343,25 +363,23 @@ public:
     return mPendingMarkers.getPendingMarkers();
   }
 
-  void push(const char *aName, void *aStackAddress, uint32_t line, bool aCopy)
+  void push(const char *aName, uint32_t line)
+  {
+    push(aName, nullptr, false, line);
+  }
+
+  void push(const char *aName, void *aStackAddress, bool aCopy, uint32_t line)
   {
     if (size_t(mStackPointer) >= mozilla::ArrayLength(mStack)) {
       mStackPointer++;
       return;
     }
 
-    volatile StackEntry &entry = mStack[mStackPointer];
-
     // Make sure we increment the pointer after the name has
     // been written such that mStack is always consistent.
-    entry.setLabel(aName);
-    entry.setCppFrame(aStackAddress, line);
-
-    // Track if mLabel needs a copy.
-    if (aCopy)
-      entry.setFlag(js::ProfileEntry::FRAME_LABEL_COPY);
-    else
-      entry.unsetFlag(js::ProfileEntry::FRAME_LABEL_COPY);
+    mStack[mStackPointer].setLabel(aName);
+    mStack[mStackPointer].setStackAddressCopy(aStackAddress, aCopy);
+    mStack[mStackPointer].setLine(line);
 
     // Prevent the optimizer from re-ordering these instructions
     STORE_SEQUENCER();
diff --git a/tools/profiler/TableTicker.cpp b/tools/profiler/TableTicker.cpp
index ca6c73801db6..b7bd032ed8bf 100644
--- a/tools/profiler/TableTicker.cpp
+++ b/tools/profiler/TableTicker.cpp
@@ -347,7 +347,7 @@ void addProfileEntry(volatile StackEntry &entry, ThreadProfile &aProfile,
     // that will happen to the preceding tag
 
     addDynamicTag(aProfile, 'c', sampleLabel);
-    if (entry.isJs()) {
+    if (entry.js()) {
       if (!entry.pc()) {
         // The JIT only allows the top-most entry to have a nullptr pc
         MOZ_ASSERT(&entry == &stack->mStack[stack->stackSize() - 1]);
@@ -367,12 +367,7 @@ void addProfileEntry(volatile StackEntry &entry, ThreadProfile &aProfile,
     }
   } else {
     aProfile.addTag(ProfileEntry('c', sampleLabel));
-
-    // XXX: Bug 1010578. Don't assume a CPP entry and try to get the
-    // line for js entries as well.
-    if (entry.isCpp()) {
-      lineno = entry.line();
-    }
+    lineno = entry.line();
   }
   if (lineno != -1) {
     aProfile.addTag(ProfileEntry('n', lineno));
@@ -512,7 +507,7 @@ void TableTicker::doNativeBacktrace(ThreadProfile &aProfile, TickSample* aSample
     // The pseudostack grows towards higher indices, so we iterate
     // backwards (from callee to caller).
     volatile StackEntry &entry = pseudoStack->mStack[i - 1];
-    if (!entry.isJs() && strcmp(entry.label(), "EnterJIT") == 0) {
+    if (!entry.js() && strcmp(entry.label(), "EnterJIT") == 0) {
       // Found JIT entry frame.  Unwind up to that point (i.e., force
       // the stack walk to stop before the block of saved registers;
       // note that it yields nondecreasing stack pointers), then restore
diff --git a/uriloader/exthandler/android/nsMIMEInfoAndroid.cpp b/uriloader/exthandler/android/nsMIMEInfoAndroid.cpp
index 33ff69dc4c21..68466daf2f32 100644
--- a/uriloader/exthandler/android/nsMIMEInfoAndroid.cpp
+++ b/uriloader/exthandler/android/nsMIMEInfoAndroid.cpp
@@ -382,7 +382,7 @@ NS_IMPL_ISUPPORTS(nsMIMEInfoAndroid::SystemChooser, nsIHandlerApp)
 
 
 nsresult nsMIMEInfoAndroid::SystemChooser::GetName(nsAString & aName) {
-  aName.AssignLiteral("Android chooser");
+  aName.AssignLiteral(MOZ_UTF16("Android chooser"));
   return NS_OK;
 }
 
@@ -393,7 +393,7 @@ nsMIMEInfoAndroid::SystemChooser::SetName(const nsAString&) {
 
 nsresult
 nsMIMEInfoAndroid::SystemChooser::GetDetailedDescription(nsAString & aDesc) {
-  aDesc.AssignLiteral("Android's default handler application chooser");
+  aDesc.AssignLiteral(MOZ_UTF16("Android's default handler application chooser"));
   return NS_OK;
 }
 
diff --git a/widget/android/GfxInfo.cpp b/widget/android/GfxInfo.cpp
index fb4e26ceb483..2a9e3ee43727 100644
--- a/widget/android/GfxInfo.cpp
+++ b/widget/android/GfxInfo.cpp
@@ -223,7 +223,7 @@ NS_IMETHODIMP
 GfxInfo::GetAdapterRAM(nsAString & aAdapterRAM)
 {
   EnsureInitialized();
-  aAdapterRAM.AssignLiteral("");
+  aAdapterRAM.Truncate();
   return NS_OK;
 }
 
@@ -240,7 +240,7 @@ NS_IMETHODIMP
 GfxInfo::GetAdapterDriver(nsAString & aAdapterDriver)
 {
   EnsureInitialized();
-  aAdapterDriver.AssignLiteral("");
+  aAdapterDriver.Truncate();
   return NS_OK;
 }
 
@@ -274,7 +274,7 @@ NS_IMETHODIMP
 GfxInfo::GetAdapterDriverDate(nsAString & aAdapterDriverDate)
 {
   EnsureInitialized();
-  aAdapterDriverDate.AssignLiteral("");
+  aAdapterDriverDate.Truncate();
   return NS_OK;
 }
 
diff --git a/widget/gonk/GfxInfo.cpp b/widget/gonk/GfxInfo.cpp
index 719f0aedd0b5..f5018c2accca 100644
--- a/widget/gonk/GfxInfo.cpp
+++ b/widget/gonk/GfxInfo.cpp
@@ -39,7 +39,7 @@ GfxInfo::GetCleartypeParameters(nsAString & aCleartypeParams)
 NS_IMETHODIMP
 GfxInfo::GetAdapterDescription(nsAString & aAdapterDescription)
 {
-  aAdapterDescription.AssignLiteral("");
+  aAdapterDescription.Truncate();
   return NS_OK;
 }
 
@@ -54,7 +54,7 @@ GfxInfo::GetAdapterDescription2(nsAString & aAdapterDescription)
 NS_IMETHODIMP
 GfxInfo::GetAdapterRAM(nsAString & aAdapterRAM)
 {
-  aAdapterRAM.AssignLiteral("");
+  aAdapterRAM.Truncate();
   return NS_OK;
 }
 
@@ -69,7 +69,7 @@ GfxInfo::GetAdapterRAM2(nsAString & aAdapterRAM)
 NS_IMETHODIMP
 GfxInfo::GetAdapterDriver(nsAString & aAdapterDriver)
 {
-  aAdapterDriver.AssignLiteral("");
+  aAdapterDriver.Truncate();
   return NS_OK;
 }
 
@@ -84,7 +84,7 @@ GfxInfo::GetAdapterDriver2(nsAString & aAdapterDriver)
 NS_IMETHODIMP
 GfxInfo::GetAdapterDriverVersion(nsAString & aAdapterDriverVersion)
 {
-  aAdapterDriverVersion.AssignLiteral("");
+  aAdapterDriverVersion.Truncate();
   return NS_OK;
 }
 
@@ -99,7 +99,7 @@ GfxInfo::GetAdapterDriverVersion2(nsAString & aAdapterDriverVersion)
 NS_IMETHODIMP
 GfxInfo::GetAdapterDriverDate(nsAString & aAdapterDriverDate)
 {
-  aAdapterDriverDate.AssignLiteral("");
+  aAdapterDriverDate.Truncate();
   return NS_OK;
 }
 
@@ -114,7 +114,7 @@ GfxInfo::GetAdapterDriverDate2(nsAString & aAdapterDriverDate)
 NS_IMETHODIMP
 GfxInfo::GetAdapterVendorID(nsAString & aAdapterVendorID)
 {
-  aAdapterVendorID.AssignLiteral("");
+  aAdapterVendorID.Truncate();
   return NS_OK;
 }
 
@@ -129,7 +129,7 @@ GfxInfo::GetAdapterVendorID2(nsAString & aAdapterVendorID)
 NS_IMETHODIMP
 GfxInfo::GetAdapterDeviceID(nsAString & aAdapterDeviceID)
 {
-  aAdapterDeviceID.AssignLiteral("");
+  aAdapterDeviceID.Truncate();
   return NS_OK;
 }
 
diff --git a/widget/gtk/nsColorPicker.cpp b/widget/gtk/nsColorPicker.cpp
index cacfdb4cc0ec..85eb5bdcb47f 100644
--- a/widget/gtk/nsColorPicker.cpp
+++ b/widget/gtk/nsColorPicker.cpp
@@ -175,7 +175,7 @@ void nsColorPicker::ReadValueFromColorSelection(GtkColorSelection* colorselectio
   GdkColor rgba;
   gtk_color_selection_get_current_color(colorselection, &rgba);
 
-  mColor.AssignLiteral("#");
+  mColor.Assign('#');
   mColor += ToHexString(convertGdkColorComponent(rgba.red));
   mColor += ToHexString(convertGdkColorComponent(rgba.green));
   mColor += ToHexString(convertGdkColorComponent(rgba.blue));
diff --git a/widget/gtk/nsWindow.cpp b/widget/gtk/nsWindow.cpp
index 9987c09b2ac1..ded4f851d122 100644
--- a/widget/gtk/nsWindow.cpp
+++ b/widget/gtk/nsWindow.cpp
@@ -3289,7 +3289,7 @@ GetBrandName(nsXPIDLString& brandName)
             getter_Copies(brandName));
 
     if (brandName.IsEmpty())
-        brandName.AssignLiteral("Mozilla");
+        brandName.AssignLiteral(MOZ_UTF16("Mozilla"));
 }
 
 static GdkWindow *
diff --git a/widget/qt/nsWindow.cpp b/widget/qt/nsWindow.cpp
index 4259aba6848e..5cdca6cd9b24 100644
--- a/widget/qt/nsWindow.cpp
+++ b/widget/qt/nsWindow.cpp
@@ -909,6 +909,47 @@ nsWindow::mouseMoveEvent(QMouseEvent* aEvent)
     return nsEventStatus_eIgnore;
 }
 
+static void
+InitMouseEvent(WidgetMouseEvent& aMouseEvent, QMouseEvent* aEvent,
+               int aClickCount)
+{
+    aMouseEvent.refPoint.x = nscoord(aEvent->pos().x());
+    aMouseEvent.refPoint.y = nscoord(aEvent->pos().y());
+
+    aMouseEvent.InitBasicModifiers(aEvent->modifiers() & Qt::ControlModifier,
+                                   aEvent->modifiers() & Qt::AltModifier,
+                                   aEvent->modifiers() & Qt::ShiftModifier,
+                                   aEvent->modifiers() & Qt::MetaModifier);
+    aMouseEvent.clickCount = aClickCount;
+
+    switch (aEvent->button()) {
+    case Qt::LeftButton:
+        aMouseEvent.button = WidgetMouseEvent::eLeftButton;
+        break;
+    case Qt::RightButton:
+        aMouseEvent.button = WidgetMouseEvent::eRightButton;
+        break;
+    case Qt::MiddleButton:
+        aMouseEvent.button = WidgetMouseEvent::eMiddleButton;
+        break;
+    default:
+        break;
+    }
+}
+
+static bool
+IsAcceptedButton(Qt::MouseButton button)
+{
+    switch (button) {
+    case Qt::LeftButton:
+    case Qt::RightButton:
+    case Qt::MiddleButton:
+        return true;
+    default:
+        return false;
+    }
+}
+
 nsEventStatus
 nsWindow::mousePressEvent(QMouseEvent* aEvent)
 {
@@ -922,37 +963,28 @@ nsWindow::mousePressEvent(QMouseEvent* aEvent)
     if (mWidget)
         pos = mWidget->mapToGlobal(pos);
 
-    if (CheckForRollup( pos.x(), pos.y(), false))
+    if (CheckForRollup(pos.x(), pos.y(), false))
         return nsEventStatus_eIgnore;
 
-    uint16_t      domButton;
-    switch (aEvent->button()) {
-    case Qt::MidButton:
-        domButton = WidgetMouseEvent::eMiddleButton;
-        break;
-    case Qt::RightButton:
-        domButton = WidgetMouseEvent::eRightButton;
-        break;
-    default:
-        domButton = WidgetMouseEvent::eLeftButton;
-        break;
+    if (!IsAcceptedButton(aEvent->button())) {
+        if (aEvent->button() == Qt::BackButton)
+            return DispatchCommandEvent(nsGkAtoms::Back);
+        if (aEvent->button() == Qt::ForwardButton)
+            return DispatchCommandEvent(nsGkAtoms::Forward);
+        return nsEventStatus_eIgnore;
     }
 
     WidgetMouseEvent event(true, NS_MOUSE_BUTTON_DOWN, this,
                            WidgetMouseEvent::eReal);
-    event.button = domButton;
-    InitButtonEvent(event, aEvent, 1);
-
-    LOG(("%s [%p] button: %d\n", __PRETTY_FUNCTION__, (void*)this, domButton));
-
+    InitMouseEvent(event, aEvent, 1);
     nsEventStatus status = DispatchEvent(&event);
 
-    // right menu click on linux should also pop up a context menu
-    if (domButton == WidgetMouseEvent::eRightButton &&
+    // Right click on linux should also pop up a context menu.
+    if (event.button == WidgetMouseEvent::eRightButton &&
         MOZ_LIKELY(!mIsDestroyed)) {
         WidgetMouseEvent contextMenuEvent(true, NS_CONTEXTMENU, this,
                                           WidgetMouseEvent::eReal);
-        InitButtonEvent(contextMenuEvent, aEvent, 1);
+        InitMouseEvent(contextMenuEvent, aEvent, 1);
         DispatchEvent(&contextMenuEvent, status);
     }
 
@@ -965,55 +997,27 @@ nsWindow::mouseReleaseEvent(QMouseEvent* aEvent)
     // The user has done something.
     UserActivity();
 
-    uint16_t domButton;
-
-    switch (aEvent->button()) {
-    case Qt::MidButton:
-        domButton = WidgetMouseEvent::eMiddleButton;
-        break;
-    case Qt::RightButton:
-        domButton = WidgetMouseEvent::eRightButton;
-        break;
-    default:
-        domButton = WidgetMouseEvent::eLeftButton;
-        break;
-    }
-
-    LOG(("%s [%p] button: %d\n", __PRETTY_FUNCTION__, (void*)this, domButton));
+    if (!IsAcceptedButton(aEvent->button()))
+        return nsEventStatus_eIgnore;
 
     WidgetMouseEvent event(true, NS_MOUSE_BUTTON_UP, this,
                            WidgetMouseEvent::eReal);
-    event.button = domButton;
-    InitButtonEvent(event, aEvent, 1);
-
-    nsEventStatus status = DispatchEvent(&event);
-
-    return status;
+    InitMouseEvent(event, aEvent, 1);
+    return DispatchEvent(&event);
 }
 
 nsEventStatus
 nsWindow::mouseDoubleClickEvent(QMouseEvent* aEvent)
 {
-    uint32_t eventType;
+    // The user has done something.
+    UserActivity();
 
-    switch (aEvent->button()) {
-    case Qt::MidButton:
-        eventType = WidgetMouseEvent::eMiddleButton;
-        break;
-    case Qt::RightButton:
-        eventType = WidgetMouseEvent::eRightButton;
-        break;
-    default:
-        eventType = WidgetMouseEvent::eLeftButton;
-        break;
-    }
+    if (!IsAcceptedButton(aEvent->button()))
+        return nsEventStatus_eIgnore;
 
     WidgetMouseEvent event(true, NS_MOUSE_DOUBLECLICK, this,
                            WidgetMouseEvent::eReal);
-    event.button = eventType;
-
-    InitButtonEvent(event, aEvent, 2);
-    //pressed
+    InitMouseEvent(event, aEvent, 2);
     return DispatchEvent(&event);
 }
 
@@ -1554,21 +1558,6 @@ nsWindow::tabletEvent(QTabletEvent* aEvent)
 
 //  Helpers
 
-void
-nsWindow::InitButtonEvent(WidgetMouseEvent& aMoveEvent,
-                          QMouseEvent* aEvent,
-                          int aClickCount)
-{
-    aMoveEvent.refPoint.x = nscoord(aEvent->pos().x());
-    aMoveEvent.refPoint.y = nscoord(aEvent->pos().y());
-
-    aMoveEvent.InitBasicModifiers(aEvent->modifiers() & Qt::ControlModifier,
-                                  aEvent->modifiers() & Qt::AltModifier,
-                                  aEvent->modifiers() & Qt::ShiftModifier,
-                                  aEvent->modifiers() & Qt::MetaModifier);
-    aMoveEvent.clickCount      = aClickCount;
-}
-
 nsEventStatus
 nsWindow::DispatchEvent(WidgetGUIEvent* aEvent)
 {
@@ -1982,7 +1971,7 @@ GetBrandName(nsXPIDLString& brandName)
     }
 
     if (brandName.IsEmpty()) {
-        brandName.AssignLiteral("Mozilla");
+        brandName.AssignLiteral(MOZ_UTF16("Mozilla"));
     }
 }
 
diff --git a/widget/qt/nsWindow.h b/widget/qt/nsWindow.h
index cd6474f324db..bb174cd15532 100644
--- a/widget/qt/nsWindow.h
+++ b/widget/qt/nsWindow.h
@@ -177,10 +177,6 @@ protected:
     MozQWidget* mWidget;
 
 private:
-    void InitButtonEvent(mozilla::WidgetMouseEvent& event,
-                         QMouseEvent* aEvent,
-                         int aClickCount = 1);
-
     // event handling code
     nsEventStatus DispatchEvent(mozilla::WidgetGUIEvent* aEvent);
     void DispatchActivateEvent(void);
diff --git a/widget/windows/GfxInfo.cpp b/widget/windows/GfxInfo.cpp
index 63e2b2a96e84..375f22867f61 100644
--- a/widget/windows/GfxInfo.cpp
+++ b/widget/windows/GfxInfo.cpp
@@ -592,7 +592,7 @@ NS_IMETHODIMP
 GfxInfo::GetAdapterRAM2(nsAString & aAdapterRAM)
 {
   if (!mHasDualGPU) {
-    aAdapterRAM.AssignLiteral("");
+    aAdapterRAM.Truncate();
   } else if (NS_FAILED(GetKeyValue(mDeviceKey2.get(), L"HardwareInformation.MemorySize", aAdapterRAM, REG_DWORD))) {
     aAdapterRAM = L"Unknown";
   }
@@ -613,7 +613,7 @@ NS_IMETHODIMP
 GfxInfo::GetAdapterDriver2(nsAString & aAdapterDriver)
 {
   if (!mHasDualGPU) {
-    aAdapterDriver.AssignLiteral("");
+    aAdapterDriver.Truncate();
   } else if (NS_FAILED(GetKeyValue(mDeviceKey2.get(), L"InstalledDisplayDrivers", aAdapterDriver, REG_MULTI_SZ))) {
     aAdapterDriver = L"Unknown";
   }
diff --git a/widget/windows/nsColorPicker.cpp b/widget/windows/nsColorPicker.cpp
index e2150ed6d455..e033e877806f 100644
--- a/widget/windows/nsColorPicker.cpp
+++ b/widget/windows/nsColorPicker.cpp
@@ -83,7 +83,7 @@ BGRIntToRGBString(DWORD color, nsAString& aResult)
   BYTE g = GetGValue(color);
   BYTE b = GetBValue(color);
 
-  aResult.AssignLiteral("#");
+  aResult.Assign('#');
   aResult.Append(ToHexString(r));
   aResult.Append(ToHexString(g));
   aResult.Append(ToHexString(b));
diff --git a/widget/windows/winrt/MetroContracts.cpp b/widget/windows/winrt/MetroContracts.cpp
index 1198d6895de5..60118eda54e3 100644
--- a/widget/windows/winrt/MetroContracts.cpp
+++ b/widget/windows/winrt/MetroContracts.cpp
@@ -301,10 +301,10 @@ FrameworkView::PerformSearch(HString& aQuery)
   }
 
   nsAutoCString parameter;
-  parameter.AppendLiteral("\"");
+  parameter.Append('"');
   unsigned int length;
   parameter.Append(NS_ConvertUTF16toUTF8(aQuery.GetRawBuffer(&length)));
-  parameter.AppendLiteral("\"");
+  parameter.Append('"');
 
   // NB: The first argument gets stripped by nsICommandLineRunner::Init,
   //     so it doesn't matter what we pass as the first argument, but we
diff --git a/widget/windows/winrt/MetroInput.cpp b/widget/windows/winrt/MetroInput.cpp
index b9c4662f0dc0..0ac21478a796 100644
--- a/widget/windows/winrt/MetroInput.cpp
+++ b/widget/windows/winrt/MetroInput.cpp
@@ -1231,7 +1231,10 @@ MetroInput::HandleFirstTouchStartEvent(WidgetTouchEvent* aEvent)
 
   WidgetTouchEvent transformedEvent(*aEvent);
   DUMP_TOUCH_IDS("APZC(1)", aEvent);
-  mWidget->ApzReceiveInputEvent(&transformedEvent, &mTargetAPZCGuid);
+  nsEventStatus result = mWidget->ApzReceiveInputEvent(&transformedEvent, &mTargetAPZCGuid);
+  if (result == nsEventStatus_eConsumeNoDefault) {
+    return;
+  }
 
   if (gTouchActionPropertyEnabled) {
     nsTArray<TouchBehaviorFlags> touchBehaviors;
@@ -1285,6 +1288,9 @@ MetroInput::HandleFirstTouchMoveEvent(WidgetTouchEvent* aEvent)
   WidgetTouchEvent transformedEvent(*aEvent);
   DUMP_TOUCH_IDS("APZC(2)", aEvent);
   apzcStatus = mWidget->ApzReceiveInputEvent(&transformedEvent, &mTargetAPZCGuid);
+  if (apzcStatus == nsEventStatus_eConsumeNoDefault) {
+    return;
+  }
 
   // We need to dispatch here only touch event, not pointer one.
   // That's because according to the spec pointer events doesn't imply pointermove event
@@ -1306,7 +1312,7 @@ MetroInput::HandleFirstTouchMoveEvent(WidgetTouchEvent* aEvent)
   if (nsEventStatus_eConsumeNoDefault == contentStatus) {
     // Touchmove handler consumed touch.
     mContentConsumingTouch = true;
-  } else if (nsEventStatus_eConsumeNoDefault == apzcStatus) {
+  } else if (nsEventStatus_eConsumeDoDefault == apzcStatus) {
     // Apzc triggered default behavior.
     mApzConsumingTouch = true;
   }
@@ -1418,6 +1424,9 @@ MetroInput::DeliverNextQueuedTouchEvent()
 
   DUMP_TOUCH_IDS("APZC(3)", event);
   status = mWidget->ApzReceiveInputEvent(event, nullptr);
+  if (status == nsEventStatus_eConsumeNoDefault) {
+    return;
+  }
 
   // If we're getting a new touch (touch start) after some touch start/move
   // events we need to reset touch behavior for touches.
@@ -1430,7 +1439,7 @@ MetroInput::DeliverNextQueuedTouchEvent()
 
   // Send the event to content unless APZC is consuming it.
   if (!mApzConsumingTouch) {
-    if (status == nsEventStatus_eConsumeNoDefault) {
+    if (status == nsEventStatus_eConsumeDoDefault) {
       mApzConsumingTouch = true;
       DispatchTouchCancel(event);
       return;
diff --git a/widget/xpwidgets/GfxInfoX11.cpp b/widget/xpwidgets/GfxInfoX11.cpp
index 10d398a76dfc..fd441eb2fb89 100644
--- a/widget/xpwidgets/GfxInfoX11.cpp
+++ b/widget/xpwidgets/GfxInfoX11.cpp
@@ -193,7 +193,7 @@ GfxInfo::GetData()
     note.Append(mVersion);
     if (mHasTextureFromPixmap)
         note.AppendLiteral(" -- texture_from_pixmap");
-    note.AppendLiteral("\n");
+    note.Append('\n');
 #ifdef MOZ_CRASHREPORTER
     CrashReporter::AppendAppNotesToCrashReport(note);
 #endif
@@ -423,7 +423,7 @@ GfxInfo::GetAdapterDescription2(nsAString & aAdapterDescription)
 NS_IMETHODIMP
 GfxInfo::GetAdapterRAM(nsAString & aAdapterRAM)
 {
-  aAdapterRAM.AssignLiteral("");
+  aAdapterRAM.Truncate();
   return NS_OK;
 }
 
@@ -438,7 +438,7 @@ GfxInfo::GetAdapterRAM2(nsAString & aAdapterRAM)
 NS_IMETHODIMP
 GfxInfo::GetAdapterDriver(nsAString & aAdapterDriver)
 {
-  aAdapterDriver.AssignLiteral("");
+  aAdapterDriver.Truncate();
   return NS_OK;
 }
 
@@ -469,7 +469,7 @@ GfxInfo::GetAdapterDriverVersion2(nsAString & aAdapterDriverVersion)
 NS_IMETHODIMP
 GfxInfo::GetAdapterDriverDate(nsAString & aAdapterDriverDate)
 {
-  aAdapterDriverDate.AssignLiteral("");
+  aAdapterDriverDate.Truncate();
   return NS_OK;
 }
 
diff --git a/xpcom/base/nsCycleCollector.cpp b/xpcom/base/nsCycleCollector.cpp
index 2a46527e928c..bde019091c8d 100644
--- a/xpcom/base/nsCycleCollector.cpp
+++ b/xpcom/base/nsCycleCollector.cpp
@@ -4139,7 +4139,7 @@ nsCycleCollector_collectSlice(int64_t aSliceTime)
   PROFILER_LABEL("CC", "nsCycleCollector_collectSlice");
   SliceBudget budget;
   if (aSliceTime >= 0) {
-    budget = SliceBudget::TimeBudget(aSliceTime);
+    budget = SliceBudget(SliceBudget::TimeBudget(aSliceTime));
   }
   data->mCollector->Collect(SliceCC, budget, nullptr);
 }
@@ -4156,7 +4156,7 @@ nsCycleCollector_collectSliceWork(int64_t aSliceWork)
   PROFILER_LABEL("CC", "nsCycleCollector_collectSliceWork");
   SliceBudget budget;
   if (aSliceWork >= 0) {
-    budget = SliceBudget::WorkBudget(aSliceWork);
+    budget = SliceBudget(SliceBudget::WorkBudget(aSliceWork));
   }
   data->mCollector->Collect(SliceCC, budget, nullptr);
 }
diff --git a/xpcom/io/SpecialSystemDirectory.cpp b/xpcom/io/SpecialSystemDirectory.cpp
index c2ec50f2f46b..939032f310ad 100644
--- a/xpcom/io/SpecialSystemDirectory.cpp
+++ b/xpcom/io/SpecialSystemDirectory.cpp
@@ -166,7 +166,7 @@ GetLibrarySaveToPath(int aFallbackFolderId, REFKNOWNFOLDERID aFolderId,
     if (SUCCEEDED(savePath->GetDisplayName(SIGDN_FILESYSPATH, &str))) {
       nsAutoString path;
       path.Assign(str);
-      path.AppendLiteral("\\");
+      path.Append('\\');
       nsresult rv =
         NS_NewLocalFile(path, false, aFile);
       CoTaskMemFree(str);
diff --git a/xpcom/io/nsLocalFileWin.cpp b/xpcom/io/nsLocalFileWin.cpp
index 90cb9a308281..4e26edcd2348 100644
--- a/xpcom/io/nsLocalFileWin.cpp
+++ b/xpcom/io/nsLocalFileWin.cpp
@@ -238,7 +238,7 @@ private:
     // "what do you want to do" dialog
     if (r == SE_ERR_NOASSOC) {
       nsAutoString shellArg;
-      shellArg.AssignLiteral("shell32.dll,OpenAs_RunDLL ");
+      shellArg.AssignLiteral(MOZ_UTF16("shell32.dll,OpenAs_RunDLL "));
       shellArg.Append(mResolvedPath);
       seinfo.lpFile = L"RUNDLL32.EXE";
       seinfo.lpParameters = shellArg.get();
diff --git a/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_ppc_linux.cpp b/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_ppc_linux.cpp
index 7f235b46ddf9..deb72db8f5e5 100644
--- a/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_ppc_linux.cpp
+++ b/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_ppc_linux.cpp
@@ -45,8 +45,12 @@ invoke_copy_to_stack(uint32_t* d,
     uint64_t tempu64;
     
     for(uint32_t i = 0; i < paramCount; i++, s++) {
-        if(s->IsPtrData())
-            tempu32 = (uint32_t) s->ptr;
+        if(s->IsPtrData()) {
+            if(s->type == nsXPTType::T_JSVAL)
+                tempu32 = (uint32_t) &s->ptr;
+            else
+                tempu32 = (uint32_t) s->ptr;
+        }
         else {
             switch(s->type) {
             case nsXPTType::T_FLOAT:                                  break;
diff --git a/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_ppc_netbsd.cpp b/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_ppc_netbsd.cpp
index 069d6083ceb9..515e8c50bd66 100644
--- a/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_ppc_netbsd.cpp
+++ b/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_ppc_netbsd.cpp
@@ -41,9 +41,12 @@ invoke_copy_to_stack(uint32_t* d,
     uint64_t tempu64;
     
     for(uint32_t i = 0; i < paramCount; i++, s++) {
-        if(s->IsPtrData())
-            tempu32 = (uint32_t) s->ptr;
-        else {
+        if(s->IsPtrData()) {
+            if(s->type == nsXPTType::T_JSVAL)
+               tempu32 = (uint32_t) &(s->ptr);
+            else
+               tempu32 = (uint32_t) s->ptr;
+        } else {
             switch(s->type) {
             case nsXPTType::T_FLOAT:                                  break;
             case nsXPTType::T_DOUBLE:                                 break;
diff --git a/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_ppc_openbsd.cpp b/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_ppc_openbsd.cpp
index 70f40b38ec38..5353220fefc1 100644
--- a/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_ppc_openbsd.cpp
+++ b/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_ppc_openbsd.cpp
@@ -41,9 +41,12 @@ invoke_copy_to_stack(uint32_t* d,
     uint64_t tempu64;
     
     for(uint32_t i = 0; i < paramCount; i++, s++) {
-        if(s->IsPtrData())
-            tempu32 = (uint32_t) s->ptr;
-        else {
+        if(s->IsPtrData()) {
+            if(s->type == nsXPTType::T_JSVAL)
+               tempu32 = (uint32_t) &(s->ptr);
+            else
+               tempu32 = (uint32_t) s->ptr;
+        } else {
             switch(s->type) {
             case nsXPTType::T_FLOAT:                                  break;
             case nsXPTType::T_DOUBLE:                                 break;
diff --git a/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_sparc_netbsd.cpp b/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_sparc_netbsd.cpp
index 2ed3d53d243c..126ef1dad2da 100644
--- a/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_sparc_netbsd.cpp
+++ b/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_sparc_netbsd.cpp
@@ -92,7 +92,14 @@ invoke_copy_to_stack(uint32_t* d, uint32_t paramCount, nsXPTCVariant* s)
 	if (regCount < 5) regCount++;
         if(l_s->IsPtrData())
         {
-            *((void**)l_d) = l_s->ptr;
+            if(l_s->type == nsXPTType::T_JSVAL)
+            {
+              // On SPARC, we need to pass a pointer to HandleValue
+              *((void**)l_d) = &l_s->ptr;
+            } else
+            {
+              *((void**)l_d) = l_s->ptr;
+            }
             continue;
         }
         switch(l_s->type)
diff --git a/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_sparc_openbsd.cpp b/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_sparc_openbsd.cpp
index 6b9b09b57b12..9b2e4f858fba 100644
--- a/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_sparc_openbsd.cpp
+++ b/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_sparc_openbsd.cpp
@@ -89,7 +89,14 @@ invoke_copy_to_stack(uint32_t* d, uint32_t paramCount, nsXPTCVariant* s)
 	if (regCount < 5) regCount++;
         if(l_s->IsPtrData())
         {
-            *((void**)l_d) = l_s->ptr;
+            if(l_s->type == nsXPTType::T_JSVAL)
+            {
+              // On SPARC, we need to pass a pointer to HandleValue
+              *((void**)l_d) = &l_s->ptr;
+            } else
+            {
+              *((void**)l_d) = l_s->ptr;
+            }
             continue;
         }
         switch(l_s->type)
diff --git a/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_sparc_solaris.cpp b/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_sparc_solaris.cpp
index 2ed3d53d243c..126ef1dad2da 100644
--- a/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_sparc_solaris.cpp
+++ b/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_sparc_solaris.cpp
@@ -92,7 +92,14 @@ invoke_copy_to_stack(uint32_t* d, uint32_t paramCount, nsXPTCVariant* s)
 	if (regCount < 5) regCount++;
         if(l_s->IsPtrData())
         {
-            *((void**)l_d) = l_s->ptr;
+            if(l_s->type == nsXPTType::T_JSVAL)
+            {
+              // On SPARC, we need to pass a pointer to HandleValue
+              *((void**)l_d) = &l_s->ptr;
+            } else
+            {
+              *((void**)l_d) = l_s->ptr;
+            }
             continue;
         }
         switch(l_s->type)
diff --git a/xpcom/string/public/nsAString.h b/xpcom/string/public/nsAString.h
index c4147f44c38c..e15ae81aec96 100644
--- a/xpcom/string/public/nsAString.h
+++ b/xpcom/string/public/nsAString.h
@@ -37,18 +37,22 @@ class nsCaseInsensitiveCStringComparator
   : public nsCStringComparator
 {
 public:
-  nsCaseInsensitiveCStringComparator() {}
+  nsCaseInsensitiveCStringComparator()
+  {
+  }
   typedef char char_type;
 
-  virtual int operator()( const char_type*, const char_type*, uint32_t, uint32_t ) const;
+  virtual int operator()(const char_type*, const char_type*,
+                         uint32_t, uint32_t) const;
 };
 
 class nsCaseInsensitiveCStringArrayComparator
 {
 public:
   template<class A, class B>
-  bool Equals(const A& a, const B& b) const {
-    return a.Equals(b, nsCaseInsensitiveCStringComparator());
+  bool Equals(const A& aStrA, const B& aStrB) const
+  {
+    return aStrA.Equals(aStrB, nsCaseInsensitiveCStringComparator());
   }
 };
 
diff --git a/xpcom/string/public/nsAlgorithm.h b/xpcom/string/public/nsAlgorithm.h
index 66f87a559926..b269393a9f84 100644
--- a/xpcom/string/public/nsAlgorithm.h
+++ b/xpcom/string/public/nsAlgorithm.h
@@ -10,68 +10,66 @@
 #include "nsCharTraits.h"  // for |nsCharSourceTraits|, |nsCharSinkTraits|
 
 template <class T>
-inline
-T
-NS_ROUNDUP( const T& a, const T& b )
+inline T
+NS_ROUNDUP(const T& aA, const T& aB)
 {
-  return ((a + (b - 1)) / b) * b;
+  return ((aA + (aB - 1)) / aB) * aB;
 }
 
 // We use these instead of std::min/max because we can't include the algorithm
 // header in all of XPCOM because the stl wrappers will error out when included
 // in parts of XPCOM. These functions should never be used outside of XPCOM.
 template <class T>
-inline
-const T&
-XPCOM_MIN( const T& a, const T& b )
+inline const T&
+XPCOM_MIN(const T& aA, const T& aB)
 {
-  return b < a ? b : a;
+  return aB < aA ? aB : aA;
 }
 
 // Must return b when a == b in case a is -0
 template <class T>
-inline
-const T&
-XPCOM_MAX( const T& a, const T& b )
+inline const T&
+XPCOM_MAX(const T& aA, const T& aB)
 {
-  return a > b ? a : b;
+  return aA > aB ? aA : aB;
 }
 
 namespace mozilla {
 
 template <class T>
-inline
-const T&
-clamped( const T& a, const T& min, const T& max )
+inline const T&
+clamped(const T& aA, const T& aMin, const T& aMax)
 {
-  NS_ABORT_IF_FALSE(max >= min, "clamped(): max must be greater than or equal to min");
-  return XPCOM_MIN(XPCOM_MAX(a, min), max);
+  NS_ABORT_IF_FALSE(aMax >= aMin,
+                    "clamped(): aMax must be greater than or equal to aMin");
+  return XPCOM_MIN(XPCOM_MAX(aA, aMin), aMax);
 }
 
 }
 
 template <class InputIterator, class T>
-inline
-uint32_t
-NS_COUNT( InputIterator& first, const InputIterator& last, const T& value )
+inline uint32_t
+NS_COUNT(InputIterator& aFirst, const InputIterator& aLast, const T& aValue)
 {
   uint32_t result = 0;
-  for ( ; first != last; ++first )
-    if ( *first == value )
+  for (; aFirst != aLast; ++aFirst)
+    if (*aFirst == aValue) {
       ++result;
+    }
   return result;
 }
 
 template <class InputIterator, class OutputIterator>
-inline
-OutputIterator&
-copy_string( const InputIterator& first, const InputIterator& last, OutputIterator& result )
+inline OutputIterator&
+copy_string(const InputIterator& aFirst, const InputIterator& aLast,
+            OutputIterator& aResult)
 {
   typedef nsCharSourceTraits<InputIterator> source_traits;
   typedef nsCharSinkTraits<OutputIterator>  sink_traits;
 
-  sink_traits::write(result, source_traits::read(first), source_traits::readable_distance(first, last));
-  return result;
+  sink_traits::write(aResult, source_traits::read(aFirst),
+                     source_traits::readable_distance(aFirst, aLast));
+  return aResult;
 }
 
 #endif // !defined(nsAlgorithm_h___)
diff --git a/xpcom/string/public/nsCharTraits.h b/xpcom/string/public/nsCharTraits.h
index fdbcfd5b0332..dabdadc6df67 100644
--- a/xpcom/string/public/nsCharTraits.h
+++ b/xpcom/string/public/nsCharTraits.h
@@ -83,7 +83,10 @@
 #define IS_VALID_CHAR(c) ((uint32_t(c) < UCS_END) && !IS_SURROGATE(c))
 #define ENSURE_VALID_CHAR(c) (IS_VALID_CHAR(c) ? (c) : UCS2_REPLACEMENT_CHAR)
 
-template <class CharT> struct nsCharTraits {};
+template <class CharT>
+struct nsCharTraits
+{
+};
 
 template <>
 struct nsCharTraits<char16_t>
@@ -94,115 +97,106 @@ struct nsCharTraits<char16_t>
 
   static char_type* const sEmptyBuffer;
 
-  static
-  void
-  assign( char_type& lhs, char_type rhs )
+  static void
+  assign(char_type& aLhs, char_type aRhs)
   {
-    lhs = rhs;
+    aLhs = aRhs;
   }
 
 
   // integer representation of characters:
   typedef int int_type;
 
-  static
-  char_type
-  to_char_type( int_type c )
+  static char_type
+  to_char_type(int_type aChar)
   {
-    return char_type(c);
+    return char_type(aChar);
   }
 
-  static
-  int_type
-  to_int_type( char_type c )
+  static int_type
+  to_int_type(char_type aChar)
   {
-    return int_type( static_cast<unsigned_char_type>(c) );
+    return int_type(static_cast<unsigned_char_type>(aChar));
   }
 
-  static
-  bool
-  eq_int_type( int_type lhs, int_type rhs )
+  static bool
+  eq_int_type(int_type aLhs, int_type aRhs)
   {
-    return lhs == rhs;
+    return aLhs == aRhs;
   }
 
 
   // |char_type| comparisons:
 
-  static
-  bool
-  eq( char_type lhs, char_type rhs )
+  static bool
+  eq(char_type aLhs, char_type aRhs)
   {
-    return lhs == rhs;
+    return aLhs == aRhs;
   }
 
-  static
-  bool
-  lt( char_type lhs, char_type rhs )
+  static bool
+  lt(char_type aLhs, char_type aRhs)
   {
-    return lhs < rhs;
+    return aLhs < aRhs;
   }
 
 
   // operations on s[n] arrays:
 
-  static
-  char_type*
-  move( char_type* s1, const char_type* s2, size_t n )
+  static char_type*
+  move(char_type* aStr1, const char_type* aStr2, size_t aN)
   {
-    return static_cast<char_type*>(memmove(s1, s2, n * sizeof(char_type)));
+    return static_cast<char_type*>(memmove(aStr1, aStr2,
+                                           aN * sizeof(char_type)));
   }
 
-  static
-  char_type*
-  copy( char_type* s1, const char_type* s2, size_t n )
+  static char_type*
+  copy(char_type* aStr1, const char_type* aStr2, size_t aN)
   {
-    return static_cast<char_type*>(memcpy(s1, s2, n * sizeof(char_type)));
+    return static_cast<char_type*>(memcpy(aStr1, aStr2,
+                                          aN * sizeof(char_type)));
   }
 
-  static
-  char_type*
-  copyASCII( char_type* s1, const char* s2, size_t n )
+  static char_type*
+  copyASCII(char_type* aStr1, const char* aStr2, size_t aN)
   {
-    for (char_type* s = s1; n--; ++s, ++s2) {
-      NS_ASSERTION(!(*s2 & ~0x7F), "Unexpected non-ASCII character");
-      *s = *s2;
+    for (char_type* s = aStr1; aN--; ++s, ++aStr2) {
+      NS_ASSERTION(!(*aStr2 & ~0x7F), "Unexpected non-ASCII character");
+      *s = *aStr2;
     }
-    return s1;
+    return aStr1;
   }
 
-  static
-  char_type*
-  assign( char_type* s, size_t n, char_type c )
+  static char_type*
+  assign(char_type* aStr, size_t aN, char_type aChar)
   {
-    char_type* result = s;
-    while ( n-- )
-      assign(*s++, c);
+    char_type* result = aStr;
+    while (aN--) {
+      assign(*aStr++, aChar);
+    }
     return result;
   }
 
-  static
-  int
-  compare( const char_type* s1, const char_type* s2, size_t n )
+  static int
+  compare(const char_type* aStr1, const char_type* aStr2, size_t aN)
   {
-    for ( ; n--; ++s1, ++s2 )
-    {
-      if ( !eq(*s1, *s2) )
-        return to_int_type(*s1) - to_int_type(*s2);
+    for (; aN--; ++aStr1, ++aStr2) {
+      if (!eq(*aStr1, *aStr2)) {
+        return to_int_type(*aStr1) - to_int_type(*aStr2);
+      }
     }
 
     return 0;
   }
 
-  static
-  int
-  compareASCII( const char_type* s1, const char* s2, size_t n )
+  static int
+  compareASCII(const char_type* aStr1, const char* aStr2, size_t aN)
   {
-    for ( ; n--; ++s1, ++s2 )
-    {
-      NS_ASSERTION(!(*s2 & ~0x7F), "Unexpected non-ASCII character");
-      if ( !eq_int_type(to_int_type(*s1), to_int_type(*s2)) )
-        return to_int_type(*s1) - to_int_type(*s2);
+    for (; aN--; ++aStr1, ++aStr2) {
+      NS_ASSERTION(!(*aStr2 & ~0x7F), "Unexpected non-ASCII character");
+      if (!eq_int_type(to_int_type(*aStr1), to_int_type(*aStr2))) {
+        return to_int_type(*aStr1) - to_int_type(*aStr2);
+      }
     }
 
     return 0;
@@ -211,21 +205,23 @@ struct nsCharTraits<char16_t>
   // this version assumes that s2 is null-terminated and s1 has length n.
   // if s1 is shorter than s2 then we return -1; if s1 is longer than s2,
   // we return 1.
-  static
-  int
-  compareASCIINullTerminated( const char_type* s1, size_t n, const char* s2 )
+  static int
+  compareASCIINullTerminated(const char_type* aStr1, size_t aN,
+                             const char* aStr2)
   {
-    for ( ; n--; ++s1, ++s2 )
-    {
-      if ( !*s2 )
+    for (; aN--; ++aStr1, ++aStr2) {
+      if (!*aStr2) {
         return 1;
-      NS_ASSERTION(!(*s2 & ~0x7F), "Unexpected non-ASCII character");
-      if ( !eq_int_type(to_int_type(*s1), to_int_type(*s2)) )
-        return to_int_type(*s1) - to_int_type(*s2);
+      }
+      NS_ASSERTION(!(*aStr2 & ~0x7F), "Unexpected non-ASCII character");
+      if (!eq_int_type(to_int_type(*aStr1), to_int_type(*aStr2))) {
+        return to_int_type(*aStr1) - to_int_type(*aStr2);
+      }
     }
 
-    if ( *s2 )
+    if (*aStr2) {
       return -1;
+    }
 
     return 0;
   }
@@ -234,28 +230,27 @@ struct nsCharTraits<char16_t>
    * Convert c to its lower-case form, but only if c is in the ASCII
    * range. Otherwise leave it alone.
    */
-  static
-  char_type
-  ASCIIToLower( char_type c )
+  static char_type
+  ASCIIToLower(char_type aChar)
   {
-    if (c >= 'A' && c <= 'Z')
-      return char_type(c + ('a' - 'A'));
+    if (aChar >= 'A' && aChar <= 'Z') {
+      return char_type(aChar + ('a' - 'A'));
+    }
 
-    return c;
+    return aChar;
   }
 
-  static
-  int
-  compareLowerCaseToASCII( const char_type* s1, const char* s2, size_t n )
+  static int
+  compareLowerCaseToASCII(const char_type* aStr1, const char* aStr2, size_t aN)
   {
-    for ( ; n--; ++s1, ++s2 )
-    {
-      NS_ASSERTION(!(*s2 & ~0x7F), "Unexpected non-ASCII character");
-      NS_ASSERTION(!(*s2 >= 'A' && *s2 <= 'Z'),
+    for (; aN--; ++aStr1, ++aStr2) {
+      NS_ASSERTION(!(*aStr2 & ~0x7F), "Unexpected non-ASCII character");
+      NS_ASSERTION(!(*aStr2 >= 'A' && *aStr2 <= 'Z'),
                    "Unexpected uppercase character");
-      char_type lower_s1 = ASCIIToLower(*s1);
-      if ( lower_s1 != to_char_type(*s2) )
-        return to_int_type(lower_s1) - to_int_type(*s2);
+      char_type lower_s1 = ASCIIToLower(*aStr1);
+      if (lower_s1 != to_char_type(*aStr2)) {
+        return to_int_type(lower_s1) - to_int_type(*aStr2);
+      }
     }
 
     return 0;
@@ -264,47 +259,48 @@ struct nsCharTraits<char16_t>
   // this version assumes that s2 is null-terminated and s1 has length n.
   // if s1 is shorter than s2 then we return -1; if s1 is longer than s2,
   // we return 1.
-  static
-  int
-  compareLowerCaseToASCIINullTerminated( const char_type* s1, size_t n, const char* s2 )
+  static int
+  compareLowerCaseToASCIINullTerminated(const char_type* aStr1,
+                                        size_t aN, const char* aStr2)
   {
-    for ( ; n--; ++s1, ++s2 )
-    {
-      if ( !*s2 )
+    for (; aN--; ++aStr1, ++aStr2) {
+      if (!*aStr2) {
         return 1;
-      NS_ASSERTION(!(*s2 & ~0x7F), "Unexpected non-ASCII character");
-      NS_ASSERTION(!(*s2 >= 'A' && *s2 <= 'Z'),
+      }
+      NS_ASSERTION(!(*aStr2 & ~0x7F), "Unexpected non-ASCII character");
+      NS_ASSERTION(!(*aStr2 >= 'A' && *aStr2 <= 'Z'),
                    "Unexpected uppercase character");
-      char_type lower_s1 = ASCIIToLower(*s1);
-      if ( lower_s1 != to_char_type(*s2) )
-        return to_int_type(lower_s1) - to_int_type(*s2);
+      char_type lower_s1 = ASCIIToLower(*aStr1);
+      if (lower_s1 != to_char_type(*aStr2)) {
+        return to_int_type(lower_s1) - to_int_type(*aStr2);
+      }
     }
 
-    if ( *s2 )
+    if (*aStr2) {
       return -1;
+    }
 
     return 0;
   }
 
-  static
-  size_t
-  length( const char_type* s )
+  static size_t
+  length(const char_type* aStr)
   {
     size_t result = 0;
-    while ( !eq(*s++, char_type(0)) )
+    while (!eq(*aStr++, char_type(0))) {
       ++result;
+    }
     return result;
   }
 
-  static
-  const char_type*
-  find( const char_type* s, size_t n, char_type c )
+  static const char_type*
+  find(const char_type* aStr, size_t aN, char_type aChar)
   {
-    while ( n-- )
-    {
-      if ( eq(*s, c) )
-        return s;
-      ++s;
+    while (aN--) {
+      if (eq(*aStr, aChar)) {
+        return aStr;
+      }
+      ++aStr;
     }
 
     return 0;
@@ -320,11 +316,10 @@ struct nsCharTraits<char>
 
   static char_type* const sEmptyBuffer;
 
-  static
-  void
-  assign( char_type& lhs, char_type rhs )
+  static void
+  assign(char_type& aLhs, char_type aRhs)
   {
-    lhs = rhs;
+    aLhs = aRhs;
   }
 
 
@@ -332,115 +327,106 @@ struct nsCharTraits<char>
 
   typedef int int_type;
 
-  static
-  char_type
-  to_char_type( int_type c )
+  static char_type
+  to_char_type(int_type aChar)
   {
-    return char_type(c);
+    return char_type(aChar);
   }
 
-  static
-  int_type
-  to_int_type( char_type c )
+  static int_type
+  to_int_type(char_type aChar)
   {
-    return int_type( static_cast<unsigned_char_type>(c) );
+    return int_type(static_cast<unsigned_char_type>(aChar));
   }
 
-  static
-  bool
-  eq_int_type( int_type lhs, int_type rhs )
+  static bool
+  eq_int_type(int_type aLhs, int_type aRhs)
   {
-    return lhs == rhs;
+    return aLhs == aRhs;
   }
 
 
   // |char_type| comparisons:
 
-  static
-  bool
-  eq( char_type lhs, char_type rhs )
+  static bool eq(char_type aLhs, char_type aRhs)
   {
-    return lhs == rhs;
+    return aLhs == aRhs;
   }
 
-  static
-  bool
-  lt( char_type lhs, char_type rhs )
+  static bool
+  lt(char_type aLhs, char_type aRhs)
   {
-    return lhs < rhs;
+    return aLhs < aRhs;
   }
 
 
   // operations on s[n] arrays:
 
-  static
-  char_type*
-  move( char_type* s1, const char_type* s2, size_t n )
+  static char_type*
+  move(char_type* aStr1, const char_type* aStr2, size_t aN)
   {
-    return static_cast<char_type*>(memmove(s1, s2, n * sizeof(char_type)));
+    return static_cast<char_type*>(memmove(aStr1, aStr2,
+                                           aN * sizeof(char_type)));
   }
 
-  static
-  char_type*
-  copy( char_type* s1, const char_type* s2, size_t n )
+  static char_type*
+  copy(char_type* aStr1, const char_type* aStr2, size_t aN)
   {
-    return static_cast<char_type*>(memcpy(s1, s2, n * sizeof(char_type)));
+    return static_cast<char_type*>(memcpy(aStr1, aStr2,
+                                          aN * sizeof(char_type)));
   }
 
-  static
-  char_type*
-  copyASCII( char_type* s1, const char* s2, size_t n )
+  static char_type*
+  copyASCII(char_type* aStr1, const char* aStr2, size_t aN)
   {
-    return copy(s1, s2, n);
+    return copy(aStr1, aStr2, aN);
   }
 
-  static
-  char_type*
-  assign( char_type* s, size_t n, char_type c )
+  static char_type*
+  assign(char_type* aStr, size_t aN, char_type aChar)
   {
-    return static_cast<char_type*>(memset(s, to_int_type(c), n));
+    return static_cast<char_type*>(memset(aStr, to_int_type(aChar), aN));
   }
 
-  static
-  int
-  compare( const char_type* s1, const char_type* s2, size_t n )
+  static int
+  compare(const char_type* aStr1, const char_type* aStr2, size_t aN)
   {
-    return memcmp(s1, s2, n);
+    return memcmp(aStr1, aStr2, aN);
   }
 
-  static
-  int
-  compareASCII( const char_type* s1, const char* s2, size_t n )
+  static int
+  compareASCII(const char_type* aStr1, const char* aStr2, size_t aN)
   {
 #ifdef DEBUG
-    for (size_t i = 0; i < n; ++i)
-    {
-      NS_ASSERTION(!(s2[i] & ~0x7F), "Unexpected non-ASCII character");
+    for (size_t i = 0; i < aN; ++i) {
+      NS_ASSERTION(!(aStr2[i] & ~0x7F), "Unexpected non-ASCII character");
     }
 #endif
-    return compare(s1, s2, n);
+    return compare(aStr1, aStr2, aN);
   }
 
   // this version assumes that s2 is null-terminated and s1 has length n.
   // if s1 is shorter than s2 then we return -1; if s1 is longer than s2,
   // we return 1.
-  static
-  int
-  compareASCIINullTerminated( const char_type* s1, size_t n, const char* s2 )
+  static int
+  compareASCIINullTerminated(const char_type* aStr1, size_t aN,
+                             const char* aStr2)
   {
-    // can't use strcmp here because we don't want to stop when s1
+    // can't use strcmp here because we don't want to stop when aStr1
     // contains a null
-    for ( ; n--; ++s1, ++s2 )
-    {
-      if ( !*s2 )
+    for (; aN--; ++aStr1, ++aStr2) {
+      if (!*aStr2) {
         return 1;
-      NS_ASSERTION(!(*s2 & ~0x7F), "Unexpected non-ASCII character");
-      if ( *s1 != *s2 )
-        return to_int_type(*s1) - to_int_type(*s2);
+      }
+      NS_ASSERTION(!(*aStr2 & ~0x7F), "Unexpected non-ASCII character");
+      if (*aStr1 != *aStr2) {
+        return to_int_type(*aStr1) - to_int_type(*aStr2);
+      }
     }
 
-    if ( *s2 )
+    if (*aStr2) {
       return -1;
+    }
 
     return 0;
   }
@@ -448,28 +434,27 @@ struct nsCharTraits<char>
   /**
    * Convert c to its lower-case form, but only if c is ASCII.
    */
-  static
-  char_type
-  ASCIIToLower( char_type c )
+  static char_type
+  ASCIIToLower(char_type aChar)
   {
-    if (c >= 'A' && c <= 'Z')
-      return char_type(c + ('a' - 'A'));
+    if (aChar >= 'A' && aChar <= 'Z') {
+      return char_type(aChar + ('a' - 'A'));
+    }
 
-    return c;
+    return aChar;
   }
 
-  static
-  int
-  compareLowerCaseToASCII( const char_type* s1, const char* s2, size_t n )
+  static int
+  compareLowerCaseToASCII(const char_type* aStr1, const char* aStr2, size_t aN)
   {
-    for ( ; n--; ++s1, ++s2 )
-    {
-      NS_ASSERTION(!(*s2 & ~0x7F), "Unexpected non-ASCII character");
-      NS_ASSERTION(!(*s2 >= 'A' && *s2 <= 'Z'),
+    for (; aN--; ++aStr1, ++aStr2) {
+      NS_ASSERTION(!(*aStr2 & ~0x7F), "Unexpected non-ASCII character");
+      NS_ASSERTION(!(*aStr2 >= 'A' && *aStr2 <= 'Z'),
                    "Unexpected uppercase character");
-      char_type lower_s1 = ASCIIToLower(*s1);
-      if ( lower_s1 != *s2 )
-        return to_int_type(lower_s1) - to_int_type(*s2);
+      char_type lower_s1 = ASCIIToLower(*aStr1);
+      if (lower_s1 != *aStr2) {
+        return to_int_type(lower_s1) - to_int_type(*aStr2);
+      }
     }
     return 0;
   }
@@ -477,40 +462,41 @@ struct nsCharTraits<char>
   // this version assumes that s2 is null-terminated and s1 has length n.
   // if s1 is shorter than s2 then we return -1; if s1 is longer than s2,
   // we return 1.
-  static
-  int
-  compareLowerCaseToASCIINullTerminated( const char_type* s1, size_t n, const char* s2 )
+  static int
+  compareLowerCaseToASCIINullTerminated(const char_type* aStr1, size_t aN,
+                                        const char* aStr2)
   {
-    for ( ; n--; ++s1, ++s2 )
-    {
-      if ( !*s2 )
+    for (; aN--; ++aStr1, ++aStr2) {
+      if (!*aStr2) {
         return 1;
-      NS_ASSERTION(!(*s2 & ~0x7F), "Unexpected non-ASCII character");
-      NS_ASSERTION(!(*s2 >= 'A' && *s2 <= 'Z'),
+      }
+      NS_ASSERTION(!(*aStr2 & ~0x7F), "Unexpected non-ASCII character");
+      NS_ASSERTION(!(*aStr2 >= 'A' && *aStr2 <= 'Z'),
                    "Unexpected uppercase character");
-      char_type lower_s1 = ASCIIToLower(*s1);
-      if ( lower_s1 != *s2 )
-        return to_int_type(lower_s1) - to_int_type(*s2);
+      char_type lower_s1 = ASCIIToLower(*aStr1);
+      if (lower_s1 != *aStr2) {
+        return to_int_type(lower_s1) - to_int_type(*aStr2);
+      }
     }
 
-    if ( *s2 )
+    if (*aStr2) {
       return -1;
+    }
 
     return 0;
   }
 
-  static
-  size_t
-  length( const char_type* s )
+  static size_t
+  length(const char_type* aStr)
   {
-    return strlen(s);
+    return strlen(aStr);
   }
 
-  static
-  const char_type*
-  find( const char_type* s, size_t n, char_type c )
+  static const char_type*
+  find(const char_type* aStr, size_t aN, char_type aChar)
   {
-    return reinterpret_cast<const char_type*>(memchr(s, to_int_type(c), n));
+    return reinterpret_cast<const char_type*>(memchr(aStr, to_int_type(aChar),
+                                                     aN));
   }
 };
 
@@ -519,26 +505,23 @@ struct nsCharSourceTraits
 {
   typedef typename InputIterator::difference_type difference_type;
 
-  static
-  uint32_t
-  readable_distance( const InputIterator& first, const InputIterator& last )
+  static uint32_t
+  readable_distance(const InputIterator& aFirst, const InputIterator& aLast)
   {
     // assumes single fragment
-    return uint32_t(last.get() - first.get());
+    return uint32_t(aLast.get() - aFirst.get());
   }
 
-  static
-  const typename InputIterator::value_type*
-  read( const InputIterator& iter )
+  static const typename InputIterator::value_type*
+  read(const InputIterator& aIter)
   {
-    return iter.get();
+    return aIter.get();
   }
 
-  static
-  void
-  advance( InputIterator& s, difference_type n )
+  static void
+  advance(InputIterator& aStr, difference_type aN)
   {
-    s.advance(n);
+    aStr.advance(aN);
   }
 };
 
@@ -547,56 +530,51 @@ struct nsCharSourceTraits<CharT*>
 {
   typedef ptrdiff_t difference_type;
 
-  static
-  uint32_t
-  readable_distance( CharT* s )
+  static uint32_t
+  readable_distance(CharT* aStr)
   {
-    return uint32_t(nsCharTraits<CharT>::length(s));
+    return uint32_t(nsCharTraits<CharT>::length(aStr));
     // return numeric_limits<uint32_t>::max();
   }
 
-  static
-  uint32_t
-  readable_distance( CharT* first, CharT* last )
+  static uint32_t
+  readable_distance(CharT* aFirst, CharT* aLast)
   {
-    return uint32_t(last-first);
+    return uint32_t(aLast - aFirst);
   }
 
-  static
-  const CharT*
-  read( CharT* s )
+  static const CharT*
+  read(CharT* aStr)
   {
-    return s;
+    return aStr;
   }
 
-  static
-  void
-  advance( CharT*& s, difference_type n )
+  static void
+  advance(CharT*& aStr, difference_type aN)
   {
-    s += n;
+    aStr += aN;
   }
 };
 
 template <class OutputIterator>
 struct nsCharSinkTraits
 {
-  static
-  void
-  write( OutputIterator& iter, const typename OutputIterator::value_type* s, uint32_t n )
+  static void
+  write(OutputIterator& aIter, const typename OutputIterator::value_type* aStr,
+        uint32_t aN)
   {
-    iter.write(s, n);
+    aIter.write(aStr, aN);
   }
 };
 
 template <class CharT>
 struct nsCharSinkTraits<CharT*>
 {
-  static
-  void
-  write( CharT*& iter, const CharT* s, uint32_t n )
+  static void
+  write(CharT*& aIter, const CharT* aStr, uint32_t aN)
   {
-    nsCharTraits<CharT>::move(iter, s, n);
-    iter += n;
+    nsCharTraits<CharT>::move(aIter, aStr, aN);
+    aIter += aN;
   }
 };
 
diff --git a/xpcom/string/public/nsPrintfCString.h b/xpcom/string/public/nsPrintfCString.h
index 56f2b4ddcb7c..ce90ec497985 100644
--- a/xpcom/string/public/nsPrintfCString.h
+++ b/xpcom/string/public/nsPrintfCString.h
@@ -25,12 +25,12 @@ class nsPrintfCString : public nsFixedCString
   typedef nsCString string_type;
 
 public:
-  explicit nsPrintfCString( const char_type* format, ... )
+  explicit nsPrintfCString(const char_type* aFormat, ...)
     : nsFixedCString(mLocalBuffer, kLocalBufferSize, 0)
   {
     va_list ap;
-    va_start(ap, format);
-    AppendPrintf(format, ap);
+    va_start(ap, aFormat);
+    AppendPrintf(aFormat, ap);
     va_end(ap);
   }
 
diff --git a/xpcom/string/public/nsReadableUtils.h b/xpcom/string/public/nsReadableUtils.h
index 547cdc62bbc5..8577f7e9552b 100644
--- a/xpcom/string/public/nsReadableUtils.h
+++ b/xpcom/string/public/nsReadableUtils.h
@@ -17,47 +17,54 @@
 
 #include "nsTArrayForwardDeclare.h"
 
-inline size_t Distance( const nsReadingIterator<char16_t>& start, const nsReadingIterator<char16_t>& end )
+inline size_t
+Distance(const nsReadingIterator<char16_t>& aStart,
+         const nsReadingIterator<char16_t>& aEnd)
 {
-  return end.get() - start.get();
+  return aEnd.get() - aStart.get();
 }
-inline size_t Distance( const nsReadingIterator<char>& start, const nsReadingIterator<char>& end )
+inline size_t
+Distance(const nsReadingIterator<char>& aStart,
+         const nsReadingIterator<char>& aEnd)
 {
-  return end.get() - start.get();
+  return aEnd.get() - aStart.get();
 }
 
-void LossyCopyUTF16toASCII( const nsAString& aSource, nsACString& aDest );
-void CopyASCIItoUTF16( const nsACString& aSource, nsAString& aDest );
+void LossyCopyUTF16toASCII(const nsAString& aSource, nsACString& aDest);
+void CopyASCIItoUTF16(const nsACString& aSource, nsAString& aDest);
 
-void LossyCopyUTF16toASCII( const char16_t* aSource, nsACString& aDest );
-void CopyASCIItoUTF16( const char* aSource, nsAString& aDest );
+void LossyCopyUTF16toASCII(const char16_t* aSource, nsACString& aDest);
+void CopyASCIItoUTF16(const char* aSource, nsAString& aDest);
 
-void CopyUTF16toUTF8( const nsAString& aSource, nsACString& aDest );
-void CopyUTF8toUTF16( const nsACString& aSource, nsAString& aDest );
+void CopyUTF16toUTF8(const nsAString& aSource, nsACString& aDest);
+void CopyUTF8toUTF16(const nsACString& aSource, nsAString& aDest);
 
-void CopyUTF16toUTF8( const char16_t* aSource, nsACString& aDest );
-void CopyUTF8toUTF16( const char* aSource, nsAString& aDest );
+void CopyUTF16toUTF8(const char16_t* aSource, nsACString& aDest);
+void CopyUTF8toUTF16(const char* aSource, nsAString& aDest);
 
-void LossyAppendUTF16toASCII( const nsAString& aSource, nsACString& aDest );
-void AppendASCIItoUTF16( const nsACString& aSource, nsAString& aDest );
-bool AppendASCIItoUTF16( const nsACString& aSource, nsAString& aDest,
-                         const mozilla::fallible_t& ) NS_WARN_UNUSED_RESULT;
+void LossyAppendUTF16toASCII(const nsAString& aSource, nsACString& aDest);
+void AppendASCIItoUTF16(const nsACString& aSource, nsAString& aDest);
+NS_WARN_UNUSED_RESULT bool AppendASCIItoUTF16(const nsACString& aSource,
+                                              nsAString& aDest,
+                                              const mozilla::fallible_t&);
 
-void LossyAppendUTF16toASCII( const char16_t* aSource, nsACString& aDest );
-void AppendASCIItoUTF16( const char* aSource, nsAString& aDest );
+void LossyAppendUTF16toASCII(const char16_t* aSource, nsACString& aDest);
+void AppendASCIItoUTF16(const char* aSource, nsAString& aDest);
 
-void AppendUTF16toUTF8( const nsAString& aSource, nsACString& aDest );
-bool AppendUTF16toUTF8( const nsAString& aSource, nsACString& aDest,
-                        const mozilla::fallible_t& ) NS_WARN_UNUSED_RESULT;
-void AppendUTF8toUTF16( const nsACString& aSource, nsAString& aDest );
-bool AppendUTF8toUTF16( const nsACString& aSource, nsAString& aDest,
-                        const mozilla::fallible_t& ) NS_WARN_UNUSED_RESULT;
+void AppendUTF16toUTF8(const nsAString& aSource, nsACString& aDest);
+NS_WARN_UNUSED_RESULT bool AppendUTF16toUTF8(const nsAString& aSource,
+                                             nsACString& aDest,
+                                             const mozilla::fallible_t&);
+void AppendUTF8toUTF16(const nsACString& aSource, nsAString& aDest);
+NS_WARN_UNUSED_RESULT bool AppendUTF8toUTF16(const nsACString& aSource,
+                                             nsAString& aDest,
+                                             const mozilla::fallible_t&);
 
-void AppendUTF16toUTF8( const char16_t* aSource, nsACString& aDest );
-void AppendUTF8toUTF16( const char* aSource, nsAString& aDest );
+void AppendUTF16toUTF8(const char16_t* aSource, nsACString& aDest);
+void AppendUTF8toUTF16(const char* aSource, nsAString& aDest);
 
 #ifdef MOZ_USE_CHAR16_WRAPPER
-inline void AppendUTF16toUTF8( char16ptr_t aSource, nsACString& aDest )
+inline void AppendUTF16toUTF8(char16ptr_t aSource, nsACString& aDest)
 {
   return AppendUTF16toUTF8(static_cast<const char16_t*>(aSource), aDest);
 }
@@ -74,7 +81,7 @@ inline void AppendUTF16toUTF8( char16ptr_t aSource, nsACString& aDest )
  * @param aSource a 16-bit wide string
  * @return a new |char| buffer you must free with |nsMemory::Free|.
  */
-char* ToNewCString( const nsAString& aSource );
+char* ToNewCString(const nsAString& aSource);
 
 
 /**
@@ -86,7 +93,7 @@ char* ToNewCString( const nsAString& aSource );
  * @param aSource an 8-bit wide string
  * @return a new |char| buffer you must free with |nsMemory::Free|.
  */
-char* ToNewCString( const nsACString& aSource );
+char* ToNewCString(const nsACString& aSource);
 
 /**
  * Returns a new |char| buffer containing a zero-terminated copy of |aSource|.
@@ -103,7 +110,7 @@ char* ToNewCString( const nsACString& aSource );
  * @return a new |char| buffer you must free with |nsMemory::Free|.
  */
 
-char* ToNewUTF8String( const nsAString& aSource, uint32_t *aUTF8Count = nullptr );
+char* ToNewUTF8String(const nsAString& aSource, uint32_t* aUTF8Count = nullptr);
 
 
 /**
@@ -118,7 +125,7 @@ char* ToNewUTF8String( const nsAString& aSource, uint32_t *aUTF8Count = nullptr
  * @param aSource a UTF-16 string
  * @return a new |char16_t| buffer you must free with |nsMemory::Free|.
  */
-char16_t* ToNewUnicode( const nsAString& aSource );
+char16_t* ToNewUnicode(const nsAString& aSource);
 
 
 /**
@@ -132,7 +139,7 @@ char16_t* ToNewUnicode( const nsAString& aSource );
  * @param aSource an 8-bit wide string (a C-string, NOT UTF-8)
  * @return a new |char16_t| buffer you must free with |nsMemory::Free|.
  */
-char16_t* ToNewUnicode( const nsACString& aSource );
+char16_t* ToNewUnicode(const nsACString& aSource);
 
 /**
  * Returns the required length for a char16_t buffer holding
@@ -142,7 +149,7 @@ char16_t* ToNewUnicode( const nsACString& aSource );
  * @param aSource an 8-bit wide string, UTF-8 encoded
  * @return length of UTF-16 encoded string copy, not zero-terminated
  */
-uint32_t CalcUTF8ToUnicodeLength( const nsACString& aSource );
+uint32_t CalcUTF8ToUnicodeLength(const nsACString& aSource);
 
 /**
  * Copies the source string into the specified buffer, converting UTF-8 to
@@ -162,9 +169,9 @@ uint32_t CalcUTF8ToUnicodeLength( const nsACString& aSource );
  *                    were copied
  * @return aBuffer pointer, for convenience
  */
-char16_t* UTF8ToUnicodeBuffer( const nsACString& aSource,
-                               char16_t *aBuffer,
-                               uint32_t *aUTF16Count = nullptr );
+char16_t* UTF8ToUnicodeBuffer(const nsACString& aSource,
+                              char16_t* aBuffer,
+                              uint32_t* aUTF16Count = nullptr);
 
 /**
  * Returns a new |char16_t| buffer containing a zero-terminated copy
@@ -181,7 +188,8 @@ char16_t* UTF8ToUnicodeBuffer( const nsACString& aSource,
  * @return a new |char16_t| buffer you must free with |nsMemory::Free|.
  *         (UTF-16 encoded)
  */
-char16_t* UTF8ToNewUnicode( const nsACString& aSource, uint32_t *aUTF16Count = nullptr );
+char16_t* UTF8ToNewUnicode(const nsACString& aSource,
+                           uint32_t* aUTF16Count = nullptr);
 
 /**
  * Copies |aLength| 16-bit code units from the start of |aSource| to the
@@ -195,10 +203,10 @@ char16_t* UTF8ToNewUnicode( const nsACString& aSource, uint32_t *aUTF16Count = n
  * @param aLength the number of 16-bit code units to copy
  * @return pointer to destination buffer - identical to |aDest|
  */
-char16_t* CopyUnicodeTo( const nsAString& aSource,
-                         uint32_t aSrcOffset,
-                         char16_t* aDest,
-                         uint32_t aLength );
+char16_t* CopyUnicodeTo(const nsAString& aSource,
+                        uint32_t aSrcOffset,
+                        char16_t* aDest,
+                        uint32_t aLength);
 
 
 /**
@@ -212,9 +220,9 @@ char16_t* CopyUnicodeTo( const nsAString& aSource,
  * @param aSrcEnd end source iterator
  * @param aDest destination for the copy
  */
-void CopyUnicodeTo( const nsAString::const_iterator& aSrcStart,
-                    const nsAString::const_iterator& aSrcEnd,
-                    nsAString& aDest );
+void CopyUnicodeTo(const nsAString::const_iterator& aSrcStart,
+                   const nsAString::const_iterator& aSrcEnd,
+                   nsAString& aDest);
 
 /**
  * Appends 16-bit characters between iterators |aSrcStart| and
@@ -226,23 +234,23 @@ void CopyUnicodeTo( const nsAString::const_iterator& aSrcStart,
  * @param aSrcEnd end source iterator
  * @param aDest destination for the copy
  */
-void AppendUnicodeTo( const nsAString::const_iterator& aSrcStart,
-                      const nsAString::const_iterator& aSrcEnd,
-                      nsAString& aDest );
+void AppendUnicodeTo(const nsAString::const_iterator& aSrcStart,
+                     const nsAString::const_iterator& aSrcEnd,
+                     nsAString& aDest);
 
 /**
  * Returns |true| if |aString| contains only ASCII characters, that is, characters in the range (0x00, 0x7F).
  *
  * @param aString a 16-bit wide string to scan
  */
-bool IsASCII( const nsAString& aString );
+bool IsASCII(const nsAString& aString);
 
 /**
  * Returns |true| if |aString| contains only ASCII characters, that is, characters in the range (0x00, 0x7F).
  *
  * @param aString a 8-bit wide string to scan
  */
-bool IsASCII( const nsACString& aString );
+bool IsASCII(const nsACString& aString);
 
 /**
  * Returns |true| if |aString| is a valid UTF-8 string.
@@ -275,7 +283,7 @@ bool IsASCII( const nsACString& aString );
  * @param aRejectNonChar a boolean to control the rejection of utf-8
  *        non characters
  */
-bool IsUTF8( const nsACString& aString, bool aRejectNonChar = true );
+bool IsUTF8(const nsACString& aString, bool aRejectNonChar = true);
 
 bool ParseString(const nsACString& aAstring, char aDelimiter,
                  nsTArray<nsCString>& aArray);
@@ -283,20 +291,20 @@ bool ParseString(const nsACString& aAstring, char aDelimiter,
 /**
  * Converts case in place in the argument string.
  */
-void ToUpperCase( nsACString& );
+void ToUpperCase(nsACString&);
 
-void ToLowerCase( nsACString& );
+void ToLowerCase(nsACString&);
 
-void ToUpperCase( nsCSubstring& );
+void ToUpperCase(nsCSubstring&);
 
-void ToLowerCase( nsCSubstring& );
+void ToLowerCase(nsCSubstring&);
 
 /**
  * Converts case from string aSource to aDest.
  */
-void ToUpperCase( const nsACString& aSource, nsACString& aDest );
+void ToUpperCase(const nsACString& aSource, nsACString& aDest);
 
-void ToLowerCase( const nsACString& aSource, nsACString& aDest );
+void ToLowerCase(const nsACString& aSource, nsACString& aDest);
 
 /**
  * Finds the leftmost occurrence of |aPattern|, if any in the range |aSearchStart|..|aSearchEnd|.
@@ -308,29 +316,39 @@ void ToLowerCase( const nsACString& aSource, nsACString& aDest );
  * If we need something faster, then we can implement that later.
  */
 
-bool FindInReadable( const nsAString& aPattern, nsAString::const_iterator&, nsAString::const_iterator&, const nsStringComparator& = nsDefaultStringComparator() );
-bool FindInReadable( const nsACString& aPattern, nsACString::const_iterator&, nsACString::const_iterator&, const nsCStringComparator& = nsDefaultCStringComparator() );
+bool FindInReadable(const nsAString& aPattern, nsAString::const_iterator&,
+                    nsAString::const_iterator&,
+                    const nsStringComparator& = nsDefaultStringComparator());
+bool FindInReadable(const nsACString& aPattern, nsACString::const_iterator&,
+                    nsACString::const_iterator&,
+                    const nsCStringComparator& = nsDefaultCStringComparator());
 
 /* sometimes we don't care about where the string was, just that we
  * found it or not */
-inline bool FindInReadable( const nsAString& aPattern, const nsAString& aSource, const nsStringComparator& compare = nsDefaultStringComparator() )
+inline bool
+FindInReadable(const nsAString& aPattern, const nsAString& aSource,
+               const nsStringComparator& aCompare = nsDefaultStringComparator())
 {
   nsAString::const_iterator start, end;
   aSource.BeginReading(start);
   aSource.EndReading(end);
-  return FindInReadable(aPattern, start, end, compare);
+  return FindInReadable(aPattern, start, end, aCompare);
 }
 
-inline bool FindInReadable( const nsACString& aPattern, const nsACString& aSource, const nsCStringComparator& compare = nsDefaultCStringComparator() )
+inline bool
+FindInReadable(const nsACString& aPattern, const nsACString& aSource,
+               const nsCStringComparator& aCompare = nsDefaultCStringComparator())
 {
   nsACString::const_iterator start, end;
   aSource.BeginReading(start);
   aSource.EndReading(end);
-  return FindInReadable(aPattern, start, end, compare);
+  return FindInReadable(aPattern, start, end, aCompare);
 }
 
 
-bool CaseInsensitiveFindInReadable( const nsACString& aPattern, nsACString::const_iterator&, nsACString::const_iterator& );
+bool CaseInsensitiveFindInReadable(const nsACString& aPattern,
+                                   nsACString::const_iterator&,
+                                   nsACString::const_iterator&);
 
 /**
  * Finds the rightmost occurrence of |aPattern|
@@ -338,8 +356,12 @@ bool CaseInsensitiveFindInReadable( const nsACString& aPattern, nsACString::cons
  * point to the match.  If no match was found, returns |false| and makes |aSearchStart == aSearchEnd|.
  *
  */
-bool RFindInReadable( const nsAString& aPattern, nsAString::const_iterator&, nsAString::const_iterator&, const nsStringComparator& = nsDefaultStringComparator() );
-bool RFindInReadable( const nsACString& aPattern, nsACString::const_iterator&, nsACString::const_iterator&, const nsCStringComparator& = nsDefaultCStringComparator() );
+bool RFindInReadable(const nsAString& aPattern, nsAString::const_iterator&,
+                     nsAString::const_iterator&,
+                     const nsStringComparator& = nsDefaultStringComparator());
+bool RFindInReadable(const nsACString& aPattern, nsACString::const_iterator&,
+                     nsACString::const_iterator&,
+                     const nsCStringComparator& = nsDefaultCStringComparator());
 
 /**
 * Finds the leftmost occurrence of |aChar|, if any in the range
@@ -349,33 +371,31 @@ bool RFindInReadable( const nsACString& aPattern, nsACString::const_iterator&, n
 * point to the match.  If no match was found, returns |false| and
 * makes |aSearchStart == aSearchEnd|.
 */
-bool FindCharInReadable( char16_t aChar, nsAString::const_iterator& aSearchStart, const nsAString::const_iterator& aSearchEnd );
-bool FindCharInReadable( char aChar, nsACString::const_iterator& aSearchStart, const nsACString::const_iterator& aSearchEnd );
+bool FindCharInReadable(char16_t aChar, nsAString::const_iterator& aSearchStart,
+                        const nsAString::const_iterator& aSearchEnd);
+bool FindCharInReadable(char aChar, nsACString::const_iterator& aSearchStart,
+                        const nsACString::const_iterator& aSearchEnd);
 
 /**
 * Finds the number of occurences of |aChar| in the string |aStr|
 */
-uint32_t CountCharInReadable( const nsAString& aStr,
-                              char16_t aChar );
-uint32_t CountCharInReadable( const nsACString& aStr,
-                              char aChar );
+uint32_t CountCharInReadable(const nsAString& aStr,
+                             char16_t aChar);
+uint32_t CountCharInReadable(const nsACString& aStr,
+                             char aChar);
 
-bool
-StringBeginsWith( const nsAString& aSource, const nsAString& aSubstring,
-                  const nsStringComparator& aComparator =
-                    nsDefaultStringComparator() );
-bool
-StringBeginsWith( const nsACString& aSource, const nsACString& aSubstring,
-                  const nsCStringComparator& aComparator =
-                    nsDefaultCStringComparator() );
-bool
-StringEndsWith( const nsAString& aSource, const nsAString& aSubstring,
-                const nsStringComparator& aComparator =
-                  nsDefaultStringComparator() );
-bool
-StringEndsWith( const nsACString& aSource, const nsACString& aSubstring,
-                const nsCStringComparator& aComparator =
-                  nsDefaultCStringComparator() );
+bool StringBeginsWith(const nsAString& aSource, const nsAString& aSubstring,
+                      const nsStringComparator& aComparator =
+                        nsDefaultStringComparator());
+bool StringBeginsWith(const nsACString& aSource, const nsACString& aSubstring,
+                      const nsCStringComparator& aComparator =
+                        nsDefaultCStringComparator());
+bool StringEndsWith(const nsAString& aSource, const nsAString& aSubstring,
+                    const nsStringComparator& aComparator =
+                      nsDefaultStringComparator());
+bool StringEndsWith(const nsACString& aSource, const nsACString& aSubstring,
+                    const nsCStringComparator& aComparator =
+                      nsDefaultCStringComparator());
 
 const nsAFlatString& EmptyString();
 const nsAFlatCString& EmptyCString();
@@ -391,15 +411,14 @@ const nsAFlatCString& NullCString();
 * error (eg the strings are not valid UTF8 and UTF16 respectively),
 * this method will return INT32_MIN.
 */
-int32_t
-CompareUTF8toUTF16(const nsASingleFragmentCString& aUTF8String,
-                   const nsASingleFragmentString& aUTF16String);
+int32_t CompareUTF8toUTF16(const nsASingleFragmentCString& aUTF8String,
+                           const nsASingleFragmentString& aUTF16String);
 
-void
-AppendUCS4ToUTF16(const uint32_t aSource, nsAString& aDest);
+void AppendUCS4ToUTF16(const uint32_t aSource, nsAString& aDest);
 
 template<class T>
-inline bool EnsureStringLength(T& aStr, uint32_t aLen)
+inline bool
+EnsureStringLength(T& aStr, uint32_t aLen)
 {
   aStr.SetLength(aLen);
   return (aStr.Length() == aLen);
diff --git a/xpcom/string/public/nsString.h b/xpcom/string/public/nsString.h
index c5e7fc927b71..dd0c8e246380 100644
--- a/xpcom/string/public/nsString.h
+++ b/xpcom/string/public/nsString.h
@@ -55,61 +55,60 @@ static_assert(sizeof(nsCString::char_type) == 1,
 class NS_LossyConvertUTF16toASCII : public nsAutoCString
 {
 public:
-  explicit
-  NS_LossyConvertUTF16toASCII( const char16_t* aString )
+  explicit NS_LossyConvertUTF16toASCII(const char16_t* aString)
   {
     LossyAppendUTF16toASCII(aString, *this);
   }
 
-  NS_LossyConvertUTF16toASCII( const char16_t* aString, uint32_t aLength )
+  NS_LossyConvertUTF16toASCII(const char16_t* aString, uint32_t aLength)
   {
     LossyAppendUTF16toASCII(Substring(aString, aLength), *this);
   }
 
 #ifdef MOZ_USE_CHAR16_WRAPPER
-  explicit
-  NS_LossyConvertUTF16toASCII( char16ptr_t aString )
-    : NS_LossyConvertUTF16toASCII(static_cast<const char16_t*>(aString)) {}
+  explicit NS_LossyConvertUTF16toASCII(char16ptr_t aString)
+    : NS_LossyConvertUTF16toASCII(static_cast<const char16_t*>(aString))
+  {
+  }
 
-  NS_LossyConvertUTF16toASCII( char16ptr_t aString, uint32_t aLength )
-    : NS_LossyConvertUTF16toASCII(static_cast<const char16_t*>(aString), aLength) {}
+  NS_LossyConvertUTF16toASCII(char16ptr_t aString, uint32_t aLength)
+    : NS_LossyConvertUTF16toASCII(static_cast<const char16_t*>(aString), aLength)
+  {
+  }
 #endif
 
-  explicit
-  NS_LossyConvertUTF16toASCII( const nsAString& aString )
+  explicit NS_LossyConvertUTF16toASCII(const nsAString& aString)
   {
     LossyAppendUTF16toASCII(aString, *this);
   }
 
 private:
   // NOT TO BE IMPLEMENTED
-  NS_LossyConvertUTF16toASCII( char ) MOZ_DELETE;
+  NS_LossyConvertUTF16toASCII(char) MOZ_DELETE;
 };
 
 
 class NS_ConvertASCIItoUTF16 : public nsAutoString
 {
 public:
-  explicit
-  NS_ConvertASCIItoUTF16( const char* aCString )
+  explicit NS_ConvertASCIItoUTF16(const char* aCString)
   {
     AppendASCIItoUTF16(aCString, *this);
   }
 
-  NS_ConvertASCIItoUTF16( const char* aCString, uint32_t aLength )
+  NS_ConvertASCIItoUTF16(const char* aCString, uint32_t aLength)
   {
     AppendASCIItoUTF16(Substring(aCString, aLength), *this);
   }
 
-  explicit
-  NS_ConvertASCIItoUTF16( const nsACString& aCString )
+  explicit NS_ConvertASCIItoUTF16(const nsACString& aCString)
   {
     AppendASCIItoUTF16(aCString, *this);
   }
 
 private:
   // NOT TO BE IMPLEMENTED
-  NS_ConvertASCIItoUTF16( char16_t ) MOZ_DELETE;
+  NS_ConvertASCIItoUTF16(char16_t) MOZ_DELETE;
 };
 
 
@@ -119,82 +118,83 @@ private:
 class NS_ConvertUTF16toUTF8 : public nsAutoCString
 {
 public:
-  explicit
-  NS_ConvertUTF16toUTF8( const char16_t* aString )
+  explicit NS_ConvertUTF16toUTF8(const char16_t* aString)
   {
     AppendUTF16toUTF8(aString, *this);
   }
 
-  NS_ConvertUTF16toUTF8( const char16_t* aString, uint32_t aLength )
+  NS_ConvertUTF16toUTF8(const char16_t* aString, uint32_t aLength)
   {
     AppendUTF16toUTF8(Substring(aString, aLength), *this);
   }
 
 #ifdef MOZ_USE_CHAR16_WRAPPER
-  NS_ConvertUTF16toUTF8( char16ptr_t aString ) : NS_ConvertUTF16toUTF8(static_cast<const char16_t*>(aString)) {}
+  NS_ConvertUTF16toUTF8(char16ptr_t aString)
+    : NS_ConvertUTF16toUTF8(static_cast<const char16_t*>(aString))
+  {
+  }
 
-  NS_ConvertUTF16toUTF8( char16ptr_t aString, uint32_t aLength )
-    : NS_ConvertUTF16toUTF8(static_cast<const char16_t*>(aString), aLength) {}
+  NS_ConvertUTF16toUTF8(char16ptr_t aString, uint32_t aLength)
+    : NS_ConvertUTF16toUTF8(static_cast<const char16_t*>(aString), aLength)
+  {
+  }
 #endif
 
-  explicit
-  NS_ConvertUTF16toUTF8( const nsAString& aString )
+  explicit NS_ConvertUTF16toUTF8(const nsAString& aString)
   {
     AppendUTF16toUTF8(aString, *this);
   }
 
 private:
   // NOT TO BE IMPLEMENTED
-  NS_ConvertUTF16toUTF8( char ) MOZ_DELETE;
+  NS_ConvertUTF16toUTF8(char) MOZ_DELETE;
 };
 
 
 class NS_ConvertUTF8toUTF16 : public nsAutoString
 {
 public:
-  explicit
-  NS_ConvertUTF8toUTF16( const char* aCString )
+  explicit NS_ConvertUTF8toUTF16(const char* aCString)
   {
     AppendUTF8toUTF16(aCString, *this);
   }
 
-  NS_ConvertUTF8toUTF16( const char* aCString, uint32_t aLength )
+  NS_ConvertUTF8toUTF16(const char* aCString, uint32_t aLength)
   {
     AppendUTF8toUTF16(Substring(aCString, aLength), *this);
   }
 
-  explicit
-  NS_ConvertUTF8toUTF16( const nsACString& aCString )
+  explicit NS_ConvertUTF8toUTF16(const nsACString& aCString)
   {
     AppendUTF8toUTF16(aCString, *this);
   }
 
 private:
   // NOT TO BE IMPLEMENTED
-  NS_ConvertUTF8toUTF16( char16_t ) MOZ_DELETE;
+  NS_ConvertUTF8toUTF16(char16_t) MOZ_DELETE;
 };
 
 
 #ifdef MOZ_USE_CHAR16_WRAPPER
 
 inline char16_t*
-wwc(wchar_t *str)
+wwc(wchar_t* aStr)
 {
-  return reinterpret_cast<char16_t*>(str);
+  return reinterpret_cast<char16_t*>(aStr);
 }
 
 inline wchar_t*
-wwc(char16_t *str)
+wwc(char16_t* aStr)
 {
-  return reinterpret_cast<wchar_t*>(str);
+  return reinterpret_cast<wchar_t*>(aStr);
 }
 
 #else
 
 inline char16_t*
-wwc(char16_t *str)
+wwc(char16_t* aStr)
 {
-  return str;
+  return aStr;
 }
 
 #endif
diff --git a/xpcom/string/public/nsStringBuffer.h b/xpcom/string/public/nsStringBuffer.h
index ab8d28d6aaf2..19d7b9c43d3d 100644
--- a/xpcom/string/public/nsStringBuffer.h
+++ b/xpcom/string/public/nsStringBuffer.h
@@ -45,7 +45,7 @@ public:
    *
    * @return new string buffer or null if out of memory.
    */
-  static already_AddRefed<nsStringBuffer> Alloc(size_t storageSize);
+  static already_AddRefed<nsStringBuffer> Alloc(size_t aStorageSize);
 
   /**
    * Resizes the given string buffer to the specified storage size.  This
@@ -58,7 +58,7 @@ public:
    *
    * @see IsReadonly
    */
-  static nsStringBuffer* Realloc(nsStringBuffer* buf, size_t storageSize);
+  static nsStringBuffer* Realloc(nsStringBuffer* aBuf, size_t aStorageSize);
 
   /**
    * Increment the reference count on this string buffer.
@@ -76,9 +76,9 @@ public:
    * pointer.  The data pointer must have been returned previously by a
    * call to the nsStringBuffer::Data method.
    */
-  static nsStringBuffer* FromData(void* data)
+  static nsStringBuffer* FromData(void* aData)
   {
-    return reinterpret_cast<nsStringBuffer*> (data) - 1;
+    return reinterpret_cast<nsStringBuffer*>(aData) - 1;
   }
 
   /**
@@ -86,7 +86,7 @@ public:
    */
   void* Data() const
   {
-    return const_cast<char*> (reinterpret_cast<const char*> (this + 1));
+    return const_cast<char*>(reinterpret_cast<const char*>(this + 1));
   }
 
   /**
@@ -120,8 +120,8 @@ public:
    * the returned string buffer must have its reference count incremented
    * via a call to the AddRef method.
    */
-  static nsStringBuffer* FromString(const nsAString &str);
-  static nsStringBuffer* FromString(const nsACString &str);
+  static nsStringBuffer* FromString(const nsAString& aStr);
+  static nsStringBuffer* FromString(const nsACString& aStr);
 
   /**
    * The ToString methods assign this string buffer to a given string
@@ -137,10 +137,8 @@ public:
    *       however, string length is always measured in storage units
    *       (2-byte units for wide strings).
    */
-  void ToString(uint32_t len, nsAString &str,
-                bool aMoveOwnership = false);
-  void ToString(uint32_t len, nsACString &str,
-                bool aMoveOwnership = false);
+  void ToString(uint32_t aLen, nsAString& aStr, bool aMoveOwnership = false);
+  void ToString(uint32_t aLen, nsACString& aStr, bool aMoveOwnership = false);
 
   /**
    * This measures the size.  It should only be used if the StringBuffer is
diff --git a/xpcom/string/public/nsStringIterator.h b/xpcom/string/public/nsStringIterator.h
index ac10c4f4dc3d..d853cca505ec 100644
--- a/xpcom/string/public/nsStringIterator.h
+++ b/xpcom/string/public/nsStringIterator.h
@@ -39,33 +39,35 @@ private:
   const CharT* mPosition;
 
 public:
-  nsReadingIterator() { }
+  nsReadingIterator()
+  {
+  }
   // nsReadingIterator( const nsReadingIterator<CharT>& );                    // auto-generated copy-constructor OK
   // nsReadingIterator<CharT>& operator=( const nsReadingIterator<CharT>& );  // auto-generated copy-assignment operator OK
 
-  inline void normalize_forward() {}
-  inline void normalize_backward() {}
+  inline void normalize_forward()
+  {
+  }
+  inline void normalize_backward()
+  {
+  }
 
-  pointer
-  start() const
+  pointer start() const
   {
     return mStart;
   }
 
-  pointer
-  end() const
+  pointer end() const
   {
     return mEnd;
   }
 
-  pointer
-  get() const
+  pointer get() const
   {
     return mPosition;
   }
 
-  CharT
-  operator*() const
+  CharT operator*() const
   {
     return *get();
   }
@@ -73,71 +75,60 @@ public:
 #if 0
   // An iterator really deserves this, but some compilers (notably IBM VisualAge for OS/2)
   //  don't like this when |CharT| is a type without members.
-  pointer
-  operator->() const
+  pointer operator->() const
   {
     return get();
   }
 #endif
 
-  self_type&
-  operator++()
+  self_type& operator++()
   {
     ++mPosition;
     return *this;
   }
 
-  self_type
-  operator++( int )
+  self_type operator++(int)
   {
     self_type result(*this);
     ++mPosition;
     return result;
   }
 
-  self_type&
-  operator--()
+  self_type& operator--()
   {
     --mPosition;
     return *this;
   }
 
-  self_type
-  operator--( int )
+  self_type operator--(int)
   {
     self_type result(*this);
     --mPosition;
     return result;
   }
 
-  difference_type
-  size_forward() const
+  difference_type size_forward() const
   {
     return mEnd - mPosition;
   }
 
-  difference_type
-  size_backward() const
+  difference_type size_backward() const
   {
     return mPosition - mStart;
   }
 
-  self_type&
-  advance( difference_type n )
+  self_type& advance(difference_type aN)
   {
-    if (n > 0)
-    {
-      difference_type step = XPCOM_MIN(n, size_forward());
+    if (aN > 0) {
+      difference_type step = XPCOM_MIN(aN, size_forward());
 
-      NS_ASSERTION(step>0, "can't advance a reading iterator beyond the end of a string");
+      NS_ASSERTION(step > 0, "can't advance a reading iterator beyond the end of a string");
 
       mPosition += step;
-    }
-    else if (n < 0)
-    {
-      difference_type step = XPCOM_MAX(n, -size_backward());
+    } else if (aN < 0) {
+      difference_type step = XPCOM_MAX(aN, -size_backward());
 
-      NS_ASSERTION(step<0, "can't advance (backward) a reading iterator beyond the end of a string");
+      NS_ASSERTION(step < 0, "can't advance (backward) a reading iterator beyond the end of a string");
 
       mPosition += step;
     }
@@ -173,33 +164,35 @@ private:
   CharT* mPosition;
 
 public:
-  nsWritingIterator() { }
+  nsWritingIterator()
+  {
+  }
   // nsWritingIterator( const nsWritingIterator<CharT>& );                    // auto-generated copy-constructor OK
   // nsWritingIterator<CharT>& operator=( const nsWritingIterator<CharT>& );  // auto-generated copy-assignment operator OK
 
-  inline void normalize_forward() {}
-  inline void normalize_backward() {}
+  inline void normalize_forward()
+  {
+  }
+  inline void normalize_backward()
+  {
+  }
 
-  pointer
-  start() const
+  pointer start() const
   {
     return mStart;
   }
 
-  pointer
-  end() const
+  pointer end() const
   {
     return mEnd;
   }
 
-  pointer
-  get() const
+  pointer get() const
   {
     return mPosition;
   }
 
-  reference
-  operator*() const
+  reference operator*() const
   {
     return *get();
   }
@@ -214,94 +207,83 @@ public:
   }
 #endif
 
-  self_type&
-  operator++()
+  self_type& operator++()
   {
     ++mPosition;
     return *this;
   }
 
-  self_type
-  operator++( int )
+  self_type operator++(int)
   {
     self_type result(*this);
     ++mPosition;
     return result;
   }
 
-  self_type&
-  operator--()
+  self_type& operator--()
   {
     --mPosition;
     return *this;
   }
 
-  self_type
-  operator--( int )
+  self_type operator--(int)
   {
     self_type result(*this);
     --mPosition;
     return result;
   }
 
-  difference_type
-  size_forward() const
+  difference_type size_forward() const
   {
     return mEnd - mPosition;
   }
 
-  difference_type
-  size_backward() const
+  difference_type size_backward() const
   {
     return mPosition - mStart;
   }
 
-  self_type&
-  advance( difference_type n )
+  self_type& advance(difference_type aN)
   {
-    if (n > 0)
-    {
-      difference_type step = XPCOM_MIN(n, size_forward());
+    if (aN > 0) {
+      difference_type step = XPCOM_MIN(aN, size_forward());
 
-      NS_ASSERTION(step>0, "can't advance a writing iterator beyond the end of a string");
+      NS_ASSERTION(step > 0, "can't advance a writing iterator beyond the end of a string");
 
       mPosition += step;
-    }
-    else if (n < 0)
-    {
-      difference_type step = XPCOM_MAX(n, -size_backward());
+    } else if (aN < 0) {
+      difference_type step = XPCOM_MAX(aN, -size_backward());
 
-      NS_ASSERTION(step<0, "can't advance (backward) a writing iterator beyond the end of a string");
+      NS_ASSERTION(step < 0, "can't advance (backward) a writing iterator beyond the end of a string");
 
       mPosition += step;
     }
     return *this;
   }
 
-  void
-  write( const value_type* s, uint32_t n )
+  void write(const value_type* aS, uint32_t aN)
   {
     NS_ASSERTION(size_forward() > 0, "You can't |write| into an |nsWritingIterator| with no space!");
 
-    nsCharTraits<value_type>::move(mPosition, s, n);
-    advance( difference_type(n) );
+    nsCharTraits<value_type>::move(mPosition, aS, aN);
+    advance(difference_type(aN));
   }
 };
 
 template <class CharT>
-inline
-bool
-operator==( const nsReadingIterator<CharT>& lhs, const nsReadingIterator<CharT>& rhs )
+inline bool
+operator==(const nsReadingIterator<CharT>& aLhs,
+           const nsReadingIterator<CharT>& aRhs)
 {
-  return lhs.get() == rhs.get();
+  return aLhs.get() == aRhs.get();
 }
 
 template <class CharT>
-inline
-bool
-operator!=( const nsReadingIterator<CharT>& lhs, const nsReadingIterator<CharT>& rhs )
+inline bool
+operator!=(const nsReadingIterator<CharT>& aLhs,
+           const nsReadingIterator<CharT>& aRhs)
 {
-  return lhs.get() != rhs.get();
+  return aLhs.get() != aRhs.get();
 }
 
 
@@ -310,19 +292,19 @@ operator!=( const nsReadingIterator<CharT>& lhs, const nsReadingIterator<CharT>&
 //
 
 template <class CharT>
-inline
-bool
-operator==( const nsWritingIterator<CharT>& lhs, const nsWritingIterator<CharT>& rhs )
+inline bool
+operator==(const nsWritingIterator<CharT>& aLhs,
+           const nsWritingIterator<CharT>& aRhs)
 {
-  return lhs.get() == rhs.get();
+  return aLhs.get() == aRhs.get();
 }
 
 template <class CharT>
-inline
-bool
-operator!=( const nsWritingIterator<CharT>& lhs, const nsWritingIterator<CharT>& rhs )
+inline bool
+operator!=(const nsWritingIterator<CharT>& aLhs,
+           const nsWritingIterator<CharT>& aRhs)
 {
-  return lhs.get() != rhs.get();
+  return aLhs.get() != aRhs.get();
 }
 
 #endif /* !defined(nsStringIterator_h___) */
diff --git a/xpcom/string/public/nsTDependentString.h b/xpcom/string/public/nsTDependentString.h
index a554a667d14a..b4951e831f50 100644
--- a/xpcom/string/public/nsTDependentString.h
+++ b/xpcom/string/public/nsTDependentString.h
@@ -20,7 +20,7 @@ class nsTDependentString_CharT : public nsTString_CharT
 {
 public:
 
-  typedef nsTDependentString_CharT    self_type;
+  typedef nsTDependentString_CharT self_type;
 
 public:
 
@@ -28,45 +28,53 @@ public:
    * constructors
    */
 
-  nsTDependentString_CharT( const char_type* start, const char_type* end )
-    : string_type(const_cast<char_type*>(start), uint32_t(end - start), F_TERMINATED)
+  nsTDependentString_CharT(const char_type* aStart, const char_type* aEnd)
+    : string_type(const_cast<char_type*>(aStart),
+                  uint32_t(aEnd - aStart), F_TERMINATED)
   {
     AssertValidDepedentString();
   }
 
-  nsTDependentString_CharT( const char_type* data, uint32_t length )
-    : string_type(const_cast<char_type*>(data), length, F_TERMINATED)
+  nsTDependentString_CharT(const char_type* aData, uint32_t aLength)
+    : string_type(const_cast<char_type*>(aData), aLength, F_TERMINATED)
   {
     AssertValidDepedentString();
   }
 
 #if defined(CharT_is_PRUnichar) && defined(MOZ_USE_CHAR16_WRAPPER)
-  nsTDependentString_CharT( char16ptr_t data, uint32_t length )
-    : nsTDependentString_CharT(static_cast<const char16_t*>(data), length) {}
+  nsTDependentString_CharT(char16ptr_t aData, uint32_t aLength)
+    : nsTDependentString_CharT(static_cast<const char16_t*>(aData), aLength)
+  {
+  }
 #endif
 
   explicit
-  nsTDependentString_CharT( const char_type* data )
-    : string_type(const_cast<char_type*>(data), uint32_t(char_traits::length(data)), F_TERMINATED)
+  nsTDependentString_CharT(const char_type* aData)
+    : string_type(const_cast<char_type*>(aData),
+                  uint32_t(char_traits::length(aData)), F_TERMINATED)
   {
     AssertValidDepedentString();
   }
 
 #if defined(CharT_is_PRUnichar) && defined(MOZ_USE_CHAR16_WRAPPER)
   explicit
-  nsTDependentString_CharT( char16ptr_t data )
-    : nsTDependentString_CharT( static_cast<const char16_t*>(data)) {}
+  nsTDependentString_CharT(char16ptr_t aData)
+    : nsTDependentString_CharT(static_cast<const char16_t*>(aData))
+  {
+  }
 #endif
 
-  nsTDependentString_CharT( const string_type& str, uint32_t startPos )
+  nsTDependentString_CharT(const string_type& aStr, uint32_t aStartPos)
     : string_type()
   {
-    Rebind(str, startPos);
+    Rebind(aStr, aStartPos);
   }
 
   // Create a nsTDependentSubstring to be bound later
   nsTDependentString_CharT()
-    : string_type() {}
+    : string_type()
+  {
+  }
 
   // XXX are you sure??
   // auto-generated copy-constructor OK
@@ -79,20 +87,20 @@ public:
    */
 
   using nsTString_CharT::Rebind;
-  void Rebind( const char_type* data )
+  void Rebind(const char_type* aData)
   {
-    Rebind(data, uint32_t(char_traits::length(data)));
+    Rebind(aData, uint32_t(char_traits::length(aData)));
   }
 
-  void Rebind( const char_type* start, const char_type* end )
+  void Rebind(const char_type* aStart, const char_type* aEnd)
   {
-    Rebind(start, uint32_t(end - start));
+    Rebind(aStart, uint32_t(aEnd - aStart));
   }
 
-  void Rebind( const string_type&, uint32_t startPos );
+  void Rebind(const string_type&, uint32_t aStartPos);
 
 private:
 
   // NOT USED
-  nsTDependentString_CharT( const substring_tuple_type& ) MOZ_DELETE;
+  nsTDependentString_CharT(const substring_tuple_type&) MOZ_DELETE;
 };
diff --git a/xpcom/string/public/nsTDependentSubstring.h b/xpcom/string/public/nsTDependentSubstring.h
index c2a2163b0df3..dd28f32f94e8 100644
--- a/xpcom/string/public/nsTDependentSubstring.h
+++ b/xpcom/string/public/nsTDependentSubstring.h
@@ -20,91 +20,105 @@ class nsTDependentSubstring_CharT : public nsTSubstring_CharT
 {
 public:
 
-  typedef nsTDependentSubstring_CharT    self_type;
+  typedef nsTDependentSubstring_CharT self_type;
 
 public:
 
-  void Rebind( const substring_type&, uint32_t startPos, uint32_t length = size_type(-1) );
+  void Rebind(const substring_type&, uint32_t aStartPos,
+              uint32_t aLength = size_type(-1));
 
-  void Rebind( const char_type* data, size_type length );
+  void Rebind(const char_type* aData, size_type aLength);
 
-  void Rebind( const char_type* start, const char_type* end )
+  void Rebind(const char_type* aStart, const char_type* aEnd)
   {
-    Rebind(start, size_type(end - start));
+    Rebind(aStart, size_type(aEnd - aStart));
   }
 
-  nsTDependentSubstring_CharT( const substring_type& str, uint32_t startPos, uint32_t length = size_type(-1) )
+  nsTDependentSubstring_CharT(const substring_type& aStr, uint32_t aStartPos,
+                              uint32_t aLength = size_type(-1))
     : substring_type()
   {
-    Rebind(str, startPos, length);
+    Rebind(aStr, aStartPos, aLength);
   }
 
-  nsTDependentSubstring_CharT( const char_type* data, size_type length )
-    : substring_type(const_cast<char_type*>(data), length, F_NONE) {}
+  nsTDependentSubstring_CharT(const char_type* aData, size_type aLength)
+    : substring_type(const_cast<char_type*>(aData), aLength, F_NONE)
+  {
+  }
 
-  nsTDependentSubstring_CharT( const char_type* start, const char_type* end )
-    : substring_type(const_cast<char_type*>(start), uint32_t(end - start), F_NONE) {}
+  nsTDependentSubstring_CharT(const char_type* aStart, const char_type* aEnd)
+    : substring_type(const_cast<char_type*>(aStart), uint32_t(aEnd - aStart),
+                     F_NONE)
+  {
+  }
 
 #if defined(CharT_is_PRUnichar) && defined(MOZ_USE_CHAR16_WRAPPER)
-  nsTDependentSubstring_CharT( char16ptr_t data, size_type length )
-    : nsTDependentSubstring_CharT(static_cast<const char16_t*>(data), length) {}
+  nsTDependentSubstring_CharT(char16ptr_t aData, size_type aLength)
+    : nsTDependentSubstring_CharT(static_cast<const char16_t*>(aData), aLength)
+  {
+  }
 
-  nsTDependentSubstring_CharT( char16ptr_t start, char16ptr_t end )
-    : nsTDependentSubstring_CharT(static_cast<const char16_t*>(start), static_cast<const char16_t*>(end)) {}
+  nsTDependentSubstring_CharT(char16ptr_t aStart, char16ptr_t aEnd)
+    : nsTDependentSubstring_CharT(static_cast<const char16_t*>(aStart),
+                                  static_cast<const char16_t*>(aEnd))
+  {
+  }
 #endif
 
-  nsTDependentSubstring_CharT( const const_iterator& start, const const_iterator& end )
-    : substring_type(const_cast<char_type*>(start.get()), uint32_t(end.get() - start.get()), F_NONE) {}
+  nsTDependentSubstring_CharT(const const_iterator& aStart,
+                              const const_iterator& aEnd)
+    : substring_type(const_cast<char_type*>(aStart.get()),
+                     uint32_t(aEnd.get() - aStart.get()), F_NONE)
+  {
+  }
 
   // Create a nsTDependentSubstring to be bound later
   nsTDependentSubstring_CharT()
-    : substring_type() {}
+    : substring_type()
+  {
+  }
 
   // auto-generated copy-constructor OK (XXX really?? what about base class copy-ctor?)
 
 private:
   // NOT USED
-  void operator=( const self_type& );        // we're immutable, you can't assign into a substring
+  void operator=(const self_type&);  // we're immutable, you can't assign into a substring
 };
 
-inline
-const nsTDependentSubstring_CharT
-Substring( const nsTSubstring_CharT& str, uint32_t startPos, uint32_t length = uint32_t(-1) )
+inline const nsTDependentSubstring_CharT
+Substring(const nsTSubstring_CharT& aStr, uint32_t aStartPos,
+          uint32_t aLength = uint32_t(-1))
 {
-  return nsTDependentSubstring_CharT(str, startPos, length);
+  return nsTDependentSubstring_CharT(aStr, aStartPos, aLength);
 }
 
-inline
-const nsTDependentSubstring_CharT
-Substring( const nsReadingIterator<CharT>& start, const nsReadingIterator<CharT>& end )
+inline const nsTDependentSubstring_CharT
+Substring(const nsReadingIterator<CharT>& aStart,
+          const nsReadingIterator<CharT>& aEnd)
 {
-  return nsTDependentSubstring_CharT(start.get(), end.get());
+  return nsTDependentSubstring_CharT(aStart.get(), aEnd.get());
 }
 
-inline
-const nsTDependentSubstring_CharT
-Substring( const CharT* data, uint32_t length )
+inline const nsTDependentSubstring_CharT
+Substring(const CharT* aData, uint32_t aLength)
 {
-  return nsTDependentSubstring_CharT(data, length);
+  return nsTDependentSubstring_CharT(aData, aLength);
 }
 
-inline
-const nsTDependentSubstring_CharT
-Substring( const CharT* start, const CharT* end )
+inline const nsTDependentSubstring_CharT
+Substring(const CharT* aStart, const CharT* aEnd)
 {
-  return nsTDependentSubstring_CharT(start, end);
+  return nsTDependentSubstring_CharT(aStart, aEnd);
 }
 
-inline
-const nsTDependentSubstring_CharT
-StringHead( const nsTSubstring_CharT& str, uint32_t count )
+inline const nsTDependentSubstring_CharT
+StringHead(const nsTSubstring_CharT& aStr, uint32_t aCount)
 {
-  return nsTDependentSubstring_CharT(str, 0, count);
+  return nsTDependentSubstring_CharT(aStr, 0, aCount);
 }
 
-inline
-const nsTDependentSubstring_CharT
-StringTail( const nsTSubstring_CharT& str, uint32_t count )
+inline const nsTDependentSubstring_CharT
+StringTail(const nsTSubstring_CharT& aStr, uint32_t aCount)
 {
-  return nsTDependentSubstring_CharT(str, str.Length() - count, count);
+  return nsTDependentSubstring_CharT(aStr, aStr.Length() - aCount, aCount);
 }
diff --git a/xpcom/string/public/nsTLiteralString.h b/xpcom/string/public/nsTLiteralString.h
index e18a5467f5bb..b69993c188c9 100644
--- a/xpcom/string/public/nsTLiteralString.h
+++ b/xpcom/string/public/nsTLiteralString.h
@@ -19,7 +19,7 @@ class nsTLiteralString_CharT : public nsTString_CharT
 {
 public:
 
-  typedef nsTLiteralString_CharT    self_type;
+  typedef nsTLiteralString_CharT self_type;
 
 public:
 
@@ -28,8 +28,8 @@ public:
    */
 
   template<size_type N>
-  nsTLiteralString_CharT( const char_type (&str)[N] )
-    : string_type(const_cast<char_type*>(str), N - 1, F_TERMINATED | F_LITERAL)
+  nsTLiteralString_CharT(const char_type (&aStr)[N])
+    : string_type(const_cast<char_type*>(aStr), N - 1, F_TERMINATED | F_LITERAL)
   {
   }
 
@@ -37,5 +37,5 @@ private:
 
   // NOT TO BE IMPLEMENTED
   template<size_type N>
-  nsTLiteralString_CharT( char_type (&str)[N] ) MOZ_DELETE;
+  nsTLiteralString_CharT(char_type (&aStr)[N]) MOZ_DELETE;
 };
diff --git a/xpcom/string/public/nsTPromiseFlatString.h b/xpcom/string/public/nsTPromiseFlatString.h
index 8147c2de1992..763b2dfdf752 100644
--- a/xpcom/string/public/nsTPromiseFlatString.h
+++ b/xpcom/string/public/nsTPromiseFlatString.h
@@ -62,37 +62,37 @@ class nsTPromiseFlatString_CharT : public nsTString_CharT
 {
 public:
 
-  typedef nsTPromiseFlatString_CharT    self_type;
+  typedef nsTPromiseFlatString_CharT self_type;
 
 private:
 
-  void Init( const substring_type& );
+  void Init(const substring_type&);
 
   // NOT TO BE IMPLEMENTED
-  void operator=( const self_type& ) MOZ_DELETE;
+  void operator=(const self_type&) MOZ_DELETE;
 
   // NOT TO BE IMPLEMENTED
   nsTPromiseFlatString_CharT() MOZ_DELETE;
 
   // NOT TO BE IMPLEMENTED
-  nsTPromiseFlatString_CharT( const string_type& str ) MOZ_DELETE;
+  nsTPromiseFlatString_CharT(const string_type& aStr) MOZ_DELETE;
 
 public:
 
   explicit
-  nsTPromiseFlatString_CharT( const substring_type& str )
+  nsTPromiseFlatString_CharT(const substring_type& aStr)
     : string_type()
   {
-    Init(str);
+    Init(aStr);
   }
 
   explicit
-  nsTPromiseFlatString_CharT( const substring_tuple_type& tuple )
+  nsTPromiseFlatString_CharT(const substring_tuple_type& aTuple)
     : string_type()
   {
     // nothing else to do here except assign the value of the tuple
     // into ourselves.
-    Assign(tuple);
+    Assign(aTuple);
   }
 };
 
@@ -100,7 +100,7 @@ public:
 // parameter. This allows us to reject attempts to promise a flat flat string.
 template<class T>
 const nsTPromiseFlatString_CharT
-TPromiseFlatString_CharT( const T& string )
+TPromiseFlatString_CharT(const T& aString)
 {
-  return nsTPromiseFlatString_CharT(string);
+  return nsTPromiseFlatString_CharT(aString);
 }
diff --git a/xpcom/string/public/nsTString.h b/xpcom/string/public/nsTString.h
index a92212d25f9f..6871937d9a25 100644
--- a/xpcom/string/public/nsTString.h
+++ b/xpcom/string/public/nsTString.h
@@ -21,7 +21,7 @@ class nsTString_CharT : public nsTSubstring_CharT
 {
 public:
 
-  typedef nsTString_CharT    self_type;
+  typedef nsTString_CharT self_type;
 
 public:
 
@@ -30,53 +30,79 @@ public:
    */
 
   nsTString_CharT()
-    : substring_type() {}
-
-  explicit
-  nsTString_CharT( const char_type* data, size_type length = size_type(-1) )
     : substring_type()
   {
-    Assign(data, length);
+  }
+
+  explicit
+  nsTString_CharT(const char_type* aData, size_type aLength = size_type(-1))
+    : substring_type()
+  {
+    Assign(aData, aLength);
   }
 
 #if defined(CharT_is_PRUnichar) && defined(MOZ_USE_CHAR16_WRAPPER)
   explicit
-  nsTString_CharT( char16ptr_t data, size_type length = size_type(-1) )
+  nsTString_CharT(char16ptr_t aStr, size_type aLength = size_type(-1))
     : substring_type()
   {
-    Assign(static_cast<const char16_t*>(data), length);
+    Assign(static_cast<const char16_t*>(aStr), aLength);
   }
 #endif
 
-  nsTString_CharT( const self_type& str )
+  nsTString_CharT(const self_type& aStr)
     : substring_type()
   {
-    Assign(str);
+    Assign(aStr);
   }
 
-  MOZ_IMPLICIT nsTString_CharT( const substring_tuple_type& tuple )
+  MOZ_IMPLICIT nsTString_CharT(const substring_tuple_type& aTuple)
     : substring_type()
   {
-    Assign(tuple);
+    Assign(aTuple);
   }
 
   explicit
-  nsTString_CharT( const substring_type& readable )
+  nsTString_CharT(const substring_type& aReadable)
     : substring_type()
   {
-    Assign(readable);
+    Assign(aReadable);
   }
 
 
   // |operator=| does not inherit, so we must define our own
-  self_type& operator=( char_type c )                       { Assign(c);     return *this; }
-  self_type& operator=( const char_type* data )             { Assign(data);  return *this; }
-  self_type& operator=( const self_type& str )              { Assign(str);   return *this; }
+  self_type& operator=(char_type aChar)
+  {
+    Assign(aChar);
+    return *this;
+  }
+  self_type& operator=(const char_type* aData)
+  {
+    Assign(aData);
+    return *this;
+  }
+  self_type& operator=(const self_type& aStr)
+  {
+    Assign(aStr);
+    return *this;
+  }
 #if defined(CharT_is_PRUnichar) && defined(MOZ_USE_CHAR16_WRAPPER)
-  self_type& operator=( const char16ptr_t data )            { Assign(static_cast<const char16_t*>(data)); return *this; }
+  self_type& operator=(const char16ptr_t aStr)
+  {
+    Assign(static_cast<const char16_t*>(aStr));
+    return *this;
+  }
 #endif
-  self_type& operator=( const substring_type& str )         { Assign(str);   return *this; }
-  self_type& operator=( const substring_tuple_type& tuple ) { Assign(tuple); return *this; }
+  self_type& operator=(const substring_type& aStr)
+  {
+    Assign(aStr);
+    return *this;
+  }
+  self_type& operator=(const substring_tuple_type& aTuple)
+  {
+    Assign(aTuple);
+    return *this;
+  }
 
   /**
    * returns the null-terminated string
@@ -99,15 +125,15 @@ public:
    *       the null terminator character.
    */
 
-  char_type CharAt( index_type i ) const
+  char_type CharAt(index_type aIndex) const
   {
-    NS_ASSERTION(i <= mLength, "index exceeds allowable range");
-    return mData[i];
+    NS_ASSERTION(aIndex <= mLength, "index exceeds allowable range");
+    return mData[aIndex];
   }
 
-  char_type operator[]( index_type i ) const
+  char_type operator[](index_type aIndex) const
   {
-    return CharAt(i);
+    return CharAt(aIndex);
   }
 
 
@@ -125,14 +151,19 @@ public:
    *  @return  offset in string, or kNotFound
    */
 
-  int32_t Find( const nsCString& aString, bool aIgnoreCase=false, int32_t aOffset=0, int32_t aCount=-1 ) const;
-  int32_t Find( const char* aString, bool aIgnoreCase=false, int32_t aOffset=0, int32_t aCount=-1 ) const;
+  int32_t Find(const nsCString& aString, bool aIgnoreCase = false,
+               int32_t aOffset = 0, int32_t aCount = -1) const;
+  int32_t Find(const char* aString, bool aIgnoreCase = false,
+               int32_t aOffset = 0, int32_t aCount = -1) const;
 
 #ifdef CharT_is_PRUnichar
-  int32_t Find( const nsAFlatString& aString, int32_t aOffset=0, int32_t aCount=-1 ) const;
-  int32_t Find( const char16_t* aString, int32_t aOffset=0, int32_t aCount=-1 ) const;
+  int32_t Find(const nsAFlatString& aString, int32_t aOffset = 0,
+               int32_t aCount = -1) const;
+  int32_t Find(const char16_t* aString, int32_t aOffset = 0,
+               int32_t aCount = -1) const;
 #ifdef MOZ_USE_CHAR16_WRAPPER
-  int32_t Find( char16ptr_t aString, int32_t aOffset=0, int32_t aCount=-1 ) const
+  int32_t Find(char16ptr_t aString, int32_t aOffset = 0,
+               int32_t aCount = -1) const
   {
     return Find(static_cast<const char16_t*>(aString), aOffset, aCount);
   }
@@ -152,12 +183,16 @@ public:
    * @return  offset in string, or kNotFound
    */
 
-  int32_t RFind( const nsCString& aString, bool aIgnoreCase=false, int32_t aOffset=-1, int32_t aCount=-1 ) const;
-  int32_t RFind( const char* aCString, bool aIgnoreCase=false, int32_t aOffset=-1, int32_t aCount=-1 ) const;
+  int32_t RFind(const nsCString& aString, bool aIgnoreCase = false,
+                int32_t aOffset = -1, int32_t aCount = -1) const;
+  int32_t RFind(const char* aCString, bool aIgnoreCase = false,
+                int32_t aOffset = -1, int32_t aCount = -1) const;
 
 #ifdef CharT_is_PRUnichar
-  int32_t RFind( const nsAFlatString& aString, int32_t aOffset=-1, int32_t aCount=-1 ) const;
-  int32_t RFind( const char16_t* aString, int32_t aOffset=-1, int32_t aCount=-1 ) const;
+  int32_t RFind(const nsAFlatString& aString, int32_t aOffset = -1,
+                int32_t aCount = -1) const;
+  int32_t RFind(const char16_t* aString, int32_t aOffset = -1,
+                int32_t aCount = -1) const;
 #endif
 
 
@@ -172,7 +207,8 @@ public:
    */
 
   // int32_t FindChar( char16_t aChar, int32_t aOffset=0, int32_t aCount=-1 ) const;
-  int32_t RFindChar( char16_t aChar, int32_t aOffset=-1, int32_t aCount=-1 ) const;
+  int32_t RFindChar(char16_t aChar, int32_t aOffset = -1,
+                    int32_t aCount = -1) const;
 
 
   /**
@@ -185,14 +221,14 @@ public:
    * @return offset in string, or kNotFound
    */
 
-  int32_t FindCharInSet( const char* aString, int32_t aOffset=0 ) const;
-  int32_t FindCharInSet( const self_type& aString, int32_t aOffset=0 ) const
+  int32_t FindCharInSet(const char* aString, int32_t aOffset = 0) const;
+  int32_t FindCharInSet(const self_type& aString, int32_t aOffset = 0) const
   {
     return FindCharInSet(aString.get(), aOffset);
   }
 
 #ifdef CharT_is_PRUnichar
-  int32_t FindCharInSet( const char16_t* aString, int32_t aOffset=0 ) const;
+  int32_t FindCharInSet(const char16_t* aString, int32_t aOffset = 0) const;
 #endif
 
 
@@ -206,8 +242,8 @@ public:
    * @return offset in string, or kNotFound
    */
 
-  int32_t RFindCharInSet( const char_type* aString, int32_t aOffset=-1 ) const;
-  int32_t RFindCharInSet( const self_type& aString, int32_t aOffset=-1 ) const
+  int32_t RFindCharInSet(const char_type* aString, int32_t aOffset = -1) const;
+  int32_t RFindCharInSet(const self_type& aString, int32_t aOffset = -1) const
   {
     return RFindCharInSet(aString.get(), aOffset);
   }
@@ -223,7 +259,8 @@ public:
    */
 
 #ifdef CharT_is_char
-  int32_t Compare( const char* aString, bool aIgnoreCase=false, int32_t aCount=-1 ) const;
+  int32_t Compare(const char* aString, bool aIgnoreCase = false,
+                  int32_t aCount = -1) const;
 #endif
 
 
@@ -236,11 +273,12 @@ public:
    * @return  boolean
    */
 #ifdef CharT_is_char
-  bool EqualsIgnoreCase( const char* aString, int32_t aCount=-1 ) const {
+  bool EqualsIgnoreCase(const char* aString, int32_t aCount = -1) const
+  {
     return Compare(aString, true, aCount) == 0;
   }
 #else
-  bool EqualsIgnoreCase( const char* aString, int32_t aCount=-1 ) const;
+  bool EqualsIgnoreCase(const char* aString, int32_t aCount = -1) const;
 
 
 #endif // !CharT_is_PRUnichar
@@ -251,7 +289,7 @@ public:
    * @param   aErrorCode will contain error if one occurs
    * @return  double-precision float rep of string value
    */
-  double ToDouble( nsresult* aErrorCode ) const;
+  double ToDouble(nsresult* aErrorCode) const;
 
   /**
    * Perform string to single-precision float conversion.
@@ -259,7 +297,8 @@ public:
    * @param   aErrorCode will contain error if one occurs
    * @return  single-precision float rep of string value
    */
-  float ToFloat( nsresult* aErrorCode ) const {
+  float ToFloat(nsresult* aErrorCode) const
+  {
     return (float)ToDouble(aErrorCode);
   }
 
@@ -270,7 +309,7 @@ public:
    * @param   aRadix tells us which radix to assume; kAutoDetect tells us to determine the radix for you.
    * @return  int rep of string value, and possible (out) error code
    */
-  int32_t ToInteger( nsresult* aErrorCode, uint32_t aRadix=kRadix10 ) const;
+  int32_t ToInteger(nsresult* aErrorCode, uint32_t aRadix = kRadix10) const;
 
   /**
    * Perform string to 64-bit int conversion.
@@ -278,7 +317,7 @@ public:
    * @param   aRadix tells us which radix to assume; kAutoDetect tells us to determine the radix for you.
    * @return  64-bit int rep of string value, and possible (out) error code
    */
-  int64_t ToInteger64( nsresult* aErrorCode, uint32_t aRadix=kRadix10 ) const;
+  int64_t ToInteger64(nsresult* aErrorCode, uint32_t aRadix = kRadix10) const;
 
 
   /**
@@ -298,14 +337,14 @@ public:
    * aWritable = Substring(aReadable, 0, 17);
    */
 
-  size_type Mid( self_type& aResult, uint32_t aStartPos, uint32_t aCount ) const;
+  size_type Mid(self_type& aResult, uint32_t aStartPos, uint32_t aCount) const;
 
-  size_type Left( self_type& aResult, size_type aCount ) const
+  size_type Left(self_type& aResult, size_type aCount) const
   {
     return Mid(aResult, 0, aCount);
   }
 
-  size_type Right( self_type& aResult, size_type aCount ) const
+  size_type Right(self_type& aResult, size_type aCount) const
   {
     aCount = XPCOM_MIN(mLength, aCount);
     return Mid(aResult, mLength - aCount, aCount);
@@ -320,7 +359,7 @@ public:
    * @return TRUE if successful
    */
 
-  bool SetCharAt( char16_t aChar, uint32_t aIndex );
+  bool SetCharAt(char16_t aChar, uint32_t aIndex);
 
 
   /**
@@ -329,7 +368,7 @@ public:
    *
    *  @param  aSet -- characters to be cut from this
    */
-  void StripChars( const char* aSet );
+  void StripChars(const char* aSet);
 
 
   /**
@@ -342,13 +381,13 @@ public:
    *  swaps occurence of 1 string for another
    */
 
-  void ReplaceChar( char_type aOldChar, char_type aNewChar );
-  void ReplaceChar( const char* aSet, char_type aNewChar );
+  void ReplaceChar(char_type aOldChar, char_type aNewChar);
+  void ReplaceChar(const char* aSet, char_type aNewChar);
 #ifdef CharT_is_PRUnichar
-  void ReplaceChar( const char16_t* aSet, char16_t aNewChar );
+  void ReplaceChar(const char16_t* aSet, char16_t aNewChar);
 #endif
-  void ReplaceSubstring( const self_type& aTarget, const self_type& aNewValue);
-  void ReplaceSubstring( const char_type* aTarget, const char_type* aNewValue);
+  void ReplaceSubstring(const self_type& aTarget, const self_type& aNewValue);
+  void ReplaceSubstring(const char_type* aTarget, const char_type* aNewValue);
 
 
   /**
@@ -361,7 +400,8 @@ public:
    *  @param   aIgnoreQuotes -- if true, causes surrounding quotes to be ignored
    *  @return  this
    */
-  void Trim( const char* aSet, bool aEliminateLeading=true, bool aEliminateTrailing=true, bool aIgnoreQuotes=false );
+  void Trim(const char* aSet, bool aEliminateLeading = true,
+            bool aEliminateTrailing = true, bool aIgnoreQuotes = false);
 
   /**
    *  This method strips whitespace from string.
@@ -371,15 +411,17 @@ public:
    *  @param   aEliminateLeading controls stripping of leading ws
    *  @param   aEliminateTrailing controls stripping of trailing ws
    */
-  void CompressWhitespace( bool aEliminateLeading=true, bool aEliminateTrailing=true );
+  void CompressWhitespace(bool aEliminateLeading = true,
+                          bool aEliminateTrailing = true);
 
 
   /**
    * assign/append/insert with _LOSSY_ conversion
    */
 
-  void AssignWithConversion( const nsTAString_IncompatibleCharT& aString );
-  void AssignWithConversion( const incompatible_char_type* aData, int32_t aLength=-1 );
+  void AssignWithConversion(const nsTAString_IncompatibleCharT& aString);
+  void AssignWithConversion(const incompatible_char_type* aData,
+                            int32_t aLength = -1);
 
 #endif // !MOZ_STRING_WITH_OBSOLETE_API
 
@@ -388,7 +430,7 @@ public:
    * until the string is rebound or mutated; the caller
    * must ensure that the buffer outlives the string.
    */
-  void Rebind( const char_type* data, size_type length );
+  void Rebind(const char_type* aData, size_type aLength);
 
   /**
    * verify restrictions for dependent strings
@@ -397,19 +439,25 @@ public:
   {
     NS_ASSERTION(mData, "nsTDependentString must wrap a non-NULL buffer");
     NS_ASSERTION(mLength != size_type(-1), "nsTDependentString has bogus length");
-    NS_ASSERTION(mData[mLength] == 0, "nsTDependentString must wrap only null-terminated strings. You are probably looking for nsTDependentSubstring.");
+    NS_ASSERTION(mData[mLength] == 0,
+                 "nsTDependentString must wrap only null-terminated strings. "
+                 "You are probably looking for nsTDependentSubstring.");
   }
 
 
 protected:
 
   explicit
-  nsTString_CharT( uint32_t flags )
-    : substring_type(flags) {}
+  nsTString_CharT(uint32_t aFlags)
+    : substring_type(aFlags)
+  {
+  }
 
   // allow subclasses to initialize fields directly
-  nsTString_CharT( char_type* data, size_type length, uint32_t flags )
-    : substring_type(data, length, flags) {}
+  nsTString_CharT(char_type* aData, size_type aLength, uint32_t aFlags)
+    : substring_type(aData, aLength, aFlags)
+  {
+  }
 };
 
 
@@ -417,48 +465,67 @@ class nsTFixedString_CharT : public nsTString_CharT
 {
 public:
 
-  typedef nsTFixedString_CharT    self_type;
-  typedef nsTFixedString_CharT    fixed_string_type;
+  typedef nsTFixedString_CharT self_type;
+  typedef nsTFixedString_CharT fixed_string_type;
 
 public:
 
   /**
-   * @param data
+   * @param aData
    *        fixed-size buffer to be used by the string (the contents of
    *        this buffer may be modified by the string)
-   * @param storageSize
+   * @param aStorageSize
    *        the size of the fixed buffer
-   * @param length (optional)
+   * @param aLength (optional)
    *        the length of the string already contained in the buffer
    */
 
-  nsTFixedString_CharT( char_type* data, size_type storageSize )
-    : string_type(data, uint32_t(char_traits::length(data)), F_TERMINATED | F_FIXED | F_CLASS_FIXED)
-    , mFixedCapacity(storageSize - 1)
-    , mFixedBuf(data)
-  {}
+  nsTFixedString_CharT(char_type* aData, size_type aStorageSize)
+    : string_type(aData, uint32_t(char_traits::length(aData)),
+                  F_TERMINATED | F_FIXED | F_CLASS_FIXED)
+    , mFixedCapacity(aStorageSize - 1)
+    , mFixedBuf(aData)
+  {
+  }
 
-  nsTFixedString_CharT( char_type* data, size_type storageSize, size_type length )
-    : string_type(data, length, F_TERMINATED | F_FIXED | F_CLASS_FIXED)
-    , mFixedCapacity(storageSize - 1)
-    , mFixedBuf(data)
+  nsTFixedString_CharT(char_type* aData, size_type aStorageSize,
+                       size_type aLength)
+    : string_type(aData, aLength, F_TERMINATED | F_FIXED | F_CLASS_FIXED)
+    , mFixedCapacity(aStorageSize - 1)
+    , mFixedBuf(aData)
   {
     // null-terminate
-    mFixedBuf[length] = char_type(0);
+    mFixedBuf[aLength] = char_type(0);
   }
 
   // |operator=| does not inherit, so we must define our own
-  self_type& operator=( char_type c )                       { Assign(c);     return *this; }
-  self_type& operator=( const char_type* data )             { Assign(data);  return *this; }
-  self_type& operator=( const substring_type& str )         { Assign(str);   return *this; }
-  self_type& operator=( const substring_tuple_type& tuple ) { Assign(tuple); return *this; }
+  self_type& operator=(char_type aChar)
+  {
+    Assign(aChar);
+    return *this;
+  }
+  self_type& operator=(const char_type* aData)
+  {
+    Assign(aData);
+    return *this;
+  }
+  self_type& operator=(const substring_type& aStr)
+  {
+    Assign(aStr);
+    return *this;
+  }
+  self_type& operator=(const substring_tuple_type& aTuple)
+  {
+    Assign(aTuple);
+    return *this;
+  }
 
 protected:
 
   friend class nsTSubstring_CharT;
 
   size_type  mFixedCapacity;
-  char_type *mFixedBuf;
+  char_type* mFixedBuf;
 };
 
 
@@ -478,7 +545,7 @@ class nsTAutoString_CharT : public nsTFixedString_CharT
 {
 public:
 
-  typedef nsTAutoString_CharT    self_type;
+  typedef nsTAutoString_CharT self_type;
 
 public:
 
@@ -488,59 +555,88 @@ public:
 
   nsTAutoString_CharT()
     : fixed_string_type(mStorage, kDefaultStorageSize, 0)
-  {}
-
-  explicit
-  nsTAutoString_CharT( char_type c )
-    : fixed_string_type(mStorage, kDefaultStorageSize, 0)
   {
-    Assign(c);
   }
 
   explicit
-  nsTAutoString_CharT( const char_type* data, size_type length = size_type(-1) )
+  nsTAutoString_CharT(char_type aChar)
     : fixed_string_type(mStorage, kDefaultStorageSize, 0)
   {
-    Assign(data, length);
+    Assign(aChar);
+  }
+
+  explicit
+  nsTAutoString_CharT(const char_type* aData, size_type aLength = size_type(-1))
+    : fixed_string_type(mStorage, kDefaultStorageSize, 0)
+  {
+    Assign(aData, aLength);
   }
 
 #if defined(CharT_is_PRUnichar) && defined(MOZ_USE_CHAR16_WRAPPER)
   explicit
-  nsTAutoString_CharT( char16ptr_t data, size_type length = size_type(-1) )
-    : nsTAutoString_CharT(static_cast<const char16_t*>(data), length)
-  {}
+  nsTAutoString_CharT(char16ptr_t aData, size_type aLength = size_type(-1))
+    : nsTAutoString_CharT(static_cast<const char16_t*>(aData), aLength)
+  {
+  }
 #endif
 
-  nsTAutoString_CharT( const self_type& str )
+  nsTAutoString_CharT(const self_type& aStr)
     : fixed_string_type(mStorage, kDefaultStorageSize, 0)
   {
-    Assign(str);
+    Assign(aStr);
   }
 
   explicit
-  nsTAutoString_CharT( const substring_type& str )
+  nsTAutoString_CharT(const substring_type& aStr)
     : fixed_string_type(mStorage, kDefaultStorageSize, 0)
   {
-    Assign(str);
+    Assign(aStr);
   }
 
-  MOZ_IMPLICIT nsTAutoString_CharT( const substring_tuple_type& tuple )
+  MOZ_IMPLICIT nsTAutoString_CharT(const substring_tuple_type& aTuple)
     : fixed_string_type(mStorage, kDefaultStorageSize, 0)
   {
-    Assign(tuple);
+    Assign(aTuple);
   }
 
   // |operator=| does not inherit, so we must define our own
-  self_type& operator=( char_type c )                       { Assign(c);     return *this; }
-  self_type& operator=( const char_type* data )             { Assign(data);  return *this; }
+  self_type& operator=(char_type aChar)
+  {
+    Assign(aChar);
+    return *this;
+  }
+  self_type& operator=(const char_type* aData)
+  {
+    Assign(aData);
+    return *this;
+  }
 #if defined(CharT_is_PRUnichar) && defined(MOZ_USE_CHAR16_WRAPPER)
-  self_type& operator=( char16ptr_t data )                  { Assign(data);  return *this; }
+  self_type& operator=(char16ptr_t aStr)
+  {
+    Assign(aStr);
+    return *this;
+  }
 #endif
-  self_type& operator=( const self_type& str )              { Assign(str);   return *this; }
-  self_type& operator=( const substring_type& str )         { Assign(str);   return *this; }
-  self_type& operator=( const substring_tuple_type& tuple ) { Assign(tuple); return *this; }
+  self_type& operator=(const self_type& aStr)
+  {
+    Assign(aStr);
+    return *this;
+  }
+  self_type& operator=(const substring_type& aStr)
+  {
+    Assign(aStr);
+    return *this;
+  }
+  self_type& operator=(const substring_tuple_type& aTuple)
+  {
+    Assign(aTuple);
+    return *this;
+  }
 
-  enum { kDefaultStorageSize = 64 };
+  enum
+  {
+    kDefaultStorageSize = 64
+  };
 
 private:
 
@@ -555,23 +651,26 @@ private:
 //
 template<class E> class nsTArrayElementTraits;
 template<>
-class nsTArrayElementTraits<nsTAutoString_CharT> {
+class nsTArrayElementTraits<nsTAutoString_CharT>
+{
 public:
   template<class A> struct Dont_Instantiate_nsTArray_of;
   template<class A> struct Instead_Use_nsTArray_of;
 
-  static Dont_Instantiate_nsTArray_of<nsTAutoString_CharT> *
-  Construct(Instead_Use_nsTArray_of<nsTString_CharT> *e) {
+  static Dont_Instantiate_nsTArray_of<nsTAutoString_CharT>*
+  Construct(Instead_Use_nsTArray_of<nsTString_CharT>* aE)
+  {
     return 0;
   }
   template<class A>
-  static Dont_Instantiate_nsTArray_of<nsTAutoString_CharT> *
-  Construct(Instead_Use_nsTArray_of<nsTString_CharT> *e,
-            const A &arg) {
+  static Dont_Instantiate_nsTArray_of<nsTAutoString_CharT>*
+  Construct(Instead_Use_nsTArray_of<nsTString_CharT>* aE, const A& aArg)
+  {
     return 0;
   }
-  static Dont_Instantiate_nsTArray_of<nsTAutoString_CharT> *
-  Destruct(Instead_Use_nsTArray_of<nsTString_CharT> *e) {
+  static Dont_Instantiate_nsTArray_of<nsTAutoString_CharT>*
+  Destruct(Instead_Use_nsTArray_of<nsTString_CharT>* aE)
+  {
     return 0;
   }
 };
@@ -592,18 +691,20 @@ class nsTXPIDLString_CharT : public nsTString_CharT
 {
 public:
 
-  typedef nsTXPIDLString_CharT    self_type;
+  typedef nsTXPIDLString_CharT self_type;
 
 public:
 
   nsTXPIDLString_CharT()
-    : string_type(char_traits::sEmptyBuffer, 0, F_TERMINATED | F_VOIDED) {}
-
-  // copy-constructor required to avoid default
-  nsTXPIDLString_CharT( const self_type& str )
     : string_type(char_traits::sEmptyBuffer, 0, F_TERMINATED | F_VOIDED)
   {
-    Assign(str);
+  }
+
+  // copy-constructor required to avoid default
+  nsTXPIDLString_CharT(const self_type& aStr)
+    : string_type(char_traits::sEmptyBuffer, 0, F_TERMINATED | F_VOIDED)
+  {
+    Assign(aStr);
   }
 
   // return nullptr if we are voided
@@ -624,17 +725,37 @@ public:
   }
 
   // need this to diambiguous operator[int]
-  char_type operator[]( int32_t i ) const
+  char_type operator[](int32_t aIndex) const
   {
-    return CharAt(index_type(i));
+    return CharAt(index_type(aIndex));
   }
 
   // |operator=| does not inherit, so we must define our own
-  self_type& operator=( char_type c )                       { Assign(c);     return *this; }
-  self_type& operator=( const char_type* data )             { Assign(data);  return *this; }
-  self_type& operator=( const self_type& str )              { Assign(str);   return *this; }
-  self_type& operator=( const substring_type& str )         { Assign(str);   return *this; }
-  self_type& operator=( const substring_tuple_type& tuple ) { Assign(tuple); return *this; }
+  self_type& operator=(char_type aChar)
+  {
+    Assign(aChar);
+    return *this;
+  }
+  self_type& operator=(const char_type* aStr)
+  {
+    Assign(aStr);
+    return *this;
+  }
+  self_type& operator=(const self_type& aStr)
+  {
+    Assign(aStr);
+    return *this;
+  }
+  self_type& operator=(const substring_type& aStr)
+  {
+    Assign(aStr);
+    return *this;
+  }
+  self_type& operator=(const substring_tuple_type& aTuple)
+  {
+    Assign(aTuple);
+    return *this;
+  }
 };
 
 
@@ -655,8 +776,11 @@ class MOZ_STACK_CLASS nsTGetterCopies_CharT
 public:
   typedef CharT char_type;
 
-  explicit nsTGetterCopies_CharT(nsTSubstring_CharT& str)
-    : mString(str), mData(nullptr) {}
+  explicit nsTGetterCopies_CharT(nsTSubstring_CharT& aStr)
+    : mString(aStr)
+    , mData(nullptr)
+  {
+  }
 
   ~nsTGetterCopies_CharT()
   {
@@ -669,13 +793,12 @@ public:
   }
 
 private:
-  nsTSubstring_CharT&      mString;
-  char_type*            mData;
+  nsTSubstring_CharT& mString;
+  char_type* mData;
 };
 
-inline
-nsTGetterCopies_CharT
-getter_Copies( nsTSubstring_CharT& aString )
+inline nsTGetterCopies_CharT
+getter_Copies(nsTSubstring_CharT& aString)
 {
   return nsTGetterCopies_CharT(aString);
 }
@@ -693,36 +816,47 @@ class nsTAdoptingString_CharT : public nsTXPIDLString_CharT
 {
 public:
 
-  typedef nsTAdoptingString_CharT    self_type;
+  typedef nsTAdoptingString_CharT self_type;
 
 public:
 
-  explicit nsTAdoptingString_CharT() {}
-  explicit nsTAdoptingString_CharT(char_type* str, size_type length = size_type(-1))
+  explicit nsTAdoptingString_CharT()
   {
-    Adopt(str, length);
+  }
+  explicit nsTAdoptingString_CharT(char_type* aStr,
+                                   size_type aLength = size_type(-1))
+  {
+    Adopt(aStr, aLength);
   }
 
   // copy-constructor required to adopt on copy. Note that this
-  // will violate the constness of |str| in the operator=()
-  // call. |str| will be truncated as a side-effect of this
+  // will violate the constness of |aStr| in the operator=()
+  // call. |aStr| will be truncated as a side-effect of this
   // constructor.
-  nsTAdoptingString_CharT( const self_type& str )
+  nsTAdoptingString_CharT(const self_type& aStr)
   {
-    *this = str;
+    *this = aStr;
   }
 
   // |operator=| does not inherit, so we must define our own
-  self_type& operator=( const substring_type& str )         { Assign(str);   return *this; }
-  self_type& operator=( const substring_tuple_type& tuple ) { Assign(tuple); return *this; }
+  self_type& operator=(const substring_type& aStr)
+  {
+    Assign(aStr);
+    return *this;
+  }
+  self_type& operator=(const substring_tuple_type& aTuple)
+  {
+    Assign(aTuple);
+    return *this;
+  }
 
   // Adopt(), if possible, when assigning to a self_type&. Note
-  // that this violates the constness of str, str is always
+  // that this violates the constness of aStr, aStr is always
   // truncated when this operator is called.
-  self_type& operator=( const self_type& str );
+  self_type& operator=(const self_type& aStr);
 
 private:
-  self_type& operator=( const char_type* data ) MOZ_DELETE;
-  self_type& operator=( char_type* data ) MOZ_DELETE;
+  self_type& operator=(const char_type* aData) MOZ_DELETE;
+  self_type& operator=(char_type* aData) MOZ_DELETE;
 };
 
diff --git a/xpcom/string/public/nsTSubstring.h b/xpcom/string/public/nsTSubstring.h
index a7a78c666515..581828e551ac 100644
--- a/xpcom/string/public/nsTSubstring.h
+++ b/xpcom/string/public/nsTSubstring.h
@@ -20,9 +20,12 @@ class nsTStringComparator_CharT
 public:
   typedef CharT char_type;
 
-  nsTStringComparator_CharT() {}
+  nsTStringComparator_CharT()
+  {
+  }
 
-  virtual int operator()( const char_type*, const char_type*, uint32_t, uint32_t ) const = 0;
+  virtual int operator()(const char_type*, const char_type*,
+                         uint32_t, uint32_t) const = 0;
 };
 
 
@@ -35,9 +38,12 @@ class nsTDefaultStringComparator_CharT
 public:
   typedef CharT char_type;
 
-  nsTDefaultStringComparator_CharT() {}
+  nsTDefaultStringComparator_CharT()
+  {
+  }
 
-  virtual int operator()( const char_type*, const char_type*, uint32_t, uint32_t ) const;
+  virtual int operator()(const char_type*, const char_type*,
+                         uint32_t, uint32_t) const;
 };
 
 /**
@@ -84,43 +90,52 @@ public:
 public:
 
   // this acts like a virtual destructor
-  ~nsTSubstring_CharT() { Finalize(); }
+  ~nsTSubstring_CharT()
+  {
+    Finalize();
+  }
 
   /**
    * reading iterators
    */
 
-  const_char_iterator BeginReading() const { return mData; }
-  const_char_iterator EndReading() const { return mData + mLength; }
+  const_char_iterator BeginReading() const
+  {
+    return mData;
+  }
+  const_char_iterator EndReading() const
+  {
+    return mData + mLength;
+  }
 
   /**
    * deprecated reading iterators
    */
 
-  const_iterator& BeginReading( const_iterator& iter ) const
+  const_iterator& BeginReading(const_iterator& aIter) const
   {
-    iter.mStart = mData;
-    iter.mEnd = mData + mLength;
-    iter.mPosition = iter.mStart;
-    return iter;
+    aIter.mStart = mData;
+    aIter.mEnd = mData + mLength;
+    aIter.mPosition = aIter.mStart;
+    return aIter;
   }
 
-  const_iterator& EndReading( const_iterator& iter ) const
+  const_iterator& EndReading(const_iterator& aIter) const
   {
-    iter.mStart = mData;
-    iter.mEnd = mData + mLength;
-    iter.mPosition = iter.mEnd;
-    return iter;
+    aIter.mStart = mData;
+    aIter.mEnd = mData + mLength;
+    aIter.mPosition = aIter.mEnd;
+    return aIter;
   }
 
-  const_char_iterator& BeginReading( const_char_iterator& iter ) const
+  const_char_iterator& BeginReading(const_char_iterator& aIter) const
   {
-    return iter = mData;
+    return aIter = mData;
   }
 
-  const_char_iterator& EndReading( const_char_iterator& iter ) const
+  const_char_iterator& EndReading(const_char_iterator& aIter) const
   {
-    return iter = mData + mLength;
+    return aIter = mData + mLength;
   }
 
 
@@ -130,70 +145,72 @@ public:
 
   char_iterator BeginWriting()
   {
-    if (!EnsureMutable())
+    if (!EnsureMutable()) {
       NS_ABORT_OOM(mLength);
+    }
 
     return mData;
   }
 
-  char_iterator BeginWriting( const fallible_t& )
+  char_iterator BeginWriting(const fallible_t&)
   {
     return EnsureMutable() ? mData : char_iterator(0);
   }
 
   char_iterator EndWriting()
   {
-    if (!EnsureMutable())
+    if (!EnsureMutable()) {
       NS_ABORT_OOM(mLength);
+    }
 
     return mData + mLength;
   }
 
-  char_iterator EndWriting( const fallible_t& )
+  char_iterator EndWriting(const fallible_t&)
   {
     return EnsureMutable() ? (mData + mLength) : char_iterator(0);
   }
 
-  char_iterator& BeginWriting( char_iterator& iter )
+  char_iterator& BeginWriting(char_iterator& aIter)
   {
-    return iter = BeginWriting();
+    return aIter = BeginWriting();
   }
 
-  char_iterator& BeginWriting( char_iterator& iter, const fallible_t& )
+  char_iterator& BeginWriting(char_iterator& aIter, const fallible_t&)
   {
-    return iter = BeginWriting(fallible_t());
+    return aIter = BeginWriting(fallible_t());
   }
 
-  char_iterator& EndWriting( char_iterator& iter )
+  char_iterator& EndWriting(char_iterator& aIter)
   {
-    return iter = EndWriting();
+    return aIter = EndWriting();
   }
 
-  char_iterator& EndWriting( char_iterator& iter, const fallible_t& )
+  char_iterator& EndWriting(char_iterator& aIter, const fallible_t&)
   {
-    return iter = EndWriting(fallible_t());
+    return aIter = EndWriting(fallible_t());
   }
 
   /**
    * deprecated writing iterators
    */
 
-  iterator& BeginWriting( iterator& iter )
+  iterator& BeginWriting(iterator& aIter)
   {
-    char_type *data = BeginWriting();
-    iter.mStart = data;
-    iter.mEnd = data + mLength;
-    iter.mPosition = iter.mStart;
-    return iter;
+    char_type* data = BeginWriting();
+    aIter.mStart = data;
+    aIter.mEnd = data + mLength;
+    aIter.mPosition = aIter.mStart;
+    return aIter;
   }
 
-  iterator& EndWriting( iterator& iter )
+  iterator& EndWriting(iterator& aIter)
   {
-    char_type *data = BeginWriting();
-    iter.mStart = data;
-    iter.mEnd = data + mLength;
-    iter.mPosition = iter.mEnd;
-    return iter;
+    char_type* data = BeginWriting();
+    aIter.mStart = data;
+    aIter.mEnd = data + mLength;
+    aIter.mPosition = aIter.mEnd;
+    return aIter;
   }
 
   /**
@@ -204,7 +221,7 @@ public:
 #if defined(CharT_is_PRUnichar) && defined(MOZ_USE_CHAR16_WRAPPER)
   char16ptr_t Data() const
 #else
-  const char_type *Data() const
+  const char_type* Data() const
 #endif
   {
     return mData;
@@ -240,15 +257,15 @@ public:
     return (mFlags & F_TERMINATED) != 0;
   }
 
-  char_type CharAt( index_type i ) const
+  char_type CharAt(index_type aIndex) const
   {
-    NS_ASSERTION(i < mLength, "index exceeds allowable range");
-    return mData[i];
+    NS_ASSERTION(aIndex < mLength, "index exceeds allowable range");
+    return mData[aIndex];
   }
 
-  char_type operator[]( index_type i ) const
+  char_type operator[](index_type aIndex) const
   {
-    return CharAt(i);
+    return CharAt(aIndex);
   }
 
   char_type First() const
@@ -257,35 +274,35 @@ public:
     return mData[0];
   }
 
-  inline
-  char_type Last() const
+  inline   char_type Last() const
   {
     NS_ASSERTION(mLength > 0, "|Last()| called on an empty string");
     return mData[mLength - 1];
   }
 
-  size_type NS_FASTCALL CountChar( char_type ) const;
-  int32_t NS_FASTCALL FindChar( char_type, index_type offset = 0 ) const;
+  size_type NS_FASTCALL CountChar(char_type) const;
+  int32_t NS_FASTCALL FindChar(char_type, index_type aOffset = 0) const;
 
 
   /**
    * equality
    */
 
-  bool NS_FASTCALL Equals( const self_type& ) const;
-  bool NS_FASTCALL Equals( const self_type&, const comparator_type& ) const;
+  bool NS_FASTCALL Equals(const self_type&) const;
+  bool NS_FASTCALL Equals(const self_type&, const comparator_type&) const;
 
-  bool NS_FASTCALL Equals( const char_type* data ) const;
-  bool NS_FASTCALL Equals( const char_type* data, const comparator_type& comp ) const;
+  bool NS_FASTCALL Equals(const char_type* aData) const;
+  bool NS_FASTCALL Equals(const char_type* aData,
+                          const comparator_type& aComp) const;
 
 #if defined(CharT_is_PRUnichar) && defined(MOZ_USE_CHAR16_WRAPPER)
-  bool NS_FASTCALL Equals( char16ptr_t data ) const
+  bool NS_FASTCALL Equals(char16ptr_t aData) const
   {
-    return Equals(static_cast<const char16_t*>(data));
+    return Equals(static_cast<const char16_t*>(aData));
   }
-  bool NS_FASTCALL Equals( char16ptr_t data, const comparator_type& comp ) const
+  bool NS_FASTCALL Equals(char16ptr_t aData, const comparator_type& aComp) const
   {
-    return Equals(static_cast<const char16_t*>(data), comp);
+    return Equals(static_cast<const char16_t*>(aData), aComp);
   }
 #endif
 
@@ -294,13 +311,13 @@ public:
    * for wide strings. Call this version when you know the
    * length of 'data'.
    */
-  bool NS_FASTCALL EqualsASCII( const char* data, size_type len ) const;
+  bool NS_FASTCALL EqualsASCII(const char* aData, size_type aLen) const;
   /**
    * An efficient comparison with ASCII that can be used even
    * for wide strings. Call this version when 'data' is
    * null-terminated.
    */
-  bool NS_FASTCALL EqualsASCII( const char* data ) const;
+  bool NS_FASTCALL EqualsASCII(const char* aData) const;
 
   // EqualsLiteral must ONLY be applied to an actual literal string, or
   // a char array *constant* declared without an explicit size.
@@ -309,9 +326,9 @@ public:
   // The template trick to acquire the array length at compile time without
   // using a macro is due to Corey Kosak, with much thanks.
   template<int N>
-  inline bool EqualsLiteral( const char (&str)[N] ) const
+  inline bool EqualsLiteral(const char (&aStr)[N]) const
   {
-    return EqualsASCII(str, N-1);
+    return EqualsASCII(aStr, N - 1);
   }
 
   // The LowerCaseEquals methods compare the ASCII-lowercase version of
@@ -320,8 +337,9 @@ public:
   // you. If you compare to an ASCII or literal string that contains an
   // uppercase character, it is guaranteed to return false. We will
   // throw assertions too.
-  bool NS_FASTCALL LowerCaseEqualsASCII( const char* data, size_type len ) const;
-  bool NS_FASTCALL LowerCaseEqualsASCII( const char* data ) const;
+  bool NS_FASTCALL LowerCaseEqualsASCII(const char* aData,
+                                        size_type aLen) const;
+  bool NS_FASTCALL LowerCaseEqualsASCII(const char* aData) const;
 
   // LowerCaseEqualsLiteral must ONLY be applied to an actual
   // literal string, or a char array *constant* declared without an
@@ -329,60 +347,71 @@ public:
   // pointer, or with a non-constant char array variable. Use
   // LowerCaseEqualsASCII for them.
   template<int N>
-  inline bool LowerCaseEqualsLiteral( const char (&str)[N] ) const
+  inline bool LowerCaseEqualsLiteral(const char (&aStr)[N]) const
   {
-    return LowerCaseEqualsASCII(str, N-1);
+    return LowerCaseEqualsASCII(aStr, N - 1);
   }
 
   /**
    * assignment
    */
 
-  void NS_FASTCALL Assign( char_type c );
-  bool NS_FASTCALL Assign( char_type c, const fallible_t& ) NS_WARN_UNUSED_RESULT;
+  void NS_FASTCALL Assign(char_type aChar);
+  NS_WARN_UNUSED_RESULT bool NS_FASTCALL Assign(char_type aChar,
+                                                const fallible_t&);
 
-  void NS_FASTCALL Assign( const char_type* data );
-  void NS_FASTCALL Assign( const char_type* data, size_type length );
-  bool NS_FASTCALL Assign( const char_type* data, size_type length, const fallible_t& ) NS_WARN_UNUSED_RESULT;
+  void NS_FASTCALL Assign(const char_type* aData);
+  void NS_FASTCALL Assign(const char_type* aData, size_type aLength);
+  NS_WARN_UNUSED_RESULT bool NS_FASTCALL Assign(const char_type* aData,
+                                                size_type aLength,
+                                                const fallible_t&);
 
-  void NS_FASTCALL Assign( const self_type& );
-  bool NS_FASTCALL Assign( const self_type&, const fallible_t& ) NS_WARN_UNUSED_RESULT;
+  void NS_FASTCALL Assign(const self_type&);
+  NS_WARN_UNUSED_RESULT bool NS_FASTCALL Assign(const self_type&,
+                                                const fallible_t&);
 
-  void NS_FASTCALL Assign( const substring_tuple_type& );
-  bool NS_FASTCALL Assign( const substring_tuple_type&, const fallible_t& ) NS_WARN_UNUSED_RESULT;
+  void NS_FASTCALL Assign(const substring_tuple_type&);
+  NS_WARN_UNUSED_RESULT bool NS_FASTCALL Assign(const substring_tuple_type&,
+                                                const fallible_t&);
 
 #if defined(CharT_is_PRUnichar) && defined(MOZ_USE_CHAR16_WRAPPER)
-  void Assign (char16ptr_t data)
+  void Assign(char16ptr_t aData)
   {
-    Assign(static_cast<const char16_t*>(data));
+    Assign(static_cast<const char16_t*>(aData));
   }
 
-  bool Assign(char16ptr_t data, const fallible_t&) NS_WARN_UNUSED_RESULT
+  NS_WARN_UNUSED_RESULT bool Assign(char16ptr_t aData, const fallible_t&)
   {
-    return Assign(static_cast<const char16_t*>(data), fallible_t());
+    return Assign(static_cast<const char16_t*>(aData), fallible_t());
   }
 
-  void Assign (char16ptr_t data, size_type length)
+  void Assign(char16ptr_t aData, size_type aLength)
   {
-    Assign(static_cast<const char16_t*>(data), length);
+    Assign(static_cast<const char16_t*>(aData), aLength);
   }
 
-  bool Assign(char16ptr_t data, size_type length, const fallible_t&) NS_WARN_UNUSED_RESULT
+  NS_WARN_UNUSED_RESULT bool Assign(char16ptr_t aData, size_type aLength,
+                                    const fallible_t&)
   {
-    return Assign(static_cast<const char16_t*>(data), length, fallible_t());
+    return Assign(static_cast<const char16_t*>(aData), aLength, fallible_t());
   }
 #endif
 
-  void NS_FASTCALL AssignASCII( const char* data, size_type length );
-  bool NS_FASTCALL AssignASCII( const char* data, size_type length, const fallible_t& ) NS_WARN_UNUSED_RESULT;
+  void NS_FASTCALL AssignASCII(const char* aData, size_type aLength);
+  NS_WARN_UNUSED_RESULT bool NS_FASTCALL AssignASCII(const char* aData,
+                                                     size_type aLength,
+                                                     const fallible_t&);
 
-  void NS_FASTCALL AssignASCII( const char* data )
+  void NS_FASTCALL AssignASCII(const char* aData)
   {
-    AssignASCII(data, mozilla::SafeCast<size_type, size_t>(strlen(data)));
+    AssignASCII(aData, mozilla::SafeCast<size_type, size_t>(strlen(aData)));
   }
-  bool NS_FASTCALL AssignASCII( const char* data, const fallible_t& ) NS_WARN_UNUSED_RESULT
+  NS_WARN_UNUSED_RESULT bool NS_FASTCALL AssignASCII(const char* aData,
+                                                     const fallible_t&)
   {
-    return AssignASCII(data, mozilla::SafeCast<size_type, size_t>(strlen(data)), fallible_t());
+    return AssignASCII(aData,
+                       mozilla::SafeCast<size_type, size_t>(strlen(aData)),
+                       fallible_t());
   }
 
   // AssignLiteral must ONLY be applied to an actual literal string, or
@@ -392,138 +421,269 @@ public:
   // There are not fallible version of these methods because they only really
   // apply to small allocations that we wouldn't want to check anyway.
   template<int N>
-  void AssignLiteral( const char_type (&str)[N] )
-  { AssignLiteral(str, N - 1); }
+  void AssignLiteral(const char_type (&aStr)[N])
+  {
+    AssignLiteral(aStr, N - 1);
+  }
 #ifdef CharT_is_PRUnichar
   template<int N>
-  void AssignLiteral( const char (&str)[N] )
-  { AssignASCII(str, N-1); }
+  void AssignLiteral(const char (&aStr)[N])
+  {
+    AssignASCII(aStr, N - 1);
+  }
 #endif
 
-  self_type& operator=( char_type c )                                                       { Assign(c);        return *this; }
-  self_type& operator=( const char_type* data )                                             { Assign(data);     return *this; }
+  self_type& operator=(char_type aChar)
+  {
+    Assign(aChar);
+    return *this;
+  }
+  self_type& operator=(const char_type* aData)
+  {
+    Assign(aData);
+    return *this;
+  }
 #if defined(CharT_is_PRUnichar) && defined(MOZ_USE_CHAR16_WRAPPER)
-  self_type& operator=( char16ptr_t data )                                                  { Assign(data);     return *this; }
+  self_type& operator=(char16ptr_t aData)
+  {
+    Assign(aData);
+    return *this;
+  }
 #endif
-  self_type& operator=( const self_type& str )                                              { Assign(str);      return *this; }
-  self_type& operator=( const substring_tuple_type& tuple )                                 { Assign(tuple);    return *this; }
+  self_type& operator=(const self_type& aStr)
+  {
+    Assign(aStr);
+    return *this;
+  }
+  self_type& operator=(const substring_tuple_type& aTuple)
+  {
+    Assign(aTuple);
+    return *this;
+  }
 
-  void NS_FASTCALL Adopt( char_type* data, size_type length = size_type(-1) );
+  void NS_FASTCALL Adopt(char_type* aData, size_type aLength = size_type(-1));
 
 
   /**
    * buffer manipulation
    */
 
-  void NS_FASTCALL Replace( index_type cutStart, size_type cutLength, char_type c );
-  bool NS_FASTCALL Replace( index_type cutStart, size_type cutLength, char_type c, const mozilla::fallible_t&) NS_WARN_UNUSED_RESULT;
-  void NS_FASTCALL Replace( index_type cutStart, size_type cutLength, const char_type* data, size_type length = size_type(-1) );
-  bool NS_FASTCALL Replace( index_type cutStart, size_type cutLength, const char_type* data, size_type length, const mozilla::fallible_t&) NS_WARN_UNUSED_RESULT;
-  void Replace( index_type cutStart, size_type cutLength, const self_type& str )      { Replace(cutStart, cutLength, str.Data(), str.Length()); }
-  bool Replace( index_type cutStart, size_type cutLength, const self_type& str, const mozilla::fallible_t&) NS_WARN_UNUSED_RESULT
-  { return Replace(cutStart, cutLength, str.Data(), str.Length(), mozilla::fallible_t()); }
-  void NS_FASTCALL Replace( index_type cutStart, size_type cutLength, const substring_tuple_type& tuple );
+  void NS_FASTCALL Replace(index_type aCutStart, size_type aCutLength,
+                           char_type aChar);
+  NS_WARN_UNUSED_RESULT bool NS_FASTCALL Replace(index_type aCutStart,
+                                                 size_type aCutLength,
+                                                 char_type aChar,
+                                                 const mozilla::fallible_t&);
+  void NS_FASTCALL Replace(index_type aCutStart, size_type aCutLength,
+                           const char_type* aData,
+                           size_type aLength = size_type(-1));
+  NS_WARN_UNUSED_RESULT bool NS_FASTCALL Replace(index_type aCutStart,
+                                                 size_type aCutLength,
+                                                 const char_type* aData,
+                                                 size_type aLength,
+                                                 const mozilla::fallible_t&);
+  void Replace(index_type aCutStart, size_type aCutLength,
+               const self_type& aStr)
+  {
+    Replace(aCutStart, aCutLength, aStr.Data(), aStr.Length());
+  }
+  NS_WARN_UNUSED_RESULT bool Replace(index_type aCutStart,
+                                     size_type aCutLength,
+                                     const self_type& aStr,
+                                     const mozilla::fallible_t&)
+  {
+    return Replace(aCutStart, aCutLength, aStr.Data(), aStr.Length(),
+                   mozilla::fallible_t());
+  }
+  void NS_FASTCALL Replace(index_type aCutStart, size_type aCutLength,
+                           const substring_tuple_type& aTuple);
 
-  void NS_FASTCALL ReplaceASCII( index_type cutStart, size_type cutLength, const char* data, size_type length = size_type(-1) );
+  void NS_FASTCALL ReplaceASCII(index_type aCutStart, size_type aCutLength,
+                                const char* aData,
+                                size_type aLength = size_type(-1));
 
   // ReplaceLiteral must ONLY be applied to an actual literal string.
   // Do not attempt to use it with a regular char* pointer, or with a char
   // array variable. Use Replace or ReplaceASCII for those.
   template<int N>
-  void ReplaceLiteral( index_type cutStart, size_type cutLength, const char_type (&str)[N] ) { ReplaceLiteral(cutStart, cutLength, str, N - 1); }
+  void ReplaceLiteral(index_type aCutStart, size_type aCutLength,
+                      const char_type (&aStr)[N])
+  {
+    ReplaceLiteral(aCutStart, aCutLength, aStr, N - 1);
+  }
 
-  void Append( char_type c )                                                                 { Replace(mLength, 0, c); }
-  bool Append( char_type c, const mozilla::fallible_t&) NS_WARN_UNUSED_RESULT                { return Replace(mLength, 0, c, mozilla::fallible_t()); }
-  void Append( const char_type* data, size_type length = size_type(-1) )                     { Replace(mLength, 0, data, length); }
-  bool Append( const char_type* data, size_type length, const mozilla::fallible_t&) NS_WARN_UNUSED_RESULT
-  { return Replace(mLength, 0, data, length, mozilla::fallible_t()); }
+  void Append(char_type aChar)
+  {
+    Replace(mLength, 0, aChar);
+  }
+  NS_WARN_UNUSED_RESULT bool Append(char_type aChar,
+                                    const mozilla::fallible_t&)
+  {
+    return Replace(mLength, 0, aChar, mozilla::fallible_t());
+  }
+  void Append(const char_type* aData, size_type aLength = size_type(-1))
+  {
+    Replace(mLength, 0, aData, aLength);
+  }
+  NS_WARN_UNUSED_RESULT bool Append(const char_type* aData, size_type aLength,
+                                    const mozilla::fallible_t&)
+  {
+    return Replace(mLength, 0, aData, aLength, mozilla::fallible_t());
+  }
 
 #if defined(CharT_is_PRUnichar) && defined(MOZ_USE_CHAR16_WRAPPER)
-  void Append( char16ptr_t data, size_type length = size_type(-1) )                            { Append(static_cast<const char16_t*>(data), length); }
+  void Append(char16ptr_t aData, size_type aLength = size_type(-1))
+  {
+    Append(static_cast<const char16_t*>(aData), aLength);
+  }
 #endif
 
-  void Append( const self_type& str )                                                        { Replace(mLength, 0, str); }
-  void Append( const substring_tuple_type& tuple )                                           { Replace(mLength, 0, tuple); }
+  void Append(const self_type& aStr)
+  {
+    Replace(mLength, 0, aStr);
+  }
+  void Append(const substring_tuple_type& aTuple)
+  {
+    Replace(mLength, 0, aTuple);
+  }
 
-  void AppendASCII( const char* data, size_type length = size_type(-1) )                     { ReplaceASCII(mLength, 0, data, length); }
+  void AppendASCII(const char* aData, size_type aLength = size_type(-1))
+  {
+    ReplaceASCII(mLength, 0, aData, aLength);
+  }
 
   /**
    * Append a formatted string to the current string. Uses the format
    * codes documented in prprf.h
    */
-  void AppendPrintf( const char* format, ... );
-  void AppendPrintf( const char* format, va_list ap );
-  void AppendInt( int32_t aInteger )
-  { AppendPrintf( "%d", aInteger ); }
-  void AppendInt( int32_t aInteger, int aRadix )
+  void AppendPrintf(const char* aFormat, ...);
+  void AppendPrintf(const char* aFormat, va_list aAp);
+  void AppendInt(int32_t aInteger)
   {
-    const char *fmt = aRadix == 10 ? "%d" : aRadix == 8 ? "%o" : "%x";
-    AppendPrintf( fmt, aInteger );
+    AppendPrintf("%d", aInteger);
   }
-  void AppendInt( uint32_t aInteger )
-  { AppendPrintf( "%u", aInteger ); }
-  void AppendInt( uint32_t aInteger, int aRadix )
+  void AppendInt(int32_t aInteger, int aRadix)
   {
-    const char *fmt = aRadix == 10 ? "%u" : aRadix == 8 ? "%o" : "%x";
-    AppendPrintf( fmt, aInteger );
+    const char* fmt = aRadix == 10 ? "%d" : aRadix == 8 ? "%o" : "%x";
+    AppendPrintf(fmt, aInteger);
   }
-  void AppendInt( int64_t aInteger )
-  { AppendPrintf( "%lld", aInteger ); }
-  void AppendInt( int64_t aInteger, int aRadix )
+  void AppendInt(uint32_t aInteger)
   {
-    const char *fmt = aRadix == 10 ? "%lld" : aRadix == 8 ? "%llo" : "%llx";
-    AppendPrintf( fmt, aInteger );
+    AppendPrintf("%u", aInteger);
   }
-  void AppendInt( uint64_t aInteger )
-  { AppendPrintf( "%llu", aInteger ); }
-  void AppendInt( uint64_t aInteger, int aRadix )
+  void AppendInt(uint32_t aInteger, int aRadix)
   {
-    const char *fmt = aRadix == 10 ? "%llu" : aRadix == 8 ? "%llo" : "%llx";
-    AppendPrintf( fmt, aInteger );
+    const char* fmt = aRadix == 10 ? "%u" : aRadix == 8 ? "%o" : "%x";
+    AppendPrintf(fmt, aInteger);
+  }
+  void AppendInt(int64_t aInteger)
+  {
+    AppendPrintf("%lld", aInteger);
+  }
+  void AppendInt(int64_t aInteger, int aRadix)
+  {
+    const char* fmt = aRadix == 10 ? "%lld" : aRadix == 8 ? "%llo" : "%llx";
+    AppendPrintf(fmt, aInteger);
+  }
+  void AppendInt(uint64_t aInteger)
+  {
+    AppendPrintf("%llu", aInteger);
+  }
+  void AppendInt(uint64_t aInteger, int aRadix)
+  {
+    const char* fmt = aRadix == 10 ? "%llu" : aRadix == 8 ? "%llo" : "%llx";
+    AppendPrintf(fmt, aInteger);
   }
 
   /**
    * Append the given float to this string
    */
-  void NS_FASTCALL AppendFloat( float aFloat );
-  void NS_FASTCALL AppendFloat( double aFloat );
+  void NS_FASTCALL AppendFloat(float aFloat);
+  void NS_FASTCALL AppendFloat(double aFloat);
 public:
 
   // AppendLiteral must ONLY be applied to an actual literal string.
   // Do not attempt to use it with a regular char* pointer, or with a char
   // array variable. Use Append or AppendASCII for those.
   template<int N>
-  void AppendLiteral( const char_type (&str)[N] )                                             { ReplaceLiteral(mLength, 0, str, N - 1); }
+  void AppendLiteral(const char_type (&aStr)[N])
+  {
+    ReplaceLiteral(mLength, 0, aStr, N - 1);
+  }
 #ifdef CharT_is_PRUnichar
   template<int N>
-  void AppendLiteral( const char (&str)[N] )
-  { AppendASCII(str, N-1); }
+  void AppendLiteral(const char (&aStr)[N])
+  {
+    AppendASCII(aStr, N - 1);
+  }
 #endif
 
-  self_type& operator+=( char_type c )                                                       { Append(c);        return *this; }
-  self_type& operator+=( const char_type* data )                                             { Append(data);     return *this; }
+  self_type& operator+=(char_type aChar)
+  {
+    Append(aChar);
+    return *this;
+  }
+  self_type& operator+=(const char_type* aData)
+  {
+    Append(aData);
+    return *this;
+  }
 #if defined(CharT_is_PRUnichar) && defined(MOZ_USE_CHAR16_WRAPPER)
-  self_type& operator+=( char16ptr_t data )                                                  { Append(data);     return *this; }
+  self_type& operator+=(char16ptr_t aData)
+  {
+    Append(aData);
+    return *this;
+  }
 #endif
-  self_type& operator+=( const self_type& str )                                              { Append(str);      return *this; }
-  self_type& operator+=( const substring_tuple_type& tuple )                                 { Append(tuple);    return *this; }
+  self_type& operator+=(const self_type& aStr)
+  {
+    Append(aStr);
+    return *this;
+  }
+  self_type& operator+=(const substring_tuple_type& aTuple)
+  {
+    Append(aTuple);
+    return *this;
+  }
 
-  void Insert( char_type c, index_type pos )                                                 { Replace(pos, 0, c); }
-  void Insert( const char_type* data, index_type pos, size_type length = size_type(-1) )     { Replace(pos, 0, data, length); }
+  void Insert(char_type aChar, index_type aPos)
+  {
+    Replace(aPos, 0, aChar);
+  }
+  void Insert(const char_type* aData, index_type aPos,
+              size_type aLength = size_type(-1))
+  {
+    Replace(aPos, 0, aData, aLength);
+  }
 #if defined(CharT_is_PRUnichar) && defined(MOZ_USE_CHAR16_WRAPPER)
-  void Insert( char16ptr_t data, index_type pos, size_type length = size_type(-1) )
-  { Insert(static_cast<const char16_t*>(data), pos, length); }
+  void Insert(char16ptr_t aData, index_type aPos,
+              size_type aLength = size_type(-1))
+  {
+    Insert(static_cast<const char16_t*>(aData), aPos, aLength);
+  }
 #endif
-  void Insert( const self_type& str, index_type pos )                                        { Replace(pos, 0, str); }
-  void Insert( const substring_tuple_type& tuple, index_type pos )                           { Replace(pos, 0, tuple); }
+  void Insert(const self_type& aStr, index_type aPos)
+  {
+    Replace(aPos, 0, aStr);
+  }
+  void Insert(const substring_tuple_type& aTuple, index_type aPos)
+  {
+    Replace(aPos, 0, aTuple);
+  }
 
   // InsertLiteral must ONLY be applied to an actual literal string.
   // Do not attempt to use it with a regular char* pointer, or with a char
   // array variable. Use Insert for those.
   template<int N>
-  void InsertLiteral( const char_type (&str)[N], index_type pos )                            { ReplaceLiteral(pos, 0, str, N - 1); }
+  void InsertLiteral(const char_type (&aStr)[N], index_type aPos)
+  {
+    ReplaceLiteral(aPos, 0, aStr, N - 1);
+  }
 
-  void Cut( index_type cutStart, size_type cutLength )                                       { Replace(cutStart, cutLength, char_traits::sEmptyBuffer, 0); }
+  void Cut(index_type aCutStart, size_type aCutLength)
+  {
+    Replace(aCutStart, aCutLength, char_traits::sEmptyBuffer, 0);
+  }
 
 
   /**
@@ -537,16 +697,18 @@ public:
    * the job of the string class.
    * Also ensures that the buffer is mutable.
    */
-  void NS_FASTCALL SetCapacity( size_type newCapacity );
-  bool NS_FASTCALL SetCapacity( size_type newCapacity, const fallible_t& ) NS_WARN_UNUSED_RESULT;
+  void NS_FASTCALL SetCapacity(size_type aNewCapacity);
+  NS_WARN_UNUSED_RESULT bool NS_FASTCALL SetCapacity(size_type aNewCapacity,
+                                                     const fallible_t&);
 
-  void NS_FASTCALL SetLength( size_type newLength );
-  bool NS_FASTCALL SetLength( size_type newLength, const fallible_t& ) NS_WARN_UNUSED_RESULT;
+  void NS_FASTCALL SetLength(size_type aNewLength);
+  NS_WARN_UNUSED_RESULT bool NS_FASTCALL SetLength(size_type aNewLength,
+                                                   const fallible_t&);
 
-  void Truncate( size_type newLength = 0 )
+  void Truncate(size_type aNewLength = 0)
   {
-    NS_ASSERTION(newLength <= mLength, "Truncate cannot make string longer");
-    SetLength(newLength);
+    NS_ASSERTION(aNewLength <= mLength, "Truncate cannot make string longer");
+    SetLength(aNewLength);
   }
 
 
@@ -561,9 +723,9 @@ public:
    *
    * @returns The length of the buffer in characters.
    */
-  inline size_type GetData( const char_type** data ) const
+  inline size_type GetData(const char_type** aData) const
   {
-    *data = mData;
+    *aData = mData;
     return mLength;
   }
 
@@ -577,36 +739,36 @@ public:
    * @returns The length of the buffer in characters or 0 if unable to
    * satisfy the request due to low-memory conditions.
    */
-  size_type GetMutableData( char_type** data, size_type newLen = size_type(-1) )
+  size_type GetMutableData(char_type** aData, size_type aNewLen = size_type(-1))
   {
-    if (!EnsureMutable(newLen))
-      NS_ABORT_OOM(newLen == size_type(-1) ? mLength : newLen);
+    if (!EnsureMutable(aNewLen)) {
+      NS_ABORT_OOM(aNewLen == size_type(-1) ? mLength : aNewLen);
+    }
 
-    *data = mData;
+    *aData = mData;
     return mLength;
   }
 
-  size_type GetMutableData( char_type** data, size_type newLen, const fallible_t& )
+  size_type GetMutableData(char_type** aData, size_type aNewLen, const fallible_t&)
   {
-    if (!EnsureMutable(newLen))
-    {
-      *data = nullptr;
+    if (!EnsureMutable(aNewLen)) {
+      *aData = nullptr;
       return 0;
     }
 
-    *data = mData;
+    *aData = mData;
     return mLength;
   }
 
 #if defined(CharT_is_PRUnichar) && defined(MOZ_USE_CHAR16_WRAPPER)
-  size_type GetMutableData( wchar_t** data, size_type newLen = size_type(-1) )
+  size_type GetMutableData(wchar_t** aData, size_type aNewLen = size_type(-1))
   {
-    return GetMutableData(reinterpret_cast<char16_t**>(data), newLen);
+    return GetMutableData(reinterpret_cast<char16_t**>(aData), aNewLen);
   }
 
-  size_type GetMutableData( wchar_t** data, size_type newLen, const fallible_t& )
+  size_type GetMutableData(wchar_t** aData, size_type aNewLen, const fallible_t&)
   {
-    return GetMutableData(reinterpret_cast<char16_t**>(data), newLen, fallible_t());
+    return GetMutableData(reinterpret_cast<char16_t**>(aData), aNewLen, fallible_t());
   }
 #endif
 
@@ -616,7 +778,7 @@ public:
    * string will be truncated.  @see nsTSubstring::IsVoid
    */
 
-  void NS_FASTCALL SetIsVoid( bool );
+  void NS_FASTCALL SetIsVoid(bool);
 
   /**
    *  This method is used to remove all occurrences of aChar from this
@@ -626,7 +788,7 @@ public:
    *  @param  aOffset -- where in this string to start stripping chars
    */
 
-  void StripChar( char_type aChar, int32_t aOffset=0 );
+  void StripChar(char_type aChar, int32_t aOffset = 0);
 
   /**
    *  This method is used to remove all occurrences of aChars from this
@@ -636,7 +798,7 @@ public:
    *  @param  aOffset -- where in this string to start stripping chars
    */
 
-  void StripChars( const char_type* aChars, uint32_t aOffset=0 );
+  void StripChars(const char_type* aChars, uint32_t aOffset = 0);
 
   /**
    * If the string uses a shared buffer, this method
@@ -644,8 +806,7 @@ public:
    */
   void ForgetSharedBuffer()
   {
-    if (mFlags & nsSubstring::F_SHARED)
-    {
+    if (mFlags & nsSubstring::F_SHARED) {
       mData = char_traits::sEmptyBuffer;
       mLength = 0;
       mFlags = F_TERMINATED;
@@ -658,12 +819,12 @@ public:
    * this is public to support automatic conversion of tuple to string
    * base type, which helps avoid converting to nsTAString.
    */
-  MOZ_IMPLICIT nsTSubstring_CharT(const substring_tuple_type& tuple)
-    : mData(nullptr),
-      mLength(0),
-      mFlags(F_NONE)
+  MOZ_IMPLICIT nsTSubstring_CharT(const substring_tuple_type& aTuple)
+    : mData(nullptr)
+    , mLength(0)
+    , mFlags(F_NONE)
   {
-    Assign(tuple);
+    Assign(aTuple);
   }
 
   /**
@@ -675,23 +836,25 @@ public:
   // XXXbz or can I just include nscore.h and use NS_BUILD_REFCNT_LOGGING?
 #if defined(DEBUG) || defined(FORCE_BUILD_REFCNT_LOGGING)
 #define XPCOM_STRING_CONSTRUCTOR_OUT_OF_LINE
-  nsTSubstring_CharT( char_type *data, size_type length, uint32_t flags );
+  nsTSubstring_CharT(char_type* aData, size_type aLength, uint32_t aFlags);
 #else
 #undef XPCOM_STRING_CONSTRUCTOR_OUT_OF_LINE
-  nsTSubstring_CharT( char_type *data, size_type length, uint32_t flags )
-    : mData(data),
-      mLength(length),
-      mFlags(flags) {}
+  nsTSubstring_CharT(char_type* aData, size_type aLength, uint32_t aFlags)
+    : mData(aData)
+    , mLength(aLength)
+    , mFlags(aFlags)
+  {
+  }
 #endif /* DEBUG || FORCE_BUILD_REFCNT_LOGGING */
 
-  size_t SizeOfExcludingThisMustBeUnshared(mozilla::MallocSizeOf mallocSizeOf)
+  size_t SizeOfExcludingThisMustBeUnshared(mozilla::MallocSizeOf aMallocSizeOf)
   const;
-  size_t SizeOfIncludingThisMustBeUnshared(mozilla::MallocSizeOf mallocSizeOf)
+  size_t SizeOfIncludingThisMustBeUnshared(mozilla::MallocSizeOf aMallocSizeOf)
   const;
 
-  size_t SizeOfExcludingThisIfUnshared(mozilla::MallocSizeOf mallocSizeOf)
+  size_t SizeOfExcludingThisIfUnshared(mozilla::MallocSizeOf aMallocSizeOf)
   const;
-  size_t SizeOfIncludingThisIfUnshared(mozilla::MallocSizeOf mallocSizeOf)
+  size_t SizeOfIncludingThisIfUnshared(mozilla::MallocSizeOf aMallocSizeOf)
   const;
 
   /**
@@ -700,9 +863,9 @@ public:
    * you do use them, please explain clearly in a comment why it's safe
    * and won't lead to double-counting.
    */
-  size_t SizeOfExcludingThisEvenIfShared(mozilla::MallocSizeOf mallocSizeOf)
+  size_t SizeOfExcludingThisEvenIfShared(mozilla::MallocSizeOf aMallocSizeOf)
   const;
-  size_t SizeOfIncludingThisEvenIfShared(mozilla::MallocSizeOf mallocSizeOf)
+  size_t SizeOfIncludingThisEvenIfShared(mozilla::MallocSizeOf aMallocSizeOf)
   const;
 
 protected:
@@ -719,21 +882,27 @@ protected:
 
   // default initialization
   nsTSubstring_CharT()
-    : mData(char_traits::sEmptyBuffer),
-      mLength(0),
-      mFlags(F_TERMINATED) {}
+    : mData(char_traits::sEmptyBuffer)
+    ,  mLength(0)
+    ,  mFlags(F_TERMINATED)
+  {
+  }
 
   // version of constructor that leaves mData and mLength uninitialized
   explicit
-  nsTSubstring_CharT( uint32_t flags )
-    : mFlags(flags) {}
+  nsTSubstring_CharT(uint32_t aFlags)
+    : mFlags(aFlags)
+  {
+  }
 
   // copy-constructor, constructs as dependent on given object
   // (NOTE: this is for internal use only)
-  nsTSubstring_CharT( const self_type& str )
-    : mData(str.mData),
-      mLength(str.mLength),
-      mFlags(str.mFlags & (F_TERMINATED | F_VOIDED)) {}
+  nsTSubstring_CharT(const self_type& aStr)
+    : mData(aStr.mData)
+    ,  mLength(aStr.mLength)
+    ,  mFlags(aStr.mFlags & (F_TERMINATED | F_VOIDED))
+  {
+  }
 
   /**
    * this function releases mData and does not change the value of
@@ -745,9 +914,9 @@ protected:
   /**
    * this function prepares mData to be mutated.
    *
-   * @param capacity     specifies the required capacity of mData
-   * @param old_data     returns null or the old value of mData
-   * @param old_flags    returns 0 or the old value of mFlags
+   * @param aCapacity    specifies the required capacity of mData
+   * @param aOldData     returns null or the old value of mData
+   * @param aOldFlags    returns 0 or the old value of mFlags
    *
    * if mData is already mutable and of sufficient capacity, then this
    * function will return immediately.  otherwise, it will either resize
@@ -760,16 +929,17 @@ protected:
    *
    * XXX we should expose a way for subclasses to free old_data.
    */
-  bool NS_FASTCALL MutatePrep( size_type capacity, char_type** old_data, uint32_t* old_flags );
+  bool NS_FASTCALL MutatePrep(size_type aCapacity,
+                              char_type** aOldData, uint32_t* aOldFlags);
 
   /**
    * this function prepares a section of mData to be modified.  if
    * necessary, this function will reallocate mData and possibly move
    * existing data to open up the specified section.
    *
-   * @param cutStart     specifies the starting offset of the section
-   * @param cutLength    specifies the length of the section to be replaced
-   * @param newLength    specifies the length of the new section
+   * @param aCutStart    specifies the starting offset of the section
+   * @param aCutLength   specifies the length of the section to be replaced
+   * @param aNewLength   specifies the length of the new section
    *
    * for example, suppose mData contains the string "abcdef" then
    *
@@ -782,25 +952,27 @@ protected:
    * this function returns false if is unable to allocate sufficient
    * memory.
    */
-  bool ReplacePrep(index_type cutStart, size_type cutLength,
-                   size_type newLength) NS_WARN_UNUSED_RESULT
+  NS_WARN_UNUSED_RESULT bool ReplacePrep(index_type aCutStart,
+                                         size_type aCutLength,
+                                         size_type aNewLength)
   {
-    cutLength = XPCOM_MIN(cutLength, mLength - cutStart);
-    uint32_t newTotalLen = mLength - cutLength + newLength;
-    if (cutStart == mLength && Capacity() > newTotalLen) {
+    aCutLength = XPCOM_MIN(aCutLength, mLength - aCutStart);
+    uint32_t newTotalLen = mLength - aCutLength + aNewLength;
+    if (aCutStart == mLength && Capacity() > newTotalLen)
+    {
       mFlags &= ~F_VOIDED;
       mData[newTotalLen] = char_type(0);
       mLength = newTotalLen;
       return true;
     }
-    return ReplacePrepInternal(cutStart, cutLength, newLength, newTotalLen);
+    return ReplacePrepInternal(aCutStart, aCutLength, aNewLength, newTotalLen);
   }
 
-  bool NS_FASTCALL ReplacePrepInternal(index_type cutStart,
-                                       size_type cutLength,
-                                       size_type newFragLength,
-                                       size_type newTotalLength)
-  NS_WARN_UNUSED_RESULT;
+  NS_WARN_UNUSED_RESULT bool NS_FASTCALL ReplacePrepInternal(
+    index_type aCutStart,
+    size_type aCutLength,
+    size_type aNewFragLength,
+    size_type aNewTotalLength);
 
   /**
    * returns the number of writable storage units starting at mData.
@@ -815,42 +987,44 @@ protected:
    * this helper function can be called prior to directly manipulating
    * the contents of mData.  see, for example, BeginWriting.
    */
-  bool NS_FASTCALL EnsureMutable( size_type newLen = size_type(-1) ) NS_WARN_UNUSED_RESULT;
+  NS_WARN_UNUSED_RESULT bool NS_FASTCALL EnsureMutable(
+    size_type aNewLen = size_type(-1));
 
   /**
    * returns true if this string overlaps with the given string fragment.
    */
-  bool IsDependentOn( const char_type *start, const char_type *end ) const
+  bool IsDependentOn(const char_type* aStart, const char_type* aEnd) const
   {
     /**
      * if it _isn't_ the case that one fragment starts after the other ends,
      * or ends before the other starts, then, they conflict:
      *
-     *   !(f2.begin >= f1.end || f2.end <= f1.begin)
+     *   !(f2.begin >= f1.aEnd || f2.aEnd <= f1.begin)
      *
      * Simplified, that gives us:
      */
-    return ( start < (mData + mLength) && end > mData );
+    return (aStart < (mData + mLength) && aEnd > mData);
   }
 
   /**
    * this helper function stores the specified dataFlags in mFlags
    */
-  void SetDataFlags(uint32_t dataFlags)
+  void SetDataFlags(uint32_t aDataFlags)
   {
-    NS_ASSERTION((dataFlags & 0xFFFF0000) == 0, "bad flags");
-    mFlags = dataFlags | (mFlags & 0xFFFF0000);
+    NS_ASSERTION((aDataFlags & 0xFFFF0000) == 0, "bad flags");
+    mFlags = aDataFlags | (mFlags & 0xFFFF0000);
   }
 
-  void NS_FASTCALL ReplaceLiteral( index_type cutStart, size_type cutLength, const char_type* data, size_type length );
+  void NS_FASTCALL ReplaceLiteral(index_type aCutStart, size_type aCutLength,
+                                  const char_type* aData, size_type aLength);
 
-  static int AppendFunc( void* arg, const char* s, uint32_t len);
+  static int AppendFunc(void* aArg, const char* aStr, uint32_t aLen);
 
 public:
 
   // NOTE: this method is declared public _only_ for convenience for
   // callers who don't have access to the original nsLiteralString_CharT.
-  void NS_FASTCALL AssignLiteral( const char_type* data, size_type length );
+  void NS_FASTCALL AssignLiteral(const char_type* aData, size_type aLength);
 
   // mFlags is a bitwise combination of the following flags.  the meaning
   // and interpretation of these flags is an implementation detail.
@@ -909,48 +1083,58 @@ public:
   //
 };
 
-int NS_FASTCALL Compare( const nsTSubstring_CharT::base_string_type& lhs, const nsTSubstring_CharT::base_string_type& rhs, const nsTStringComparator_CharT& = nsTDefaultStringComparator_CharT() );
+int NS_FASTCALL
+Compare(const nsTSubstring_CharT::base_string_type& aLhs,
+        const nsTSubstring_CharT::base_string_type& aRhs,
+        const nsTStringComparator_CharT& = nsTDefaultStringComparator_CharT());
 
 
-inline
-bool operator!=( const nsTSubstring_CharT::base_string_type& lhs, const nsTSubstring_CharT::base_string_type& rhs )
+inline bool
+operator!=(const nsTSubstring_CharT::base_string_type& aLhs,
+           const nsTSubstring_CharT::base_string_type& aRhs)
 {
-  return !lhs.Equals(rhs);
+  return !aLhs.Equals(aRhs);
 }
 
-inline
-bool operator< ( const nsTSubstring_CharT::base_string_type& lhs, const nsTSubstring_CharT::base_string_type& rhs )
+inline bool
+operator<(const nsTSubstring_CharT::base_string_type& aLhs,
+          const nsTSubstring_CharT::base_string_type& aRhs)
 {
-  return Compare(lhs, rhs)< 0;
+  return Compare(aLhs, aRhs) < 0;
 }
 
-inline
-bool operator<=( const nsTSubstring_CharT::base_string_type& lhs, const nsTSubstring_CharT::base_string_type& rhs )
+inline bool
+operator<=(const nsTSubstring_CharT::base_string_type& aLhs,
+           const nsTSubstring_CharT::base_string_type& aRhs)
 {
-  return Compare(lhs, rhs)<=0;
+  return Compare(aLhs, aRhs) <= 0;
 }
 
-inline
-bool operator==( const nsTSubstring_CharT::base_string_type& lhs, const nsTSubstring_CharT::base_string_type& rhs )
+inline bool
+operator==(const nsTSubstring_CharT::base_string_type& aLhs,
+           const nsTSubstring_CharT::base_string_type& aRhs)
 {
-  return lhs.Equals(rhs);
+  return aLhs.Equals(aRhs);
 }
 
-inline
-bool operator==( const nsTSubstring_CharT::base_string_type& lhs, const nsTSubstring_CharT::char_type* rhs )
+inline bool
+operator==(const nsTSubstring_CharT::base_string_type& aLhs,
+           const nsTSubstring_CharT::char_type* aRhs)
 {
-  return lhs.Equals(rhs);
+  return aLhs.Equals(aRhs);
 }
 
 
-inline
-bool operator>=( const nsTSubstring_CharT::base_string_type& lhs, const nsTSubstring_CharT::base_string_type& rhs )
+inline bool
+operator>=(const nsTSubstring_CharT::base_string_type& aLhs,
+           const nsTSubstring_CharT::base_string_type& aRhs)
 {
-  return Compare(lhs, rhs)>=0;
+  return Compare(aLhs, aRhs) >= 0;
 }
 
-inline
-bool operator> ( const nsTSubstring_CharT::base_string_type& lhs, const nsTSubstring_CharT::base_string_type& rhs )
+inline bool
+operator>(const nsTSubstring_CharT::base_string_type& aLhs,
+          const nsTSubstring_CharT::base_string_type& aRhs)
 {
-  return Compare(lhs, rhs)> 0;
+  return Compare(aLhs, aRhs) > 0;
 }
diff --git a/xpcom/string/public/nsTSubstringTuple.h b/xpcom/string/public/nsTSubstringTuple.h
index 45765237d280..5d24e2159447 100644
--- a/xpcom/string/public/nsTSubstringTuple.h
+++ b/xpcom/string/public/nsTSubstringTuple.h
@@ -28,15 +28,21 @@ public:
 
 public:
 
-  nsTSubstringTuple_CharT(const base_string_type* a, const base_string_type* b)
+  nsTSubstringTuple_CharT(const base_string_type* aStrA,
+                          const base_string_type* aStrB)
     : mHead(nullptr)
-    , mFragA(a)
-    , mFragB(b) {}
+    , mFragA(aStrA)
+    , mFragB(aStrB)
+  {
+  }
 
-  nsTSubstringTuple_CharT(const self_type& head, const base_string_type* b)
-    : mHead(&head)
-    , mFragA(nullptr) // this fragment is ignored when head != nullptr
-    , mFragB(b) {}
+  nsTSubstringTuple_CharT(const self_type& aHead,
+                          const base_string_type* aStrB)
+    : mHead(&aHead)
+    , mFragA(nullptr) // this fragment is ignored when aHead != nullptr
+    , mFragB(aStrB)
+  {
+  }
 
   /**
    * computes the aggregate string length
@@ -48,13 +54,13 @@ public:
    * to be equal to or greater than the value returned by the Length()
    * method.  the string written to |buf| is not null-terminated.
    */
-  void WriteTo(char_type *buf, uint32_t bufLen) const;
+  void WriteTo(char_type* aBuf, uint32_t aBufLen) const;
 
   /**
    * returns true if this tuple is dependent on (i.e., overlapping with)
    * the given char sequence.
    */
-  bool IsDependentOn(const char_type *start, const char_type *end) const;
+  bool IsDependentOn(const char_type* aStart, const char_type* aEnd) const;
 
 private:
 
@@ -63,16 +69,16 @@ private:
   const base_string_type* mFragB;
 };
 
-inline
-const nsTSubstringTuple_CharT
-operator+(const nsTSubstringTuple_CharT::base_string_type& a, const nsTSubstringTuple_CharT::base_string_type& b)
+inline const nsTSubstringTuple_CharT
+operator+(const nsTSubstringTuple_CharT::base_string_type& aStrA,
+          const nsTSubstringTuple_CharT::base_string_type& aStrB)
 {
-  return nsTSubstringTuple_CharT(&a, &b);
+  return nsTSubstringTuple_CharT(&aStrA, &aStrB);
 }
 
-inline
-const nsTSubstringTuple_CharT
-operator+(const nsTSubstringTuple_CharT& head, const nsTSubstringTuple_CharT::base_string_type& b)
+inline const nsTSubstringTuple_CharT
+operator+(const nsTSubstringTuple_CharT& aHead,
+          const nsTSubstringTuple_CharT::base_string_type& aStrB)
 {
-  return nsTSubstringTuple_CharT(head, &b);
+  return nsTSubstringTuple_CharT(aHead, &aStrB);
 }
diff --git a/xpcom/string/public/nsUTF8Utils.h b/xpcom/string/public/nsUTF8Utils.h
index 7171db238493..ae6239c2965c 100644
--- a/xpcom/string/public/nsUTF8Utils.h
+++ b/xpcom/string/public/nsUTF8Utils.h
@@ -18,13 +18,34 @@
 class UTF8traits
 {
 public:
-  static bool isASCII(char c) { return (c & 0x80) == 0x00; }
-  static bool isInSeq(char c) { return (c & 0xC0) == 0x80; }
-  static bool is2byte(char c) { return (c & 0xE0) == 0xC0; }
-  static bool is3byte(char c) { return (c & 0xF0) == 0xE0; }
-  static bool is4byte(char c) { return (c & 0xF8) == 0xF0; }
-  static bool is5byte(char c) { return (c & 0xFC) == 0xF8; }
-  static bool is6byte(char c) { return (c & 0xFE) == 0xFC; }
+  static bool isASCII(char aChar)
+  {
+    return (aChar & 0x80) == 0x00;
+  }
+  static bool isInSeq(char aChar)
+  {
+    return (aChar & 0xC0) == 0x80;
+  }
+  static bool is2byte(char aChar)
+  {
+    return (aChar & 0xE0) == 0xC0;
+  }
+  static bool is3byte(char aChar)
+  {
+    return (aChar & 0xF0) == 0xE0;
+  }
+  static bool is4byte(char aChar)
+  {
+    return (aChar & 0xF8) == 0xF0;
+  }
+  static bool is5byte(char aChar)
+  {
+    return (aChar & 0xFC) == 0xF8;
+  }
+  static bool is6byte(char aChar)
+  {
+    return (aChar & 0xFE) == 0xFC;
+  }
 };
 
 /**
@@ -38,26 +59,23 @@ public:
 class UTF8CharEnumerator
 {
 public:
-  static uint32_t NextChar(const char **buffer, const char *end,
-                           bool *err)
+  static uint32_t NextChar(const char** aBuffer, const char* aEnd, bool* aErr)
   {
-    NS_ASSERTION(buffer && *buffer, "null buffer!");
+    NS_ASSERTION(aBuffer && *aBuffer, "null buffer!");
 
-    const char *p = *buffer;
-    *err = false;
+    const char* p = *aBuffer;
+    *aErr = false;
 
-    if (p >= end)
-    {
-      *err = true;
+    if (p >= aEnd) {
+      *aErr = true;
 
       return 0;
     }
 
     char c = *p++;
 
-    if ( UTF8traits::isASCII(c) )
-    {
-      *buffer = p;
+    if (UTF8traits::isASCII(c)) {
+      *aBuffer = p;
       return c;
     }
 
@@ -67,94 +85,76 @@ public:
 
     if (!CalcState(c, ucs4, minUcs4, state)) {
       NS_ERROR("Not a UTF-8 string. This code should only be used for converting from known UTF-8 strings.");
-      *err = true;
+      *aErr = true;
 
       return 0;
     }
 
-    while ( state-- )
-    {
-      if (p == end)
-      {
-        *err = true;
+    while (state--) {
+      if (p == aEnd) {
+        *aErr = true;
 
         return 0;
       }
 
       c = *p++;
 
-      if (!AddByte(c, state, ucs4))
-      {
-        *err = true;
+      if (!AddByte(c, state, ucs4)) {
+        *aErr = true;
 
         return 0;
       }
     }
 
-    if ( ucs4 < minUcs4 )
-    {
+    if (ucs4 < minUcs4) {
       // Overlong sequence
       ucs4 = UCS2_REPLACEMENT_CHAR;
-    }
-    else if ( ucs4 >= 0xD800 &&
-              (ucs4 <= 0xDFFF || ucs4 >= UCS_END))
-    {
+    } else if (ucs4 >= 0xD800 &&
+               (ucs4 <= 0xDFFF || ucs4 >= UCS_END)) {
       // Surrogates and code points outside the Unicode range.
       ucs4 = UCS2_REPLACEMENT_CHAR;
     }
 
-    *buffer = p;
+    *aBuffer = p;
     return ucs4;
   }
 
 private:
-  static bool CalcState(char c, uint32_t& ucs4, uint32_t& minUcs4,
-                        int32_t& state)
+  static bool CalcState(char aChar, uint32_t& aUcs4, uint32_t& aMinUcs4,
+                        int32_t& aState)
   {
-    if ( UTF8traits::is2byte(c) )
-    {
-      ucs4 = (uint32_t(c) << 6) & 0x000007C0L;
-      state = 1;
-      minUcs4 = 0x00000080;
-    }
-    else if ( UTF8traits::is3byte(c) )
-    {
-      ucs4 = (uint32_t(c) << 12) & 0x0000F000L;
-      state = 2;
-      minUcs4 = 0x00000800;
-    }
-    else if ( UTF8traits::is4byte(c) )
-    {
-      ucs4 = (uint32_t(c) << 18) & 0x001F0000L;
-      state = 3;
-      minUcs4 = 0x00010000;
-    }
-    else if ( UTF8traits::is5byte(c) )
-    {
-      ucs4 = (uint32_t(c) << 24) & 0x03000000L;
-      state = 4;
-      minUcs4 = 0x00200000;
-    }
-    else if ( UTF8traits::is6byte(c) )
-    {
-      ucs4 = (uint32_t(c) << 30) & 0x40000000L;
-      state = 5;
-      minUcs4 = 0x04000000;
-    }
-    else
-    {
+    if (UTF8traits::is2byte(aChar)) {
+      aUcs4 = (uint32_t(aChar) << 6) & 0x000007C0L;
+      aState = 1;
+      aMinUcs4 = 0x00000080;
+    } else if (UTF8traits::is3byte(aChar)) {
+      aUcs4 = (uint32_t(aChar) << 12) & 0x0000F000L;
+      aState = 2;
+      aMinUcs4 = 0x00000800;
+    } else if (UTF8traits::is4byte(aChar)) {
+      aUcs4 = (uint32_t(aChar) << 18) & 0x001F0000L;
+      aState = 3;
+      aMinUcs4 = 0x00010000;
+    } else if (UTF8traits::is5byte(aChar)) {
+      aUcs4 = (uint32_t(aChar) << 24) & 0x03000000L;
+      aState = 4;
+      aMinUcs4 = 0x00200000;
+    } else if (UTF8traits::is6byte(aChar)) {
+      aUcs4 = (uint32_t(aChar) << 30) & 0x40000000L;
+      aState = 5;
+      aMinUcs4 = 0x04000000;
+    } else {
       return false;
     }
 
     return true;
   }
 
-  static bool AddByte(char c, int32_t state, uint32_t& ucs4)
+  static bool AddByte(char aChar, int32_t aState, uint32_t& aUcs4)
   {
-    if ( UTF8traits::isInSeq(c) )
-    {
-      int32_t shift = state * 6;
-      ucs4 |= (uint32_t(c) & 0x3F) << shift;
+    if (UTF8traits::isInSeq(aChar)) {
+      int32_t shift = aState * 6;
+      aUcs4 |= (uint32_t(aChar) & 0x3F) << shift;
       return true;
     }
 
@@ -173,44 +173,42 @@ private:
 class UTF16CharEnumerator
 {
 public:
-  static uint32_t NextChar(const char16_t **buffer, const char16_t *end,
-                           bool *err = nullptr)
+  static uint32_t NextChar(const char16_t** aBuffer, const char16_t* aEnd,
+                           bool* aErr = nullptr)
   {
-    NS_ASSERTION(buffer && *buffer, "null buffer!");
+    NS_ASSERTION(aBuffer && *aBuffer, "null buffer!");
 
-    const char16_t *p = *buffer;
+    const char16_t* p = *aBuffer;
 
-    if (p >= end)
-    {
+    if (p >= aEnd) {
       NS_ERROR("No input to work with");
-      if (err)
-        *err = true;
+      if (aErr) {
+        *aErr = true;
+      }
 
       return 0;
     }
 
     char16_t c = *p++;
 
-    if (!IS_SURROGATE(c)) // U+0000 - U+D7FF,U+E000 - U+FFFF
-    {
-      if (err)
-        *err = false;
-      *buffer = p;
+    if (!IS_SURROGATE(c)) { // U+0000 - U+D7FF,U+E000 - U+FFFF
+      if (aErr) {
+        *aErr = false;
+      }
+      *aBuffer = p;
       return c;
-    }
-    else if (NS_IS_HIGH_SURROGATE(c)) // U+D800 - U+DBFF
-    {
-      if (p == end)
-      {
-        // Found a high surrogate the end of the buffer. Flag this
+    } else if (NS_IS_HIGH_SURROGATE(c)) { // U+D800 - U+DBFF
+      if (p == aEnd) {
+        // Found a high surrogate at the end of the buffer. Flag this
         // as an error and return the Unicode replacement
         // character 0xFFFD.
 
         NS_WARNING("Unexpected end of buffer after high surrogate");
 
-        if (err)
-          *err = true;
-        *buffer = p;
+        if (aErr) {
+          *aErr = true;
+        }
+        *aBuffer = p;
         return 0xFFFD;
       }
 
@@ -219,18 +217,16 @@ public:
 
       c = *p++;
 
-      if (NS_IS_LOW_SURROGATE(c))
-      {
+      if (NS_IS_LOW_SURROGATE(c)) {
         // DC00- DFFF - Low Surrogate
         // N = (H - D800) *400 + 10000 + (L - DC00)
         uint32_t ucs4 = SURROGATE_TO_UCS4(h, c);
-        if (err)
-          *err = false;
-        *buffer = p;
+        if (aErr) {
+          *aErr = false;
+        }
+        *aBuffer = p;
         return ucs4;
-      }
-      else
-      {
+      } else {
         // Found a high surrogate followed by something other than
         // a low surrogate. Flag this as an error and return the
         // Unicode replacement character 0xFFFD.  Note that the
@@ -242,14 +238,13 @@ public:
         // UTF-16 code units in the range D800..DFFF are ill-formed").
         NS_WARNING("got a High Surrogate but no low surrogate");
 
-        if (err)
-          *err = true;
-        *buffer = p - 1;
+        if (aErr) {
+          *aErr = true;
+        }
+        *aBuffer = p - 1;
         return 0xFFFD;
       }
-    }
-    else // U+DC00 - U+DFFF
-    {
+    } else { // U+DC00 - U+DFFF
       // DC00- DFFF - Low Surrogate
 
       // Found a low surrogate w/o a preceding high surrogate. Flag
@@ -257,14 +252,16 @@ public:
       // character 0xFFFD.
 
       NS_WARNING("got a low Surrogate but no high surrogate");
-      if (err)
-        *err = true;
-      *buffer = p;
+      if (aErr) {
+        *aErr = true;
+      }
+      *aBuffer = p;
       return 0xFFFD;
     }
 
-    if (err)
-      *err = true;
+    if (aErr) {
+      *aErr = true;
+    }
     return 0;
   }
 };
@@ -280,42 +277,46 @@ public:
   typedef char value_type;
   typedef char16_t buffer_type;
 
-  explicit ConvertUTF8toUTF16( buffer_type* aBuffer )
-    : mStart(aBuffer), mBuffer(aBuffer), mErrorEncountered(false) {}
-
-  size_t Length() const { return mBuffer - mStart; }
-
-  bool ErrorEncountered() const { return mErrorEncountered; }
-
-  void write( const value_type* start, uint32_t N )
+  explicit ConvertUTF8toUTF16(buffer_type* aBuffer)
+    : mStart(aBuffer), mBuffer(aBuffer), mErrorEncountered(false)
   {
-    if ( mErrorEncountered )
+  }
+
+  size_t Length() const
+  {
+    return mBuffer - mStart;
+  }
+
+  bool ErrorEncountered() const
+  {
+    return mErrorEncountered;
+  }
+
+  void write(const value_type* aStart, uint32_t aN)
+  {
+    if (mErrorEncountered) {
       return;
+    }
 
     // algorithm assumes utf8 units won't
     // be spread across fragments
-    const value_type* p = start;
-    const value_type* end = start + N;
+    const value_type* p = aStart;
+    const value_type* end = aStart + aN;
     buffer_type* out = mBuffer;
-    for ( ; p != end /* && *p */; )
-    {
+    for (; p != end /* && *p */;) {
       bool err;
       uint32_t ucs4 = UTF8CharEnumerator::NextChar(&p, end, &err);
 
-      if ( err )
-      {
+      if (err) {
         mErrorEncountered = true;
         mBuffer = out;
         return;
       }
 
-      if ( ucs4 >= PLANE1_BASE )
-      {
+      if (ucs4 >= PLANE1_BASE) {
         *out++ = (buffer_type)H_SURROGATE(ucs4);
         *out++ = (buffer_type)L_SURROGATE(ucs4);
-      }
-      else
-      {
+      } else {
         *out++ = ucs4;
       }
     }
@@ -342,29 +343,35 @@ class CalculateUTF8Length
 public:
   typedef char value_type;
 
-  CalculateUTF8Length() : mLength(0), mErrorEncountered(false) { }
+  CalculateUTF8Length()
+    : mLength(0), mErrorEncountered(false)
+  {
+  }
 
-  size_t Length() const { return mLength; }
+  size_t Length() const
+  {
+    return mLength;
+  }
 
-  void write( const value_type* start, uint32_t N )
+  void write(const value_type* aStart, uint32_t aN)
   {
     // ignore any further requests
-    if ( mErrorEncountered )
+    if (mErrorEncountered) {
       return;
+    }
 
     // algorithm assumes utf8 units won't
     // be spread across fragments
-    const value_type* p = start;
-    const value_type* end = start + N;
-    for ( ; p < end /* && *p */; ++mLength )
-    {
-      if ( UTF8traits::isASCII(*p) )
+    const value_type* p = aStart;
+    const value_type* end = aStart + aN;
+    for (; p < end /* && *p */; ++mLength) {
+      if (UTF8traits::isASCII(*p)) {
         p += 1;
-      else if ( UTF8traits::is2byte(*p) )
+      } else if (UTF8traits::is2byte(*p)) {
         p += 2;
-      else if ( UTF8traits::is3byte(*p) )
+      } else if (UTF8traits::is3byte(*p)) {
         p += 3;
-      else if ( UTF8traits::is4byte(*p) ) {
+      } else if (UTF8traits::is4byte(*p)) {
         // Because a UTF-8 sequence of 4 bytes represents a codepoint
         // greater than 0xFFFF, it will become a surrogate pair in the
         // UTF-16 string, so add 1 more to mLength.
@@ -401,24 +408,22 @@ public:
         if (p + 4 <= end) {
           uint32_t c = ((uint32_t)(p[0] & 0x07)) << 6 |
                        ((uint32_t)(p[1] & 0x30));
-          if (c >= 0x010 && c < 0x110)
+          if (c >= 0x010 && c < 0x110) {
             ++mLength;
+          }
         }
 
         p += 4;
-      }
-      else if ( UTF8traits::is5byte(*p) )
+      } else if (UTF8traits::is5byte(*p)) {
         p += 5;
-      else if ( UTF8traits::is6byte(*p) )
+      } else if (UTF8traits::is6byte(*p)) {
         p += 6;
-      else // error
-      {
+      } else { // error
         ++mLength; // to account for the decrement below
         break;
       }
     }
-    if ( p != end )
-    {
+    if (p != end) {
       NS_ERROR("Not a UTF-8 string. This code should only be used for converting from known UTF-8 strings.");
       --mLength; // The last multi-byte char wasn't complete, discard it.
       mErrorEncountered = true;
@@ -445,41 +450,37 @@ public:
   // |ConvertUTF8toUTF16|, but it's that way for backwards
   // compatibility.
 
-  explicit ConvertUTF16toUTF8( buffer_type* aBuffer )
-    : mStart(aBuffer), mBuffer(aBuffer) {}
-
-  size_t Size() const { return mBuffer - mStart; }
-
-  void write( const value_type* start, uint32_t N )
+  explicit ConvertUTF16toUTF8(buffer_type* aBuffer)
+    : mStart(aBuffer), mBuffer(aBuffer)
   {
-    buffer_type *out = mBuffer; // gcc isn't smart enough to do this!
+  }
 
-    for (const value_type *p = start, *end = start + N; p < end; ++p )
-    {
+  size_t Size() const
+  {
+    return mBuffer - mStart;
+  }
+
+  void write(const value_type* aStart, uint32_t aN)
+  {
+    buffer_type* out = mBuffer; // gcc isn't smart enough to do this!
+
+    for (const value_type* p = aStart, *end = aStart + aN; p < end; ++p) {
       value_type c = *p;
-      if (! (c & 0xFF80)) // U+0000 - U+007F
-      {
+      if (!(c & 0xFF80)) { // U+0000 - U+007F
         *out++ = (char)c;
-      }
-      else if (! (c & 0xF800)) // U+0100 - U+07FF
-      {
+      } else if (!(c & 0xF800)) { // U+0100 - U+07FF
         *out++ = 0xC0 | (char)(c >> 6);
         *out++ = 0x80 | (char)(0x003F & c);
-      }
-      else if (!IS_SURROGATE(c)) // U+0800 - U+D7FF,U+E000 - U+FFFF
-      {
+      } else if (!IS_SURROGATE(c)) { // U+0800 - U+D7FF,U+E000 - U+FFFF
         *out++ = 0xE0 | (char)(c >> 12);
         *out++ = 0x80 | (char)(0x003F & (c >> 6));
-        *out++ = 0x80 | (char)(0x003F & c );
-      }
-      else if (NS_IS_HIGH_SURROGATE(c)) // U+D800 - U+DBFF
-      {
+        *out++ = 0x80 | (char)(0x003F & c);
+      } else if (NS_IS_HIGH_SURROGATE(c)) { // U+D800 - U+DBFF
         // D800- DBFF - High Surrogate
         value_type h = c;
 
         ++p;
-        if (p == end)
-        {
+        if (p == end) {
           // Treat broken characters as the Unicode
           // replacement character 0xFFFD (0xEFBFBD in
           // UTF-8)
@@ -493,8 +494,7 @@ public:
         }
         c = *p;
 
-        if (NS_IS_LOW_SURROGATE(c))
-        {
+        if (NS_IS_LOW_SURROGATE(c)) {
           // DC00- DFFF - Low Surrogate
           // N = (H - D800) *400 + 10000 + ( L - DC00 )
           uint32_t ucs4 = SURROGATE_TO_UCS4(h, c);
@@ -504,9 +504,7 @@ public:
           *out++ = 0x80 | (char)(0x003F & (ucs4 >> 12));
           *out++ = 0x80 | (char)(0x003F & (ucs4 >> 6));
           *out++ = 0x80 | (char)(0x003F & ucs4);
-        }
-        else
-        {
+        } else {
           // Treat broken characters as the Unicode
           // replacement character 0xFFFD (0xEFBFBD in
           // UTF-8)
@@ -525,9 +523,7 @@ public:
 
           NS_WARNING("got a High Surrogate but no low surrogate");
         }
-      }
-      else // U+DC00 - U+DFFF
-      {
+      } else { // U+DC00 - U+DFFF
         // Treat broken characters as the Unicode replacement
         // character 0xFFFD (0xEFBFBD in UTF-8)
         *out++ = '\xEF';
@@ -563,27 +559,29 @@ public:
   typedef char16_t value_type;
 
   CalculateUTF8Size()
-    : mSize(0) { }
+    : mSize(0)
+  {
+  }
 
-  size_t Size() const { return mSize; }
+  size_t Size() const
+  {
+    return mSize;
+  }
 
-  void write( const value_type* start, uint32_t N )
+  void write(const value_type* aStart, uint32_t aN)
   {
     // Assume UCS2 surrogate pairs won't be spread across fragments.
-    for (const value_type *p = start, *end = start + N; p < end; ++p )
-    {
+    for (const value_type* p = aStart, *end = aStart + aN; p < end; ++p) {
       value_type c = *p;
-      if (! (c & 0xFF80)) // U+0000 - U+007F
+      if (!(c & 0xFF80)) { // U+0000 - U+007F
         mSize += 1;
-      else if (! (c & 0xF800)) // U+0100 - U+07FF
+      } else if (!(c & 0xF800)) { // U+0100 - U+07FF
         mSize += 2;
-      else if (0xD800 != (0xF800 & c)) // U+0800 - U+D7FF,U+E000 - U+FFFF
+      } else if (0xD800 != (0xF800 & c)) { // U+0800 - U+D7FF,U+E000 - U+FFFF
         mSize += 3;
-      else if (0xD800 == (0xFC00 & c)) // U+D800 - U+DBFF
-      {
+      } else if (0xD800 == (0xFC00 & c)) { // U+D800 - U+DBFF
         ++p;
-        if (p == end)
-        {
+        if (p == end) {
           // Treat broken characters as the Unicode
           // replacement character 0xFFFD (0xEFBFBD in
           // UTF-8)
@@ -595,10 +593,9 @@ public:
         }
         c = *p;
 
-        if (0xDC00 == (0xFC00 & c))
+        if (0xDC00 == (0xFC00 & c)) {
           mSize += 4;
-        else
-        {
+        } else {
           // Treat broken characters as the Unicode
           // replacement character 0xFFFD (0xEFBFBD in
           // UTF-8)
@@ -615,9 +612,7 @@ public:
 
           NS_WARNING("got a high Surrogate but no low surrogate");
         }
-      }
-      else // U+DC00 - U+DFFF
-      {
+      } else { // U+DC00 - U+DFFF
         // Treat broken characters as the Unicode replacement
         // character 0xFFFD (0xEFBFBD in UTF-8)
         mSize += 3;
@@ -644,26 +639,28 @@ public:
   typedef char16_t output_type;
 
 public:
-  explicit LossyConvertEncoding8to16( char16_t* aDestination ) :
-    mDestination(aDestination) { }
+  explicit LossyConvertEncoding8to16(char16_t* aDestination) :
+    mDestination(aDestination)
+  {
+  }
 
   void
-  write( const char* aSource, uint32_t aSourceLength )
+  write(const char* aSource, uint32_t aSourceLength)
   {
 #ifdef MOZILLA_MAY_SUPPORT_SSE2
-    if (mozilla::supports_sse2())
-    {
+    if (mozilla::supports_sse2()) {
       write_sse2(aSource, aSourceLength);
       return;
     }
 #endif
     const char* done_writing = aSource + aSourceLength;
-    while ( aSource < done_writing )
+    while (aSource < done_writing) {
       *mDestination++ = (char16_t)(unsigned char)(*aSource++);
+    }
   }
 
   void
-  write_sse2( const char* aSource, uint32_t aSourceLength );
+  write_sse2(const char* aSource, uint32_t aSourceLength);
 
   void
   write_terminator()
@@ -686,26 +683,29 @@ public:
   typedef char16_t input_type;
   typedef char output_type;
 
-  explicit LossyConvertEncoding16to8( char* aDestination ) : mDestination(aDestination) { }
+  explicit LossyConvertEncoding16to8(char* aDestination)
+    : mDestination(aDestination)
+  {
+  }
 
   void
-  write( const char16_t* aSource, uint32_t aSourceLength)
+  write(const char16_t* aSource, uint32_t aSourceLength)
   {
 #ifdef MOZILLA_MAY_SUPPORT_SSE2
-    if (mozilla::supports_sse2())
-    {
+    if (mozilla::supports_sse2()) {
       write_sse2(aSource, aSourceLength);
       return;
     }
 #endif
     const char16_t* done_writing = aSource + aSourceLength;
-    while ( aSource < done_writing )
+    while (aSource < done_writing) {
       *mDestination++ = (char)(*aSource++);
+    }
   }
 
 #ifdef MOZILLA_MAY_SUPPORT_SSE2
   void
-  write_sse2( const char16_t* aSource, uint32_t aSourceLength );
+  write_sse2(const char16_t* aSource, uint32_t aSourceLength);
 #endif
 
   void
@@ -715,7 +715,7 @@ public:
   }
 
 private:
-  char *mDestination;
+  char* mDestination;
 };
 #endif // MOZILLA_INTERNAL_API
 
diff --git a/xpcom/string/public/nsXPCOMStrings.h b/xpcom/string/public/nsXPCOMStrings.h
index e7fc752fabac..e320ed7e0317 100644
--- a/xpcom/string/public/nsXPCOMStrings.h
+++ b/xpcom/string/public/nsXPCOMStrings.h
@@ -107,7 +107,7 @@ class nsStringContainer;
 struct nsStringContainer_base
 {
 protected:
-  void *d1;
+  void* d1;
   uint32_t d2;
   uint32_t d3;
 };
@@ -115,7 +115,8 @@ protected:
 /**
  * Flags that may be OR'd together to pass to NS_StringContainerInit2:
  */
-enum {
+enum
+{
   /* Data passed into NS_StringContainerInit2 is not copied; instead, the
    * string references the passed in data pointer directly.  The caller must
    * ensure that the data is valid for the lifetime of the string container.
@@ -142,8 +143,7 @@ enum {
  * This function may allocate additional memory for aContainer.  When
  * aContainer is no longer needed, NS_StringContainerFinish should be called.
  */
-XPCOM_API(nsresult)
-NS_StringContainerInit(nsStringContainer &aContainer);
+XPCOM_API(nsresult) NS_StringContainerInit(nsStringContainer& aContainer);
 
 /**
  * NS_StringContainerInit2
@@ -164,10 +164,10 @@ NS_StringContainerInit(nsStringContainer &aContainer);
  * NOTE: NS_StringContainerInit2(container, nullptr, 0, 0) is equivalent to
  * NS_StringContainerInit(container).
  */
-XPCOM_API(nsresult)
-NS_StringContainerInit2
-  (nsStringContainer &aContainer, const char16_t *aData = nullptr,
-   uint32_t aDataLength = UINT32_MAX, uint32_t aFlags = 0);
+XPCOM_API(nsresult) NS_StringContainerInit2(nsStringContainer& aContainer,
+                                            const char16_t* aData = nullptr,
+                                            uint32_t aDataLength = UINT32_MAX,
+                                            uint32_t aFlags = 0);
 
 /**
  * NS_StringContainerFinish
@@ -176,8 +176,7 @@ NS_StringContainerInit2
  *
  * This function frees any memory owned by aContainer.
  */
-XPCOM_API(void)
-NS_StringContainerFinish(nsStringContainer &aContainer);
+XPCOM_API(void) NS_StringContainerFinish(nsStringContainer& aContainer);
 
 /* ------------------------------------------------------------------------- */
 
@@ -196,10 +195,9 @@ NS_StringContainerFinish(nsStringContainer &aContainer);
  *                      terminated
  * @return              length of aStr's internal buffer
  */
-XPCOM_API(uint32_t)
-NS_StringGetData
-  (const nsAString &aStr, const char16_t **aData,
-   bool *aTerminated = nullptr);
+XPCOM_API(uint32_t) NS_StringGetData(const nsAString& aStr,
+                                     const char16_t** aData,
+                                     bool* aTerminated = nullptr);
 
 /**
  * NS_StringGetMutableData
@@ -228,9 +226,9 @@ NS_StringGetData
  * string, aStr.  If aStr is a reference to a nsStringContainer, then its data
  * will be null-terminated by this function.
  */
-XPCOM_API(uint32_t)
-NS_StringGetMutableData
-  (nsAString &aStr, uint32_t aDataLength, char16_t **aData);
+XPCOM_API(uint32_t) NS_StringGetMutableData(nsAString& aStr,
+                                            uint32_t aDataLength,
+                                            char16_t** aData);
 
 /**
  * NS_StringCloneData
@@ -242,9 +240,7 @@ NS_StringGetMutableData
  * @return              null-terminated copy of the string's internal buffer
  *                      (it must be free'd using using nsMemory::Free)
  */
-XPCOM_API(char16_t *)
-NS_StringCloneData
-  (const nsAString &aStr);
+XPCOM_API(char16_t*) NS_StringCloneData(const nsAString& aStr);
 
 /**
  * NS_StringSetData
@@ -263,10 +259,8 @@ NS_StringCloneData
  * string, aStr.  If aStr is a reference to a nsStringContainer, then its data
  * will be null-terminated by this function.
  */
-XPCOM_API(nsresult)
-NS_StringSetData
-  (nsAString &aStr, const char16_t *aData,
-   uint32_t aDataLength = UINT32_MAX);
+XPCOM_API(nsresult) NS_StringSetData(nsAString& aStr, const char16_t* aData,
+                                     uint32_t aDataLength = UINT32_MAX);
 
 /**
  * NS_StringSetDataRange
@@ -294,10 +288,10 @@ NS_StringSetData
  * string, aStr.  If aStr is a reference to a nsStringContainer, then its data
  * will be null-terminated by this function.
  */
-XPCOM_API(nsresult)
-NS_StringSetDataRange
-  (nsAString &aStr, uint32_t aCutOffset, uint32_t aCutLength,
-   const char16_t *aData, uint32_t aDataLength = UINT32_MAX);
+XPCOM_API(nsresult) NS_StringSetDataRange(nsAString& aStr,
+                                          uint32_t aCutOffset, uint32_t aCutLength,
+                                          const char16_t* aData,
+                                          uint32_t aDataLength = UINT32_MAX);
 
 /**
  * NS_StringCopy
@@ -314,9 +308,8 @@ NS_StringSetDataRange
  * abstract string, aDestStr.  If aDestStr is a reference to a
  * nsStringContainer, then its data will be null-terminated by this function.
  */
-XPCOM_API(nsresult)
-NS_StringCopy
-  (nsAString &aDestStr, const nsAString &aSrcStr);
+XPCOM_API(nsresult) NS_StringCopy(nsAString& aDestStr,
+                                  const nsAString& aSrcStr);
 
 /**
  * NS_StringAppendData
@@ -335,7 +328,7 @@ NS_StringCopy
  * terminated by this function.
  */
 inline NS_HIDDEN_(nsresult)
-NS_StringAppendData(nsAString &aStr, const char16_t *aData,
+NS_StringAppendData(nsAString& aStr, const char16_t* aData,
                     uint32_t aDataLength = UINT32_MAX)
 {
   return NS_StringSetDataRange(aStr, UINT32_MAX, 0, aData, aDataLength);
@@ -360,7 +353,7 @@ NS_StringAppendData(nsAString &aStr, const char16_t *aData,
  * terminated by this function.
  */
 inline NS_HIDDEN_(nsresult)
-NS_StringInsertData(nsAString &aStr, uint32_t aOffset, const char16_t *aData,
+NS_StringInsertData(nsAString& aStr, uint32_t aOffset, const char16_t* aData,
                     uint32_t aDataLength = UINT32_MAX)
 {
   return NS_StringSetDataRange(aStr, aOffset, 0, aData, aDataLength);
@@ -378,7 +371,7 @@ NS_StringInsertData(nsAString &aStr, uint32_t aOffset, const char16_t *aData,
  * @return              NS_OK if function succeeded
  */
 inline NS_HIDDEN_(nsresult)
-NS_StringCutData(nsAString &aStr, uint32_t aCutOffset, uint32_t aCutLength)
+NS_StringCutData(nsAString& aStr, uint32_t aCutOffset, uint32_t aCutLength)
 {
   return NS_StringSetDataRange(aStr, aCutOffset, aCutLength, nullptr, 0);
 }
@@ -389,8 +382,7 @@ NS_StringCutData(nsAString &aStr, uint32_t aCutOffset, uint32_t aCutLength)
  * This function marks a string as being a "void string".  Any data in the
  * string will be lost.
  */
-XPCOM_API(void)
-NS_StringSetIsVoid(nsAString& aStr, const bool aIsVoid);
+XPCOM_API(void) NS_StringSetIsVoid(nsAString& aStr, const bool aIsVoid);
 
 /**
  * NS_StringGetIsVoid
@@ -398,8 +390,7 @@ NS_StringSetIsVoid(nsAString& aStr, const bool aIsVoid);
  * This function provides a way to test if a string is a "void string", as
  * marked by NS_StringSetIsVoid.
  */
-XPCOM_API(bool)
-NS_StringGetIsVoid(const nsAString& aStr);
+XPCOM_API(bool) NS_StringGetIsVoid(const nsAString& aStr);
 
 /* ------------------------------------------------------------------------- */
 
@@ -420,7 +411,8 @@ class nsCStringContainer;
 /**
  * Flags that may be OR'd together to pass to NS_StringContainerInit2:
  */
-enum {
+enum
+{
   /* Data passed into NS_CStringContainerInit2 is not copied; instead, the
    * string references the passed in data pointer directly.  The caller must
    * ensure that the data is valid for the lifetime of the string container.
@@ -447,8 +439,7 @@ enum {
  * This function may allocate additional memory for aContainer.  When
  * aContainer is no longer needed, NS_CStringContainerFinish should be called.
  */
-XPCOM_API(nsresult)
-NS_CStringContainerInit(nsCStringContainer &aContainer);
+XPCOM_API(nsresult) NS_CStringContainerInit(nsCStringContainer& aContainer);
 
 /**
  * NS_CStringContainerInit2
@@ -469,10 +460,10 @@ NS_CStringContainerInit(nsCStringContainer &aContainer);
  * NOTE: NS_CStringContainerInit2(container, nullptr, 0, 0) is equivalent to
  * NS_CStringContainerInit(container).
  */
-XPCOM_API(nsresult)
-NS_CStringContainerInit2
-  (nsCStringContainer &aContainer, const char *aData = nullptr,
-   uint32_t aDataLength = UINT32_MAX, uint32_t aFlags = 0);
+XPCOM_API(nsresult) NS_CStringContainerInit2(nsCStringContainer& aContainer,
+                                             const char* aData = nullptr,
+                                             uint32_t aDataLength = UINT32_MAX,
+                                             uint32_t aFlags = 0);
 
 /**
  * NS_CStringContainerFinish
@@ -481,8 +472,7 @@ NS_CStringContainerInit2
  *
  * This function frees any memory owned by aContainer.
  */
-XPCOM_API(void)
-NS_CStringContainerFinish(nsCStringContainer &aContainer);
+XPCOM_API(void) NS_CStringContainerFinish(nsCStringContainer& aContainer);
 
 /* ------------------------------------------------------------------------- */
 
@@ -501,10 +491,9 @@ NS_CStringContainerFinish(nsCStringContainer &aContainer);
  *                      terminated
  * @return              length of aStr's internal buffer
  */
-XPCOM_API(uint32_t)
-NS_CStringGetData
-  (const nsACString &aStr, const char **aData,
-   bool *aTerminated = nullptr);
+XPCOM_API(uint32_t) NS_CStringGetData(const nsACString& aStr,
+                                      const char** aData,
+                                      bool* aTerminated = nullptr);
 
 /**
  * NS_CStringGetMutableData
@@ -533,9 +522,9 @@ NS_CStringGetData
  * string, aStr.  If aStr is a reference to a nsStringContainer, then its data
  * will be null-terminated by this function.
  */
-XPCOM_API(uint32_t)
-NS_CStringGetMutableData
-  (nsACString &aStr, uint32_t aDataLength, char **aData);
+XPCOM_API(uint32_t) NS_CStringGetMutableData(nsACString& aStr,
+                                             uint32_t aDataLength,
+                                             char** aData);
 
 /**
  * NS_CStringCloneData
@@ -547,9 +536,7 @@ NS_CStringGetMutableData
  * @return              null-terminated copy of the string's internal buffer
  *                      (it must be free'd using using nsMemory::Free)
  */
-XPCOM_API(char *)
-NS_CStringCloneData
-  (const nsACString &aStr);
+XPCOM_API(char*) NS_CStringCloneData(const nsACString& aStr);
 
 /**
  * NS_CStringSetData
@@ -568,10 +555,8 @@ NS_CStringCloneData
  * string, aStr.  If aStr is a reference to a nsStringContainer, then its data
  * will be null-terminated by this function.
  */
-XPCOM_API(nsresult)
-NS_CStringSetData
-  (nsACString &aStr, const char *aData,
-   uint32_t aDataLength = UINT32_MAX);
+XPCOM_API(nsresult) NS_CStringSetData(nsACString& aStr, const char* aData,
+                                      uint32_t aDataLength = UINT32_MAX);
 
 /**
  * NS_CStringSetDataRange
@@ -599,10 +584,11 @@ NS_CStringSetData
  * string, aStr.  If aStr is a reference to a nsStringContainer, then its data
  * will be null-terminated by this function.
  */
-XPCOM_API(nsresult)
-NS_CStringSetDataRange
-  (nsACString &aStr, uint32_t aCutOffset, uint32_t aCutLength,
-   const char *aData, uint32_t aDataLength = UINT32_MAX);
+XPCOM_API(nsresult) NS_CStringSetDataRange(nsACString& aStr,
+                                           uint32_t aCutOffset,
+                                           uint32_t aCutLength,
+                                           const char* aData,
+                                           uint32_t aDataLength = UINT32_MAX);
 
 /**
  * NS_CStringCopy
@@ -619,9 +605,8 @@ NS_CStringSetDataRange
  * abstract string, aDestStr.  If aDestStr is a reference to a
  * nsStringContainer, then its data will be null-terminated by this function.
  */
-XPCOM_API(nsresult)
-NS_CStringCopy
-  (nsACString &aDestStr, const nsACString &aSrcStr);
+XPCOM_API(nsresult) NS_CStringCopy(nsACString& aDestStr,
+                                   const nsACString& aSrcStr);
 
 /**
  * NS_CStringAppendData
@@ -640,7 +625,7 @@ NS_CStringCopy
  * terminated by this function.
  */
 inline NS_HIDDEN_(nsresult)
-NS_CStringAppendData(nsACString &aStr, const char *aData,
+NS_CStringAppendData(nsACString& aStr, const char* aData,
                      uint32_t aDataLength = UINT32_MAX)
 {
   return NS_CStringSetDataRange(aStr, UINT32_MAX, 0, aData, aDataLength);
@@ -665,7 +650,7 @@ NS_CStringAppendData(nsACString &aStr, const char *aData,
  * terminated by this function.
  */
 inline NS_HIDDEN_(nsresult)
-NS_CStringInsertData(nsACString &aStr, uint32_t aOffset, const char *aData,
+NS_CStringInsertData(nsACString& aStr, uint32_t aOffset, const char* aData,
                      uint32_t aDataLength = UINT32_MAX)
 {
   return NS_CStringSetDataRange(aStr, aOffset, 0, aData, aDataLength);
@@ -683,7 +668,7 @@ NS_CStringInsertData(nsACString &aStr, uint32_t aOffset, const char *aData,
  * @return              NS_OK if function succeeded
  */
 inline NS_HIDDEN_(nsresult)
-NS_CStringCutData(nsACString &aStr, uint32_t aCutOffset, uint32_t aCutLength)
+NS_CStringCutData(nsACString& aStr, uint32_t aCutOffset, uint32_t aCutLength)
 {
   return NS_CStringSetDataRange(aStr, aCutOffset, aCutLength, nullptr, 0);
 }
@@ -694,8 +679,7 @@ NS_CStringCutData(nsACString &aStr, uint32_t aCutOffset, uint32_t aCutLength)
  * This function marks a string as being a "void string".  Any data in the
  * string will be lost.
  */
-XPCOM_API(void)
-NS_CStringSetIsVoid(nsACString& aStr, const bool aIsVoid);
+XPCOM_API(void) NS_CStringSetIsVoid(nsACString& aStr, const bool aIsVoid);
 
 /**
  * NS_CStringGetIsVoid
@@ -703,15 +687,15 @@ NS_CStringSetIsVoid(nsACString& aStr, const bool aIsVoid);
  * This function provides a way to test if a string is a "void string", as
  * marked by NS_CStringSetIsVoid.
  */
-XPCOM_API(bool)
-NS_CStringGetIsVoid(const nsACString& aStr);
+XPCOM_API(bool) NS_CStringGetIsVoid(const nsACString& aStr);
 
 /* ------------------------------------------------------------------------- */
 
 /**
  * Encodings that can be used with the following conversion routines.
  */
-enum nsCStringEncoding {
+enum nsCStringEncoding
+{
   /* Conversion between ASCII and UTF-16 assumes that all bytes in the source
    * string are 7-bit ASCII and can be inflated to UTF-16 by inserting null
    * bytes.  Reverse conversion is done by truncating every other byte.  The
@@ -740,9 +724,9 @@ enum nsCStringEncoding {
  * @param aSrcEncoding  character encoding of the source string
  * @param aDest         abstract string reference to hold the result
  */
-XPCOM_API(nsresult)
-NS_CStringToUTF16(const nsACString &aSource, nsCStringEncoding aSrcEncoding,
-                  nsAString &aDest);
+XPCOM_API(nsresult) NS_CStringToUTF16(const nsACString& aSource,
+                                      nsCStringEncoding aSrcEncoding,
+                                      nsAString& aDest);
 
 /**
  * NS_UTF16ToCString
@@ -757,8 +741,8 @@ NS_CStringToUTF16(const nsACString &aSource, nsCStringEncoding aSrcEncoding,
  * @param aDestEncoding character encoding of the resulting string
  * @param aDest         abstract string reference to hold the result
  */
-XPCOM_API(nsresult)
-NS_UTF16ToCString(const nsAString &aSource, nsCStringEncoding aDestEncoding,
-                  nsACString &aDest);
+XPCOM_API(nsresult) NS_UTF16ToCString(const nsAString& aSource,
+                                      nsCStringEncoding aDestEncoding,
+                                      nsACString& aDest);
 
 #endif // nsXPCOMStrings_h__
diff --git a/xpcom/string/src/nsReadableUtils.cpp b/xpcom/string/src/nsReadableUtils.cpp
index 07f07a28deae..27e34427b072 100644
--- a/xpcom/string/src/nsReadableUtils.cpp
+++ b/xpcom/string/src/nsReadableUtils.cpp
@@ -12,21 +12,21 @@
 #include "nsUTF8Utils.h"
 
 void
-LossyCopyUTF16toASCII( const nsAString& aSource, nsACString& aDest )
+LossyCopyUTF16toASCII(const nsAString& aSource, nsACString& aDest)
 {
   aDest.Truncate();
   LossyAppendUTF16toASCII(aSource, aDest);
 }
 
 void
-CopyASCIItoUTF16( const nsACString& aSource, nsAString& aDest )
+CopyASCIItoUTF16(const nsACString& aSource, nsAString& aDest)
 {
   aDest.Truncate();
   AppendASCIItoUTF16(aSource, aDest);
 }
 
 void
-LossyCopyUTF16toASCII( const char16_t* aSource, nsACString& aDest )
+LossyCopyUTF16toASCII(const char16_t* aSource, nsACString& aDest)
 {
   aDest.Truncate();
   if (aSource) {
@@ -35,7 +35,7 @@ LossyCopyUTF16toASCII( const char16_t* aSource, nsACString& aDest )
 }
 
 void
-CopyASCIItoUTF16( const char* aSource, nsAString& aDest )
+CopyASCIItoUTF16(const char* aSource, nsAString& aDest)
 {
   aDest.Truncate();
   if (aSource) {
@@ -44,35 +44,35 @@ CopyASCIItoUTF16( const char* aSource, nsAString& aDest )
 }
 
 void
-CopyUTF16toUTF8( const nsAString& aSource, nsACString& aDest )
+CopyUTF16toUTF8(const nsAString& aSource, nsACString& aDest)
 {
   aDest.Truncate();
   AppendUTF16toUTF8(aSource, aDest);
 }
 
 void
-CopyUTF8toUTF16( const nsACString& aSource, nsAString& aDest )
+CopyUTF8toUTF16(const nsACString& aSource, nsAString& aDest)
 {
   aDest.Truncate();
   AppendUTF8toUTF16(aSource, aDest);
 }
 
 void
-CopyUTF16toUTF8( const char16_t* aSource, nsACString& aDest )
+CopyUTF16toUTF8(const char16_t* aSource, nsACString& aDest)
 {
   aDest.Truncate();
   AppendUTF16toUTF8(aSource, aDest);
 }
 
 void
-CopyUTF8toUTF16( const char* aSource, nsAString& aDest )
+CopyUTF8toUTF16(const char* aSource, nsAString& aDest)
 {
   aDest.Truncate();
   AppendUTF8toUTF16(aSource, aDest);
 }
 
 void
-LossyAppendUTF16toASCII( const nsAString& aSource, nsACString& aDest )
+LossyAppendUTF16toASCII(const nsAString& aSource, nsACString& aDest)
 {
   uint32_t old_dest_length = aDest.Length();
   aDest.SetLength(old_dest_length + aSource.Length());
@@ -91,7 +91,7 @@ LossyAppendUTF16toASCII( const nsAString& aSource, nsACString& aDest )
 }
 
 void
-AppendASCIItoUTF16( const nsACString& aSource, nsAString& aDest )
+AppendASCIItoUTF16(const nsACString& aSource, nsAString& aDest)
 {
   if (!AppendASCIItoUTF16(aSource, aDest, mozilla::fallible_t())) {
     NS_ABORT_OOM(aDest.Length() + aSource.Length());
@@ -99,8 +99,8 @@ AppendASCIItoUTF16( const nsACString& aSource, nsAString& aDest )
 }
 
 bool
-AppendASCIItoUTF16( const nsACString& aSource, nsAString& aDest,
-                    const mozilla::fallible_t& )
+AppendASCIItoUTF16(const nsACString& aSource, nsAString& aDest,
+                   const mozilla::fallible_t&)
 {
   uint32_t old_dest_length = aDest.Length();
   if (!aDest.SetLength(old_dest_length + aSource.Length(), mozilla::fallible_t())) {
@@ -122,7 +122,7 @@ AppendASCIItoUTF16( const nsACString& aSource, nsAString& aDest,
 }
 
 void
-LossyAppendUTF16toASCII( const char16_t* aSource, nsACString& aDest )
+LossyAppendUTF16toASCII(const char16_t* aSource, nsACString& aDest)
 {
   if (aSource) {
     LossyAppendUTF16toASCII(nsDependentString(aSource), aDest);
@@ -130,7 +130,7 @@ LossyAppendUTF16toASCII( const char16_t* aSource, nsACString& aDest )
 }
 
 void
-AppendASCIItoUTF16( const char* aSource, nsAString& aDest )
+AppendASCIItoUTF16(const char* aSource, nsAString& aDest)
 {
   if (aSource) {
     AppendASCIItoUTF16(nsDependentCString(aSource), aDest);
@@ -138,7 +138,7 @@ AppendASCIItoUTF16( const char* aSource, nsAString& aDest )
 }
 
 void
-AppendUTF16toUTF8( const nsAString& aSource, nsACString& aDest )
+AppendUTF16toUTF8(const nsAString& aSource, nsACString& aDest)
 {
   if (!AppendUTF16toUTF8(aSource, aDest, mozilla::fallible_t())) {
     NS_ABORT_OOM(aDest.Length() + aSource.Length());
@@ -146,8 +146,8 @@ AppendUTF16toUTF8( const nsAString& aSource, nsACString& aDest )
 }
 
 bool
-AppendUTF16toUTF8( const nsAString& aSource, nsACString& aDest,
-                   const mozilla::fallible_t& )
+AppendUTF16toUTF8(const nsAString& aSource, nsACString& aDest,
+                  const mozilla::fallible_t&)
 {
   nsAString::const_iterator source_start, source_end;
   CalculateUTF8Size calculator;
@@ -156,8 +156,7 @@ AppendUTF16toUTF8( const nsAString& aSource, nsACString& aDest,
 
   uint32_t count = calculator.Size();
 
-  if (count)
-  {
+  if (count) {
     uint32_t old_dest_length = aDest.Length();
 
     // Grow the buffer if we need to.
@@ -180,7 +179,7 @@ AppendUTF16toUTF8( const nsAString& aSource, nsACString& aDest,
 }
 
 void
-AppendUTF8toUTF16( const nsACString& aSource, nsAString& aDest )
+AppendUTF8toUTF16(const nsACString& aSource, nsAString& aDest)
 {
   if (!AppendUTF8toUTF16(aSource, aDest, mozilla::fallible_t())) {
     NS_ABORT_OOM(aDest.Length() + aSource.Length());
@@ -188,8 +187,8 @@ AppendUTF8toUTF16( const nsACString& aSource, nsAString& aDest )
 }
 
 bool
-AppendUTF8toUTF16( const nsACString& aSource, nsAString& aDest,
-                   const mozilla::fallible_t& )
+AppendUTF8toUTF16(const nsACString& aSource, nsAString& aDest,
+                  const mozilla::fallible_t&)
 {
   nsACString::const_iterator source_start, source_end;
   CalculateUTF8Length calculator;
@@ -199,8 +198,7 @@ AppendUTF8toUTF16( const nsACString& aSource, nsAString& aDest,
   uint32_t count = calculator.Length();
 
   // Avoid making the string mutable if we're appending an empty string
-  if (count)
-  {
+  if (count) {
     uint32_t old_dest_length = aDest.Length();
 
     // Grow the buffer if we need to.
@@ -218,8 +216,7 @@ AppendUTF8toUTF16( const nsACString& aSource, nsAString& aDest,
                  converter.Length() == count,
                  "CalculateUTF8Length produced the wrong length");
 
-    if (converter.ErrorEncountered())
-    {
+    if (converter.ErrorEncountered()) {
       NS_ERROR("Input wasn't UTF8 or incorrect length was calculated");
       aDest.SetLength(old_dest_length);
     }
@@ -229,7 +226,7 @@ AppendUTF8toUTF16( const nsACString& aSource, nsAString& aDest,
 }
 
 void
-AppendUTF16toUTF8( const char16_t* aSource, nsACString& aDest )
+AppendUTF16toUTF8(const char16_t* aSource, nsACString& aDest)
 {
   if (aSource) {
     AppendUTF16toUTF8(nsDependentString(aSource), aDest);
@@ -237,7 +234,7 @@ AppendUTF16toUTF8( const char16_t* aSource, nsACString& aDest )
 }
 
 void
-AppendUTF8toUTF16( const char* aSource, nsAString& aDest )
+AppendUTF8toUTF16(const char* aSource, nsAString& aDest)
 {
   if (aSource) {
     AppendUTF8toUTF16(nsDependentCString(aSource), aDest);
@@ -255,40 +252,44 @@ AppendUTF8toUTF16( const char* aSource, nsAString& aDest )
 template <class FromStringT, class ToCharT>
 inline
 ToCharT*
-AllocateStringCopy( const FromStringT& aSource, ToCharT* )
+AllocateStringCopy(const FromStringT& aSource, ToCharT*)
 {
-  return static_cast<ToCharT*>(nsMemory::Alloc((aSource.Length()+1) * sizeof(ToCharT)));
+  return static_cast<ToCharT*>(nsMemory::Alloc((aSource.Length() + 1) * sizeof(ToCharT)));
 }
 
 
 char*
-ToNewCString( const nsAString& aSource )
+ToNewCString(const nsAString& aSource)
 {
   char* result = AllocateStringCopy(aSource, (char*)0);
-  if (!result)
+  if (!result) {
     return nullptr;
+  }
 
   nsAString::const_iterator fromBegin, fromEnd;
   LossyConvertEncoding16to8 converter(result);
-  copy_string(aSource.BeginReading(fromBegin), aSource.EndReading(fromEnd), converter).write_terminator();
+  copy_string(aSource.BeginReading(fromBegin), aSource.EndReading(fromEnd),
+              converter).write_terminator();
   return result;
 }
 
 char*
-ToNewUTF8String( const nsAString& aSource, uint32_t *aUTF8Count )
+ToNewUTF8String(const nsAString& aSource, uint32_t* aUTF8Count)
 {
   nsAString::const_iterator start, end;
   CalculateUTF8Size calculator;
   copy_string(aSource.BeginReading(start), aSource.EndReading(end),
               calculator);
 
-  if (aUTF8Count)
+  if (aUTF8Count) {
     *aUTF8Count = calculator.Size();
+  }
 
-  char *result = static_cast<char*>
+  char* result = static_cast<char*>
                  (nsMemory::Alloc(calculator.Size() + 1));
-  if (!result)
+  if (!result) {
     return nullptr;
+  }
 
   ConvertUTF16toUTF8 converter(result);
   copy_string(aSource.BeginReading(start), aSource.EndReading(end),
@@ -299,13 +300,14 @@ ToNewUTF8String( const nsAString& aSource, uint32_t *aUTF8Count )
 }
 
 char*
-ToNewCString( const nsACString& aSource )
+ToNewCString(const nsACString& aSource)
 {
   // no conversion needed, just allocate a buffer of the correct length and copy into it
 
   char* result = AllocateStringCopy(aSource, (char*)0);
-  if (!result)
+  if (!result) {
     return nullptr;
+  }
 
   nsACString::const_iterator fromBegin, fromEnd;
   char* toBegin = result;
@@ -314,13 +316,14 @@ ToNewCString( const nsACString& aSource )
 }
 
 char16_t*
-ToNewUnicode( const nsAString& aSource )
+ToNewUnicode(const nsAString& aSource)
 {
   // no conversion needed, just allocate a buffer of the correct length and copy into it
 
   char16_t* result = AllocateStringCopy(aSource, (char16_t*)0);
-  if (!result)
+  if (!result) {
     return nullptr;
+  }
 
   nsAString::const_iterator fromBegin, fromEnd;
   char16_t* toBegin = result;
@@ -329,20 +332,22 @@ ToNewUnicode( const nsAString& aSource )
 }
 
 char16_t*
-ToNewUnicode( const nsACString& aSource )
+ToNewUnicode(const nsACString& aSource)
 {
   char16_t* result = AllocateStringCopy(aSource, (char16_t*)0);
-  if (!result)
+  if (!result) {
     return nullptr;
+  }
 
   nsACString::const_iterator fromBegin, fromEnd;
   LossyConvertEncoding8to16 converter(result);
-  copy_string(aSource.BeginReading(fromBegin), aSource.EndReading(fromEnd), converter).write_terminator();
+  copy_string(aSource.BeginReading(fromBegin), aSource.EndReading(fromEnd),
+              converter).write_terminator();
   return result;
 }
 
 uint32_t
-CalcUTF8ToUnicodeLength( const nsACString& aSource)
+CalcUTF8ToUnicodeLength(const nsACString& aSource)
 {
   nsACString::const_iterator start, end;
   CalculateUTF8Length calculator;
@@ -352,49 +357,56 @@ CalcUTF8ToUnicodeLength( const nsACString& aSource)
 }
 
 char16_t*
-UTF8ToUnicodeBuffer( const nsACString& aSource, char16_t* aBuffer, uint32_t *aUTF16Count )
+UTF8ToUnicodeBuffer(const nsACString& aSource, char16_t* aBuffer,
+                    uint32_t* aUTF16Count)
 {
   nsACString::const_iterator start, end;
   ConvertUTF8toUTF16 converter(aBuffer);
   copy_string(aSource.BeginReading(start),
               aSource.EndReading(end),
               converter).write_terminator();
-  if (aUTF16Count)
+  if (aUTF16Count) {
     *aUTF16Count = converter.Length();
+  }
   return aBuffer;
 }
 
 char16_t*
-UTF8ToNewUnicode( const nsACString& aSource, uint32_t *aUTF16Count )
+UTF8ToNewUnicode(const nsACString& aSource, uint32_t* aUTF16Count)
 {
   const uint32_t length = CalcUTF8ToUnicodeLength(aSource);
   const size_t buffer_size = (length + 1) * sizeof(char16_t);
-  char16_t *buffer = static_cast<char16_t*>(nsMemory::Alloc(buffer_size));
-  if (!buffer)
+  char16_t* buffer = static_cast<char16_t*>(nsMemory::Alloc(buffer_size));
+  if (!buffer) {
     return nullptr;
+  }
 
   uint32_t copied;
   UTF8ToUnicodeBuffer(aSource, buffer, &copied);
   NS_ASSERTION(length == copied, "length mismatch");
 
-  if (aUTF16Count)
+  if (aUTF16Count) {
     *aUTF16Count = copied;
+  }
   return buffer;
 }
 
 char16_t*
-CopyUnicodeTo( const nsAString& aSource, uint32_t aSrcOffset, char16_t* aDest, uint32_t aLength )
+CopyUnicodeTo(const nsAString& aSource, uint32_t aSrcOffset, char16_t* aDest,
+              uint32_t aLength)
 {
   nsAString::const_iterator fromBegin, fromEnd;
   char16_t* toBegin = aDest;
-  copy_string(aSource.BeginReading(fromBegin).advance( int32_t(aSrcOffset) ), aSource.BeginReading(fromEnd).advance( int32_t(aSrcOffset+aLength) ), toBegin);
+  copy_string(aSource.BeginReading(fromBegin).advance(int32_t(aSrcOffset)),
+              aSource.BeginReading(fromEnd).advance(int32_t(aSrcOffset + aLength)),
+              toBegin);
   return aDest;
 }
 
 void
-CopyUnicodeTo( const nsAString::const_iterator& aSrcStart,
-               const nsAString::const_iterator& aSrcEnd,
-               nsAString& aDest )
+CopyUnicodeTo(const nsAString::const_iterator& aSrcStart,
+              const nsAString::const_iterator& aSrcEnd,
+              nsAString& aDest)
 {
   nsAString::iterator writer;
   aDest.SetLength(Distance(aSrcStart, aSrcEnd));
@@ -406,9 +418,9 @@ CopyUnicodeTo( const nsAString::const_iterator& aSrcStart,
 }
 
 void
-AppendUnicodeTo( const nsAString::const_iterator& aSrcStart,
-                 const nsAString::const_iterator& aSrcEnd,
-                 nsAString& aDest )
+AppendUnicodeTo(const nsAString::const_iterator& aSrcStart,
+                const nsAString::const_iterator& aSrcEnd,
+                nsAString& aDest)
 {
   nsAString::iterator writer;
   uint32_t oldLength = aDest.Length();
@@ -421,7 +433,7 @@ AppendUnicodeTo( const nsAString::const_iterator& aSrcStart,
 }
 
 bool
-IsASCII( const nsAString& aString )
+IsASCII(const nsAString& aString)
 {
   static const char16_t NOT_ASCII = char16_t(~0x007F);
 
@@ -435,17 +447,17 @@ IsASCII( const nsAString& aString )
   const char16_t* c = iter.get();
   const char16_t* end = done_reading.get();
 
-  while ( c < end )
-  {
-    if ( *c++ & NOT_ASCII )
+  while (c < end) {
+    if (*c++ & NOT_ASCII) {
       return false;
+    }
   }
 
   return true;
 }
 
 bool
-IsASCII( const nsACString& aString )
+IsASCII(const nsACString& aString)
 {
   static const char NOT_ASCII = char(~0x7F);
 
@@ -459,17 +471,17 @@ IsASCII( const nsACString& aString )
   const char* c = iter.get();
   const char* end = done_reading.get();
 
-  while ( c < end )
-  {
-    if ( *c++ & NOT_ASCII )
+  while (c < end) {
+    if (*c++ & NOT_ASCII) {
       return false;
+    }
   }
 
   return true;
 }
 
 bool
-IsUTF8( const nsACString& aString, bool aRejectNonChar )
+IsUTF8(const nsACString& aString, bool aRejectNonChar)
 {
   nsReadingIterator<char> done_reading;
   aString.EndReading(done_reading);
@@ -486,75 +498,67 @@ IsUTF8( const nsACString& aString, bool aRejectNonChar )
 
   const char* ptr = iter.get();
   const char* end = done_reading.get();
-  while ( ptr < end )
-  {
+  while (ptr < end) {
     uint8_t c;
 
-    if (0 == state)
-    {
+    if (0 == state) {
       c = *ptr++;
 
-      if ( UTF8traits::isASCII(c) )
+      if (UTF8traits::isASCII(c)) {
         continue;
+      }
 
-      if ( c <= 0xC1 ) // [80-BF] where not expected, [C0-C1] for overlong.
+      if (c <= 0xC1) { // [80-BF] where not expected, [C0-C1] for overlong.
         return false;
-      else if ( UTF8traits::is2byte(c) )
+      } else if (UTF8traits::is2byte(c)) {
         state = 1;
-      else if ( UTF8traits::is3byte(c) )
-      {
+      } else if (UTF8traits::is3byte(c)) {
         state = 2;
-        if ( c == 0xE0 ) // to exclude E0[80-9F][80-BF]
-        {
+        if (c == 0xE0) { // to exclude E0[80-9F][80-BF]
           overlong = true;
           olupper = 0x9F;
-        }
-        else if ( c == 0xED ) // ED[A0-BF][80-BF] : surrogate codepoint
-        {
+        } else if (c == 0xED) { // ED[A0-BF][80-BF] : surrogate codepoint
           surrogate = true;
           slower = 0xA0;
-        }
-        else if ( c == 0xEF ) // EF BF [BE-BF] : non-character
+        } else if (c == 0xEF) { // EF BF [BE-BF] : non-character
           nonchar = true;
-      }
-      else if ( c <= 0xF4 ) // XXX replace /w UTF8traits::is4byte when it's updated to exclude [F5-F7].(bug 199090)
-      {
+        }
+      } else if (c <= 0xF4) { // XXX replace /w UTF8traits::is4byte when it's updated to exclude [F5-F7].(bug 199090)
         state = 3;
         nonchar = true;
-        if ( c == 0xF0 ) // to exclude F0[80-8F][80-BF]{2}
-        {
+        if (c == 0xF0) { // to exclude F0[80-8F][80-BF]{2}
           overlong = true;
           olupper = 0x8F;
-        }
-        else if ( c == 0xF4 ) // to exclude F4[90-BF][80-BF]
-        {
+        } else if (c == 0xF4) { // to exclude F4[90-BF][80-BF]
           // actually not surrogates but codepoints beyond 0x10FFFF
           surrogate = true;
           slower = 0x90;
         }
+      } else {
+        return false;  // Not UTF-8 string
       }
-      else
-        return false; // Not UTF-8 string
     }
 
-    if (nonchar && !aRejectNonChar)
+    if (nonchar && !aRejectNonChar) {
       nonchar = false;
+    }
 
-    while ( ptr < end && state )
-    {
+    while (ptr < end && state) {
       c = *ptr++;
       --state;
 
       // non-character : EF BF [BE-BF] or F[0-7] [89AB]F BF [BE-BF]
-      if ( nonchar &&
-           ( ( !state && c < 0xBE ) ||
-             ( state == 1 && c != 0xBF )  ||
-             ( state == 2 && 0x0F != (0x0F & c) )))
+      if (nonchar &&
+          ((!state && c < 0xBE) ||
+           (state == 1 && c != 0xBF)  ||
+           (state == 2 && 0x0F != (0x0F & c)))) {
         nonchar = false;
+      }
 
-      if ( !UTF8traits::isInSeq(c) || ( overlong && c <= olupper ) ||
-           ( surrogate && slower <= c ) || ( nonchar && !state ))
-        return false; // Not UTF-8 string
+      if (!UTF8traits::isInSeq(c) || (overlong && c <= olupper) ||
+          (surrogate && slower <= c) || (nonchar && !state)) {
+        return false;  // Not UTF-8 string
+      }
 
       overlong = surrogate = false;
     }
@@ -571,14 +575,15 @@ public:
   typedef char value_type;
 
   uint32_t
-  write( const char* aSource, uint32_t aSourceLength )
+  write(const char* aSource, uint32_t aSourceLength)
   {
     char* cp = const_cast<char*>(aSource);
     const char* end = aSource + aSourceLength;
     while (cp != end) {
       char ch = *cp;
-      if ((ch >= 'a') && (ch <= 'z'))
+      if (ch >= 'a' && ch <= 'z') {
         *cp = ch - ('a' - 'A');
+      }
       ++cp;
     }
     return aSourceLength;
@@ -586,7 +591,7 @@ public:
 };
 
 void
-ToUpperCase( nsCSubstring& aCString )
+ToUpperCase(nsCSubstring& aCString)
 {
   ConvertToUpperCase converter;
   char* start;
@@ -601,23 +606,24 @@ class CopyToUpperCase
 public:
   typedef char value_type;
 
-  explicit CopyToUpperCase( nsACString::iterator& aDestIter )
+  explicit CopyToUpperCase(nsACString::iterator& aDestIter)
     : mIter(aDestIter)
   {
   }
 
   uint32_t
-  write( const char* aSource, uint32_t aSourceLength )
+  write(const char* aSource, uint32_t aSourceLength)
   {
     uint32_t len = XPCOM_MIN(uint32_t(mIter.size_forward()), aSourceLength);
     char* cp = mIter.get();
     const char* end = aSource + len;
     while (aSource != end) {
       char ch = *aSource;
-      if ((ch >= 'a') && (ch <= 'z'))
+      if ((ch >= 'a') && (ch <= 'z')) {
         *cp = ch - ('a' - 'A');
-      else
+      } else {
         *cp = ch;
+      }
       ++aSource;
       ++cp;
     }
@@ -630,7 +636,7 @@ protected:
 };
 
 void
-ToUpperCase( const nsACString& aSource, nsACString& aDest )
+ToUpperCase(const nsACString& aSource, nsACString& aDest)
 {
   nsACString::const_iterator fromBegin, fromEnd;
   nsACString::iterator toBegin;
@@ -649,14 +655,15 @@ public:
   typedef char value_type;
 
   uint32_t
-  write( const char* aSource, uint32_t aSourceLength )
+  write(const char* aSource, uint32_t aSourceLength)
   {
     char* cp = const_cast<char*>(aSource);
     const char* end = aSource + aSourceLength;
     while (cp != end) {
       char ch = *cp;
-      if ((ch >= 'A') && (ch <= 'Z'))
+      if ((ch >= 'A') && (ch <= 'Z')) {
         *cp = ch + ('a' - 'A');
+      }
       ++cp;
     }
     return aSourceLength;
@@ -664,7 +671,7 @@ public:
 };
 
 void
-ToLowerCase( nsCSubstring& aCString )
+ToLowerCase(nsCSubstring& aCString)
 {
   ConvertToLowerCase converter;
   char* start;
@@ -679,23 +686,24 @@ class CopyToLowerCase
 public:
   typedef char value_type;
 
-  explicit CopyToLowerCase( nsACString::iterator& aDestIter )
+  explicit CopyToLowerCase(nsACString::iterator& aDestIter)
     : mIter(aDestIter)
   {
   }
 
   uint32_t
-  write( const char* aSource, uint32_t aSourceLength )
+  write(const char* aSource, uint32_t aSourceLength)
   {
     uint32_t len = XPCOM_MIN(uint32_t(mIter.size_forward()), aSourceLength);
     char* cp = mIter.get();
     const char* end = aSource + len;
     while (aSource != end) {
       char ch = *aSource;
-      if ((ch >= 'A') && (ch <= 'Z'))
+      if ((ch >= 'A') && (ch <= 'Z')) {
         *cp = ch + ('a' - 'A');
-      else
+      } else {
         *cp = ch;
+      }
       ++aSource;
       ++cp;
     }
@@ -708,7 +716,7 @@ protected:
 };
 
 void
-ToLowerCase( const nsACString& aSource, nsACString& aDest )
+ToLowerCase(const nsACString& aSource, nsACString& aDest)
 {
   nsACString::const_iterator fromBegin, fromEnd;
   nsACString::iterator toBegin;
@@ -728,25 +736,24 @@ ParseString(const nsACString& aSource, char aDelimiter,
 
   uint32_t oldLength = aArray.Length();
 
-  for (;;)
-  {
+  for (;;) {
     nsACString::const_iterator delimiter = start;
     FindCharInReadable(aDelimiter, delimiter, end);
 
-    if (delimiter != start)
-    {
-      if (!aArray.AppendElement(Substring(start, delimiter)))
-      {
+    if (delimiter != start) {
+      if (!aArray.AppendElement(Substring(start, delimiter))) {
         aArray.RemoveElementsAt(oldLength, aArray.Length() - oldLength);
         return false;
       }
     }
 
-    if (delimiter == end)
+    if (delimiter == end) {
       break;
+    }
     start = ++delimiter;
-    if (start == end)
+    if (start == end) {
       break;
+    }
   }
 
   return true;
@@ -754,44 +761,43 @@ ParseString(const nsACString& aSource, char aDelimiter,
 
 template <class StringT, class IteratorT, class Comparator>
 bool
-FindInReadable_Impl( const StringT& aPattern, IteratorT& aSearchStart, IteratorT& aSearchEnd, const Comparator& compare )
+FindInReadable_Impl(const StringT& aPattern, IteratorT& aSearchStart,
+                    IteratorT& aSearchEnd, const Comparator& aCompare)
 {
   bool found_it = false;
 
   // only bother searching at all if we're given a non-empty range to search
-  if ( aSearchStart != aSearchEnd )
-  {
+  if (aSearchStart != aSearchEnd) {
     IteratorT aPatternStart, aPatternEnd;
     aPattern.BeginReading(aPatternStart);
     aPattern.EndReading(aPatternEnd);
 
     // outer loop keeps searching till we find it or run out of string to search
-    while ( !found_it )
-    {
+    while (!found_it) {
       // fast inner loop (that's what it's called, not what it is) looks for a potential match
-      while ( aSearchStart != aSearchEnd &&
-              compare(aPatternStart.get(), aSearchStart.get(), 1, 1) )
+      while (aSearchStart != aSearchEnd &&
+             aCompare(aPatternStart.get(), aSearchStart.get(), 1, 1)) {
         ++aSearchStart;
+      }
 
       // if we broke out of the `fast' loop because we're out of string ... we're done: no match
-      if ( aSearchStart == aSearchEnd )
+      if (aSearchStart == aSearchEnd) {
         break;
+      }
 
       // otherwise, we're at a potential match, let's see if we really hit one
       IteratorT testPattern(aPatternStart);
       IteratorT testSearch(aSearchStart);
 
       // slow inner loop verifies the potential match (found by the `fast' loop) at the current position
-      for(;;)
-      {
+      for (;;) {
         // we already compared the first character in the outer loop,
         //  so we'll advance before the next comparison
         ++testPattern;
         ++testSearch;
 
         // if we verified all the way to the end of the pattern, then we found it!
-        if ( testPattern == aPatternEnd )
-        {
+        if (testPattern == aPatternEnd) {
           found_it = true;
           aSearchEnd = testSearch; // return the exact found range through the parameters
           break;
@@ -799,16 +805,14 @@ FindInReadable_Impl( const StringT& aPattern, IteratorT& aSearchStart, IteratorT
 
         // if we got to end of the string we're searching before we hit the end of the
         //  pattern, we'll never find what we're looking for
-        if ( testSearch == aSearchEnd )
-        {
+        if (testSearch == aSearchEnd) {
           aSearchStart = aSearchEnd;
           break;
         }
 
         // else if we mismatched ... it's time to advance to the next search position
         //  and get back into the `fast' loop
-        if ( compare(testPattern.get(), testSearch.get(), 1, 1) )
-        {
+        if (aCompare(testPattern.get(), testSearch.get(), 1, 1)) {
           ++aSearchStart;
           break;
         }
@@ -824,7 +828,8 @@ FindInReadable_Impl( const StringT& aPattern, IteratorT& aSearchStart, IteratorT
  */
 template <class StringT, class IteratorT, class Comparator>
 bool
-RFindInReadable_Impl( const StringT& aPattern, IteratorT& aSearchStart, IteratorT& aSearchEnd, const Comparator& compare )
+RFindInReadable_Impl(const StringT& aPattern, IteratorT& aSearchStart,
+                     IteratorT& aSearchEnd, const Comparator& aCompare)
 {
   IteratorT patternStart, patternEnd, searchEnd = aSearchEnd;
   aPattern.BeginReading(patternStart);
@@ -833,24 +838,20 @@ RFindInReadable_Impl( const StringT& aPattern, IteratorT& aSearchStart, Iterator
   // Point to the last character in the pattern
   --patternEnd;
   // outer loop keeps searching till we run out of string to search
-  while ( aSearchStart != searchEnd )
-  {
+  while (aSearchStart != searchEnd) {
     // Point to the end position of the next possible match
     --searchEnd;
 
     // Check last character, if a match, explore further from here
-    if ( compare(patternEnd.get(), searchEnd.get(), 1, 1) == 0 )
-    {
+    if (aCompare(patternEnd.get(), searchEnd.get(), 1, 1) == 0) {
       // We're at a potential match, let's see if we really hit one
       IteratorT testPattern(patternEnd);
       IteratorT testSearch(searchEnd);
 
       // inner loop verifies the potential match at the current position
-      do
-      {
+      do {
         // if we verified all the way to the end of the pattern, then we found it!
-        if ( testPattern == patternStart )
-        {
+        if (testPattern == patternStart) {
           aSearchStart = testSearch;  // point to start of match
           aSearchEnd = ++searchEnd;   // point to end of match
           return true;
@@ -858,8 +859,7 @@ RFindInReadable_Impl( const StringT& aPattern, IteratorT& aSearchStart, Iterator
 
         // if we got to end of the string we're searching before we hit the end of the
         //  pattern, we'll never find what we're looking for
-        if ( testSearch == aSearchStart )
-        {
+        if (testSearch == aSearchStart) {
           aSearchStart = aSearchEnd;
           return false;
         }
@@ -867,8 +867,7 @@ RFindInReadable_Impl( const StringT& aPattern, IteratorT& aSearchStart, Iterator
         // test previous character for a match
         --testPattern;
         --testSearch;
-      }
-      while ( compare(testPattern.get(), testSearch.get(), 1, 1) == 0 );
+      } while (aCompare(testPattern.get(), testSearch.get(), 1, 1) == 0);
     }
   }
 
@@ -877,43 +876,60 @@ RFindInReadable_Impl( const StringT& aPattern, IteratorT& aSearchStart, Iterator
 }
 
 bool
-FindInReadable( const nsAString& aPattern, nsAString::const_iterator& aSearchStart, nsAString::const_iterator& aSearchEnd, const nsStringComparator& aComparator )
+FindInReadable(const nsAString& aPattern,
+               nsAString::const_iterator& aSearchStart,
+               nsAString::const_iterator& aSearchEnd,
+               const nsStringComparator& aComparator)
 {
   return FindInReadable_Impl(aPattern, aSearchStart, aSearchEnd, aComparator);
 }
 
 bool
-FindInReadable( const nsACString& aPattern, nsACString::const_iterator& aSearchStart, nsACString::const_iterator& aSearchEnd, const nsCStringComparator& aComparator)
+FindInReadable(const nsACString& aPattern,
+               nsACString::const_iterator& aSearchStart,
+               nsACString::const_iterator& aSearchEnd,
+               const nsCStringComparator& aComparator)
 {
   return FindInReadable_Impl(aPattern, aSearchStart, aSearchEnd, aComparator);
 }
 
 bool
-CaseInsensitiveFindInReadable( const nsACString& aPattern, nsACString::const_iterator& aSearchStart, nsACString::const_iterator& aSearchEnd )
+CaseInsensitiveFindInReadable(const nsACString& aPattern,
+                              nsACString::const_iterator& aSearchStart,
+                              nsACString::const_iterator& aSearchEnd)
 {
-  return FindInReadable_Impl(aPattern, aSearchStart, aSearchEnd, nsCaseInsensitiveCStringComparator());
+  return FindInReadable_Impl(aPattern, aSearchStart, aSearchEnd,
+                             nsCaseInsensitiveCStringComparator());
 }
 
 bool
-RFindInReadable( const nsAString& aPattern, nsAString::const_iterator& aSearchStart, nsAString::const_iterator& aSearchEnd, const nsStringComparator& aComparator)
+RFindInReadable(const nsAString& aPattern,
+                nsAString::const_iterator& aSearchStart,
+                nsAString::const_iterator& aSearchEnd,
+                const nsStringComparator& aComparator)
 {
   return RFindInReadable_Impl(aPattern, aSearchStart, aSearchEnd, aComparator);
 }
 
 bool
-RFindInReadable( const nsACString& aPattern, nsACString::const_iterator& aSearchStart, nsACString::const_iterator& aSearchEnd, const nsCStringComparator& aComparator)
+RFindInReadable(const nsACString& aPattern,
+                nsACString::const_iterator& aSearchStart,
+                nsACString::const_iterator& aSearchEnd,
+                const nsCStringComparator& aComparator)
 {
   return RFindInReadable_Impl(aPattern, aSearchStart, aSearchEnd, aComparator);
 }
 
 bool
-FindCharInReadable( char16_t aChar, nsAString::const_iterator& aSearchStart, const nsAString::const_iterator& aSearchEnd )
+FindCharInReadable(char16_t aChar, nsAString::const_iterator& aSearchStart,
+                   const nsAString::const_iterator& aSearchEnd)
 {
   int32_t fragmentLength = aSearchEnd.get() - aSearchStart.get();
 
-  const char16_t* charFoundAt = nsCharTraits<char16_t>::find(aSearchStart.get(), fragmentLength, aChar);
-  if ( charFoundAt ) {
-    aSearchStart.advance( charFoundAt - aSearchStart.get() );
+  const char16_t* charFoundAt =
+    nsCharTraits<char16_t>::find(aSearchStart.get(), fragmentLength, aChar);
+  if (charFoundAt) {
+    aSearchStart.advance(charFoundAt - aSearchStart.get());
     return true;
   }
 
@@ -922,13 +938,15 @@ FindCharInReadable( char16_t aChar, nsAString::const_iterator& aSearchStart, con
 }
 
 bool
-FindCharInReadable( char aChar, nsACString::const_iterator& aSearchStart, const nsACString::const_iterator& aSearchEnd )
+FindCharInReadable(char aChar, nsACString::const_iterator& aSearchStart,
+                   const nsACString::const_iterator& aSearchEnd)
 {
   int32_t fragmentLength = aSearchEnd.get() - aSearchStart.get();
 
-  const char* charFoundAt = nsCharTraits<char>::find(aSearchStart.get(), fragmentLength, aChar);
-  if ( charFoundAt ) {
-    aSearchStart.advance( charFoundAt - aSearchStart.get() );
+  const char* charFoundAt =
+    nsCharTraits<char>::find(aSearchStart.get(), fragmentLength, aChar);
+  if (charFoundAt) {
+    aSearchStart.advance(charFoundAt - aSearchStart.get());
     return true;
   }
 
@@ -937,8 +955,7 @@ FindCharInReadable( char aChar, nsACString::const_iterator& aSearchStart, const
 }
 
 uint32_t
-CountCharInReadable( const nsAString& aStr,
-                     char16_t aChar )
+CountCharInReadable(const nsAString& aStr, char16_t aChar)
 {
   uint32_t count = 0;
   nsAString::const_iterator begin, end;
@@ -957,8 +974,7 @@ CountCharInReadable( const nsAString& aStr,
 }
 
 uint32_t
-CountCharInReadable( const nsACString& aStr,
-                     char aChar )
+CountCharInReadable(const nsACString& aStr, char aChar)
 {
   uint32_t count = 0;
   nsACString::const_iterator begin, end;
@@ -977,47 +993,51 @@ CountCharInReadable( const nsACString& aStr,
 }
 
 bool
-StringBeginsWith( const nsAString& aSource, const nsAString& aSubstring,
-                  const nsStringComparator& aComparator )
+StringBeginsWith(const nsAString& aSource, const nsAString& aSubstring,
+                 const nsStringComparator& aComparator)
 {
   nsAString::size_type src_len = aSource.Length(),
                        sub_len = aSubstring.Length();
-  if (sub_len > src_len)
+  if (sub_len > src_len) {
     return false;
+  }
   return Substring(aSource, 0, sub_len).Equals(aSubstring, aComparator);
 }
 
 bool
-StringBeginsWith( const nsACString& aSource, const nsACString& aSubstring,
-                  const nsCStringComparator& aComparator )
+StringBeginsWith(const nsACString& aSource, const nsACString& aSubstring,
+                 const nsCStringComparator& aComparator)
 {
   nsACString::size_type src_len = aSource.Length(),
                         sub_len = aSubstring.Length();
-  if (sub_len > src_len)
+  if (sub_len > src_len) {
     return false;
+  }
   return Substring(aSource, 0, sub_len).Equals(aSubstring, aComparator);
 }
 
 bool
-StringEndsWith( const nsAString& aSource, const nsAString& aSubstring,
-                const nsStringComparator& aComparator )
+StringEndsWith(const nsAString& aSource, const nsAString& aSubstring,
+               const nsStringComparator& aComparator)
 {
   nsAString::size_type src_len = aSource.Length(),
                        sub_len = aSubstring.Length();
-  if (sub_len > src_len)
+  if (sub_len > src_len) {
     return false;
+  }
   return Substring(aSource, src_len - sub_len, sub_len).Equals(aSubstring,
                                                                aComparator);
 }
 
 bool
-StringEndsWith( const nsACString& aSource, const nsACString& aSubstring,
-                const nsCStringComparator& aComparator )
+StringEndsWith(const nsACString& aSource, const nsACString& aSubstring,
+               const nsCStringComparator& aComparator)
 {
   nsACString::size_type src_len = aSource.Length(),
                         sub_len = aSubstring.Length();
-  if (sub_len > src_len)
+  if (sub_len > src_len) {
     return false;
+  }
   return Substring(aSource, src_len - sub_len, sub_len).Equals(aSubstring,
                                                                aComparator);
 }
@@ -1037,7 +1057,7 @@ EmptyString()
 const nsAFlatCString&
 EmptyCString()
 {
-  static const nsDependentCString sEmpty((const char *)empty_buffer);
+  static const nsDependentCString sEmpty((const char*)empty_buffer);
 
   return sEmpty;
 }
@@ -1064,26 +1084,27 @@ CompareUTF8toUTF16(const nsASingleFragmentCString& aUTF8String,
 {
   static const uint32_t NOT_ASCII = uint32_t(~0x7F);
 
-  const char *u8, *u8end;
+  const char* u8;
+  const char* u8end;
   aUTF8String.BeginReading(u8);
   aUTF8String.EndReading(u8end);
 
-  const char16_t *u16, *u16end;
+  const char16_t* u16;
+  const char16_t* u16end;
   aUTF16String.BeginReading(u16);
   aUTF16String.EndReading(u16end);
 
-  while (u8 != u8end && u16 != u16end)
-  {
+  while (u8 != u8end && u16 != u16end) {
     // Cast away the signedness of *u8 to prevent signextension when
     // converting to uint32_t
     uint32_t c8_32 = (uint8_t)*u8;
 
-    if (c8_32 & NOT_ASCII)
-    {
+    if (c8_32 & NOT_ASCII) {
       bool err;
       c8_32 = UTF8CharEnumerator::NextChar(&u8, u8end, &err);
-      if (err)
+      if (err) {
         return INT32_MIN;
+      }
 
       uint32_t c16_32 = UTF16CharEnumerator::NextChar(&u16, u16end);
       // The above UTF16CharEnumerator::NextChar() calls can
@@ -1099,21 +1120,20 @@ CompareUTF8toUTF16(const nsASingleFragmentCString& aUTF8String,
       // string it came from. Same is true for any other UTF16
       // string differs only in the invalid part of the string.
 
-      if (c8_32 != c16_32)
+      if (c8_32 != c16_32) {
         return c8_32 < c16_32 ? -1 : 1;
-    }
-    else
-    {
-      if (c8_32 != *u16)
+      }
+    } else {
+      if (c8_32 != *u16) {
         return c8_32 > *u16 ? 1 : -1;
+      }
 
       ++u8;
       ++u16;
     }
   }
 
-  if (u8 != u8end)
-  {
+  if (u8 != u8end) {
     // We get to the end of the UTF16 string, but no to the end of
     // the UTF8 string. The UTF8 string is longer than the UTF16
     // string
@@ -1121,8 +1141,7 @@ CompareUTF8toUTF16(const nsASingleFragmentCString& aUTF8String,
     return 1;
   }
 
-  if (u16 != u16end)
-  {
+  if (u16 != u16end) {
     // We get to the end of the UTF8 string, but no to the end of
     // the UTF16 string. The UTF16 string is longer than the UTF8
     // string
@@ -1139,12 +1158,9 @@ void
 AppendUCS4ToUTF16(const uint32_t aSource, nsAString& aDest)
 {
   NS_ASSERTION(IS_VALID_CHAR(aSource), "Invalid UCS4 char");
-  if (IS_IN_BMP(aSource))
-  {
+  if (IS_IN_BMP(aSource)) {
     aDest.Append(char16_t(aSource));
-  }
-  else
-  {
+  } else {
     aDest.Append(H_SURROGATE(aSource));
     aDest.Append(L_SURROGATE(aSource));
   }
diff --git a/xpcom/string/src/nsStringComparator.cpp b/xpcom/string/src/nsStringComparator.cpp
index f601483e9022..81f1629f8538 100644
--- a/xpcom/string/src/nsStringComparator.cpp
+++ b/xpcom/string/src/nsStringComparator.cpp
@@ -21,17 +21,19 @@
 
 
 int
-nsCaseInsensitiveCStringComparator::operator()( const char_type* lhs,
-                                                const char_type* rhs,
-                                                uint32_t lLength,
-                                                uint32_t rLength ) const
+nsCaseInsensitiveCStringComparator::operator()(const char_type* aLhs,
+                                               const char_type* aRhs,
+                                               uint32_t aLhsLength,
+                                               uint32_t aRhsLength) const
 {
-  if (lLength != rLength)
-    return (lLength > rLength) ? 1 : -1;
-  int32_t result=int32_t(PL_strncasecmp(lhs, rhs, lLength));
+  if (aLhsLength != aRhsLength) {
+    return (aLhsLength > aRhsLength) ? 1 : -1;
+  }
+  int32_t result = int32_t(PL_strncasecmp(aLhs, aRhs, aLhsLength));
   //Egads. PL_strncasecmp is returning *very* negative numbers.
   //Some folks expect -1,0,1, so let's temper its enthusiasm.
-  if (result<0)
-    result=-1;
+  if (result < 0) {
+    result = -1;
+  }
   return result;
 }
diff --git a/xpcom/string/src/nsSubstring.cpp b/xpcom/string/src/nsSubstring.cpp
index 08ba83204071..052e6399ec8d 100644
--- a/xpcom/string/src/nsSubstring.cpp
+++ b/xpcom/string/src/nsSubstring.cpp
@@ -43,7 +43,7 @@ using mozilla::Atomic;
 static const char16_t gNullChar = 0;
 
 char* const nsCharTraits<char>::sEmptyBuffer =
-  (char*) const_cast<char16_t*>(&gNullChar);
+  (char*)const_cast<char16_t*>(&gNullChar);
 char16_t* const nsCharTraits<char16_t>::sEmptyBuffer =
   const_cast<char16_t*>(&gNullChar);
 
@@ -54,31 +54,39 @@ class nsStringStats
 {
 public:
   nsStringStats()
-    : mAllocCount(0), mReallocCount(0), mFreeCount(0), mShareCount(0) {}
+    : mAllocCount(0)
+    , mReallocCount(0)
+    , mFreeCount(0)
+    , mShareCount(0)
+  {
+  }
 
   ~nsStringStats()
   {
     // this is a hack to suppress duplicate string stats printing
     // in seamonkey as a result of the string code being linked
     // into seamonkey and libxpcom! :-(
-    if (!mAllocCount && !mAdoptCount)
+    if (!mAllocCount && !mAdoptCount) {
       return;
+    }
 
     printf("nsStringStats\n");
     printf(" => mAllocCount:     % 10d\n", int(mAllocCount));
     printf(" => mReallocCount:   % 10d\n", int(mReallocCount));
     printf(" => mFreeCount:      % 10d", int(mFreeCount));
-    if (mAllocCount > mFreeCount)
+    if (mAllocCount > mFreeCount) {
       printf("  --  LEAKED %d !!!\n", mAllocCount - mFreeCount);
-    else
+    } else {
       printf("\n");
+    }
     printf(" => mShareCount:     % 10d\n", int(mShareCount));
     printf(" => mAdoptCount:     % 10d\n", int(mAdoptCount));
     printf(" => mAdoptFreeCount: % 10d", int(mAdoptFreeCount));
-    if (mAdoptCount > mAdoptFreeCount)
+    if (mAdoptCount > mAdoptFreeCount) {
       printf("  --  LEAKED %d !!!\n", mAdoptCount - mAdoptFreeCount);
-    else
+    } else {
       printf("\n");
+    }
     printf(" => Process ID: %" PRIuPTR ", Thread ID: %" PRIuPTR "\n",
            uintptr_t(getpid()), uintptr_t(pthread_self()));
   }
@@ -99,20 +107,17 @@ static nsStringStats gStringStats;
 // ---------------------------------------------------------------------------
 
 inline void
-ReleaseData( void* data, uint32_t flags )
+ReleaseData(void* aData, uint32_t aFlags)
 {
-  if (flags & nsSubstring::F_SHARED)
-  {
-    nsStringBuffer::FromData(data)->Release();
-  }
-  else if (flags & nsSubstring::F_OWNED)
-  {
-    nsMemory::Free(data);
+  if (aFlags & nsSubstring::F_SHARED) {
+    nsStringBuffer::FromData(aData)->Release();
+  } else if (aFlags & nsSubstring::F_OWNED) {
+    nsMemory::Free(aData);
     STRING_STAT_INCREMENT(AdoptFree);
 #ifdef NS_BUILD_REFCNT_LOGGING
     // Treat this as destruction of a "StringAdopt" object for leak
     // tracking purposes.
-    NS_LogDtor(data, "StringAdopt", 1);
+    NS_LogDtor(aData, "StringAdopt", 1);
 #endif // NS_BUILD_REFCNT_LOGGING
   }
   // otherwise, nothing to do.
@@ -128,16 +133,25 @@ private:
   nsAStringAccessor(); // NOT IMPLEMENTED
 
 public:
-  char_type  *data() const   { return mData; }
-  size_type   length() const { return mLength; }
-  uint32_t    flags() const  { return mFlags; }
+  char_type* data() const
+  {
+    return mData;
+  }
+  size_type length() const
+  {
+    return mLength;
+  }
+  uint32_t flags() const
+  {
+    return mFlags;
+  }
 
-  void set(char_type *data, size_type len, uint32_t flags)
+  void set(char_type* aData, size_type aLen, uint32_t aFlags)
   {
     ReleaseData(mData, mFlags);
-    mData = data;
-    mLength = len;
-    mFlags = flags;
+    mData = aData;
+    mLength = aLen;
+    mFlags = aFlags;
   }
 };
 
@@ -147,16 +161,25 @@ private:
   nsACStringAccessor(); // NOT IMPLEMENTED
 
 public:
-  char_type  *data() const   { return mData; }
-  size_type   length() const { return mLength; }
-  uint32_t    flags() const  { return mFlags; }
+  char_type* data() const
+  {
+    return mData;
+  }
+  size_type length() const
+  {
+    return mLength;
+  }
+  uint32_t flags() const
+  {
+    return mFlags;
+  }
 
-  void set(char_type *data, size_type len, uint32_t flags)
+  void set(char_type* aData, size_type aLen, uint32_t aFlags)
   {
     ReleaseData(mData, mFlags);
-    mData = data;
-    mLength = len;
-    mFlags = flags;
+    mData = aData;
+    mLength = aLen;
+    mFlags = aFlags;
   }
 };
 
@@ -175,8 +198,7 @@ nsStringBuffer::Release()
 {
   int32_t count = --mRefCount;
   NS_LOG_RELEASE(this, count, "nsStringBuffer");
-  if (count == 0)
-  {
+  if (count == 0) {
     STRING_STAT_INCREMENT(Free);
     free(this); // we were allocated with |malloc|
   }
@@ -186,85 +208,86 @@ nsStringBuffer::Release()
  * Alloc returns a pointer to a new string header with set capacity.
  */
 already_AddRefed<nsStringBuffer>
-nsStringBuffer::Alloc(size_t size)
+nsStringBuffer::Alloc(size_t aSize)
 {
-  NS_ASSERTION(size != 0, "zero capacity allocation not allowed");
-  NS_ASSERTION(sizeof(nsStringBuffer) + size <= size_t(uint32_t(-1)) &&
-               sizeof(nsStringBuffer) + size > size,
+  NS_ASSERTION(aSize != 0, "zero capacity allocation not allowed");
+  NS_ASSERTION(sizeof(nsStringBuffer) + aSize <= size_t(uint32_t(-1)) &&
+               sizeof(nsStringBuffer) + aSize > aSize,
                "mStorageSize will truncate");
 
-  nsStringBuffer *hdr =
-    (nsStringBuffer *) malloc(sizeof(nsStringBuffer) + size);
-  if (hdr)
-  {
+  nsStringBuffer* hdr =
+    (nsStringBuffer*)malloc(sizeof(nsStringBuffer) + aSize);
+  if (hdr) {
     STRING_STAT_INCREMENT(Alloc);
 
     hdr->mRefCount = 1;
-    hdr->mStorageSize = size;
+    hdr->mStorageSize = aSize;
     NS_LOG_ADDREF(hdr, 1, "nsStringBuffer", sizeof(*hdr));
   }
   return dont_AddRef(hdr);
 }
 
 nsStringBuffer*
-nsStringBuffer::Realloc(nsStringBuffer* hdr, size_t size)
+nsStringBuffer::Realloc(nsStringBuffer* aHdr, size_t aSize)
 {
   STRING_STAT_INCREMENT(Realloc);
 
-  NS_ASSERTION(size != 0, "zero capacity allocation not allowed");
-  NS_ASSERTION(sizeof(nsStringBuffer) + size <= size_t(uint32_t(-1)) &&
-               sizeof(nsStringBuffer) + size > size,
+  NS_ASSERTION(aSize != 0, "zero capacity allocation not allowed");
+  NS_ASSERTION(sizeof(nsStringBuffer) + aSize <= size_t(uint32_t(-1)) &&
+               sizeof(nsStringBuffer) + aSize > aSize,
                "mStorageSize will truncate");
 
   // no point in trying to save ourselves if we hit this assertion
-  NS_ASSERTION(!hdr->IsReadonly(), "|Realloc| attempted on readonly string");
+  NS_ASSERTION(!aHdr->IsReadonly(), "|Realloc| attempted on readonly string");
 
   // Treat this as a release and addref for refcounting purposes, since we
   // just asserted that the refcount is 1.  If we don't do that, refcount
   // logging will claim we've leaked all sorts of stuff.
-  NS_LOG_RELEASE(hdr, 0, "nsStringBuffer");
+  NS_LOG_RELEASE(aHdr, 0, "nsStringBuffer");
 
-  hdr = (nsStringBuffer*) realloc(hdr, sizeof(nsStringBuffer) + size);
-  if (hdr) {
-    NS_LOG_ADDREF(hdr, 1, "nsStringBuffer", sizeof(*hdr));
-    hdr->mStorageSize = size;
+  aHdr = (nsStringBuffer*)realloc(aHdr, sizeof(nsStringBuffer) + aSize);
+  if (aHdr) {
+    NS_LOG_ADDREF(aHdr, 1, "nsStringBuffer", sizeof(*aHdr));
+    aHdr->mStorageSize = aSize;
   }
 
-  return hdr;
+  return aHdr;
 }
 
 nsStringBuffer*
-nsStringBuffer::FromString(const nsAString& str)
+nsStringBuffer::FromString(const nsAString& aStr)
 {
   const nsAStringAccessor* accessor =
-    static_cast<const nsAStringAccessor*>(&str);
+    static_cast<const nsAStringAccessor*>(&aStr);
 
-  if (!(accessor->flags() & nsSubstring::F_SHARED))
+  if (!(accessor->flags() & nsSubstring::F_SHARED)) {
     return nullptr;
+  }
 
   return FromData(accessor->data());
 }
 
 nsStringBuffer*
-nsStringBuffer::FromString(const nsACString& str)
+nsStringBuffer::FromString(const nsACString& aStr)
 {
   const nsACStringAccessor* accessor =
-    static_cast<const nsACStringAccessor*>(&str);
+    static_cast<const nsACStringAccessor*>(&aStr);
 
-  if (!(accessor->flags() & nsCSubstring::F_SHARED))
+  if (!(accessor->flags() & nsCSubstring::F_SHARED)) {
     return nullptr;
+  }
 
   return FromData(accessor->data());
 }
 
 void
-nsStringBuffer::ToString(uint32_t len, nsAString &str,
+nsStringBuffer::ToString(uint32_t aLen, nsAString& aStr,
                          bool aMoveOwnership)
 {
   char16_t* data = static_cast<char16_t*>(Data());
 
-  nsAStringAccessor* accessor = static_cast<nsAStringAccessor*>(&str);
-  NS_ASSERTION(data[len] == char16_t(0), "data should be null terminated");
+  nsAStringAccessor* accessor = static_cast<nsAStringAccessor*>(&aStr);
+  NS_ASSERTION(data[aLen] == char16_t(0), "data should be null terminated");
 
   // preserve class flags
   uint32_t flags = accessor->flags();
@@ -273,17 +296,17 @@ nsStringBuffer::ToString(uint32_t len, nsAString &str,
   if (!aMoveOwnership) {
     AddRef();
   }
-  accessor->set(data, len, flags);
+  accessor->set(data, aLen, flags);
 }
 
 void
-nsStringBuffer::ToString(uint32_t len, nsACString &str,
+nsStringBuffer::ToString(uint32_t aLen, nsACString& aStr,
                          bool aMoveOwnership)
 {
   char* data = static_cast<char*>(Data());
 
-  nsACStringAccessor* accessor = static_cast<nsACStringAccessor*>(&str);
-  NS_ASSERTION(data[len] == char(0), "data should be null terminated");
+  nsACStringAccessor* accessor = static_cast<nsACStringAccessor*>(&aStr);
+  NS_ASSERTION(data[aLen] == char(0), "data should be null terminated");
 
   // preserve class flags
   uint32_t flags = accessor->flags();
@@ -292,7 +315,7 @@ nsStringBuffer::ToString(uint32_t len, nsACString &str,
   if (!aMoveOwnership) {
     AddRef();
   }
-  accessor->set(data, len, flags);
+  accessor->set(data, aLen, flags);
 }
 
 size_t
@@ -306,8 +329,7 @@ nsStringBuffer::SizeOfIncludingThisMustBeUnshared(mozilla::MallocSizeOf aMallocS
 size_t
 nsStringBuffer::SizeOfIncludingThisIfUnshared(mozilla::MallocSizeOf aMallocSizeOf) const
 {
-  if (!IsReadonly())
-  {
+  if (!IsReadonly()) {
     return SizeOfIncludingThisMustBeUnshared(aMallocSizeOf);
   }
   return 0;
diff --git a/xpcom/string/src/nsTDependentString.cpp b/xpcom/string/src/nsTDependentString.cpp
index 6f0561f20c3f..a32c8f2547da 100644
--- a/xpcom/string/src/nsTDependentString.cpp
+++ b/xpcom/string/src/nsTDependentString.cpp
@@ -5,7 +5,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 void
-nsTDependentString_CharT::Rebind( const string_type& str, uint32_t startPos )
+nsTDependentString_CharT::Rebind(const string_type& str, uint32_t startPos)
 {
   NS_ABORT_IF_FALSE(str.Flags() & F_TERMINATED, "Unterminated flat string");
 
@@ -14,8 +14,9 @@ nsTDependentString_CharT::Rebind( const string_type& str, uint32_t startPos )
 
   size_type strLength = str.Length();
 
-  if (startPos > strLength)
+  if (startPos > strLength) {
     startPos = strLength;
+  }
 
   mData = const_cast<char_type*>(static_cast<const char_type*>(str.Data())) + startPos;
   mLength = strLength - startPos;
diff --git a/xpcom/string/src/nsTDependentSubstring.cpp b/xpcom/string/src/nsTDependentSubstring.cpp
index 394f3b6ca51c..b540c028d320 100644
--- a/xpcom/string/src/nsTDependentSubstring.cpp
+++ b/xpcom/string/src/nsTDependentSubstring.cpp
@@ -5,15 +5,17 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 void
-nsTDependentSubstring_CharT::Rebind( const substring_type& str, uint32_t startPos, uint32_t length )
+nsTDependentSubstring_CharT::Rebind(const substring_type& str,
+                                    uint32_t startPos, uint32_t length)
 {
   // If we currently own a buffer, release it.
   Finalize();
 
   size_type strLength = str.Length();
 
-  if (startPos > strLength)
+  if (startPos > strLength) {
     startPos = strLength;
+  }
 
   mData = const_cast<char_type*>(static_cast<const char_type*>(str.Data())) + startPos;
   mLength = XPCOM_MIN(length, strLength - startPos);
@@ -22,7 +24,7 @@ nsTDependentSubstring_CharT::Rebind( const substring_type& str, uint32_t startPo
 }
 
 void
-nsTDependentSubstring_CharT::Rebind( const char_type* data, size_type length )
+nsTDependentSubstring_CharT::Rebind(const char_type* data, size_type length)
 {
   NS_ASSERTION(data, "nsTDependentSubstring must wrap a non-NULL buffer");
 
diff --git a/xpcom/string/src/nsTPromiseFlatString.cpp b/xpcom/string/src/nsTPromiseFlatString.cpp
index 596683f2431e..f02fc925c92c 100644
--- a/xpcom/string/src/nsTPromiseFlatString.cpp
+++ b/xpcom/string/src/nsTPromiseFlatString.cpp
@@ -7,15 +7,12 @@
 void
 nsTPromiseFlatString_CharT::Init(const substring_type& str)
 {
-  if (str.IsTerminated())
-  {
+  if (str.IsTerminated()) {
     mData = const_cast<char_type*>(static_cast<const char_type*>(str.Data()));
     mLength = str.Length();
     mFlags = str.mFlags & (F_TERMINATED | F_LITERAL);
-             // does not promote F_VOIDED
-  }
-  else
-  {
+    // does not promote F_VOIDED
+  } else {
     Assign(str);
   }
 }
diff --git a/xpcom/string/src/nsTString.cpp b/xpcom/string/src/nsTString.cpp
index b53fd4579a7a..f35f9a33e107 100644
--- a/xpcom/string/src/nsTString.cpp
+++ b/xpcom/string/src/nsTString.cpp
@@ -5,14 +5,13 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 nsTAdoptingString_CharT&
-nsTAdoptingString_CharT::operator=( const self_type& str )
+nsTAdoptingString_CharT::operator=(const self_type& str)
 {
   // This'll violate the constness of this argument, that's just
   // the nature of this class...
   self_type* mutable_str = const_cast<self_type*>(&str);
 
-  if (str.mFlags & F_OWNED)
-  {
+  if (str.mFlags & F_OWNED) {
     // We want to do what Adopt() does, but without actually incrementing
     // the Adopt count.  Note that we can be a little more straightforward
     // about this than Adopt() is, because we know that str.mData is
@@ -24,10 +23,8 @@ nsTAdoptingString_CharT::operator=( const self_type& str )
     SetDataFlags(F_TERMINATED | F_OWNED);
 
     // Make str forget the buffer we just took ownership of.
-    new (mutable_str) self_type();
-  }
-  else
-  {
+    new(mutable_str) self_type();
+  } else {
     Assign(str);
 
     mutable_str->Truncate();
@@ -37,7 +34,7 @@ nsTAdoptingString_CharT::operator=( const self_type& str )
 }
 
 void
-nsTString_CharT::Rebind( const char_type* data, size_type length )
+nsTString_CharT::Rebind(const char_type* data, size_type length)
 {
   // If we currently own a buffer, release it.
   Finalize();
diff --git a/xpcom/string/src/nsTStringComparator.cpp b/xpcom/string/src/nsTStringComparator.cpp
index 81c0ac061841..13d285e8b4d9 100644
--- a/xpcom/string/src/nsTStringComparator.cpp
+++ b/xpcom/string/src/nsTStringComparator.cpp
@@ -5,38 +5,46 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 int NS_FASTCALL
-Compare( const nsTSubstring_CharT::base_string_type& lhs, const nsTSubstring_CharT::base_string_type& rhs, const nsTStringComparator_CharT& comp )
+Compare(const nsTSubstring_CharT::base_string_type& aLhs,
+        const nsTSubstring_CharT::base_string_type& aRhs,
+        const nsTStringComparator_CharT& comp)
 {
   typedef nsTSubstring_CharT::size_type size_type;
 
-  if ( &lhs == &rhs )
+  if (&aLhs == &aRhs) {
     return 0;
+  }
 
   nsTSubstring_CharT::const_iterator leftIter, rightIter;
-  lhs.BeginReading(leftIter);
-  rhs.BeginReading(rightIter);
+  aLhs.BeginReading(leftIter);
+  aRhs.BeginReading(rightIter);
 
   size_type lLength = leftIter.size_forward();
   size_type rLength = rightIter.size_forward();
   size_type lengthToCompare = XPCOM_MIN(lLength, rLength);
 
   int result;
-  if ( (result = comp(leftIter.get(), rightIter.get(), lengthToCompare, lengthToCompare)) == 0 )
-  {
-    if ( lLength < rLength )
+  if ((result = comp(leftIter.get(), rightIter.get(),
+                     lengthToCompare, lengthToCompare)) == 0) {
+    if (lLength < rLength) {
       result = -1;
-    else if ( rLength < lLength )
+    } else if (rLength < lLength) {
       result = 1;
-    else
+    } else {
       result = 0;
+    }
   }
 
   return result;
 }
 
 int
-nsTDefaultStringComparator_CharT::operator()( const char_type* lhs, const char_type* rhs, uint32_t lLength, uint32_t rLength) const
+nsTDefaultStringComparator_CharT::operator()(const char_type* aLhs,
+                                             const char_type* aRhs,
+                                             uint32_t aLLength,
+                                             uint32_t aRLength) const
 {
-  return (lLength == rLength) ? nsCharTraits<CharT>::compare(lhs, rhs, lLength) :
-         (lLength > rLength) ? 1 : -1;
+  return
+    aLLength == aRLength ? nsCharTraits<CharT>::compare(aLhs, aRhs, aLLength) :
+                            (aLLength > aRLength) ? 1 : -1;
 }
diff --git a/xpcom/string/src/nsTSubstring.cpp b/xpcom/string/src/nsTSubstring.cpp
index a51940417221..e5b0e1ac0132 100644
--- a/xpcom/string/src/nsTSubstring.cpp
+++ b/xpcom/string/src/nsTSubstring.cpp
@@ -9,13 +9,13 @@
 using double_conversion::DoubleToStringConverter;
 
 #ifdef XPCOM_STRING_CONSTRUCTOR_OUT_OF_LINE
-nsTSubstring_CharT::nsTSubstring_CharT( char_type *data, size_type length,
-                                        uint32_t flags)
-  : mData(data),
-    mLength(length),
-    mFlags(flags)
+nsTSubstring_CharT::nsTSubstring_CharT(char_type* aData, size_type aLength,
+                                       uint32_t aFlags)
+  : mData(aData),
+    mLength(aLength),
+    mFlags(aFlags)
 {
-  if (flags & F_OWNED) {
+  if (aFlags & F_OWNED) {
     STRING_STAT_INCREMENT(Adopt);
 #ifdef NS_BUILD_REFCNT_LOGGING
     NS_LogCtor(mData, "StringAdopt", 1);
@@ -28,9 +28,9 @@ nsTSubstring_CharT::nsTSubstring_CharT( char_type *data, size_type length,
  * helper function for down-casting a nsTSubstring to a nsTFixedString.
  */
 inline const nsTFixedString_CharT*
-AsFixedString( const nsTSubstring_CharT* s )
+AsFixedString(const nsTSubstring_CharT* aStr)
 {
-  return static_cast<const nsTFixedString_CharT*>(s);
+  return static_cast<const nsTFixedString_CharT*>(aStr);
 }
 
 
@@ -42,24 +42,25 @@ AsFixedString( const nsTSubstring_CharT* s )
  * the old data must be released by the caller.
  */
 bool
-nsTSubstring_CharT::MutatePrep( size_type capacity, char_type** oldData, uint32_t* oldFlags )
+nsTSubstring_CharT::MutatePrep(size_type aCapacity, char_type** aOldData,
+                               uint32_t* aOldFlags)
 {
   // initialize to no old data
-  *oldData = nullptr;
-  *oldFlags = 0;
+  *aOldData = nullptr;
+  *aOldFlags = 0;
 
   size_type curCapacity = Capacity();
 
-  // If |capacity > kMaxCapacity|, then our doubling algorithm may not be
+  // If |aCapacity > kMaxCapacity|, then our doubling algorithm may not be
   // able to allocate it.  Just bail out in cases like that.  We don't want
   // to be allocating 2GB+ strings anyway.
   PR_STATIC_ASSERT((sizeof(nsStringBuffer) & 0x1) == 0);
   const size_type kMaxCapacity =
-    (size_type(-1)/2 - sizeof(nsStringBuffer)) / sizeof(char_type) - 2;
-  if (capacity > kMaxCapacity) {
-    // Also assert for |capacity| equal to |size_type(-1)|, since we used to
+    (size_type(-1) / 2 - sizeof(nsStringBuffer)) / sizeof(char_type) - 2;
+  if (aCapacity > kMaxCapacity) {
+    // Also assert for |aCapacity| equal to |size_type(-1)|, since we used to
     // use that value to flag immutability.
-    NS_ASSERTION(capacity != size_type(-1), "Bogus capacity");
+    NS_ASSERTION(aCapacity != size_type(-1), "Bogus capacity");
     return false;
   }
 
@@ -67,20 +68,20 @@ nsTSubstring_CharT::MutatePrep( size_type capacity, char_type** oldData, uint32_
   // need to allocate a new buffer. We cannot use the existing buffer even
   // though it might be large enough.
 
-  if (curCapacity != 0)
-  {
-    if (capacity <= curCapacity) {
+  if (curCapacity != 0) {
+    if (aCapacity <= curCapacity) {
       mFlags &= ~F_VOIDED;  // mutation clears voided flag
       return true;
     }
 
     // Use doubling algorithm when forced to increase available capacity.
     size_type temp = curCapacity;
-    while (temp < capacity)
+    while (temp < aCapacity) {
       temp <<= 1;
-    NS_ASSERTION(XPCOM_MIN(temp, kMaxCapacity) >= capacity,
+    }
+    NS_ASSERTION(XPCOM_MIN(temp, kMaxCapacity) >= aCapacity,
                  "should have hit the early return at the top");
-    capacity = XPCOM_MIN(temp, kMaxCapacity);
+    aCapacity = XPCOM_MIN(temp, kMaxCapacity);
   }
 
   //
@@ -95,20 +96,19 @@ nsTSubstring_CharT::MutatePrep( size_type capacity, char_type** oldData, uint32_
   // a new buffer complicates things just a bit ;-)
   //
 
-  size_type storageSize = (capacity + 1) * sizeof(char_type);
+  size_type storageSize = (aCapacity + 1) * sizeof(char_type);
 
   // case #1
-  if (mFlags & F_SHARED)
-  {
+  if (mFlags & F_SHARED) {
     nsStringBuffer* hdr = nsStringBuffer::FromData(mData);
-    if (!hdr->IsReadonly())
-    {
-      nsStringBuffer *newHdr = nsStringBuffer::Realloc(hdr, storageSize);
-      if (!newHdr)
-        return false; // out-of-memory (original header left intact)
+    if (!hdr->IsReadonly()) {
+      nsStringBuffer* newHdr = nsStringBuffer::Realloc(hdr, storageSize);
+      if (!newHdr) {
+        return false;  // out-of-memory (original header left intact)
+      }
 
       hdr = newHdr;
-      mData = (char_type*) hdr->Data();
+      mData = (char_type*)hdr->Data();
       mFlags &= ~F_VOIDED;  // mutation clears voided flag
       return true;
     }
@@ -119,29 +119,28 @@ nsTSubstring_CharT::MutatePrep( size_type capacity, char_type** oldData, uint32_
 
   // if we have a fixed buffer of sufficient size, then use it.  this helps
   // avoid heap allocations.
-  if ((mFlags & F_CLASS_FIXED) && (capacity < AsFixedString(this)->mFixedCapacity))
-  {
+  if ((mFlags & F_CLASS_FIXED) &&
+      (aCapacity < AsFixedString(this)->mFixedCapacity)) {
     newData = AsFixedString(this)->mFixedBuf;
     newDataFlags = F_TERMINATED | F_FIXED;
-  }
-  else
-  {
+  } else {
     // if we reach here then, we must allocate a new buffer.  we cannot
     // make use of our F_OWNED or F_FIXED buffers because they are not
     // large enough.
 
     nsStringBuffer* newHdr =
       nsStringBuffer::Alloc(storageSize).take();
-    if (!newHdr)
-      return false; // we are still in a consistent state
+    if (!newHdr) {
+      return false;  // we are still in a consistent state
+    }
 
-    newData = (char_type*) newHdr->Data();
+    newData = (char_type*)newHdr->Data();
     newDataFlags = F_TERMINATED | F_SHARED;
   }
 
   // save old data and flags
-  *oldData = mData;
-  *oldFlags = mFlags;
+  *aOldData = mData;
+  *aOldFlags = mFlags;
 
   mData = newData;
   SetDataFlags(newDataFlags);
@@ -162,55 +161,50 @@ nsTSubstring_CharT::Finalize()
 }
 
 bool
-nsTSubstring_CharT::ReplacePrepInternal(index_type cutStart, size_type cutLen,
-                                        size_type fragLen, size_type newLen)
+nsTSubstring_CharT::ReplacePrepInternal(index_type aCutStart, size_type aCutLen,
+                                        size_type aFragLen, size_type aNewLen)
 {
   char_type* oldData;
   uint32_t oldFlags;
-  if (!MutatePrep(newLen, &oldData, &oldFlags))
-    return false; // out-of-memory
+  if (!MutatePrep(aNewLen, &oldData, &oldFlags)) {
+    return false;  // out-of-memory
+  }
 
-  if (oldData)
-  {
+  if (oldData) {
     // determine whether or not we need to copy part of the old string
     // over to the new string.
 
-    if (cutStart > 0)
-    {
+    if (aCutStart > 0) {
       // copy prefix from old string
-      char_traits::copy(mData, oldData, cutStart);
+      char_traits::copy(mData, oldData, aCutStart);
     }
 
-    if (cutStart + cutLen < mLength)
-    {
+    if (aCutStart + aCutLen < mLength) {
       // copy suffix from old string to new offset
-      size_type from = cutStart + cutLen;
+      size_type from = aCutStart + aCutLen;
       size_type fromLen = mLength - from;
-      uint32_t to = cutStart + fragLen;
+      uint32_t to = aCutStart + aFragLen;
       char_traits::copy(mData + to, oldData + from, fromLen);
     }
 
     ::ReleaseData(oldData, oldFlags);
-  }
-  else
-  {
+  } else {
     // original data remains intact
 
     // determine whether or not we need to move part of the existing string
     // to make room for the requested hole.
-    if (fragLen != cutLen && cutStart + cutLen < mLength)
-    {
-      uint32_t from = cutStart + cutLen;
+    if (aFragLen != aCutLen && aCutStart + aCutLen < mLength) {
+      uint32_t from = aCutStart + aCutLen;
       uint32_t fromLen = mLength - from;
-      uint32_t to = cutStart + fragLen;
+      uint32_t to = aCutStart + aFragLen;
       char_traits::move(mData + to, mData + from, fromLen);
     }
   }
 
   // add null terminator (mutable mData always has room for the null-
   // terminator).
-  mData[newLen] = char_type(0);
-  mLength = newLen;
+  mData[aNewLen] = char_type(0);
+  mLength = aNewLen;
 
   return true;
 }
@@ -221,30 +215,23 @@ nsTSubstring_CharT::Capacity() const
   // return 0 to indicate an immutable or 0-sized buffer
 
   size_type capacity;
-  if (mFlags & F_SHARED)
-  {
+  if (mFlags & F_SHARED) {
     // if the string is readonly, then we pretend that it has no capacity.
     nsStringBuffer* hdr = nsStringBuffer::FromData(mData);
-    if (hdr->IsReadonly())
+    if (hdr->IsReadonly()) {
       capacity = 0;
-    else {
+    } else {
       capacity = (hdr->StorageSize() / sizeof(char_type)) - 1;
     }
-  }
-  else if (mFlags & F_FIXED)
-  {
+  } else if (mFlags & F_FIXED) {
     capacity = AsFixedString(this)->mFixedCapacity;
-  }
-  else if (mFlags & F_OWNED)
-  {
+  } else if (mFlags & F_OWNED) {
     // we don't store the capacity of an adopted buffer because that would
     // require an additional member field.  the best we can do is base the
     // capacity on our length.  remains to be seen if this is the right
     // trade-off.
     capacity = mLength;
-  }
-  else
-  {
+  } else {
     capacity = 0;
   }
 
@@ -252,212 +239,222 @@ nsTSubstring_CharT::Capacity() const
 }
 
 bool
-nsTSubstring_CharT::EnsureMutable( size_type newLen )
+nsTSubstring_CharT::EnsureMutable(size_type aNewLen)
 {
-  if (newLen == size_type(-1) || newLen == mLength)
-  {
-    if (mFlags & (F_FIXED | F_OWNED))
+  if (aNewLen == size_type(-1) || aNewLen == mLength) {
+    if (mFlags & (F_FIXED | F_OWNED)) {
       return true;
-    if ((mFlags & F_SHARED) && !nsStringBuffer::FromData(mData)->IsReadonly())
+    }
+    if ((mFlags & F_SHARED) &&
+        !nsStringBuffer::FromData(mData)->IsReadonly()) {
       return true;
+    }
 
-    newLen = mLength;
+    aNewLen = mLength;
   }
-  return SetLength(newLen, fallible_t());
+  return SetLength(aNewLen, fallible_t());
 }
 
 // ---------------------------------------------------------------------------
 
 // This version of Assign is optimized for single-character assignment.
 void
-nsTSubstring_CharT::Assign( char_type c )
+nsTSubstring_CharT::Assign(char_type aChar)
 {
-  if (!ReplacePrep(0, mLength, 1))
+  if (!ReplacePrep(0, mLength, 1)) {
     NS_ABORT_OOM(mLength);
+  }
 
-  *mData = c;
+  *mData = aChar;
 }
 
 bool
-nsTSubstring_CharT::Assign( char_type c, const fallible_t& )
+nsTSubstring_CharT::Assign(char_type aChar, const fallible_t&)
 {
-  if (!ReplacePrep(0, mLength, 1))
+  if (!ReplacePrep(0, mLength, 1)) {
     return false;
+  }
 
-  *mData = c;
+  *mData = aChar;
   return true;
 }
 
 void
-nsTSubstring_CharT::Assign( const char_type* data )
+nsTSubstring_CharT::Assign(const char_type* aData)
 {
-  if (!Assign(data, size_type(-1), fallible_t()))
-    NS_ABORT_OOM(char_traits::length(data));
+  if (!Assign(aData, size_type(-1), fallible_t())) {
+    NS_ABORT_OOM(char_traits::length(aData));
+  }
 }
 
 void
-nsTSubstring_CharT::Assign( const char_type* data, size_type length )
+nsTSubstring_CharT::Assign(const char_type* aData, size_type aLength)
 {
-  if (!Assign(data, length, fallible_t()))
-    NS_ABORT_OOM(length);
+  if (!Assign(aData, aLength, fallible_t())) {
+    NS_ABORT_OOM(aLength);
+  }
 }
 
 bool
-nsTSubstring_CharT::Assign( const char_type* data, size_type length, const fallible_t& )
+nsTSubstring_CharT::Assign(const char_type* aData, size_type aLength,
+                           const fallible_t&)
 {
-  if (!data || length == 0)
-  {
+  if (!aData || aLength == 0) {
     Truncate();
     return true;
   }
 
-  if (length == size_type(-1))
-    length = char_traits::length(data);
-
-  if (IsDependentOn(data, data + length))
-  {
-    return Assign(string_type(data, length), fallible_t());
+  if (aLength == size_type(-1)) {
+    aLength = char_traits::length(aData);
   }
 
-  if (!ReplacePrep(0, mLength, length))
-    return false;
+  if (IsDependentOn(aData, aData + aLength)) {
+    return Assign(string_type(aData, aLength), fallible_t());
+  }
 
-  char_traits::copy(mData, data, length);
+  if (!ReplacePrep(0, mLength, aLength)) {
+    return false;
+  }
+
+  char_traits::copy(mData, aData, aLength);
   return true;
 }
 
 void
-nsTSubstring_CharT::AssignASCII( const char* data, size_type length )
+nsTSubstring_CharT::AssignASCII(const char* aData, size_type aLength)
 {
-  if (!AssignASCII(data, length, fallible_t()))
-    NS_ABORT_OOM(length);
+  if (!AssignASCII(aData, aLength, fallible_t())) {
+    NS_ABORT_OOM(aLength);
+  }
 }
 
 bool
-nsTSubstring_CharT::AssignASCII( const char* data, size_type length, const fallible_t& )
+nsTSubstring_CharT::AssignASCII(const char* aData, size_type aLength,
+                                const fallible_t&)
 {
   // A Unicode string can't depend on an ASCII string buffer,
   // so this dependence check only applies to CStrings.
 #ifdef CharT_is_char
-  if (IsDependentOn(data, data + length))
-  {
-    return Assign(string_type(data, length), fallible_t());
+  if (IsDependentOn(aData, aData + aLength)) {
+    return Assign(string_type(aData, aLength), fallible_t());
   }
 #endif
 
-  if (!ReplacePrep(0, mLength, length))
+  if (!ReplacePrep(0, mLength, aLength)) {
     return false;
+  }
 
-  char_traits::copyASCII(mData, data, length);
+  char_traits::copyASCII(mData, aData, aLength);
   return true;
 }
 
 void
-nsTSubstring_CharT::AssignLiteral( const char_type* data, size_type length )
+nsTSubstring_CharT::AssignLiteral(const char_type* aData, size_type aLength)
 {
   ::ReleaseData(mData, mFlags);
-  mData = const_cast<char_type*>(data);
-  mLength = length;
+  mData = const_cast<char_type*>(aData);
+  mLength = aLength;
   SetDataFlags(F_TERMINATED | F_LITERAL);
 }
 
 void
-nsTSubstring_CharT::Assign( const self_type& str )
+nsTSubstring_CharT::Assign(const self_type& aStr)
 {
-  if (!Assign(str, fallible_t()))
-    NS_ABORT_OOM(str.Length());
+  if (!Assign(aStr, fallible_t())) {
+    NS_ABORT_OOM(aStr.Length());
+  }
 }
 
 bool
-nsTSubstring_CharT::Assign( const self_type& str, const fallible_t& )
+nsTSubstring_CharT::Assign(const self_type& aStr, const fallible_t&)
 {
-  // |str| could be sharable.  we need to check its flags to know how to
+  // |aStr| could be sharable. We need to check its flags to know how to
   // deal with it.
 
-  if (&str == this)
-    return true;
-
-  if (!str.mLength)
-  {
-    Truncate();
-    mFlags |= str.mFlags & F_VOIDED;
+  if (&aStr == this) {
     return true;
   }
 
-  if (str.mFlags & F_SHARED)
-  {
+  if (!aStr.mLength) {
+    Truncate();
+    mFlags |= aStr.mFlags & F_VOIDED;
+    return true;
+  }
+
+  if (aStr.mFlags & F_SHARED) {
     // nice! we can avoid a string copy :-)
 
-    // |str| should be null-terminated
-    NS_ASSERTION(str.mFlags & F_TERMINATED, "shared, but not terminated");
+    // |aStr| should be null-terminated
+    NS_ASSERTION(aStr.mFlags & F_TERMINATED, "shared, but not terminated");
 
     ::ReleaseData(mData, mFlags);
 
-    mData = str.mData;
-    mLength = str.mLength;
+    mData = aStr.mData;
+    mLength = aStr.mLength;
     SetDataFlags(F_TERMINATED | F_SHARED);
 
     // get an owning reference to the mData
     nsStringBuffer::FromData(mData)->AddRef();
     return true;
-  }
-  else if (str.mFlags & F_LITERAL)
-  {
-    NS_ABORT_IF_FALSE(str.mFlags & F_TERMINATED, "Unterminated literal");
+  } else if (aStr.mFlags & F_LITERAL) {
+    NS_ABORT_IF_FALSE(aStr.mFlags & F_TERMINATED, "Unterminated literal");
 
-    AssignLiteral(str.mData, str.mLength);
+    AssignLiteral(aStr.mData, aStr.mLength);
     return true;
   }
 
   // else, treat this like an ordinary assignment.
-  return Assign(str.Data(), str.Length(), fallible_t());
+  return Assign(aStr.Data(), aStr.Length(), fallible_t());
 }
 
 void
-nsTSubstring_CharT::Assign( const substring_tuple_type& tuple )
+nsTSubstring_CharT::Assign(const substring_tuple_type& aTuple)
 {
-  if (!Assign(tuple, fallible_t()))
-    NS_ABORT_OOM(tuple.Length());
+  if (!Assign(aTuple, fallible_t())) {
+    NS_ABORT_OOM(aTuple.Length());
+  }
 }
 
 bool
-nsTSubstring_CharT::Assign( const substring_tuple_type& tuple, const fallible_t& )
+nsTSubstring_CharT::Assign(const substring_tuple_type& aTuple,
+                           const fallible_t&)
 {
-  if (tuple.IsDependentOn(mData, mData + mLength))
-  {
+  if (aTuple.IsDependentOn(mData, mData + mLength)) {
     // take advantage of sharing here...
-    return Assign(string_type(tuple), fallible_t());
+    return Assign(string_type(aTuple), fallible_t());
   }
 
-  size_type length = tuple.Length();
+  size_type length = aTuple.Length();
 
   // don't use ReplacePrep here because it changes the length
   char_type* oldData;
   uint32_t oldFlags;
-  if (!MutatePrep(length, &oldData, &oldFlags))
+  if (!MutatePrep(length, &oldData, &oldFlags)) {
     return false;
+  }
 
-  if (oldData)
+  if (oldData) {
     ::ReleaseData(oldData, oldFlags);
+  }
 
-  tuple.WriteTo(mData, length);
+  aTuple.WriteTo(mData, length);
   mData[length] = 0;
   mLength = length;
   return true;
 }
 
 void
-nsTSubstring_CharT::Adopt( char_type* data, size_type length )
+nsTSubstring_CharT::Adopt(char_type* aData, size_type aLength)
 {
-  if (data)
-  {
+  if (aData) {
     ::ReleaseData(mData, mFlags);
 
-    if (length == size_type(-1))
-      length = char_traits::length(data);
+    if (aLength == size_type(-1)) {
+      aLength = char_traits::length(aData);
+    }
 
-    mData = data;
-    mLength = length;
+    mData = aData;
+    mLength = aLength;
     SetDataFlags(F_TERMINATED | F_OWNED);
 
     STRING_STAT_INCREMENT(Adopt);
@@ -466,9 +463,7 @@ nsTSubstring_CharT::Adopt( char_type* data, size_type length )
     // tracking purposes.
     NS_LogCtor(mData, "StringAdopt", 1);
 #endif // NS_BUILD_REFCNT_LOGGING
-  }
-  else
-  {
+  } else {
     SetIsVoid(true);
   }
 }
@@ -476,135 +471,147 @@ nsTSubstring_CharT::Adopt( char_type* data, size_type length )
 
 // This version of Replace is optimized for single-character replacement.
 void
-nsTSubstring_CharT::Replace( index_type cutStart, size_type cutLength, char_type c )
+nsTSubstring_CharT::Replace(index_type aCutStart, size_type aCutLength,
+                            char_type aChar)
 {
-  cutStart = XPCOM_MIN(cutStart, Length());
+  aCutStart = XPCOM_MIN(aCutStart, Length());
 
-  if (ReplacePrep(cutStart, cutLength, 1))
-    mData[cutStart] = c;
+  if (ReplacePrep(aCutStart, aCutLength, 1)) {
+    mData[aCutStart] = aChar;
+  }
 }
 
 bool
-nsTSubstring_CharT::Replace( index_type cutStart, size_type cutLength, char_type c, const mozilla::fallible_t& )
+nsTSubstring_CharT::Replace(index_type aCutStart, size_type aCutLength,
+                            char_type aChar,
+                            const mozilla::fallible_t&)
 {
-  cutStart = XPCOM_MIN(cutStart, Length());
+  aCutStart = XPCOM_MIN(aCutStart, Length());
 
-  if (!ReplacePrep(cutStart, cutLength, 1))
+  if (!ReplacePrep(aCutStart, aCutLength, 1)) {
     return false;
+  }
 
-  mData[cutStart] = c;
+  mData[aCutStart] = aChar;
 
   return true;
 }
 
 void
-nsTSubstring_CharT::Replace( index_type cutStart, size_type cutLength, const char_type* data, size_type length )
+nsTSubstring_CharT::Replace(index_type aCutStart, size_type aCutLength,
+                            const char_type* aData, size_type aLength)
 {
-  if (!Replace(cutStart, cutLength, data, length, mozilla::fallible_t()))
-  {
-    NS_ABORT_OOM(Length() - cutLength + 1);
+  if (!Replace(aCutStart, aCutLength, aData, aLength,
+               mozilla::fallible_t())) {
+    NS_ABORT_OOM(Length() - aCutLength + 1);
   }
 }
 
 bool
-nsTSubstring_CharT::Replace( index_type cutStart, size_type cutLength, const char_type* data, size_type length, const mozilla::fallible_t& )
+nsTSubstring_CharT::Replace(index_type aCutStart, size_type aCutLength,
+                            const char_type* aData, size_type aLength,
+                            const mozilla::fallible_t&)
 {
   // unfortunately, some callers pass null :-(
-  if (!data)
-  {
-    length = 0;
-  }
-  else
-  {
-    if (length == size_type(-1))
-      length = char_traits::length(data);
+  if (!aData) {
+    aLength = 0;
+  } else {
+    if (aLength == size_type(-1)) {
+      aLength = char_traits::length(aData);
+    }
 
-    if (IsDependentOn(data, data + length))
-    {
-      nsTAutoString_CharT temp(data, length);
-      return Replace(cutStart, cutLength, temp, mozilla::fallible_t());
+    if (IsDependentOn(aData, aData + aLength)) {
+      nsTAutoString_CharT temp(aData, aLength);
+      return Replace(aCutStart, aCutLength, temp, mozilla::fallible_t());
     }
   }
 
-  cutStart = XPCOM_MIN(cutStart, Length());
+  aCutStart = XPCOM_MIN(aCutStart, Length());
 
-  bool ok = ReplacePrep(cutStart, cutLength, length);
-  if (!ok)
+  bool ok = ReplacePrep(aCutStart, aCutLength, aLength);
+  if (!ok) {
     return false;
+  }
 
-  if (length > 0)
-    char_traits::copy(mData + cutStart, data, length);
+  if (aLength > 0) {
+    char_traits::copy(mData + aCutStart, aData, aLength);
+  }
 
   return true;
 }
 
 void
-nsTSubstring_CharT::ReplaceASCII( index_type cutStart, size_type cutLength, const char* data, size_type length )
+nsTSubstring_CharT::ReplaceASCII(index_type aCutStart, size_type aCutLength,
+                                 const char* aData, size_type aLength)
 {
-  if (length == size_type(-1))
-    length = strlen(data);
+  if (aLength == size_type(-1)) {
+    aLength = strlen(aData);
+  }
 
   // A Unicode string can't depend on an ASCII string buffer,
   // so this dependence check only applies to CStrings.
 #ifdef CharT_is_char
-  if (IsDependentOn(data, data + length))
-  {
-    nsTAutoString_CharT temp(data, length);
-    Replace(cutStart, cutLength, temp);
+  if (IsDependentOn(aData, aData + aLength)) {
+    nsTAutoString_CharT temp(aData, aLength);
+    Replace(aCutStart, aCutLength, temp);
     return;
   }
 #endif
 
-  cutStart = XPCOM_MIN(cutStart, Length());
+  aCutStart = XPCOM_MIN(aCutStart, Length());
 
-  if (ReplacePrep(cutStart, cutLength, length) && length > 0)
-    char_traits::copyASCII(mData + cutStart, data, length);
+  if (ReplacePrep(aCutStart, aCutLength, aLength) && aLength > 0) {
+    char_traits::copyASCII(mData + aCutStart, aData, aLength);
+  }
 }
 
 void
-nsTSubstring_CharT::Replace( index_type cutStart, size_type cutLength, const substring_tuple_type& tuple )
+nsTSubstring_CharT::Replace(index_type aCutStart, size_type aCutLength,
+                            const substring_tuple_type& aTuple)
 {
-  if (tuple.IsDependentOn(mData, mData + mLength))
-  {
-    nsTAutoString_CharT temp(tuple);
-    Replace(cutStart, cutLength, temp);
+  if (aTuple.IsDependentOn(mData, mData + mLength)) {
+    nsTAutoString_CharT temp(aTuple);
+    Replace(aCutStart, aCutLength, temp);
     return;
   }
 
-  size_type length = tuple.Length();
+  size_type length = aTuple.Length();
 
-  cutStart = XPCOM_MIN(cutStart, Length());
+  aCutStart = XPCOM_MIN(aCutStart, Length());
 
-  if (ReplacePrep(cutStart, cutLength, length) && length > 0)
-    tuple.WriteTo(mData + cutStart, length);
+  if (ReplacePrep(aCutStart, aCutLength, length) && length > 0) {
+    aTuple.WriteTo(mData + aCutStart, length);
+  }
 }
 
 void
-nsTSubstring_CharT::ReplaceLiteral( index_type cutStart, size_type cutLength, const char_type* data, size_type length )
+nsTSubstring_CharT::ReplaceLiteral(index_type aCutStart, size_type aCutLength,
+                                   const char_type* aData, size_type aLength)
 {
-  cutStart = XPCOM_MIN(cutStart, Length());
+  aCutStart = XPCOM_MIN(aCutStart, Length());
 
-  if (!cutStart && cutLength == Length())
-    AssignLiteral(data, length);
-  else if (ReplacePrep(cutStart, cutLength, length) && length > 0)
-    char_traits::copy(mData + cutStart, data, length);
+  if (!aCutStart && aCutLength == Length()) {
+    AssignLiteral(aData, aLength);
+  } else if (ReplacePrep(aCutStart, aCutLength, aLength) && aLength > 0) {
+    char_traits::copy(mData + aCutStart, aData, aLength);
+  }
 }
 
 void
-nsTSubstring_CharT::SetCapacity( size_type capacity )
+nsTSubstring_CharT::SetCapacity(size_type aCapacity)
 {
-  if (!SetCapacity(capacity, fallible_t()))
-    NS_ABORT_OOM(capacity);
+  if (!SetCapacity(aCapacity, fallible_t())) {
+    NS_ABORT_OOM(aCapacity);
+  }
 }
 
 bool
-nsTSubstring_CharT::SetCapacity( size_type capacity, const fallible_t& )
+nsTSubstring_CharT::SetCapacity(size_type aCapacity, const fallible_t&)
 {
   // capacity does not include room for the terminating null char
 
   // if our capacity is reduced to zero, then free our buffer.
-  if (capacity == 0)
-  {
+  if (aCapacity == 0) {
     ::ReleaseData(mData, mFlags);
     mData = char_traits::sEmptyBuffer;
     mLength = 0;
@@ -614,158 +621,169 @@ nsTSubstring_CharT::SetCapacity( size_type capacity, const fallible_t& )
 
   char_type* oldData;
   uint32_t oldFlags;
-  if (!MutatePrep(capacity, &oldData, &oldFlags))
-    return false; // out-of-memory
+  if (!MutatePrep(aCapacity, &oldData, &oldFlags)) {
+    return false;  // out-of-memory
+  }
 
   // compute new string length
-  size_type newLen = XPCOM_MIN(mLength, capacity);
+  size_type newLen = XPCOM_MIN(mLength, aCapacity);
 
-  if (oldData)
-  {
+  if (oldData) {
     // preserve old data
-    if (mLength > 0)
+    if (mLength > 0) {
       char_traits::copy(mData, oldData, newLen);
+    }
 
     ::ReleaseData(oldData, oldFlags);
   }
 
   // adjust mLength if our buffer shrunk down in size
-  if (newLen < mLength)
+  if (newLen < mLength) {
     mLength = newLen;
+  }
 
   // always null-terminate here, even if the buffer got longer.  this is
   // for backwards compat with the old string implementation.
-  mData[capacity] = char_type(0);
+  mData[aCapacity] = char_type(0);
 
   return true;
 }
 
 void
-nsTSubstring_CharT::SetLength( size_type length )
+nsTSubstring_CharT::SetLength(size_type aLength)
 {
-  SetCapacity(length);
-  mLength = length;
+  SetCapacity(aLength);
+  mLength = aLength;
 }
 
 bool
-nsTSubstring_CharT::SetLength( size_type length, const fallible_t& )
+nsTSubstring_CharT::SetLength(size_type aLength, const fallible_t&)
 {
-  if (!SetCapacity(length, fallible_t()))
+  if (!SetCapacity(aLength, fallible_t())) {
     return false;
+  }
 
-  mLength = length;
+  mLength = aLength;
   return true;
 }
 
 void
-nsTSubstring_CharT::SetIsVoid( bool val )
+nsTSubstring_CharT::SetIsVoid(bool aVal)
 {
-  if (val)
-  {
+  if (aVal) {
     Truncate();
     mFlags |= F_VOIDED;
-  }
-  else
-  {
+  } else {
     mFlags &= ~F_VOIDED;
   }
 }
 
 bool
-nsTSubstring_CharT::Equals( const self_type& str ) const
+nsTSubstring_CharT::Equals(const self_type& aStr) const
 {
-  return mLength == str.mLength && char_traits::compare(mData, str.mData, mLength) == 0;
+  return mLength == aStr.mLength &&
+         char_traits::compare(mData, aStr.mData, mLength) == 0;
 }
 
 bool
-nsTSubstring_CharT::Equals( const self_type& str, const comparator_type& comp ) const
+nsTSubstring_CharT::Equals(const self_type& aStr,
+                           const comparator_type& aComp) const
 {
-  return mLength == str.mLength && comp(mData, str.mData, mLength, str.mLength) == 0;
+  return mLength == aStr.mLength &&
+         aComp(mData, aStr.mData, mLength, aStr.mLength) == 0;
 }
 
 bool
-nsTSubstring_CharT::Equals( const char_type* data ) const
+nsTSubstring_CharT::Equals(const char_type* aData) const
 {
   // unfortunately, some callers pass null :-(
-  if (!data)
-  {
+  if (!aData) {
     NS_NOTREACHED("null data pointer");
     return mLength == 0;
   }
 
   // XXX avoid length calculation?
-  size_type length = char_traits::length(data);
-  return mLength == length && char_traits::compare(mData, data, mLength) == 0;
+  size_type length = char_traits::length(aData);
+  return mLength == length &&
+         char_traits::compare(mData, aData, mLength) == 0;
 }
 
 bool
-nsTSubstring_CharT::Equals( const char_type* data, const comparator_type& comp ) const
+nsTSubstring_CharT::Equals(const char_type* aData,
+                           const comparator_type& aComp) const
 {
   // unfortunately, some callers pass null :-(
-  if (!data)
-  {
+  if (!aData) {
     NS_NOTREACHED("null data pointer");
     return mLength == 0;
   }
 
   // XXX avoid length calculation?
-  size_type length = char_traits::length(data);
-  return mLength == length && comp(mData, data, mLength, length) == 0;
+  size_type length = char_traits::length(aData);
+  return mLength == length && aComp(mData, aData, mLength, length) == 0;
 }
 
 bool
-nsTSubstring_CharT::EqualsASCII( const char* data, size_type len ) const
+nsTSubstring_CharT::EqualsASCII(const char* aData, size_type aLen) const
 {
-  return mLength == len && char_traits::compareASCII(mData, data, len) == 0;
+  return mLength == aLen &&
+         char_traits::compareASCII(mData, aData, aLen) == 0;
 }
 
 bool
-nsTSubstring_CharT::EqualsASCII( const char* data ) const
+nsTSubstring_CharT::EqualsASCII(const char* aData) const
 {
-  return char_traits::compareASCIINullTerminated(mData, mLength, data) == 0;
+  return char_traits::compareASCIINullTerminated(mData, mLength, aData) == 0;
 }
 
 bool
-nsTSubstring_CharT::LowerCaseEqualsASCII( const char* data, size_type len ) const
+nsTSubstring_CharT::LowerCaseEqualsASCII(const char* aData,
+                                         size_type aLen) const
 {
-  return mLength == len && char_traits::compareLowerCaseToASCII(mData, data, len) == 0;
+  return mLength == aLen &&
+         char_traits::compareLowerCaseToASCII(mData, aData, aLen) == 0;
 }
 
 bool
-nsTSubstring_CharT::LowerCaseEqualsASCII( const char* data ) const
+nsTSubstring_CharT::LowerCaseEqualsASCII(const char* aData) const
 {
-  return char_traits::compareLowerCaseToASCIINullTerminated(mData, mLength, data) == 0;
+  return char_traits::compareLowerCaseToASCIINullTerminated(mData,
+                                                            mLength,
+                                                            aData) == 0;
 }
 
 nsTSubstring_CharT::size_type
-nsTSubstring_CharT::CountChar( char_type c ) const
+nsTSubstring_CharT::CountChar(char_type aChar) const
 {
-  const char_type *start = mData;
-  const char_type *end   = mData + mLength;
+  const char_type* start = mData;
+  const char_type* end   = mData + mLength;
 
-  return NS_COUNT(start, end, c);
+  return NS_COUNT(start, end, aChar);
 }
 
 int32_t
-nsTSubstring_CharT::FindChar( char_type c, index_type offset ) const
+nsTSubstring_CharT::FindChar(char_type aChar, index_type aOffset) const
 {
-  if (offset < mLength)
-  {
-    const char_type* result = char_traits::find(mData + offset, mLength - offset, c);
-    if (result)
+  if (aOffset < mLength) {
+    const char_type* result = char_traits::find(mData + aOffset,
+                                                mLength - aOffset, aChar);
+    if (result) {
       return result - mData;
+    }
   }
   return -1;
 }
 
 void
-nsTSubstring_CharT::StripChar( char_type aChar, int32_t aOffset )
+nsTSubstring_CharT::StripChar(char_type aChar, int32_t aOffset)
 {
-  if (mLength == 0 || aOffset >= int32_t(mLength))
+  if (mLength == 0 || aOffset >= int32_t(mLength)) {
     return;
+  }
 
-  if (!EnsureMutable()) // XXX do this lazily?
+  if (!EnsureMutable()) { // XXX do this lazily?
     NS_ABORT_OOM(mLength);
+  }
 
   // XXX(darin): this code should defer writing until necessary.
 
@@ -773,24 +791,26 @@ nsTSubstring_CharT::StripChar( char_type aChar, int32_t aOffset )
   char_type* from = mData + aOffset;
   char_type* end  = mData + mLength;
 
-  while (from < end)
-  {
+  while (from < end) {
     char_type theChar = *from++;
-    if (aChar != theChar)
+    if (aChar != theChar) {
       *to++ = theChar;
+    }
   }
   *to = char_type(0); // add the null
   mLength = to - mData;
 }
 
 void
-nsTSubstring_CharT::StripChars( const char_type* aChars, uint32_t aOffset )
+nsTSubstring_CharT::StripChars(const char_type* aChars, uint32_t aOffset)
 {
-  if (aOffset >= uint32_t(mLength))
+  if (aOffset >= uint32_t(mLength)) {
     return;
+  }
 
-  if (!EnsureMutable()) // XXX do this lazily?
+  if (!EnsureMutable()) { // XXX do this lazily?
     NS_ABORT_OOM(mLength);
+  }
 
   // XXX(darin): this code should defer writing until necessary.
 
@@ -798,8 +818,7 @@ nsTSubstring_CharT::StripChars( const char_type* aChars, uint32_t aOffset )
   char_type* from = mData + aOffset;
   char_type* end  = mData + mLength;
 
-  while (from < end)
-  {
+  while (from < end) {
     char_type theChar = *from++;
     const char_type* test = aChars;
 
@@ -815,43 +834,47 @@ nsTSubstring_CharT::StripChars( const char_type* aChars, uint32_t aOffset )
 }
 
 int
-nsTSubstring_CharT::AppendFunc(void* arg, const char* s, uint32_t len)
+nsTSubstring_CharT::AppendFunc(void* aArg, const char* aStr, uint32_t aLen)
 {
-  self_type* self = static_cast<self_type*>(arg);
+  self_type* self = static_cast<self_type*>(aArg);
 
   // NSPR sends us the final null terminator even though we don't want it
-  if (len && s[len - 1] == '\0') {
-    --len;
+  if (aLen && aStr[aLen - 1] == '\0') {
+    --aLen;
   }
 
-  self->AppendASCII(s, len);
+  self->AppendASCII(aStr, aLen);
 
-  return len;
+  return aLen;
 }
 
-void nsTSubstring_CharT::AppendPrintf( const char* format, ...)
+void
+nsTSubstring_CharT::AppendPrintf(const char* aFormat, ...)
 {
   va_list ap;
-  va_start(ap, format);
-  uint32_t r = PR_vsxprintf(AppendFunc, this, format, ap);
-  if (r == (uint32_t) -1)
+  va_start(ap, aFormat);
+  uint32_t r = PR_vsxprintf(AppendFunc, this, aFormat, ap);
+  if (r == (uint32_t)-1) {
     NS_RUNTIMEABORT("Allocation or other failure in PR_vsxprintf");
+  }
   va_end(ap);
 }
 
-void nsTSubstring_CharT::AppendPrintf( const char* format, va_list ap )
+void
+nsTSubstring_CharT::AppendPrintf(const char* aFormat, va_list aAp)
 {
-  uint32_t r = PR_vsxprintf(AppendFunc, this, format, ap);
-  if (r == (uint32_t) -1)
+  uint32_t r = PR_vsxprintf(AppendFunc, this, aFormat, aAp);
+  if (r == (uint32_t)-1) {
     NS_RUNTIMEABORT("Allocation or other failure in PR_vsxprintf");
+  }
 }
 
 /* hack to make sure we define FormatWithoutTrailingZeros only once */
 #ifdef CharT_is_PRUnichar
-// Returns the length of the formatted aDouble in buf.
+// Returns the length of the formatted aDouble in aBuf.
 static int
-FormatWithoutTrailingZeros(char (& buf)[40], double aDouble,
-                           int precision)
+FormatWithoutTrailingZeros(char (&aBuf)[40], double aDouble,
+                           int aPrecision)
 {
   static const DoubleToStringConverter converter(DoubleToStringConverter::UNIQUE_ZERO |
                                                  DoubleToStringConverter::EMIT_POSITIVE_EXPONENT_SIGN,
@@ -860,23 +883,23 @@ FormatWithoutTrailingZeros(char (& buf)[40], double aDouble,
                                                  'e',
                                                  -6, 21,
                                                  6, 1);
-  double_conversion::StringBuilder builder(buf, sizeof(buf));
+  double_conversion::StringBuilder builder(aBuf, sizeof(aBuf));
   bool exponential_notation = false;
-  converter.ToPrecision(aDouble, precision, &exponential_notation, &builder);
+  converter.ToPrecision(aDouble, aPrecision, &exponential_notation, &builder);
   int length = builder.position();
   char* formattedDouble = builder.Finalize();
 
-  // If we have a shorter string than precision, it means we have a special
+  // If we have a shorter string than aPrecision, it means we have a special
   // value (NaN or Infinity).  All other numbers will be formatted with at
-  // least precision digits.
-  if (length <= precision) {
+  // least aPrecision digits.
+  if (length <= aPrecision) {
     return length;
   }
 
   char* end = formattedDouble + length;
-  char* decimalPoint = strchr(buf, '.');
+  char* decimalPoint = strchr(aBuf, '.');
   // No trailing zeros to remove.
-  if (decimalPoint == nullptr) {
+  if (!decimalPoint) {
     return length;
   }
 
@@ -884,13 +907,13 @@ FormatWithoutTrailingZeros(char (& buf)[40], double aDouble,
     // We need to check for cases like 1.00000e-10 (yes, this is
     // disgusting).
     char* exponent = end - 1;
-    for ( ; ; --exponent) {
+    for (; ; --exponent) {
       if (*exponent == 'e') {
         break;
       }
     }
     char* zerosBeforeExponent = exponent - 1;
-    for ( ; zerosBeforeExponent != decimalPoint; --zerosBeforeExponent) {
+    for (; zerosBeforeExponent != decimalPoint; --zerosBeforeExponent) {
       if (*zerosBeforeExponent != '0') {
         break;
       }
@@ -905,7 +928,7 @@ FormatWithoutTrailingZeros(char (& buf)[40], double aDouble,
     length -= exponent - (zerosBeforeExponent + 1);
   } else {
     char* trailingZeros = end - 1;
-    for ( ; trailingZeros != decimalPoint; --trailingZeros) {
+    for (; trailingZeros != decimalPoint; --trailingZeros) {
       if (*trailingZeros != '0') {
         break;
       }
@@ -921,7 +944,7 @@ FormatWithoutTrailingZeros(char (& buf)[40], double aDouble,
 #endif /* CharT_is_PRUnichar */
 
 void
-nsTSubstring_CharT::AppendFloat( float aFloat )
+nsTSubstring_CharT::AppendFloat(float aFloat)
 {
   char buf[40];
   int length = FormatWithoutTrailingZeros(buf, aFloat, 6);
@@ -929,7 +952,7 @@ nsTSubstring_CharT::AppendFloat( float aFloat )
 }
 
 void
-nsTSubstring_CharT::AppendFloat( double aFloat )
+nsTSubstring_CharT::AppendFloat(double aFloat)
 {
   char buf[40];
   int length = FormatWithoutTrailingZeros(buf, aFloat, 15);
@@ -938,14 +961,14 @@ nsTSubstring_CharT::AppendFloat( double aFloat )
 
 size_t
 nsTSubstring_CharT::SizeOfExcludingThisMustBeUnshared(
-    mozilla::MallocSizeOf mallocSizeOf) const
+    mozilla::MallocSizeOf aMallocSizeOf) const
 {
   if (mFlags & F_SHARED) {
     return nsStringBuffer::FromData(mData)->
-      SizeOfIncludingThisMustBeUnshared(mallocSizeOf);
+      SizeOfIncludingThisMustBeUnshared(aMallocSizeOf);
   }
   if (mFlags & F_OWNED) {
-    return mallocSizeOf(mData);
+    return aMallocSizeOf(mData);
   }
 
   // If we reach here, exactly one of the following must be true:
@@ -961,54 +984,55 @@ nsTSubstring_CharT::SizeOfExcludingThisMustBeUnshared(
 
 size_t
 nsTSubstring_CharT::SizeOfExcludingThisIfUnshared(
-    mozilla::MallocSizeOf mallocSizeOf) const
+    mozilla::MallocSizeOf aMallocSizeOf) const
 {
   // This is identical to SizeOfExcludingThisMustBeUnshared except for the
   // F_SHARED case.
   if (mFlags & F_SHARED) {
     return nsStringBuffer::FromData(mData)->
-           SizeOfIncludingThisIfUnshared(mallocSizeOf);
+           SizeOfIncludingThisIfUnshared(aMallocSizeOf);
   }
   if (mFlags & F_OWNED) {
-    return mallocSizeOf(mData);
+    return aMallocSizeOf(mData);
   }
   return 0;
 }
 
 size_t
 nsTSubstring_CharT::SizeOfExcludingThisEvenIfShared(
-    mozilla::MallocSizeOf mallocSizeOf) const
+    mozilla::MallocSizeOf aMallocSizeOf) const
 {
   // This is identical to SizeOfExcludingThisMustBeUnshared except for the
   // F_SHARED case.
   if (mFlags & F_SHARED) {
     return nsStringBuffer::FromData(mData)->
-      SizeOfIncludingThisEvenIfShared(mallocSizeOf);
+      SizeOfIncludingThisEvenIfShared(aMallocSizeOf);
   }
   if (mFlags & F_OWNED) {
-    return mallocSizeOf(mData);
+    return aMallocSizeOf(mData);
   }
   return 0;
 }
 
 size_t
 nsTSubstring_CharT::SizeOfIncludingThisMustBeUnshared(
-    mozilla::MallocSizeOf mallocSizeOf) const
+    mozilla::MallocSizeOf aMallocSizeOf) const
 {
-  return mallocSizeOf(this) + SizeOfExcludingThisMustBeUnshared(mallocSizeOf);
+  return aMallocSizeOf(this) +
+         SizeOfExcludingThisMustBeUnshared(aMallocSizeOf);
 }
 
 size_t
 nsTSubstring_CharT::SizeOfIncludingThisIfUnshared(
-    mozilla::MallocSizeOf mallocSizeOf) const
+    mozilla::MallocSizeOf aMallocSizeOf) const
 {
-  return mallocSizeOf(this) + SizeOfExcludingThisIfUnshared(mallocSizeOf);
+  return aMallocSizeOf(this) + SizeOfExcludingThisIfUnshared(aMallocSizeOf);
 }
 
 size_t
 nsTSubstring_CharT::SizeOfIncludingThisEvenIfShared(
-    mozilla::MallocSizeOf mallocSizeOf) const
+    mozilla::MallocSizeOf aMallocSizeOf) const
 {
-  return mallocSizeOf(this) + SizeOfExcludingThisEvenIfShared(mallocSizeOf);
+  return aMallocSizeOf(this) + SizeOfExcludingThisEvenIfShared(aMallocSizeOf);
 }
 
diff --git a/xpcom/string/src/nsTSubstringTuple.cpp b/xpcom/string/src/nsTSubstringTuple.cpp
index 40beee0fe789..7bdaf73dae73 100644
--- a/xpcom/string/src/nsTSubstringTuple.cpp
+++ b/xpcom/string/src/nsTSubstringTuple.cpp
@@ -13,63 +13,58 @@ nsTSubstringTuple_CharT::size_type
 nsTSubstringTuple_CharT::Length() const
 {
   uint32_t len;
-  if (mHead)
+  if (mHead) {
     len = mHead->Length();
-  else
+  } else {
     len = TO_SUBSTRING(mFragA).Length();
+  }
 
   return len + TO_SUBSTRING(mFragB).Length();
 }
 
 
 /**
- * writes the aggregate string to the given buffer.  bufLen is assumed
+ * writes the aggregate string to the given buffer. aBufLen is assumed
  * to be equal to or greater than the value returned by the Length()
- * method.  the string written to |buf| is not null-terminated.
+ * method.  the string written to |aBuf| is not null-terminated.
  */
 
 void
-nsTSubstringTuple_CharT::WriteTo( char_type *buf, uint32_t bufLen ) const
+nsTSubstringTuple_CharT::WriteTo(char_type* aBuf, uint32_t aBufLen) const
 {
   const substring_type& b = TO_SUBSTRING(mFragB);
 
-  NS_ASSERTION(bufLen >= b.Length(), "buffer too small");
-  uint32_t headLen = bufLen - b.Length();
-  if (mHead)
-  {
-    mHead->WriteTo(buf, headLen);
-  }
-  else
-  {
+  NS_ASSERTION(aBufLen >= b.Length(), "buffer too small");
+  uint32_t headLen = aBufLen - b.Length();
+  if (mHead) {
+    mHead->WriteTo(aBuf, headLen);
+  } else {
     const substring_type& a = TO_SUBSTRING(mFragA);
 
     NS_ASSERTION(a.Length() == headLen, "buffer incorrectly sized");
-    char_traits::copy(buf, a.Data(), a.Length());
+    char_traits::copy(aBuf, a.Data(), a.Length());
   }
 
-  char_traits::copy(buf + headLen, b.Data(), b.Length());
+  char_traits::copy(aBuf + headLen, b.Data(), b.Length());
 
 #if 0
-  // we need to write out data into |buf|, ending at |buf+bufLen|.  so our
-  // data needs to precede |buf+bufLen| exactly.  we trust that the buffer
+  // we need to write out data into |aBuf|, ending at |aBuf + aBufLen|. So our
+  // data needs to precede |aBuf + aBufLen| exactly. We trust that the buffer
   // was properly sized!
 
   const substring_type& b = TO_SUBSTRING(mFragB);
 
-  NS_ASSERTION(bufLen >= b.Length(), "buffer is too small");
-  char_traits::copy(buf + bufLen - b.Length(), b.Data(), b.Length());
+  NS_ASSERTION(aBufLen >= b.Length(), "buffer is too small");
+  char_traits::copy(aBuf + aBufLen - b.Length(), b.Data(), b.Length());
 
-  bufLen -= b.Length();
+  aBufLen -= b.Length();
 
-  if (mHead)
-  {
-    mHead->WriteTo(buf, bufLen);
-  }
-  else
-  {
+  if (mHead) {
+    mHead->WriteTo(aBuf, aBufLen);
+  } else {
     const substring_type& a = TO_SUBSTRING(mFragA);
-    NS_ASSERTION(bufLen == a.Length(), "buffer is too small");
-    char_traits::copy(buf, a.Data(), a.Length());
+    NS_ASSERTION(aBufLen == a.Length(), "buffer is too small");
+    char_traits::copy(aBuf, a.Data(), a.Length());
   }
 #endif
 }
@@ -81,15 +76,17 @@ nsTSubstringTuple_CharT::WriteTo( char_type *buf, uint32_t bufLen ) const
  */
 
 bool
-nsTSubstringTuple_CharT::IsDependentOn( const char_type *start, const char_type *end ) const
+nsTSubstringTuple_CharT::IsDependentOn(const char_type* start, const char_type* end) const
 {
   // we start with the right-most fragment since it is faster to check.
 
-  if (TO_SUBSTRING(mFragB).IsDependentOn(start, end))
+  if (TO_SUBSTRING(mFragB).IsDependentOn(start, end)) {
     return true;
+  }
 
-  if (mHead)
+  if (mHead) {
     return mHead->IsDependentOn(start, end);
+  }
 
   return TO_SUBSTRING(mFragA).IsDependentOn(start, end);
 }
diff --git a/xpcom/string/src/nsUTF8UtilsSSE2.cpp b/xpcom/string/src/nsUTF8UtilsSSE2.cpp
index e0b7313189e4..e37f49ba745b 100644
--- a/xpcom/string/src/nsUTF8UtilsSSE2.cpp
+++ b/xpcom/string/src/nsUTF8UtilsSSE2.cpp
@@ -17,7 +17,7 @@ LossyConvertEncoding16to8::write_sse2(const char16_t* aSource,
   uint32_t i = 0;
   uint32_t alignLen =
     XPCOM_MIN<uint32_t>(aSourceLength, uint32_t(-NS_PTR_TO_INT32(aSource) & 0xf) / sizeof(char16_t));
-  for (; i < alignLen; i++) {
+  for (; i < alignLen; ++i) {
     dest[i] = static_cast<unsigned char>(aSource[i]);
   }
 
@@ -51,7 +51,7 @@ LossyConvertEncoding16to8::write_sse2(const char16_t* aSource,
   }
 
   // Finish up the rest.
-  for (; i < aSourceLength; i++) {
+  for (; i < aSourceLength; ++i) {
     dest[i] = static_cast<unsigned char>(aSource[i]);
   }
 
@@ -62,7 +62,7 @@ void
 LossyConvertEncoding8to16::write_sse2(const char* aSource,
                                       uint32_t aSourceLength)
 {
-  char16_t *dest = mDestination;
+  char16_t* dest = mDestination;
 
   // Align source to a 16-byte boundary.  We choose to align source rather than
   // dest because we'd rather have our loads than our stores be fast. You have
@@ -70,7 +70,7 @@ LossyConvertEncoding8to16::write_sse2(const char* aSource,
   // store.
   uint32_t i = 0;
   uint32_t alignLen = XPCOM_MIN(aSourceLength, uint32_t(-NS_PTR_TO_INT32(aSource) & 0xf));
-  for (; i < alignLen; i++) {
+  for (; i < alignLen; ++i) {
     dest[i] = static_cast<unsigned char>(aSource[i]);
   }
 
@@ -93,7 +93,7 @@ LossyConvertEncoding8to16::write_sse2(const char* aSource,
   }
 
   // Finish up whatever's left.
-  for (; i < aSourceLength; i++) {
+  for (; i < aSourceLength; ++i) {
     dest[i] = static_cast<unsigned char>(aSource[i]);
   }
 
diff --git a/xpcom/threads/BackgroundHangMonitor.cpp b/xpcom/threads/BackgroundHangMonitor.cpp
index 404dcdfb43dd..f129456bcf17 100644
--- a/xpcom/threads/BackgroundHangMonitor.cpp
+++ b/xpcom/threads/BackgroundHangMonitor.cpp
@@ -38,7 +38,7 @@ private:
 
 #ifdef MOZ_NUWA_PROCESS
     if (IsNuwaProcess()) {
-      NS_ASSERTION(NuwaMarkCurrentThread != nullptr,
+      NS_ASSERTION(NuwaMarkCurrentThread,
                    "NuwaMarkCurrentThread is undefined!");
       NuwaMarkCurrentThread(nullptr, nullptr);
     }
@@ -117,9 +117,8 @@ public:
 
   static void Startup()
   {
-    /* We can tolerate init() failing.
-       The if block turns off warn_unused_result. */
-    if (!sTlsKey.init()) {}
+    /* We can tolerate init() failing. */
+    (void)!sTlsKey.init();
   }
 
   // Hang timeout in ticks
@@ -176,18 +175,14 @@ BackgroundHangManager::BackgroundHangManager()
     PR_USER_THREAD, MonitorThread, this,
     PR_PRIORITY_LOW, PR_GLOBAL_THREAD, PR_JOINABLE_THREAD, 0);
 
-  MOZ_ASSERT(mHangMonitorThread,
-    "Failed to create monitor thread");
+  MOZ_ASSERT(mHangMonitorThread, "Failed to create monitor thread");
 }
 
 BackgroundHangManager::~BackgroundHangManager()
 {
-  MOZ_ASSERT(mShutdown,
-    "Destruction without Shutdown call");
-  MOZ_ASSERT(mHangThreads.isEmpty(),
-    "Destruction with outstanding monitors");
-  MOZ_ASSERT(mHangMonitorThread,
-    "No monitor thread");
+  MOZ_ASSERT(mShutdown, "Destruction without Shutdown call");
+  MOZ_ASSERT(mHangThreads.isEmpty(), "Destruction with outstanding monitors");
+  MOZ_ASSERT(mHangMonitorThread, "No monitor thread");
 
   // PR_CreateThread could have failed above due to resource limitation
   if (mHangMonitorThread) {
diff --git a/xpcom/threads/HangMonitor.cpp b/xpcom/threads/HangMonitor.cpp
index 711b2ca8066e..6731c7151219 100644
--- a/xpcom/threads/HangMonitor.cpp
+++ b/xpcom/threads/HangMonitor.cpp
@@ -26,7 +26,8 @@
   #define REPORT_CHROME_HANGS
 #endif
 
-namespace mozilla { namespace HangMonitor {
+namespace mozilla {
+namespace HangMonitor {
 
 /**
  * A flag which may be set from within a debugger to disable the hang
@@ -112,21 +113,22 @@ Crash()
 
 #ifdef REPORT_CHROME_HANGS
 static void
-ChromeStackWalker(void *aPC, void *aSP, void *aClosure)
+ChromeStackWalker(void* aPC, void* aSP, void* aClosure)
 {
   MOZ_ASSERT(aClosure);
-  std::vector<uintptr_t> *stack =
+  std::vector<uintptr_t>* stack =
     static_cast<std::vector<uintptr_t>*>(aClosure);
-  if (stack->size() == MAX_CALL_STACK_PCS)
+  if (stack->size() == MAX_CALL_STACK_PCS) {
     return;
+  }
   MOZ_ASSERT(stack->size() < MAX_CALL_STACK_PCS);
   stack->push_back(reinterpret_cast<uintptr_t>(aPC));
 }
 
 static void
-GetChromeHangReport(Telemetry::ProcessedStack &aStack,
-                    int32_t &aSystemUptime,
-                    int32_t &aFirefoxUptime)
+GetChromeHangReport(Telemetry::ProcessedStack& aStack,
+                    int32_t& aSystemUptime,
+                    int32_t& aFirefoxUptime)
 {
   MOZ_ASSERT(winMainThreadHandle);
 
@@ -135,14 +137,16 @@ GetChromeHangReport(Telemetry::ProcessedStack &aStack,
   std::vector<uintptr_t> rawStack;
   rawStack.reserve(MAX_CALL_STACK_PCS);
   DWORD ret = ::SuspendThread(winMainThreadHandle);
-  if (ret == -1)
+  if (ret == -1) {
     return;
+  }
   NS_StackWalk(ChromeStackWalker, /* skipFrames */ 0, /* maxFrames */ 0,
                reinterpret_cast<void*>(&rawStack),
                reinterpret_cast<uintptr_t>(winMainThreadHandle), nullptr);
   ret = ::ResumeThread(winMainThreadHandle);
-  if (ret == -1)
+  if (ret == -1) {
     return;
+  }
   aStack = Telemetry::GetStackAndModules(rawStack);
 
   // Record system uptime (in minutes) at the time of the hang
@@ -217,8 +221,7 @@ ThreadMain(void*)
         }
       }
 #endif
-    }
-    else {
+    } else {
 #ifdef REPORT_CHROME_HANGS
       if (waitCount >= 2) {
         uint32_t hangDuration = PR_IntervalToSeconds(now - lastTimestamp);
@@ -234,8 +237,7 @@ ThreadMain(void*)
     PRIntervalTime timeout;
     if (gTimeout <= 0) {
       timeout = PR_INTERVAL_NO_TIMEOUT;
-    }
-    else {
+    } else {
       timeout = PR_MillisecondsToInterval(gTimeout * 500);
     }
     lock.Wait(timeout);
@@ -248,8 +250,9 @@ Startup()
   // The hang detector only runs in chrome processes. If you change this,
   // you must also deal with the threadsafety of AnnotateCrashReport in
   // non-chrome processes!
-  if (GeckoProcessType_Default != XRE_GetProcessType())
+  if (GeckoProcessType_Default != XRE_GetProcessType()) {
     return;
+  }
 
   MOZ_ASSERT(!gMonitor, "Hang monitor already initialized");
   gMonitor = new Monitor("HangMonitor");
@@ -261,8 +264,9 @@ Startup()
   Preferences::RegisterCallback(PrefChanged, kTelemetryPrefName, nullptr);
   winMainThreadHandle =
     OpenThread(THREAD_ALL_ACCESS, FALSE, GetCurrentThreadId());
-  if (!winMainThreadHandle)
+  if (!winMainThreadHandle) {
     return;
+  }
 #endif
 
   // Don't actually start measuring hangs until we hit the main event loop.
@@ -280,12 +284,14 @@ Startup()
 void
 Shutdown()
 {
-  if (GeckoProcessType_Default != XRE_GetProcessType())
+  if (GeckoProcessType_Default != XRE_GetProcessType()) {
     return;
+  }
 
   MOZ_ASSERT(gMonitor, "Hang monitor not started");
 
-  { // Scope the lock we're going to delete later
+  {
+    // Scope the lock we're going to delete later
     MonitorAutoLock lock(*gMonitor);
     gShutdown = true;
     lock.Notify();
@@ -307,11 +313,11 @@ IsUIMessageWaiting()
 #ifndef XP_WIN
   return false;
 #else
-  #define NS_WM_IMEFIRST WM_IME_SETCONTEXT
-  #define NS_WM_IMELAST  WM_IME_KEYUP
+#define NS_WM_IMEFIRST WM_IME_SETCONTEXT
+#define NS_WM_IMELAST  WM_IME_KEYUP
   BOOL haveUIMessageWaiting = FALSE;
   MSG msg;
-  haveUIMessageWaiting |= ::PeekMessageW(&msg, nullptr, WM_KEYFIRST, 
+  haveUIMessageWaiting |= ::PeekMessageW(&msg, nullptr, WM_KEYFIRST,
                                          WM_IME_KEYLAST, PM_NOREMOVE);
   haveUIMessageWaiting |= ::PeekMessageW(&msg, nullptr, NS_WM_IMEFIRST,
                                          NS_WM_IMELAST, PM_NOREMOVE);
@@ -322,32 +328,32 @@ IsUIMessageWaiting()
 }
 
 void
-NotifyActivity(ActivityType activityType)
+NotifyActivity(ActivityType aActivityType)
 {
   MOZ_ASSERT(NS_IsMainThread(),
              "HangMonitor::Notify called from off the main thread.");
 
   // Determine the activity type more specifically
-  if (activityType == kGeneralActivity) {
-    activityType = IsUIMessageWaiting() ? kActivityUIAVail : 
-                                          kActivityNoUIAVail;
+  if (aActivityType == kGeneralActivity) {
+    aActivityType = IsUIMessageWaiting() ? kActivityUIAVail :
+                                           kActivityNoUIAVail;
   }
 
   // Calculate the cumulative amount of lag time since the last UI message
   static uint32_t cumulativeUILagMS = 0;
-  switch(activityType) {
-  case kActivityNoUIAVail:
-    cumulativeUILagMS = 0;
-    break;
-  case kActivityUIAVail:
-  case kUIActivity:
-    if (gTimestamp != PR_INTERVAL_NO_WAIT) {
-      cumulativeUILagMS += PR_IntervalToMilliseconds(PR_IntervalNow() -
-                                                     gTimestamp);
-    }
-    break;
-  default:
-    break;
+  switch (aActivityType) {
+    case kActivityNoUIAVail:
+      cumulativeUILagMS = 0;
+      break;
+    case kActivityUIAVail:
+    case kUIActivity:
+      if (gTimestamp != PR_INTERVAL_NO_WAIT) {
+        cumulativeUILagMS += PR_IntervalToMilliseconds(PR_IntervalNow() -
+                                                       gTimestamp);
+      }
+      break;
+    default:
+      break;
   }
 
   // This is not a locked activity because PRTimeStamp is a 32-bit quantity
@@ -357,7 +363,7 @@ NotifyActivity(ActivityType activityType)
 
   // If we have UI activity we should reset the timer and report it if it is
   // significant enough.
-  if (activityType == kUIActivity) {
+  if (aActivityType == kUIActivity) {
     // The minimum amount of lag time that we should report for telemetry data.
     // Mozilla's UI responsiveness goal is 50ms
     static const uint32_t kUIResponsivenessThresholdMS = 50;
@@ -387,4 +393,5 @@ Suspend()
   }
 }
 
-} } // namespace mozilla::HangMonitor
+} // namespace HangMonitor
+} // namespace mozilla
diff --git a/xpcom/threads/HangMonitor.h b/xpcom/threads/HangMonitor.h
index 65cbb07589ff..803290cf2e7b 100644
--- a/xpcom/threads/HangMonitor.h
+++ b/xpcom/threads/HangMonitor.h
@@ -1,4 +1,5 @@
 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
@@ -6,12 +7,14 @@
 #ifndef mozilla_HangMonitor_h
 #define mozilla_HangMonitor_h
 
-namespace mozilla { namespace HangMonitor {
+namespace mozilla {
+namespace HangMonitor {
 
 /**
  * Signifies the type of activity in question
 */
-enum ActivityType {
+enum ActivityType
+{
   /* There is activity and it is known to be UI related activity. */
   kUIActivity,
 
@@ -49,6 +52,7 @@ void NotifyActivity(ActivityType activityType = kGeneralActivity);
  */
 void Suspend();
 
-} } // namespace mozilla::HangMonitor
+} // namespace HangMonitor
+} // namespace mozilla
 
 #endif // mozilla_HangMonitor_h
diff --git a/xpcom/threads/LazyIdleThread.cpp b/xpcom/threads/LazyIdleThread.cpp
index a3c668f8cefb..6098d259a352 100644
--- a/xpcom/threads/LazyIdleThread.cpp
+++ b/xpcom/threads/LazyIdleThread.cpp
@@ -34,18 +34,18 @@ LazyIdleThread::LazyIdleThread(uint32_t aIdleTimeoutMS,
                                const nsCSubstring& aName,
                                ShutdownMethod aShutdownMethod,
                                nsIObserver* aIdleObserver)
-: mMutex("LazyIdleThread::mMutex"),
-  mOwningThread(NS_GetCurrentThread()),
-  mIdleObserver(aIdleObserver),
-  mQueuedRunnables(nullptr),
-  mIdleTimeoutMS(aIdleTimeoutMS),
-  mPendingEventCount(0),
-  mIdleNotificationCount(0),
-  mShutdownMethod(aShutdownMethod),
-  mShutdown(false),
-  mThreadIsShuttingDown(false),
-  mIdleTimeoutEnabled(true),
-  mName(aName)
+  : mMutex("LazyIdleThread::mMutex")
+  , mOwningThread(NS_GetCurrentThread())
+  , mIdleObserver(aIdleObserver)
+  , mQueuedRunnables(nullptr)
+  , mIdleTimeoutMS(aIdleTimeoutMS)
+  , mPendingEventCount(0)
+  , mIdleNotificationCount(0)
+  , mShutdownMethod(aShutdownMethod)
+  , mShutdown(false)
+  , mThreadIsShuttingDown(false)
+  , mIdleTimeoutEnabled(true)
+  , mName(aName)
 {
   MOZ_ASSERT(mOwningThread, "Need owning thread!");
 }
@@ -147,26 +147,31 @@ LazyIdleThread::EnsureThread()
   if (mShutdownMethod == AutomaticShutdown && NS_IsMainThread()) {
     nsCOMPtr<nsIObserverService> obs =
       do_GetService(NS_OBSERVERSERVICE_CONTRACTID, &rv);
-    if (NS_WARN_IF(NS_FAILED(rv)))
+    if (NS_WARN_IF(NS_FAILED(rv))) {
       return rv;
+    }
 
     rv = obs->AddObserver(this, "xpcom-shutdown-threads", false);
-    if (NS_WARN_IF(NS_FAILED(rv)))
+    if (NS_WARN_IF(NS_FAILED(rv))) {
       return rv;
+    }
   }
 
   mIdleTimer = do_CreateInstance(NS_TIMER_CONTRACTID, &rv);
-  if (NS_WARN_IF(!mIdleTimer))
+  if (NS_WARN_IF(!mIdleTimer)) {
     return NS_ERROR_UNEXPECTED;
+  }
 
   nsCOMPtr<nsIRunnable> runnable =
     NS_NewRunnableMethod(this, &LazyIdleThread::InitThread);
-  if (NS_WARN_IF(!runnable))
+  if (NS_WARN_IF(!runnable)) {
     return NS_ERROR_UNEXPECTED;
+  }
 
   rv = NS_NewThread(getter_AddRefs(mThread), runnable);
-  if (NS_WARN_IF(NS_FAILED(rv)))
+  if (NS_WARN_IF(NS_FAILED(rv))) {
     return rv;
+  }
 
   return NS_OK;
 }
@@ -273,14 +278,16 @@ LazyIdleThread::ShutdownThread()
 
     nsCOMPtr<nsIRunnable> runnable =
       NS_NewRunnableMethod(this, &LazyIdleThread::CleanupThread);
-    if (NS_WARN_IF(!runnable))
+    if (NS_WARN_IF(!runnable)) {
       return NS_ERROR_UNEXPECTED;
+    }
 
     PreDispatch();
 
     rv = mThread->Dispatch(runnable, NS_DISPATCH_NORMAL);
-    if (NS_WARN_IF(NS_FAILED(rv)))
+    if (NS_WARN_IF(NS_FAILED(rv))) {
       return rv;
+    }
 
     // Put the temporary queue in place before calling Shutdown().
     mQueuedRunnables = &queuedRunnables;
@@ -306,8 +313,9 @@ LazyIdleThread::ShutdownThread()
 
   if (mIdleTimer) {
     rv = mIdleTimer->Cancel();
-    if (NS_WARN_IF(NS_FAILED(rv)))
+    if (NS_WARN_IF(NS_FAILED(rv))) {
       return rv;
+    }
 
     mIdleTimer = nullptr;
   }
@@ -384,8 +392,9 @@ LazyIdleThread::Dispatch(nsIRunnable* aEvent,
   ASSERT_OWNING_THREAD();
 
   // LazyIdleThread can't always support synchronous dispatch currently.
-  if (NS_WARN_IF(aFlags != NS_DISPATCH_NORMAL))
+  if (NS_WARN_IF(aFlags != NS_DISPATCH_NORMAL)) {
     return NS_ERROR_NOT_IMPLEMENTED;
+  }
 
   // If our thread is shutting down then we can't actually dispatch right now.
   // Queue this runnable for later.
@@ -395,8 +404,9 @@ LazyIdleThread::Dispatch(nsIRunnable* aEvent,
   }
 
   nsresult rv = EnsureThread();
-  if (NS_WARN_IF(NS_FAILED(rv)))
+  if (NS_WARN_IF(NS_FAILED(rv))) {
     return rv;
+  }
 
   PreDispatch();
 
@@ -437,8 +447,9 @@ LazyIdleThread::Shutdown()
 
   mIdleObserver = nullptr;
 
-  if (NS_WARN_IF(NS_FAILED(rv)))
+  if (NS_WARN_IF(NS_FAILED(rv))) {
     return rv;
+  }
 
   return NS_OK;
 }
@@ -478,8 +489,9 @@ LazyIdleThread::Notify(nsITimer* aTimer)
   }
 
   nsresult rv = ShutdownThread();
-  if (NS_WARN_IF(NS_FAILED(rv)))
+  if (NS_WARN_IF(NS_FAILED(rv))) {
     return rv;
+  }
 
   return NS_OK;
 }
@@ -528,12 +540,14 @@ LazyIdleThread::AfterProcessNextEvent(nsIThreadInternal* /* aThread */,
   if (shouldNotifyIdle) {
     nsCOMPtr<nsIRunnable> runnable =
       NS_NewRunnableMethod(this, &LazyIdleThread::ScheduleTimer);
-    if (NS_WARN_IF(!runnable))
+    if (NS_WARN_IF(!runnable)) {
       return NS_ERROR_UNEXPECTED;
+    }
 
     nsresult rv = mOwningThread->Dispatch(runnable, NS_DISPATCH_NORMAL);
-    if (NS_WARN_IF(NS_FAILED(rv)))
+    if (NS_WARN_IF(NS_FAILED(rv))) {
       return rv;
+    }
   }
 
   return NS_OK;
diff --git a/xpcom/threads/LazyIdleThread.h b/xpcom/threads/LazyIdleThread.h
index 276a50a8955a..0eabf720bed3 100644
--- a/xpcom/threads/LazyIdleThread.h
+++ b/xpcom/threads/LazyIdleThread.h
@@ -32,10 +32,11 @@ namespace mozilla {
  * is created on the main thread then it will automatically join its thread on
  * XPCOM shutdown using the Observer Service.
  */
-class LazyIdleThread MOZ_FINAL : public nsIThread,
-                                 public nsITimerCallback,
-                                 public nsIThreadObserver,
-                                 public nsIObserver
+class LazyIdleThread MOZ_FINAL
+  : public nsIThread
+  , public nsITimerCallback
+  , public nsIThreadObserver
+  , public nsIObserver
 {
 public:
   NS_DECL_THREADSAFE_ISUPPORTS
@@ -45,7 +46,8 @@ public:
   NS_DECL_NSITHREADOBSERVER
   NS_DECL_NSIOBSERVER
 
-  enum ShutdownMethod {
+  enum ShutdownMethod
+  {
     AutomaticShutdown = 0,
     ManualShutdown
   };
@@ -128,7 +130,8 @@ private:
    * Returns true if events should be queued rather than immediately dispatched
    * to mThread. Currently only happens when the thread is shutting down.
    */
-  bool UseRunnableQueue() {
+  bool UseRunnableQueue()
+  {
     return !!mQueuedRunnables;
   }
 
@@ -165,7 +168,7 @@ private:
    * Temporary storage for events that happen to be dispatched while we're in
    * the process of shutting down our real thread.
    */
-  nsTArray<nsCOMPtr<nsIRunnable> >* mQueuedRunnables;
+  nsTArray<nsCOMPtr<nsIRunnable>>* mQueuedRunnables;
 
   /**
    * The number of milliseconds a thread should be idle before dying.
diff --git a/xpcom/threads/SyncRunnable.h b/xpcom/threads/SyncRunnable.h
index 35f01c377480..3fbde8068951 100644
--- a/xpcom/threads/SyncRunnable.h
+++ b/xpcom/threads/SyncRunnable.h
@@ -30,20 +30,20 @@ namespace mozilla {
 class SyncRunnable : public nsRunnable
 {
 public:
-  SyncRunnable(nsIRunnable* r)
-    : mRunnable(r)
+  SyncRunnable(nsIRunnable* aRunnable)
+    : mRunnable(aRunnable)
     , mMonitor("SyncRunnable")
     , mDone(false)
-  { }
+  {
+  }
 
-  void DispatchToThread(nsIEventTarget* thread,
-                        bool forceDispatch = false)
+  void DispatchToThread(nsIEventTarget* aThread, bool aForceDispatch = false)
   {
     nsresult rv;
     bool on;
 
-    if (!forceDispatch) {
-      rv = thread->IsOnCurrentThread(&on);
+    if (!aForceDispatch) {
+      rv = aThread->IsOnCurrentThread(&on);
       MOZ_ASSERT(NS_SUCCEEDED(rv));
       if (NS_SUCCEEDED(rv) && on) {
         mRunnable->Run();
@@ -51,7 +51,7 @@ public:
       }
     }
 
-    rv = thread->Dispatch(this, NS_DISPATCH_NORMAL);
+    rv = aThread->Dispatch(this, NS_DISPATCH_NORMAL);
     if (NS_SUCCEEDED(rv)) {
       mozilla::MonitorAutoLock lock(mMonitor);
       while (!mDone) {
@@ -60,12 +60,12 @@ public:
     }
   }
 
-  static void DispatchToThread(nsIEventTarget* thread,
-                               nsIRunnable* r,
-                               bool forceDispatch = false)
+  static void DispatchToThread(nsIEventTarget* aThread,
+                               nsIRunnable* aRunnable,
+                               bool aForceDispatch = false)
   {
-    nsRefPtr<SyncRunnable> s(new SyncRunnable(r));
-    s->DispatchToThread(thread, forceDispatch);
+    nsRefPtr<SyncRunnable> s(new SyncRunnable(aRunnable));
+    s->DispatchToThread(aThread, aForceDispatch);
   }
 
 protected:
diff --git a/xpcom/threads/ThreadStackHelper.cpp b/xpcom/threads/ThreadStackHelper.cpp
index 75f0e8b07e11..acdedafc4968 100644
--- a/xpcom/threads/ThreadStackHelper.cpp
+++ b/xpcom/threads/ThreadStackHelper.cpp
@@ -184,7 +184,8 @@ ThreadStackHelper::SigAction(int aSignal, siginfo_t* aInfo, void* aContext)
 #endif // XP_LINUX
 
 bool
-ThreadStackHelper::PrepareStackBuffer(Stack& aStack) {
+ThreadStackHelper::PrepareStackBuffer(Stack& aStack)
+{
   // Return false to skip getting the stack and return an empty stack
   aStack.clear();
 #ifdef MOZ_ENABLE_PROFILER_SPS
@@ -208,7 +209,8 @@ ThreadStackHelper::PrepareStackBuffer(Stack& aStack) {
 }
 
 void
-ThreadStackHelper::FillStackBuffer() {
+ThreadStackHelper::FillStackBuffer()
+{
 #ifdef MOZ_ENABLE_PROFILER_SPS
   size_t reservedSize = mMaxStackSize;
 
diff --git a/xpcom/threads/TimerThread.cpp b/xpcom/threads/TimerThread.cpp
index 1c21016aaee7..1e17eba21198 100644
--- a/xpcom/threads/TimerThread.cpp
+++ b/xpcom/threads/TimerThread.cpp
@@ -50,9 +50,10 @@ namespace {
 class TimerObserverRunnable : public nsRunnable
 {
 public:
-  TimerObserverRunnable(nsIObserver* observer)
-    : mObserver(observer)
-  { }
+  TimerObserverRunnable(nsIObserver* aObserver)
+    : mObserver(aObserver)
+  {
+  }
 
   NS_DECL_NSIRUNNABLE
 
@@ -76,13 +77,16 @@ TimerObserverRunnable::Run()
 
 } // anonymous namespace
 
-nsresult TimerThread::Init()
+nsresult
+TimerThread::Init()
 {
-  PR_LOG(GetTimerLog(), PR_LOG_DEBUG, ("TimerThread::Init [%d]\n", mInitialized));
+  PR_LOG(GetTimerLog(), PR_LOG_DEBUG,
+         ("TimerThread::Init [%d]\n", mInitialized));
 
   if (mInitialized) {
-    if (!mThread)
+    if (!mThread) {
       return NS_ERROR_FAILURE;
+    }
 
     return NS_OK;
   }
@@ -92,13 +96,11 @@ nsresult TimerThread::Init()
     nsresult rv = NS_NewThread(getter_AddRefs(mThread), this);
     if (NS_FAILED(rv)) {
       mThread = nullptr;
-    }
-    else {
+    } else {
       nsRefPtr<TimerObserverRunnable> r = new TimerObserverRunnable(this);
       if (NS_IsMainThread()) {
         r->Run();
-      }
-      else {
+      } else {
         NS_DispatchToMainThread(r);
       }
     }
@@ -108,29 +110,32 @@ nsresult TimerThread::Init()
       mInitialized = true;
       mMonitor.NotifyAll();
     }
-  }
-  else {
+  } else {
     MonitorAutoLock lock(mMonitor);
     while (!mInitialized) {
       mMonitor.Wait();
     }
   }
 
-  if (!mThread)
+  if (!mThread) {
     return NS_ERROR_FAILURE;
+  }
 
   return NS_OK;
 }
 
-nsresult TimerThread::Shutdown()
+nsresult
+TimerThread::Shutdown()
 {
   PR_LOG(GetTimerLog(), PR_LOG_DEBUG, ("TimerThread::Shutdown begin\n"));
 
-  if (!mThread)
+  if (!mThread) {
     return NS_ERROR_NOT_INITIALIZED;
+  }
 
   nsTArray<nsTimerImpl*> timers;
-  {   // lock scope
+  {
+    // lock scope
     MonitorAutoLock lock(mMonitor);
 
     mShutdown = true;
@@ -153,7 +158,7 @@ nsresult TimerThread::Shutdown()
 
   uint32_t timersCount = timers.Length();
   for (uint32_t i = 0; i < timersCount; i++) {
-    nsTimerImpl *timer = timers[i];
+    nsTimerImpl* timer = timers[i];
     timer->ReleaseCallback();
     ReleaseTimerInternal(timer);
   }
@@ -169,13 +174,14 @@ nsresult TimerThread::Shutdown()
 #endif
 
 /* void Run(); */
-NS_IMETHODIMP TimerThread::Run()
+NS_IMETHODIMP
+TimerThread::Run()
 {
   PR_SetCurrentThreadName("Timer");
 
 #ifdef MOZ_NUWA_PROCESS
   if (IsNuwaProcess()) {
-    NS_ASSERTION(NuwaMarkCurrentThread != nullptr,
+    NS_ASSERTION(NuwaMarkCurrentThread,
                  "NuwaMarkCurrentThread is undefined!");
     NuwaMarkCurrentThread(nullptr, nullptr);
   }
@@ -187,18 +193,20 @@ NS_IMETHODIMP TimerThread::Run()
   // is platform-dependent, we calculate it at runtime now.
   // First we find a value such that PR_MicrosecondsToInterval(high) = 1
   int32_t low = 0, high = 1;
-  while (PR_MicrosecondsToInterval(high) == 0)
+  while (PR_MicrosecondsToInterval(high) == 0) {
     high <<= 1;
+  }
   // We now have
   //    PR_MicrosecondsToInterval(low)  = 0
   //    PR_MicrosecondsToInterval(high) = 1
   // and we can proceed to find the critical value using binary search
-  while (high-low > 1) {
-    int32_t mid = (high+low) >> 1;
-    if (PR_MicrosecondsToInterval(mid) == 0)
+  while (high - low > 1) {
+    int32_t mid = (high + low) >> 1;
+    if (PR_MicrosecondsToInterval(mid) == 0) {
       low = mid;
-    else
+    } else {
       high = mid;
+    }
   }
 
   // Half of the amount of microseconds needed to get positive PRIntervalTime.
@@ -222,7 +230,7 @@ NS_IMETHODIMP TimerThread::Run()
     } else {
       waitFor = PR_INTERVAL_NO_TIMEOUT;
       TimeStamp now = TimeStamp::Now();
-      nsTimerImpl *timer = nullptr;
+      nsTimerImpl* timer = nullptr;
 
       if (!mTimers.IsEmpty()) {
         timer = mTimers[0];
@@ -273,8 +281,9 @@ NS_IMETHODIMP TimerThread::Run()
             timer = nullptr;
           }
 
-          if (mShutdown)
+          if (mShutdown) {
             break;
+          }
 
           // Update now, as PostTimerEvent plus the locking may have taken a
           // tick or two, and we may goto next below.
@@ -294,7 +303,7 @@ NS_IMETHODIMP TimerThread::Run()
         // resolution. We use halfMicrosecondsIntervalResolution, calculated
         // before, to do the optimal rounding (i.e., of how to decide what
         // interval is so small we should not wait at all).
-        double microseconds = (timeout - now).ToMilliseconds()*1000;
+        double microseconds = (timeout - now).ToMilliseconds() * 1000;
 
         if (ChaosMode::isActive()) {
           // The mean value of sFractions must be 1 to ensure that
@@ -303,7 +312,8 @@ NS_IMETHODIMP TimerThread::Run()
           static const float sFractions[] = {
             0.0f, 0.25f, 0.5f, 0.75f, 1.0f, 1.75f, 2.75f
           };
-          microseconds *= sFractions[ChaosMode::randomUint32LessThan(ArrayLength(sFractions))];
+          microseconds *=
+            sFractions[ChaosMode::randomUint32LessThan(ArrayLength(sFractions))];
           forceRunNextTimer = true;
         }
 
@@ -311,9 +321,11 @@ NS_IMETHODIMP TimerThread::Run()
           forceRunNextTimer = false;
           goto next; // round down; execute event now
         }
-        waitFor = PR_MicrosecondsToInterval(static_cast<uint32_t>(microseconds)); // Floor is accurate enough.
-        if (waitFor == 0)
-          waitFor = 1; // round up, wait the minimum time we can wait
+        waitFor = PR_MicrosecondsToInterval(
+          static_cast<uint32_t>(microseconds)); // Floor is accurate enough.
+        if (waitFor == 0) {
+          waitFor = 1;  // round up, wait the minimum time we can wait
+        }
       }
 
 #ifdef DEBUG_TIMERS
@@ -340,14 +352,16 @@ NS_IMETHODIMP TimerThread::Run()
   return NS_OK;
 }
 
-nsresult TimerThread::AddTimer(nsTimerImpl *aTimer)
+nsresult
+TimerThread::AddTimer(nsTimerImpl* aTimer)
 {
   MonitorAutoLock lock(mMonitor);
 
   // Add the timer to our list.
   int32_t i = AddTimerInternal(aTimer);
-  if (i < 0)
+  if (i < 0) {
     return NS_ERROR_OUT_OF_MEMORY;
+  }
 
   // Awaken the timer thread.
   if (mWaiting && i == 0) {
@@ -358,7 +372,8 @@ nsresult TimerThread::AddTimer(nsTimerImpl *aTimer)
   return NS_OK;
 }
 
-nsresult TimerThread::TimerDelayChanged(nsTimerImpl *aTimer)
+nsresult
+TimerThread::TimerDelayChanged(nsTimerImpl* aTimer)
 {
   MonitorAutoLock lock(mMonitor);
 
@@ -367,8 +382,9 @@ nsresult TimerThread::TimerDelayChanged(nsTimerImpl *aTimer)
   RemoveTimerInternal(aTimer);
 
   int32_t i = AddTimerInternal(aTimer);
-  if (i < 0)
+  if (i < 0) {
     return NS_ERROR_OUT_OF_MEMORY;
+  }
 
   // Awaken the timer thread.
   if (mWaiting && i == 0) {
@@ -379,7 +395,8 @@ nsresult TimerThread::TimerDelayChanged(nsTimerImpl *aTimer)
   return NS_OK;
 }
 
-nsresult TimerThread::RemoveTimer(nsTimerImpl *aTimer)
+nsresult
+TimerThread::RemoveTimer(nsTimerImpl* aTimer)
 {
   MonitorAutoLock lock(mMonitor);
 
@@ -390,8 +407,9 @@ nsresult TimerThread::RemoveTimer(nsTimerImpl *aTimer)
   // TimerThread::Run, must wait for the mMonitor auto-lock here, and during the
   // wait Run drops the only remaining ref to aTimer via RemoveTimerInternal.
 
-  if (!RemoveTimerInternal(aTimer))
+  if (!RemoveTimerInternal(aTimer)) {
     return NS_ERROR_NOT_AVAILABLE;
+  }
 
   // Awaken the timer thread.
   if (mWaiting) {
@@ -403,18 +421,21 @@ nsresult TimerThread::RemoveTimer(nsTimerImpl *aTimer)
 }
 
 // This function must be called from within a lock
-int32_t TimerThread::AddTimerInternal(nsTimerImpl *aTimer)
+int32_t
+TimerThread::AddTimerInternal(nsTimerImpl* aTimer)
 {
-  if (mShutdown)
+  if (mShutdown) {
     return -1;
+  }
 
   TimeStamp now = TimeStamp::Now();
 
   TimerAdditionComparator c(now, aTimer);
   nsTimerImpl** insertSlot = mTimers.InsertElementSorted(aTimer, c);
 
-  if (!insertSlot)
+  if (!insertSlot) {
     return -1;
+  }
 
   aTimer->mArmed = true;
   NS_ADDREF(aTimer);
@@ -426,32 +447,37 @@ int32_t TimerThread::AddTimerInternal(nsTimerImpl *aTimer)
   return insertSlot - mTimers.Elements();
 }
 
-bool TimerThread::RemoveTimerInternal(nsTimerImpl *aTimer)
+bool
+TimerThread::RemoveTimerInternal(nsTimerImpl* aTimer)
 {
-  if (!mTimers.RemoveElement(aTimer))
+  if (!mTimers.RemoveElement(aTimer)) {
     return false;
+  }
 
   ReleaseTimerInternal(aTimer);
   return true;
 }
 
-void TimerThread::ReleaseTimerInternal(nsTimerImpl *aTimer)
+void
+TimerThread::ReleaseTimerInternal(nsTimerImpl* aTimer)
 {
   // Order is crucial here -- see nsTimerImpl::Release.
   aTimer->mArmed = false;
   NS_RELEASE(aTimer);
 }
 
-void TimerThread::DoBeforeSleep()
+void
+TimerThread::DoBeforeSleep()
 {
   mSleeping = true;
 }
 
-void TimerThread::DoAfterSleep()
+void
+TimerThread::DoAfterSleep()
 {
   mSleeping = true; // wake may be notified without preceding sleep notification
   for (uint32_t i = 0; i < mTimers.Length(); i ++) {
-    nsTimerImpl *timer = mTimers[i];
+    nsTimerImpl* timer = mTimers[i];
     // get and set the delay to cause its timeout to be recomputed
     uint32_t delay;
     timer->GetDelay(&delay);
@@ -464,14 +490,16 @@ void TimerThread::DoAfterSleep()
 
 /* void observe (in nsISupports aSubject, in string aTopic, in wstring aData); */
 NS_IMETHODIMP
-TimerThread::Observe(nsISupports* /* aSubject */, const char *aTopic, const char16_t* /* aData */)
+TimerThread::Observe(nsISupports* /* aSubject */, const char* aTopic,
+                     const char16_t* /* aData */)
 {
   if (strcmp(aTopic, "sleep_notification") == 0 ||
-      strcmp(aTopic, "suspend_process_notification") == 0)
+      strcmp(aTopic, "suspend_process_notification") == 0) {
     DoBeforeSleep();
-  else if (strcmp(aTopic, "wake_notification") == 0 ||
-           strcmp(aTopic, "resume_process_notification") == 0)
+  } else if (strcmp(aTopic, "wake_notification") == 0 ||
+             strcmp(aTopic, "resume_process_notification") == 0) {
     DoAfterSleep();
+  }
 
   return NS_OK;
 }
diff --git a/xpcom/threads/TimerThread.h b/xpcom/threads/TimerThread.h
index eaa005f71948..343783c7f0b7 100644
--- a/xpcom/threads/TimerThread.h
+++ b/xpcom/threads/TimerThread.h
@@ -23,8 +23,9 @@ namespace mozilla {
 class TimeStamp;
 }
 
-class TimerThread MOZ_FINAL : public nsIRunnable,
-                              public nsIObserver
+class TimerThread MOZ_FINAL
+  : public nsIRunnable
+  , public nsIObserver
 {
 public:
   typedef mozilla::Monitor Monitor;
@@ -41,9 +42,9 @@ public:
   NS_HIDDEN_(nsresult) Init();
   NS_HIDDEN_(nsresult) Shutdown();
 
-  nsresult AddTimer(nsTimerImpl *aTimer);
-  nsresult TimerDelayChanged(nsTimerImpl *aTimer);
-  nsresult RemoveTimer(nsTimerImpl *aTimer);
+  nsresult AddTimer(nsTimerImpl* aTimer);
+  nsresult TimerDelayChanged(nsTimerImpl* aTimer);
+  nsresult RemoveTimer(nsTimerImpl* aTimer);
 
   void DoBeforeSleep();
   void DoAfterSleep();
@@ -62,9 +63,9 @@ private:
   // These two internal helper methods must be called while mLock is held.
   // AddTimerInternal returns the position where the timer was added in the
   // list, or -1 if it failed.
-  int32_t AddTimerInternal(nsTimerImpl *aTimer);
-  bool    RemoveTimerInternal(nsTimerImpl *aTimer);
-  void    ReleaseTimerInternal(nsTimerImpl *aTimer);
+  int32_t AddTimerInternal(nsTimerImpl* aTimer);
+  bool    RemoveTimerInternal(nsTimerImpl* aTimer);
+  void    ReleaseTimerInternal(nsTimerImpl* aTimer);
 
   nsCOMPtr<nsIThread> mThread;
   Monitor mMonitor;
@@ -77,31 +78,35 @@ private:
   nsTArray<nsTimerImpl*> mTimers;
 };
 
-struct TimerAdditionComparator {
-  TimerAdditionComparator(const mozilla::TimeStamp &aNow,
-                          nsTimerImpl *aTimerToInsert) :
+struct TimerAdditionComparator
+{
+  TimerAdditionComparator(const mozilla::TimeStamp& aNow,
+                          nsTimerImpl* aTimerToInsert) :
     now(aNow)
 #ifdef DEBUG
     , timerToInsert(aTimerToInsert)
 #endif
-  {}
-
-  bool LessThan(nsTimerImpl *fromArray, nsTimerImpl *newTimer) const {
-    NS_ABORT_IF_FALSE(newTimer == timerToInsert, "Unexpected timer ordering");
-
-    // Skip any overdue timers.
-    return fromArray->mTimeout <= now ||
-           fromArray->mTimeout <= newTimer->mTimeout;
+  {
   }
 
-  bool Equals(nsTimerImpl* fromArray, nsTimerImpl* newTimer) const {
+  bool LessThan(nsTimerImpl* aFromArray, nsTimerImpl* aNewTimer) const
+  {
+    NS_ABORT_IF_FALSE(aNewTimer == timerToInsert, "Unexpected timer ordering");
+
+    // Skip any overdue timers.
+    return aFromArray->mTimeout <= now ||
+           aFromArray->mTimeout <= aNewTimer->mTimeout;
+  }
+
+  bool Equals(nsTimerImpl* aFromArray, nsTimerImpl* aNewTimer) const
+  {
     return false;
   }
 
 private:
-  const mozilla::TimeStamp &now;
+  const mozilla::TimeStamp& now;
 #ifdef DEBUG
-  const nsTimerImpl * const timerToInsert;
+  const nsTimerImpl* const timerToInsert;
 #endif
 };
 
diff --git a/xpcom/threads/nsEnvironment.cpp b/xpcom/threads/nsEnvironment.cpp
index 36c9d51d10e8..4648c9c2e0b5 100644
--- a/xpcom/threads/nsEnvironment.cpp
+++ b/xpcom/threads/nsEnvironment.cpp
@@ -1,4 +1,5 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
@@ -17,26 +18,25 @@ using namespace mozilla;
 NS_IMPL_ISUPPORTS(nsEnvironment, nsIEnvironment)
 
 nsresult
-nsEnvironment::Create(nsISupports *aOuter, REFNSIID aIID,
-                      void **aResult)
+nsEnvironment::Create(nsISupports* aOuter, REFNSIID aIID, void** aResult)
 {
-    nsresult rv;
-    *aResult = nullptr;
+  nsresult rv;
+  *aResult = nullptr;
 
-    if (aOuter != nullptr) {
-        return NS_ERROR_NO_AGGREGATION;
-    }
+  if (aOuter) {
+    return NS_ERROR_NO_AGGREGATION;
+  }
 
-    nsEnvironment* obj = new nsEnvironment();
-    if (!obj) {
-        return NS_ERROR_OUT_OF_MEMORY;
-    }
+  nsEnvironment* obj = new nsEnvironment();
+  if (!obj) {
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
 
-    rv = obj->QueryInterface(aIID, aResult);
-    if (NS_FAILED(rv)) {
-      delete obj;
-    }
-    return rv;
+  rv = obj->QueryInterface(aIID, aResult);
+  if (NS_FAILED(rv)) {
+    delete obj;
+  }
+  return rv;
 }
 
 nsEnvironment::~nsEnvironment()
@@ -44,117 +44,123 @@ nsEnvironment::~nsEnvironment()
 }
 
 NS_IMETHODIMP
-nsEnvironment::Exists(const nsAString& aName, bool *aOutValue)
+nsEnvironment::Exists(const nsAString& aName, bool* aOutValue)
 {
-    nsAutoCString nativeName;
-    nsresult rv = NS_CopyUnicodeToNative(aName, nativeName);
-    if (NS_WARN_IF(NS_FAILED(rv)))
-        return rv;
+  nsAutoCString nativeName;
+  nsresult rv = NS_CopyUnicodeToNative(aName, nativeName);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return rv;
+  }
 
-    nsAutoCString nativeVal;
+  nsAutoCString nativeVal;
 #if defined(XP_UNIX)
-    /* For Unix/Linux platforms we follow the Unix definition:
-     * An environment variable exists when |getenv()| returns a non-nullptr
-     * value. An environment variable does not exist when |getenv()| returns
-     * nullptr.
-     */
-    const char *value = PR_GetEnv(nativeName.get());
-    *aOutValue = value && *value;
+  /* For Unix/Linux platforms we follow the Unix definition:
+   * An environment variable exists when |getenv()| returns a non-nullptr
+   * value. An environment variable does not exist when |getenv()| returns
+   * nullptr.
+   */
+  const char* value = PR_GetEnv(nativeName.get());
+  *aOutValue = value && *value;
 #else
-    /* For non-Unix/Linux platforms we have to fall back to a 
-     * "portable" definition (which is incorrect for Unix/Linux!!!!)
-     * which simply checks whether the string returned by |Get()| is empty
-     * or not.
-     */
-    nsAutoString value;
-    Get(aName, value);
-    *aOutValue = !value.IsEmpty();
+  /* For non-Unix/Linux platforms we have to fall back to a
+   * "portable" definition (which is incorrect for Unix/Linux!!!!)
+   * which simply checks whether the string returned by |Get()| is empty
+   * or not.
+   */
+  nsAutoString value;
+  Get(aName, value);
+  *aOutValue = !value.IsEmpty();
 #endif /* XP_UNIX */
 
-    return NS_OK;
+  return NS_OK;
 }
 
 NS_IMETHODIMP
 nsEnvironment::Get(const nsAString& aName, nsAString& aOutValue)
 {
-    nsAutoCString nativeName;
-    nsresult rv = NS_CopyUnicodeToNative(aName, nativeName);
-    if (NS_WARN_IF(NS_FAILED(rv)))
-        return rv;
-
-    nsAutoCString nativeVal;
-    const char *value = PR_GetEnv(nativeName.get());
-    if (value && *value) {
-        rv = NS_CopyNativeToUnicode(nsDependentCString(value), aOutValue);
-    } else {
-        aOutValue.Truncate();
-        rv = NS_OK;
-    }
-
+  nsAutoCString nativeName;
+  nsresult rv = NS_CopyUnicodeToNative(aName, nativeName);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
     return rv;
+  }
+
+  nsAutoCString nativeVal;
+  const char* value = PR_GetEnv(nativeName.get());
+  if (value && *value) {
+    rv = NS_CopyNativeToUnicode(nsDependentCString(value), aOutValue);
+  } else {
+    aOutValue.Truncate();
+    rv = NS_OK;
+  }
+
+  return rv;
 }
 
 /* Environment strings must have static duration; We're gonna leak all of this
  * at shutdown: this is by design, caused how Unix/Linux implement environment
- * vars. 
+ * vars.
  */
 
-typedef nsBaseHashtableET<nsCharPtrHashKey,char*> EnvEntryType;
+typedef nsBaseHashtableET<nsCharPtrHashKey, char*> EnvEntryType;
 typedef nsTHashtable<EnvEntryType> EnvHashType;
 
-static EnvHashType *gEnvHash = nullptr;
+static EnvHashType* gEnvHash = nullptr;
 
 static bool
 EnsureEnvHash()
 {
-    if (gEnvHash)
-        return true;
-
-    gEnvHash = new EnvHashType;
-    if (!gEnvHash)
-        return false;
-
+  if (gEnvHash) {
     return true;
+  }
+
+  gEnvHash = new EnvHashType;
+  if (!gEnvHash) {
+    return false;
+  }
+
+  return true;
 }
 
 NS_IMETHODIMP
 nsEnvironment::Set(const nsAString& aName, const nsAString& aValue)
 {
-    nsAutoCString nativeName;
-    nsAutoCString nativeVal;
+  nsAutoCString nativeName;
+  nsAutoCString nativeVal;
 
-    nsresult rv = NS_CopyUnicodeToNative(aName, nativeName);
-    if (NS_WARN_IF(NS_FAILED(rv)))
-        return rv;
+  nsresult rv = NS_CopyUnicodeToNative(aName, nativeName);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return rv;
+  }
 
-    rv = NS_CopyUnicodeToNative(aValue, nativeVal);
-    if (NS_WARN_IF(NS_FAILED(rv)))
-        return rv;
+  rv = NS_CopyUnicodeToNative(aValue, nativeVal);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return rv;
+  }
 
-    MutexAutoLock lock(mLock);
+  MutexAutoLock lock(mLock);
 
-    if (!EnsureEnvHash()){
-        return NS_ERROR_UNEXPECTED;
-    }
+  if (!EnsureEnvHash()) {
+    return NS_ERROR_UNEXPECTED;
+  }
 
-    EnvEntryType* entry = gEnvHash->PutEntry(nativeName.get());
-    if (!entry) {
-        return NS_ERROR_OUT_OF_MEMORY;
-    }
-    
-    char* newData = PR_smprintf("%s=%s",
-                                nativeName.get(),
-                                nativeVal.get());
-    if (!newData) {
-        return NS_ERROR_OUT_OF_MEMORY;
-    } 
-    
-    PR_SetEnv(newData);
-    if (entry->mData) {
-        PR_smprintf_free(entry->mData);
-    }
-    entry->mData = newData;
-    return NS_OK;
+  EnvEntryType* entry = gEnvHash->PutEntry(nativeName.get());
+  if (!entry) {
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+
+  char* newData = PR_smprintf("%s=%s",
+                              nativeName.get(),
+                              nativeVal.get());
+  if (!newData) {
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+
+  PR_SetEnv(newData);
+  if (entry->mData) {
+    PR_smprintf_free(entry->mData);
+  }
+  entry->mData = newData;
+  return NS_OK;
 }
 
 
diff --git a/xpcom/threads/nsEnvironment.h b/xpcom/threads/nsEnvironment.h
index bcc32d11fdd9..1c852159de62 100644
--- a/xpcom/threads/nsEnvironment.h
+++ b/xpcom/threads/nsEnvironment.h
@@ -1,4 +1,5 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
@@ -18,17 +19,18 @@
 class nsEnvironment MOZ_FINAL : public nsIEnvironment
 {
 public:
-    NS_DECL_THREADSAFE_ISUPPORTS
-    NS_DECL_NSIENVIRONMENT
+  NS_DECL_THREADSAFE_ISUPPORTS
+  NS_DECL_NSIENVIRONMENT
 
-    static nsresult Create(nsISupports *aOuter, REFNSIID aIID,
-                           void **aResult);
+  static nsresult Create(nsISupports* aOuter, REFNSIID aIID, void** aResult);
 
 private:
-    nsEnvironment() : mLock("nsEnvironment.mLock") { }
-    ~nsEnvironment();
+  nsEnvironment() : mLock("nsEnvironment.mLock")
+  {
+  }
+  ~nsEnvironment();
 
-    mozilla::Mutex mLock;
+  mozilla::Mutex mLock;
 };
 
 #endif /* !nsEnvironment_h__ */
diff --git a/xpcom/threads/nsEventQueue.cpp b/xpcom/threads/nsEventQueue.cpp
index 4c68e5156414..04c62281f855 100644
--- a/xpcom/threads/nsEventQueue.cpp
+++ b/xpcom/threads/nsEventQueue.cpp
@@ -14,12 +14,13 @@
 using namespace mozilla;
 
 #ifdef PR_LOGGING
-static PRLogModuleInfo *
+static PRLogModuleInfo*
 GetLog()
 {
-  static PRLogModuleInfo *sLog;
-  if (!sLog)
+  static PRLogModuleInfo* sLog;
+  if (!sLog) {
     sLog = PR_NewLogModule("nsEventQueue");
+  }
   return sLog;
 }
 #endif
@@ -41,35 +42,38 @@ nsEventQueue::~nsEventQueue()
 {
   // It'd be nice to be able to assert that no one else is holding the monitor,
   // but NSPR doesn't really expose APIs for it.
-  NS_ASSERTION(IsEmpty(), "Non-empty event queue being destroyed; events being leaked.");
+  NS_ASSERTION(IsEmpty(),
+               "Non-empty event queue being destroyed; events being leaked.");
 
-  if (mHead)
+  if (mHead) {
     FreePage(mHead);
+  }
 }
 
 bool
-nsEventQueue::GetEvent(bool mayWait, nsIRunnable **result)
+nsEventQueue::GetEvent(bool aMayWait, nsIRunnable** aResult)
 {
   {
     ReentrantMonitorAutoEnter mon(mReentrantMonitor);
-    
+
     while (IsEmpty()) {
-      if (!mayWait) {
-        if (result)
-          *result = nullptr;
+      if (!aMayWait) {
+        if (aResult) {
+          *aResult = nullptr;
+        }
         return false;
       }
-      LOG(("EVENTQ(%p): wait begin\n", this)); 
+      LOG(("EVENTQ(%p): wait begin\n", this));
       mon.Wait();
-      LOG(("EVENTQ(%p): wait end\n", this)); 
+      LOG(("EVENTQ(%p): wait end\n", this));
     }
-    
-    if (result) {
-      *result = mHead->mEvents[mOffsetHead++];
-      
+
+    if (aResult) {
+      *aResult = mHead->mEvents[mOffsetHead++];
+
       // Check if mHead points to empty Page
       if (mOffsetHead == EVENTS_PER_PAGE) {
-        Page *dead = mHead;
+        Page* dead = mHead;
         mHead = mHead->mNext;
         FreePage(dead);
         mOffsetHead = 0;
diff --git a/xpcom/threads/nsEventQueue.h b/xpcom/threads/nsEventQueue.h
index 5a9bf5adf4a3..e27f4c987929 100644
--- a/xpcom/threads/nsEventQueue.h
+++ b/xpcom/threads/nsEventQueue.h
@@ -23,7 +23,7 @@ public:
   // This method adds a new event to the pending event queue.  The queue holds
   // a strong reference to the event after this method returns.  This method
   // cannot fail.
-  void PutEvent(nsIRunnable *event);
+  void PutEvent(nsIRunnable* aEvent);
 
   // This method gets an event from the event queue.  If mayWait is true, then
   // the method will block the calling thread until an event is available.  If
@@ -31,53 +31,63 @@ public:
   // or not an event is pending.  When the resulting event is non-null, the
   // caller is responsible for releasing the event object.  This method does
   // not alter the reference count of the resulting event.
-  bool GetEvent(bool mayWait, nsIRunnable **event);
+  bool GetEvent(bool aMayWait, nsIRunnable** aEvent);
 
   // This method returns true if there is a pending event.
-  bool HasPendingEvent() {
+  bool HasPendingEvent()
+  {
     return GetEvent(false, nullptr);
   }
 
   // This method returns the next pending event or null.
-  bool GetPendingEvent(nsIRunnable **runnable) {
+  bool GetPendingEvent(nsIRunnable** runnable)
+  {
     return GetEvent(false, runnable);
   }
 
   // Expose the event queue's monitor for "power users"
-  ReentrantMonitor& GetReentrantMonitor() {
+  ReentrantMonitor& GetReentrantMonitor()
+  {
     return mReentrantMonitor;
   }
 
 private:
 
-  bool IsEmpty() {
+  bool IsEmpty()
+  {
     return !mHead || (mHead == mTail && mOffsetHead == mOffsetTail);
   }
 
-  enum { EVENTS_PER_PAGE = 255 };
+  enum
+  {
+    EVENTS_PER_PAGE = 255
+  };
 
   // Page objects are linked together to form a simple deque.
 
-  struct Page {
-    struct Page *mNext;
-    nsIRunnable *mEvents[EVENTS_PER_PAGE];
+  struct Page
+  {
+    struct Page* mNext;
+    nsIRunnable* mEvents[EVENTS_PER_PAGE];
   };
 
   static_assert((sizeof(Page) & (sizeof(Page) - 1)) == 0,
                 "sizeof(Page) should be a power of two to avoid heap slop.");
 
-  static Page *NewPage() {
-    return static_cast<Page *>(moz_xcalloc(1, sizeof(Page)));
+  static Page* NewPage()
+  {
+    return static_cast<Page*>(moz_xcalloc(1, sizeof(Page)));
   }
 
-  static void FreePage(Page *p) {
-    free(p);
+  static void FreePage(Page* aPage)
+  {
+    free(aPage);
   }
 
   ReentrantMonitor mReentrantMonitor;
 
-  Page *mHead;
-  Page *mTail;
+  Page* mHead;
+  Page* mTail;
 
   uint16_t mOffsetHead;  // offset into mHead where next item is removed
   uint16_t mOffsetTail;  // offset into mTail where next item is added
diff --git a/xpcom/threads/nsMemoryPressure.cpp b/xpcom/threads/nsMemoryPressure.cpp
index 094d4c06ab04..04d3b2b7f7ed 100644
--- a/xpcom/threads/nsMemoryPressure.cpp
+++ b/xpcom/threads/nsMemoryPressure.cpp
@@ -24,14 +24,14 @@ NS_GetPendingMemoryPressure()
 }
 
 void
-NS_DispatchEventualMemoryPressure(MemoryPressureState state)
+NS_DispatchEventualMemoryPressure(MemoryPressureState aState)
 {
   /*
    * A new memory pressure event erases an ongoing memory pressure, but an
    * existing "new" memory pressure event takes precedence over a new "ongoing"
    * memory pressure event.
    */
-  switch (state) {
+  switch (aState) {
     case MemPressure_None:
       sMemoryPressurePending = MemPressure_None;
       break;
@@ -39,15 +39,16 @@ NS_DispatchEventualMemoryPressure(MemoryPressureState state)
       sMemoryPressurePending = MemPressure_New;
       break;
     case MemPressure_Ongoing:
-      sMemoryPressurePending.compareExchange(MemPressure_None, MemPressure_Ongoing);
+      sMemoryPressurePending.compareExchange(MemPressure_None,
+                                             MemPressure_Ongoing);
       break;
   }
 }
 
 nsresult
-NS_DispatchMemoryPressure(MemoryPressureState state)
+NS_DispatchMemoryPressure(MemoryPressureState aState)
 {
-  NS_DispatchEventualMemoryPressure(state);
+  NS_DispatchEventualMemoryPressure(aState);
   nsCOMPtr<nsIRunnable> event = new nsRunnable;
   return NS_DispatchToMainThread(event);
 }
diff --git a/xpcom/threads/nsMemoryPressure.h b/xpcom/threads/nsMemoryPressure.h
index cf5d60f45fb4..f752294a52d6 100644
--- a/xpcom/threads/nsMemoryPressure.h
+++ b/xpcom/threads/nsMemoryPressure.h
@@ -9,7 +9,8 @@
 
 #include "nscore.h"
 
-enum MemoryPressureState {
+enum MemoryPressureState
+{
   /*
    * No memory pressure.
    */
@@ -59,7 +60,7 @@ NS_GetPendingMemoryPressure();
  * You may call this function from any thread.
  */
 void
-NS_DispatchEventualMemoryPressure(MemoryPressureState state);
+NS_DispatchEventualMemoryPressure(MemoryPressureState aState);
 
 /**
  * This function causes the main thread to fire a memory pressure event
@@ -71,6 +72,6 @@ NS_DispatchEventualMemoryPressure(MemoryPressureState state);
  * You may call this function from any thread.
  */
 nsresult
-NS_DispatchMemoryPressure(MemoryPressureState state);
+NS_DispatchMemoryPressure(MemoryPressureState aState);
 
 #endif // nsMemoryPressure_h__
diff --git a/xpcom/threads/nsProcess.h b/xpcom/threads/nsProcess.h
index 63abf52dc98c..2a0436afd4e8 100644
--- a/xpcom/threads/nsProcess.h
+++ b/xpcom/threads/nsProcess.h
@@ -31,8 +31,9 @@
 {0x7b4eeb20, 0xd781, 0x11d4, \
    {0x8A, 0x83, 0x00, 0x10, 0xa4, 0xe0, 0xc9, 0xca}}
 
-class nsProcess MOZ_FINAL : public nsIProcess,
-                            public nsIObserver
+class nsProcess MOZ_FINAL
+  : public nsIProcess
+  , public nsIObserver
 {
 public:
 
@@ -44,17 +45,17 @@ public:
 
 private:
   ~nsProcess();
-  static void Monitor(void *arg);
+  static void Monitor(void* aArg);
   void ProcessComplete();
-  nsresult CopyArgsAndRunProcess(bool blocking, const char** args,
-                                 uint32_t count, nsIObserver* observer,
-                                 bool holdWeak);
-  nsresult CopyArgsAndRunProcessw(bool blocking, const char16_t** args,
-                                  uint32_t count, nsIObserver* observer,
-                                  bool holdWeak);
+  nsresult CopyArgsAndRunProcess(bool aBlocking, const char** aArgs,
+                                 uint32_t aCount, nsIObserver* aObserver,
+                                 bool aHoldWeak);
+  nsresult CopyArgsAndRunProcessw(bool aBlocking, const char16_t** aArgs,
+                                  uint32_t aCount, nsIObserver* aObserver,
+                                  bool aHoldWeak);
   // The 'args' array is null-terminated.
-  nsresult RunProcess(bool blocking, char **args, nsIObserver* observer,
-                      bool holdWeak, bool argsUTF8);
+  nsresult RunProcess(bool aBlocking, char** aArgs, nsIObserver* aObserver,
+                      bool aHoldWeak, bool aArgsUTF8);
 
   PRThread* mThread;
   mozilla::Mutex mLock;
@@ -73,7 +74,7 @@ private:
 #if defined(PROCESSMODEL_WINAPI)
   HANDLE mProcess;
 #elif !defined(XP_MACOSX)
-  PRProcess *mProcess;
+  PRProcess* mProcess;
 #endif
 };
 
diff --git a/xpcom/threads/nsProcessCommon.cpp b/xpcom/threads/nsProcessCommon.cpp
index 20795a9af480..4880f478e109 100644
--- a/xpcom/threads/nsProcessCommon.cpp
+++ b/xpcom/threads/nsProcessCommon.cpp
@@ -1,10 +1,11 @@
-/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 /*****************************************************************************
- * 
+ *
  * nsProcess is used to execute new processes and specify if you want to
  * wait (blocking) or continue (non-blocking).
  *
@@ -46,13 +47,14 @@ using namespace mozilla;
 #ifdef XP_MACOSX
 cpu_type_t pref_cpu_types[2] = {
 #if defined(__i386__)
-                                 CPU_TYPE_X86,
+  CPU_TYPE_X86,
 #elif defined(__x86_64__)
-                                 CPU_TYPE_X86_64,
+  CPU_TYPE_X86_64,
 #elif defined(__ppc__)
-                                 CPU_TYPE_POWERPC,
+  CPU_TYPE_POWERPC,
 #endif
-                                 CPU_TYPE_ANY };
+  CPU_TYPE_ANY
+};
 #endif
 
 //-------------------------------------------------------------------//
@@ -63,16 +65,16 @@ NS_IMPL_ISUPPORTS(nsProcess, nsIProcess,
 
 //Constructor
 nsProcess::nsProcess()
-    : mThread(nullptr)
-    , mLock("nsProcess.mLock")
-    , mShutdown(false)
-    , mBlocking(false)
-    , mPid(-1)
-    , mObserver(nullptr)
-    , mWeakObserver(nullptr)
-    , mExitValue(-1)
+  : mThread(nullptr)
+  , mLock("nsProcess.mLock")
+  , mShutdown(false)
+  , mBlocking(false)
+  , mPid(-1)
+  , mObserver(nullptr)
+  , mWeakObserver(nullptr)
+  , mExitValue(-1)
 #if !defined(XP_MACOSX)
-    , mProcess(nullptr)
+  , mProcess(nullptr)
 #endif
 {
 }
@@ -83,536 +85,572 @@ nsProcess::~nsProcess()
 }
 
 NS_IMETHODIMP
-nsProcess::Init(nsIFile* executable)
+nsProcess::Init(nsIFile* aExecutable)
 {
-    if (mExecutable)
-        return NS_ERROR_ALREADY_INITIALIZED;
+  if (mExecutable) {
+    return NS_ERROR_ALREADY_INITIALIZED;
+  }
 
-    if (NS_WARN_IF(!executable))
-        return NS_ERROR_INVALID_ARG;
-    bool isFile;
-
-    //First make sure the file exists
-    nsresult rv = executable->IsFile(&isFile);
-    if (NS_FAILED(rv)) return rv;
-    if (!isFile)
-        return NS_ERROR_FAILURE;
-
-    //Store the nsIFile in mExecutable
-    mExecutable = executable;
-    //Get the path because it is needed by the NSPR process creation
-#ifdef XP_WIN 
-    rv = mExecutable->GetTarget(mTargetPath);
-    if (NS_FAILED(rv) || mTargetPath.IsEmpty() )
-#endif
-        rv = mExecutable->GetPath(mTargetPath);
+  if (NS_WARN_IF(!aExecutable)) {
+    return NS_ERROR_INVALID_ARG;
+  }
+  bool isFile;
 
+  //First make sure the file exists
+  nsresult rv = aExecutable->IsFile(&isFile);
+  if (NS_FAILED(rv)) {
     return rv;
+  }
+  if (!isFile) {
+    return NS_ERROR_FAILURE;
+  }
+
+  //Store the nsIFile in mExecutable
+  mExecutable = aExecutable;
+  //Get the path because it is needed by the NSPR process creation
+#ifdef XP_WIN
+  rv = mExecutable->GetTarget(mTargetPath);
+  if (NS_FAILED(rv) || mTargetPath.IsEmpty())
+#endif
+    rv = mExecutable->GetPath(mTargetPath);
+
+  return rv;
 }
 
 
 #if defined(XP_WIN)
-// Out param `wideCmdLine` must be PR_Freed by the caller.
-static int assembleCmdLine(char *const *argv, wchar_t **wideCmdLine,
-                           UINT codePage)
+// Out param `aWideCmdLine` must be PR_Freed by the caller.
+static int
+assembleCmdLine(char* const* aArgv, wchar_t** aWideCmdLine, UINT aCodePage)
 {
-    char *const *arg;
-    char *p, *q, *cmdLine;
-    int cmdLineSize;
-    int numBackslashes;
-    int i;
-    int argNeedQuotes;
+  char* const* arg;
+  char* p;
+  char* q;
+  char* cmdLine;
+  int cmdLineSize;
+  int numBackslashes;
+  int i;
+  int argNeedQuotes;
 
+  /*
+   * Find out how large the command line buffer should be.
+   */
+  cmdLineSize = 0;
+  for (arg = aArgv; *arg; ++arg) {
     /*
-     * Find out how large the command line buffer should be.
+     * \ and " need to be escaped by a \.  In the worst case,
+     * every character is a \ or ", so the string of length
+     * may double.  If we quote an argument, that needs two ".
+     * Finally, we need a space between arguments, and
+     * a null byte at the end of command line.
      */
-    cmdLineSize = 0;
-    for (arg = argv; *arg; arg++) {
-        /*
-         * \ and " need to be escaped by a \.  In the worst case,
-         * every character is a \ or ", so the string of length
-         * may double.  If we quote an argument, that needs two ".
-         * Finally, we need a space between arguments, and
-         * a null byte at the end of command line.
-         */
-        cmdLineSize += 2 * strlen(*arg)  /* \ and " need to be escaped */
-                + 2                      /* we quote every argument */
-                + 1;                     /* space in between, or final null */
+    cmdLineSize += 2 * strlen(*arg)  /* \ and " need to be escaped */
+                   + 2               /* we quote every argument */
+                   + 1;              /* space in between, or final null */
+  }
+  p = cmdLine = (char*)PR_MALLOC(cmdLineSize * sizeof(char));
+  if (!p) {
+    return -1;
+  }
+
+  for (arg = aArgv; *arg; ++arg) {
+    /* Add a space to separates the arguments */
+    if (arg != aArgv) {
+      *p++ = ' ';
     }
-    p = cmdLine = (char *) PR_MALLOC(cmdLineSize*sizeof(char));
-    if (p == nullptr) {
-        return -1;
+    q = *arg;
+    numBackslashes = 0;
+    argNeedQuotes = 0;
+
+    /* If the argument contains white space, it needs to be quoted. */
+    if (strpbrk(*arg, " \f\n\r\t\v")) {
+      argNeedQuotes = 1;
     }
 
-    for (arg = argv; *arg; arg++) {
-        /* Add a space to separates the arguments */
-        if (arg != argv) {
-            *p++ = ' '; 
-        }
-        q = *arg;
-        numBackslashes = 0;
-        argNeedQuotes = 0;
-
-        /* If the argument contains white space, it needs to be quoted. */
-        if (strpbrk(*arg, " \f\n\r\t\v")) {
-            argNeedQuotes = 1;
-        }
-
-        if (argNeedQuotes) {
-            *p++ = '"';
-        }
-        while (*q) {
-            if (*q == '\\') {
-                numBackslashes++;
-                q++;
-            } else if (*q == '"') {
-                if (numBackslashes) {
-                    /*
-                     * Double the backslashes since they are followed
-                     * by a quote
-                     */
-                    for (i = 0; i < 2 * numBackslashes; i++) {
-                        *p++ = '\\';
-                    }
-                    numBackslashes = 0;
-                }
-                /* To escape the quote */
-                *p++ = '\\';
-                *p++ = *q++;
-            } else {
-                if (numBackslashes) {
-                    /*
-                     * Backslashes are not followed by a quote, so
-                     * don't need to double the backslashes.
-                     */
-                    for (i = 0; i < numBackslashes; i++) {
-                        *p++ = '\\';
-                    }
-                    numBackslashes = 0;
-                }
-                *p++ = *q++;
-            }
-        }
-
-        /* Now we are at the end of this argument */
+    if (argNeedQuotes) {
+      *p++ = '"';
+    }
+    while (*q) {
+      if (*q == '\\') {
+        numBackslashes++;
+        q++;
+      } else if (*q == '"') {
         if (numBackslashes) {
-            /*
-             * Double the backslashes if we have a quote string
-             * delimiter at the end.
-             */
-            if (argNeedQuotes) {
-                numBackslashes *= 2;
-            }
-            for (i = 0; i < numBackslashes; i++) {
-                *p++ = '\\';
-            }
+          /*
+           * Double the backslashes since they are followed
+           * by a quote
+           */
+          for (i = 0; i < 2 * numBackslashes; i++) {
+            *p++ = '\\';
+          }
+          numBackslashes = 0;
         }
-        if (argNeedQuotes) {
-            *p++ = '"';
+        /* To escape the quote */
+        *p++ = '\\';
+        *p++ = *q++;
+      } else {
+        if (numBackslashes) {
+          /*
+           * Backslashes are not followed by a quote, so
+           * don't need to double the backslashes.
+           */
+          for (i = 0; i < numBackslashes; i++) {
+            *p++ = '\\';
+          }
+          numBackslashes = 0;
         }
-    } 
+        *p++ = *q++;
+      }
+    }
 
-    *p = '\0';
-    int32_t numChars = MultiByteToWideChar(codePage, 0, cmdLine, -1, nullptr, 0);
-    *wideCmdLine = (wchar_t *) PR_MALLOC(numChars*sizeof(wchar_t));
-    MultiByteToWideChar(codePage, 0, cmdLine, -1, *wideCmdLine, numChars); 
-    PR_Free(cmdLine);
-    return 0;
+    /* Now we are at the end of this argument */
+    if (numBackslashes) {
+      /*
+       * Double the backslashes if we have a quote string
+       * delimiter at the end.
+       */
+      if (argNeedQuotes) {
+        numBackslashes *= 2;
+      }
+      for (i = 0; i < numBackslashes; i++) {
+        *p++ = '\\';
+      }
+    }
+    if (argNeedQuotes) {
+      *p++ = '"';
+    }
+  }
+
+  *p = '\0';
+  int32_t numChars = MultiByteToWideChar(aCodePage, 0, cmdLine, -1, nullptr, 0);
+  *aWideCmdLine = (wchar_t*)PR_MALLOC(numChars * sizeof(wchar_t));
+  MultiByteToWideChar(aCodePage, 0, cmdLine, -1, *aWideCmdLine, numChars);
+  PR_Free(cmdLine);
+  return 0;
 }
 #endif
 
-void nsProcess::Monitor(void *arg)
+void
+nsProcess::Monitor(void* aArg)
 {
-    nsRefPtr<nsProcess> process = dont_AddRef(static_cast<nsProcess*>(arg));
+  nsRefPtr<nsProcess> process = dont_AddRef(static_cast<nsProcess*>(aArg));
 
-    if (!process->mBlocking)
-        PR_SetCurrentThreadName("RunProcess");
+  if (!process->mBlocking) {
+    PR_SetCurrentThreadName("RunProcess");
+  }
 
 #if defined(PROCESSMODEL_WINAPI)
-    DWORD dwRetVal;
-    unsigned long exitCode = -1;
+  DWORD dwRetVal;
+  unsigned long exitCode = -1;
 
-    dwRetVal = WaitForSingleObject(process->mProcess, INFINITE);
-    if (dwRetVal != WAIT_FAILED) {
-        if (GetExitCodeProcess(process->mProcess, &exitCode) == FALSE)
-            exitCode = -1;
+  dwRetVal = WaitForSingleObject(process->mProcess, INFINITE);
+  if (dwRetVal != WAIT_FAILED) {
+    if (GetExitCodeProcess(process->mProcess, &exitCode) == FALSE) {
+      exitCode = -1;
     }
+  }
 
-    // Lock in case Kill or GetExitCode are called during this
-    {
-        MutexAutoLock lock(process->mLock);
-        CloseHandle(process->mProcess);
-        process->mProcess = nullptr;
-        process->mExitValue = exitCode;
-        if (process->mShutdown)
-            return;
+  // Lock in case Kill or GetExitCode are called during this
+  {
+    MutexAutoLock lock(process->mLock);
+    CloseHandle(process->mProcess);
+    process->mProcess = nullptr;
+    process->mExitValue = exitCode;
+    if (process->mShutdown) {
+      return;
     }
+  }
 #else
 #ifdef XP_MACOSX
-    int exitCode = -1;
-    int status = 0;
-    if (waitpid(process->mPid, &status, 0) == process->mPid) {
-        if (WIFEXITED(status)) {
-            exitCode = WEXITSTATUS(status);
-        }
-        else if(WIFSIGNALED(status)) {
-            exitCode = 256; // match NSPR's signal exit status
-        }
+  int exitCode = -1;
+  int status = 0;
+  if (waitpid(process->mPid, &status, 0) == process->mPid) {
+    if (WIFEXITED(status)) {
+      exitCode = WEXITSTATUS(status);
+    } else if (WIFSIGNALED(status)) {
+      exitCode = 256; // match NSPR's signal exit status
     }
+  }
 #else
-    int32_t exitCode = -1;
-    if (PR_WaitProcess(process->mProcess, &exitCode) != PR_SUCCESS)
-        exitCode = -1;
+  int32_t exitCode = -1;
+  if (PR_WaitProcess(process->mProcess, &exitCode) != PR_SUCCESS) {
+    exitCode = -1;
+  }
 #endif
 
-    // Lock in case Kill or GetExitCode are called during this
-    {
-        MutexAutoLock lock(process->mLock);
+  // Lock in case Kill or GetExitCode are called during this
+  {
+    MutexAutoLock lock(process->mLock);
 #if !defined(XP_MACOSX)
-        process->mProcess = nullptr;
+    process->mProcess = nullptr;
 #endif
-        process->mExitValue = exitCode;
-        if (process->mShutdown)
-            return;
+    process->mExitValue = exitCode;
+    if (process->mShutdown) {
+      return;
     }
+  }
 #endif
 
-    // If we ran a background thread for the monitor then notify on the main
-    // thread
-    if (NS_IsMainThread()) {
-        process->ProcessComplete();
-    }
-    else {
-        nsCOMPtr<nsIRunnable> event =
-            NS_NewRunnableMethod(process, &nsProcess::ProcessComplete);
-        NS_DispatchToMainThread(event);
-    }
+  // If we ran a background thread for the monitor then notify on the main
+  // thread
+  if (NS_IsMainThread()) {
+    process->ProcessComplete();
+  } else {
+    nsCOMPtr<nsIRunnable> event =
+      NS_NewRunnableMethod(process, &nsProcess::ProcessComplete);
+    NS_DispatchToMainThread(event);
+  }
 }
 
-void nsProcess::ProcessComplete()
+void
+nsProcess::ProcessComplete()
 {
-    if (mThread) {
-        nsCOMPtr<nsIObserverService> os =
-            mozilla::services::GetObserverService();
-        if (os)
-            os->RemoveObserver(this, "xpcom-shutdown");
-        PR_JoinThread(mThread);
-        mThread = nullptr;
+  if (mThread) {
+    nsCOMPtr<nsIObserverService> os =
+      mozilla::services::GetObserverService();
+    if (os) {
+      os->RemoveObserver(this, "xpcom-shutdown");
     }
+    PR_JoinThread(mThread);
+    mThread = nullptr;
+  }
 
-    const char* topic;
-    if (mExitValue < 0)
-        topic = "process-failed";
-    else
-        topic = "process-finished";
+  const char* topic;
+  if (mExitValue < 0) {
+    topic = "process-failed";
+  } else {
+    topic = "process-finished";
+  }
 
-    mPid = -1;
-    nsCOMPtr<nsIObserver> observer;
-    if (mWeakObserver)
-        observer = do_QueryReferent(mWeakObserver);
-    else if (mObserver)
-        observer = mObserver;
-    mObserver = nullptr;
-    mWeakObserver = nullptr;
+  mPid = -1;
+  nsCOMPtr<nsIObserver> observer;
+  if (mWeakObserver) {
+    observer = do_QueryReferent(mWeakObserver);
+  } else if (mObserver) {
+    observer = mObserver;
+  }
+  mObserver = nullptr;
+  mWeakObserver = nullptr;
 
-    if (observer)
-        observer->Observe(NS_ISUPPORTS_CAST(nsIProcess*, this), topic, nullptr);
+  if (observer) {
+    observer->Observe(NS_ISUPPORTS_CAST(nsIProcess*, this), topic, nullptr);
+  }
 }
 
-// XXXldb |args| has the wrong const-ness
-NS_IMETHODIMP  
-nsProcess::Run(bool blocking, const char **args, uint32_t count)
+// XXXldb |aArgs| has the wrong const-ness
+NS_IMETHODIMP
+nsProcess::Run(bool aBlocking, const char** aArgs, uint32_t aCount)
 {
-    return CopyArgsAndRunProcess(blocking, args, count, nullptr, false);
+  return CopyArgsAndRunProcess(aBlocking, aArgs, aCount, nullptr, false);
 }
 
-// XXXldb |args| has the wrong const-ness
-NS_IMETHODIMP  
-nsProcess::RunAsync(const char **args, uint32_t count,
-                    nsIObserver* observer, bool holdWeak)
+// XXXldb |aArgs| has the wrong const-ness
+NS_IMETHODIMP
+nsProcess::RunAsync(const char** aArgs, uint32_t aCount,
+                    nsIObserver* aObserver, bool aHoldWeak)
 {
-    return CopyArgsAndRunProcess(false, args, count, observer, holdWeak);
+  return CopyArgsAndRunProcess(false, aArgs, aCount, aObserver, aHoldWeak);
 }
 
 nsresult
-nsProcess::CopyArgsAndRunProcess(bool blocking, const char** args,
-                                 uint32_t count, nsIObserver* observer,
-                                 bool holdWeak)
+nsProcess::CopyArgsAndRunProcess(bool aBlocking, const char** aArgs,
+                                 uint32_t aCount, nsIObserver* aObserver,
+                                 bool aHoldWeak)
 {
-    // Add one to the count for the program name and one for null termination.
-    char **my_argv = nullptr;
-    my_argv = (char**)NS_Alloc(sizeof(char*) * (count + 2));
-    if (!my_argv) {
-        return NS_ERROR_OUT_OF_MEMORY;
-    }
+  // Add one to the aCount for the program name and one for null termination.
+  char** my_argv = nullptr;
+  my_argv = (char**)NS_Alloc(sizeof(char*) * (aCount + 2));
+  if (!my_argv) {
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
 
-    my_argv[0] = ToNewUTF8String(mTargetPath);
+  my_argv[0] = ToNewUTF8String(mTargetPath);
 
-    for (uint32_t i = 0; i < count; i++) {
-        my_argv[i + 1] = const_cast<char*>(args[i]);
-    }
+  for (uint32_t i = 0; i < aCount; ++i) {
+    my_argv[i + 1] = const_cast<char*>(aArgs[i]);
+  }
 
-    my_argv[count + 1] = nullptr;
+  my_argv[aCount + 1] = nullptr;
 
-    nsresult rv = RunProcess(blocking, my_argv, observer, holdWeak, false);
+  nsresult rv = RunProcess(aBlocking, my_argv, aObserver, aHoldWeak, false);
 
-    NS_Free(my_argv[0]);
-    NS_Free(my_argv);
-    return rv;
+  NS_Free(my_argv[0]);
+  NS_Free(my_argv);
+  return rv;
 }
 
-// XXXldb |args| has the wrong const-ness
-NS_IMETHODIMP  
-nsProcess::Runw(bool blocking, const char16_t **args, uint32_t count)
+// XXXldb |aArgs| has the wrong const-ness
+NS_IMETHODIMP
+nsProcess::Runw(bool aBlocking, const char16_t** aArgs, uint32_t aCount)
 {
-    return CopyArgsAndRunProcessw(blocking, args, count, nullptr, false);
+  return CopyArgsAndRunProcessw(aBlocking, aArgs, aCount, nullptr, false);
 }
 
-// XXXldb |args| has the wrong const-ness
-NS_IMETHODIMP  
-nsProcess::RunwAsync(const char16_t **args, uint32_t count,
-                    nsIObserver* observer, bool holdWeak)
+// XXXldb |aArgs| has the wrong const-ness
+NS_IMETHODIMP
+nsProcess::RunwAsync(const char16_t** aArgs, uint32_t aCount,
+                     nsIObserver* aObserver, bool aHoldWeak)
 {
-    return CopyArgsAndRunProcessw(false, args, count, observer, holdWeak);
+  return CopyArgsAndRunProcessw(false, aArgs, aCount, aObserver, aHoldWeak);
 }
 
 nsresult
-nsProcess::CopyArgsAndRunProcessw(bool blocking, const char16_t** args,
-                                  uint32_t count, nsIObserver* observer,
-                                  bool holdWeak)
+nsProcess::CopyArgsAndRunProcessw(bool aBlocking, const char16_t** aArgs,
+                                  uint32_t aCount, nsIObserver* aObserver,
+                                  bool aHoldWeak)
 {
-    // Add one to the count for the program name and one for null termination.
-    char **my_argv = nullptr;
-    my_argv = (char**)NS_Alloc(sizeof(char*) * (count + 2));
-    if (!my_argv) {
-        return NS_ERROR_OUT_OF_MEMORY;
-    }
+  // Add one to the aCount for the program name and one for null termination.
+  char** my_argv = nullptr;
+  my_argv = (char**)NS_Alloc(sizeof(char*) * (aCount + 2));
+  if (!my_argv) {
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
 
-    my_argv[0] = ToNewUTF8String(mTargetPath);
+  my_argv[0] = ToNewUTF8String(mTargetPath);
 
-    for (uint32_t i = 0; i < count; i++) {
-        my_argv[i + 1] = ToNewUTF8String(nsDependentString(args[i]));
-    }
+  for (uint32_t i = 0; i < aCount; i++) {
+    my_argv[i + 1] = ToNewUTF8String(nsDependentString(aArgs[i]));
+  }
 
-    my_argv[count + 1] = nullptr;
+  my_argv[aCount + 1] = nullptr;
 
-    nsresult rv = RunProcess(blocking, my_argv, observer, holdWeak, true);
+  nsresult rv = RunProcess(aBlocking, my_argv, aObserver, aHoldWeak, true);
 
-    for (uint32_t i = 0; i <= count; i++) {
-        NS_Free(my_argv[i]);
-    }
-    NS_Free(my_argv);
-    return rv;
+  for (uint32_t i = 0; i <= aCount; ++i) {
+    NS_Free(my_argv[i]);
+  }
+  NS_Free(my_argv);
+  return rv;
 }
 
-nsresult  
-nsProcess::RunProcess(bool blocking, char **my_argv, nsIObserver* observer,
-                      bool holdWeak, bool argsUTF8)
+nsresult
+nsProcess::RunProcess(bool aBlocking, char** aMyArgv, nsIObserver* aObserver,
+                      bool aHoldWeak, bool aArgsUTF8)
 {
-    if (NS_WARN_IF(!mExecutable))
-        return NS_ERROR_NOT_INITIALIZED;
-    if (NS_WARN_IF(mThread))
-        return NS_ERROR_ALREADY_INITIALIZED;
+  if (NS_WARN_IF(!mExecutable)) {
+    return NS_ERROR_NOT_INITIALIZED;
+  }
+  if (NS_WARN_IF(mThread)) {
+    return NS_ERROR_ALREADY_INITIALIZED;
+  }
 
-    if (observer) {
-        if (holdWeak) {
-            mWeakObserver = do_GetWeakReference(observer);
-            if (!mWeakObserver)
-                return NS_NOINTERFACE;
-        }
-        else {
-            mObserver = observer;
-        }
+  if (aObserver) {
+    if (aHoldWeak) {
+      mWeakObserver = do_GetWeakReference(aObserver);
+      if (!mWeakObserver) {
+        return NS_NOINTERFACE;
+      }
+    } else {
+      mObserver = aObserver;
     }
+  }
 
-    mExitValue = -1;
-    mPid = -1;
+  mExitValue = -1;
+  mPid = -1;
 
 #if defined(PROCESSMODEL_WINAPI)
-    BOOL retVal;
-    wchar_t *cmdLine = nullptr;
+  BOOL retVal;
+  wchar_t* cmdLine = nullptr;
 
-    // The 'argv' array is null-terminated and always starts with the program path.
-    // If the second slot is non-null then arguments are being passed.
-    if (my_argv[1] != nullptr &&
-        assembleCmdLine(my_argv + 1, &cmdLine, argsUTF8 ? CP_UTF8 : CP_ACP) == -1) {
-        return NS_ERROR_FILE_EXECUTION_FAILED;    
-    }
+  // |aMyArgv| is null-terminated and always starts with the program path. If
+  // the second slot is non-null then arguments are being passed.
+  if (aMyArgv[1] && assembleCmdLine(aMyArgv + 1, &cmdLine,
+                                    aArgsUTF8 ? CP_UTF8 : CP_ACP) == -1) {
+    return NS_ERROR_FILE_EXECUTION_FAILED;
+  }
 
-    /* The SEE_MASK_NO_CONSOLE flag is important to prevent console windows
-     * from appearing. This makes behavior the same on all platforms. The flag
-     * will not have any effect on non-console applications.
-     */
+  /* The SEE_MASK_NO_CONSOLE flag is important to prevent console windows
+   * from appearing. This makes behavior the same on all platforms. The flag
+   * will not have any effect on non-console applications.
+   */
 
-    // The program name in my_argv[0] is always UTF-8
-    NS_ConvertUTF8toUTF16 wideFile(my_argv[0]);
+  // The program name in aMyArgv[0] is always UTF-8
+  NS_ConvertUTF8toUTF16 wideFile(aMyArgv[0]);
 
-    SHELLEXECUTEINFOW sinfo;
-    memset(&sinfo, 0, sizeof(SHELLEXECUTEINFOW));
-    sinfo.cbSize = sizeof(SHELLEXECUTEINFOW);
-    sinfo.hwnd   = nullptr;
-    sinfo.lpFile = wideFile.get();
-    sinfo.nShow  = SW_SHOWNORMAL;
-    sinfo.fMask  = SEE_MASK_FLAG_DDEWAIT |
-                   SEE_MASK_NO_CONSOLE |
-                   SEE_MASK_NOCLOSEPROCESS;
+  SHELLEXECUTEINFOW sinfo;
+  memset(&sinfo, 0, sizeof(SHELLEXECUTEINFOW));
+  sinfo.cbSize = sizeof(SHELLEXECUTEINFOW);
+  sinfo.hwnd   = nullptr;
+  sinfo.lpFile = wideFile.get();
+  sinfo.nShow  = SW_SHOWNORMAL;
+  sinfo.fMask  = SEE_MASK_FLAG_DDEWAIT |
+                 SEE_MASK_NO_CONSOLE |
+                 SEE_MASK_NOCLOSEPROCESS;
 
-    if (cmdLine)
-        sinfo.lpParameters = cmdLine;
+  if (cmdLine) {
+    sinfo.lpParameters = cmdLine;
+  }
 
-    retVal = ShellExecuteExW(&sinfo);
-    if (!retVal) {
-        return NS_ERROR_FILE_EXECUTION_FAILED;
-    }
+  retVal = ShellExecuteExW(&sinfo);
+  if (!retVal) {
+    return NS_ERROR_FILE_EXECUTION_FAILED;
+  }
 
-    mProcess = sinfo.hProcess;
+  mProcess = sinfo.hProcess;
 
-    if (cmdLine)
-        PR_Free(cmdLine);
+  if (cmdLine) {
+    PR_Free(cmdLine);
+  }
 
-    mPid = GetProcessId(mProcess);
+  mPid = GetProcessId(mProcess);
 #elif defined(XP_MACOSX)
-    // Initialize spawn attributes.
-    posix_spawnattr_t spawnattr;
-    if (posix_spawnattr_init(&spawnattr) != 0) {
-        return NS_ERROR_FAILURE;
-    }
-
-    // Set spawn attributes.
-    size_t attr_count = ArrayLength(pref_cpu_types);
-    size_t attr_ocount = 0;
-    if (posix_spawnattr_setbinpref_np(&spawnattr, attr_count, pref_cpu_types, &attr_ocount) != 0 ||
-        attr_ocount != attr_count) {
-        posix_spawnattr_destroy(&spawnattr);
-        return NS_ERROR_FAILURE;
-    }
-
-    // Note that the 'argv' array is already null-terminated, which 'posix_spawnp' requires.
-    pid_t newPid = 0;
-    int result = posix_spawnp(&newPid, my_argv[0], nullptr, &spawnattr, my_argv, *_NSGetEnviron());
-    mPid = static_cast<int32_t>(newPid);
+  // Initialize spawn attributes.
+  posix_spawnattr_t spawnattr;
+  if (posix_spawnattr_init(&spawnattr) != 0) {
+    return NS_ERROR_FAILURE;
+  }
 
+  // Set spawn attributes.
+  size_t attr_count = ArrayLength(pref_cpu_types);
+  size_t attr_ocount = 0;
+  if (posix_spawnattr_setbinpref_np(&spawnattr, attr_count, pref_cpu_types,
+                                    &attr_ocount) != 0 ||
+      attr_ocount != attr_count) {
     posix_spawnattr_destroy(&spawnattr);
+    return NS_ERROR_FAILURE;
+  }
 
-    if (result != 0) {
-        return NS_ERROR_FAILURE;
-    }
+  // Note: |aMyArgv| is already null-terminated as required by posix_spawnp.
+  pid_t newPid = 0;
+  int result = posix_spawnp(&newPid, aMyArgv[0], nullptr, &spawnattr, aMyArgv,
+                            *_NSGetEnviron());
+  mPid = static_cast<int32_t>(newPid);
+
+  posix_spawnattr_destroy(&spawnattr);
+
+  if (result != 0) {
+    return NS_ERROR_FAILURE;
+  }
 #else
-    mProcess = PR_CreateProcess(my_argv[0], my_argv, nullptr, nullptr);
-    if (!mProcess)
-        return NS_ERROR_FAILURE;
-    struct MYProcess {
-        uint32_t pid;
-    };
-    MYProcess* ptrProc = (MYProcess *) mProcess;
-    mPid = ptrProc->pid;
+  mProcess = PR_CreateProcess(aMyArgv[0], aMyArgv, nullptr, nullptr);
+  if (!mProcess) {
+    return NS_ERROR_FAILURE;
+  }
+  struct MYProcess
+  {
+    uint32_t pid;
+  };
+  MYProcess* ptrProc = (MYProcess*)mProcess;
+  mPid = ptrProc->pid;
 #endif
 
-    NS_ADDREF_THIS();
-    mBlocking = blocking;
-    if (blocking) {
-        Monitor(this);
-        if (mExitValue < 0)
-            return NS_ERROR_FILE_EXECUTION_FAILED;
+  NS_ADDREF_THIS();
+  mBlocking = aBlocking;
+  if (aBlocking) {
+    Monitor(this);
+    if (mExitValue < 0) {
+      return NS_ERROR_FILE_EXECUTION_FAILED;
     }
-    else {
-        mThread = PR_CreateThread(PR_SYSTEM_THREAD, Monitor, this,
-                                  PR_PRIORITY_NORMAL, PR_GLOBAL_THREAD,
-                                  PR_JOINABLE_THREAD, 0);
-        if (!mThread) {
-            NS_RELEASE_THIS();
-            return NS_ERROR_FAILURE;
-        }
-
-        // It isn't a failure if we just can't watch for shutdown
-        nsCOMPtr<nsIObserverService> os =
-          mozilla::services::GetObserverService();
-        if (os)
-            os->AddObserver(this, "xpcom-shutdown", false);
+  } else {
+    mThread = PR_CreateThread(PR_SYSTEM_THREAD, Monitor, this,
+                              PR_PRIORITY_NORMAL, PR_GLOBAL_THREAD,
+                              PR_JOINABLE_THREAD, 0);
+    if (!mThread) {
+      NS_RELEASE_THIS();
+      return NS_ERROR_FAILURE;
     }
 
-    return NS_OK;
-}
+    // It isn't a failure if we just can't watch for shutdown
+    nsCOMPtr<nsIObserverService> os =
+      mozilla::services::GetObserverService();
+    if (os) {
+      os->AddObserver(this, "xpcom-shutdown", false);
+    }
+  }
 
-NS_IMETHODIMP nsProcess::GetIsRunning(bool *aIsRunning)
-{
-    if (mThread)
-        *aIsRunning = true;
-    else
-        *aIsRunning = false;
-
-    return NS_OK;
+  return NS_OK;
 }
 
 NS_IMETHODIMP
-nsProcess::GetPid(uint32_t *aPid)
+nsProcess::GetIsRunning(bool* aIsRunning)
 {
-    if (!mThread)
-        return NS_ERROR_FAILURE;
-    if (mPid < 0)
-        return NS_ERROR_NOT_IMPLEMENTED;
-    *aPid = mPid;
-    return NS_OK;
+  if (mThread) {
+    *aIsRunning = true;
+  } else {
+    *aIsRunning = false;
+  }
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsProcess::GetPid(uint32_t* aPid)
+{
+  if (!mThread) {
+    return NS_ERROR_FAILURE;
+  }
+  if (mPid < 0) {
+    return NS_ERROR_NOT_IMPLEMENTED;
+  }
+  *aPid = mPid;
+  return NS_OK;
 }
 
 NS_IMETHODIMP
 nsProcess::Kill()
 {
-    if (!mThread)
-        return NS_ERROR_FAILURE;
+  if (!mThread) {
+    return NS_ERROR_FAILURE;
+  }
 
-    {
-        MutexAutoLock lock(mLock);
+  {
+    MutexAutoLock lock(mLock);
 #if defined(PROCESSMODEL_WINAPI)
-        if (TerminateProcess(mProcess, 0) == 0)
-            return NS_ERROR_FAILURE;
+    if (TerminateProcess(mProcess, 0) == 0) {
+      return NS_ERROR_FAILURE;
+    }
 #elif defined(XP_MACOSX)
-        if (kill(mPid, SIGKILL) != 0)
-            return NS_ERROR_FAILURE;
+    if (kill(mPid, SIGKILL) != 0) {
+      return NS_ERROR_FAILURE;
+    }
 #else
-        if (!mProcess || (PR_KillProcess(mProcess) != PR_SUCCESS))
-            return NS_ERROR_FAILURE;
+    if (!mProcess || (PR_KillProcess(mProcess) != PR_SUCCESS)) {
+      return NS_ERROR_FAILURE;
+    }
 #endif
-    }
+  }
 
-    // We must null out mThread if we want IsRunning to return false immediately
-    // after this call.
-    nsCOMPtr<nsIObserverService> os = mozilla::services::GetObserverService();
-    if (os)
-        os->RemoveObserver(this, "xpcom-shutdown");
-    PR_JoinThread(mThread);
+  // We must null out mThread if we want IsRunning to return false immediately
+  // after this call.
+  nsCOMPtr<nsIObserverService> os = mozilla::services::GetObserverService();
+  if (os) {
+    os->RemoveObserver(this, "xpcom-shutdown");
+  }
+  PR_JoinThread(mThread);
+  mThread = nullptr;
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsProcess::GetExitValue(int32_t* aExitValue)
+{
+  MutexAutoLock lock(mLock);
+
+  *aExitValue = mExitValue;
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsProcess::Observe(nsISupports* aSubject, const char* aTopic,
+                   const char16_t* aData)
+{
+  // Shutting down, drop all references
+  if (mThread) {
+    nsCOMPtr<nsIObserverService> os =
+      mozilla::services::GetObserverService();
+    if (os) {
+      os->RemoveObserver(this, "xpcom-shutdown");
+    }
     mThread = nullptr;
+  }
 
-    return NS_OK;
-}
-
-NS_IMETHODIMP
-nsProcess::GetExitValue(int32_t *aExitValue)
-{
-    MutexAutoLock lock(mLock);
-
-    *aExitValue = mExitValue;
-    
-    return NS_OK;
-}
-
-NS_IMETHODIMP
-nsProcess::Observe(nsISupports* subject, const char* topic, const char16_t* data)
-{
-    // Shutting down, drop all references
-    if (mThread) {
-        nsCOMPtr<nsIObserverService> os =
-          mozilla::services::GetObserverService();
-        if (os)
-            os->RemoveObserver(this, "xpcom-shutdown");
-        mThread = nullptr;
-    }
-
-    mObserver = nullptr;
-    mWeakObserver = nullptr;
-
-    MutexAutoLock lock(mLock);
-    mShutdown = true;
-
-    return NS_OK;
+  mObserver = nullptr;
+  mWeakObserver = nullptr;
+
+  MutexAutoLock lock(mLock);
+  mShutdown = true;
+
+  return NS_OK;
 }
diff --git a/xpcom/threads/nsThread.cpp b/xpcom/threads/nsThread.cpp
index c01d6fb69cb0..a93abaa38faa 100644
--- a/xpcom/threads/nsThread.cpp
+++ b/xpcom/threads/nsThread.cpp
@@ -67,12 +67,13 @@ using namespace mozilla::tasktracer;
 using namespace mozilla;
 
 #ifdef PR_LOGGING
-static PRLogModuleInfo *
+static PRLogModuleInfo*
 GetThreadLog()
 {
-  static PRLogModuleInfo *sLog;
-  if (!sLog)
+  static PRLogModuleInfo* sLog;
+  if (!sLog) {
     sLog = PR_NewLogModule("nsThread");
+  }
   return sLog;
 }
 #endif
@@ -89,68 +90,79 @@ nsIThreadObserver* nsThread::sMainThreadObserver = nullptr;
 // Because we do not have our own nsIFactory, we have to implement nsIClassInfo
 // somewhat manually.
 
-class nsThreadClassInfo : public nsIClassInfo {
+class nsThreadClassInfo : public nsIClassInfo
+{
 public:
   NS_DECL_ISUPPORTS_INHERITED  // no mRefCnt
   NS_DECL_NSICLASSINFO
 
-  nsThreadClassInfo() {}
+  nsThreadClassInfo()
+  {
+  }
 };
 
-NS_IMETHODIMP_(MozExternalRefCountType) nsThreadClassInfo::AddRef() { return 2; }
-NS_IMETHODIMP_(MozExternalRefCountType) nsThreadClassInfo::Release() { return 1; }
+NS_IMETHODIMP_(MozExternalRefCountType)
+nsThreadClassInfo::AddRef()
+{
+  return 2;
+}
+NS_IMETHODIMP_(MozExternalRefCountType)
+nsThreadClassInfo::Release()
+{
+  return 1;
+}
 NS_IMPL_QUERY_INTERFACE(nsThreadClassInfo, nsIClassInfo)
 
 NS_IMETHODIMP
-nsThreadClassInfo::GetInterfaces(uint32_t *count, nsIID ***array)
+nsThreadClassInfo::GetInterfaces(uint32_t* aCount, nsIID*** aArray)
 {
-  return NS_CI_INTERFACE_GETTER_NAME(nsThread)(count, array);
+  return NS_CI_INTERFACE_GETTER_NAME(nsThread)(aCount, aArray);
 }
 
 NS_IMETHODIMP
-nsThreadClassInfo::GetHelperForLanguage(uint32_t lang, nsISupports **result)
+nsThreadClassInfo::GetHelperForLanguage(uint32_t aLang, nsISupports** aResult)
 {
-  *result = nullptr;
+  *aResult = nullptr;
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsThreadClassInfo::GetContractID(char **result)
+nsThreadClassInfo::GetContractID(char** aResult)
 {
-  *result = nullptr;
+  *aResult = nullptr;
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsThreadClassInfo::GetClassDescription(char **result)
+nsThreadClassInfo::GetClassDescription(char** aResult)
 {
-  *result = nullptr;
+  *aResult = nullptr;
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsThreadClassInfo::GetClassID(nsCID **result)
+nsThreadClassInfo::GetClassID(nsCID** aResult)
 {
-  *result = nullptr;
+  *aResult = nullptr;
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsThreadClassInfo::GetImplementationLanguage(uint32_t *result)
+nsThreadClassInfo::GetImplementationLanguage(uint32_t* aResult)
 {
-  *result = nsIProgrammingLanguage::CPLUSPLUS;
+  *aResult = nsIProgrammingLanguage::CPLUSPLUS;
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsThreadClassInfo::GetFlags(uint32_t *result)
+nsThreadClassInfo::GetFlags(uint32_t* aResult)
 {
-  *result = THREADSAFE;
+  *aResult = THREADSAFE;
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsThreadClassInfo::GetClassIDNoAlloc(nsCID *result)
+nsThreadClassInfo::GetClassIDNoAlloc(nsCID* aResult)
 {
   return NS_ERROR_NOT_AVAILABLE;
 }
@@ -175,30 +187,39 @@ NS_IMPL_CI_INTERFACE_GETTER(nsThread, nsIThread, nsIThreadInternal,
 
 //-----------------------------------------------------------------------------
 
-class nsThreadStartupEvent : public nsRunnable {
+class nsThreadStartupEvent : public nsRunnable
+{
 public:
   nsThreadStartupEvent()
     : mMon("nsThreadStartupEvent.mMon")
-    , mInitialized(false) {
+    , mInitialized(false)
+  {
   }
 
   // This method does not return until the thread startup object is in the
   // completion state.
-  void Wait() {
-    if (mInitialized)  // Maybe avoid locking...
+  void Wait()
+  {
+    if (mInitialized) {
+      // Maybe avoid locking...
       return;
+    }
+
     ReentrantMonitorAutoEnter mon(mMon);
-    while (!mInitialized)
+    while (!mInitialized) {
       mon.Wait();
+    }
   }
 
   // This method needs to be public to support older compilers (xlC_r on AIX).
   // It should be called directly as this class type is reference counted.
-  virtual ~nsThreadStartupEvent() {
+  virtual ~nsThreadStartupEvent()
+  {
   }
 
 private:
-  NS_IMETHOD Run() {
+  NS_IMETHOD Run()
+  {
     ReentrantMonitorAutoEnter mon(mMon);
     mInitialized = true;
     mon.Notify();
@@ -206,45 +227,53 @@ private:
   }
 
   ReentrantMonitor mMon;
-  bool       mInitialized;
+  bool mInitialized;
 };
 
 //-----------------------------------------------------------------------------
 
-struct nsThreadShutdownContext {
-  nsThread *joiningThread;
+struct nsThreadShutdownContext
+{
+  nsThread* joiningThread;
   bool      shutdownAck;
 };
 
 // This event is responsible for notifying nsThread::Shutdown that it is time
 // to call PR_JoinThread.
-class nsThreadShutdownAckEvent : public nsRunnable {
+class nsThreadShutdownAckEvent : public nsRunnable
+{
 public:
-  nsThreadShutdownAckEvent(nsThreadShutdownContext *ctx)
-    : mShutdownContext(ctx) {
+  nsThreadShutdownAckEvent(nsThreadShutdownContext* aCtx)
+    : mShutdownContext(aCtx)
+  {
   }
-  NS_IMETHOD Run() {
+  NS_IMETHOD Run()
+  {
     mShutdownContext->shutdownAck = true;
     return NS_OK;
   }
 private:
-  nsThreadShutdownContext *mShutdownContext;
+  nsThreadShutdownContext* mShutdownContext;
 };
 
 // This event is responsible for setting mShutdownContext
-class nsThreadShutdownEvent : public nsRunnable {
+class nsThreadShutdownEvent : public nsRunnable
+{
 public:
-  nsThreadShutdownEvent(nsThread *thr, nsThreadShutdownContext *ctx)
-    : mThread(thr), mShutdownContext(ctx) {
-  } 
-  NS_IMETHOD Run() {
+  nsThreadShutdownEvent(nsThread* aThr, nsThreadShutdownContext* aCtx)
+    : mThread(aThr)
+    , mShutdownContext(aCtx)
+  {
+  }
+  NS_IMETHOD Run()
+  {
     mThread->mShutdownContext = mShutdownContext;
     MessageLoop::current()->Quit();
     return NS_OK;
   }
 private:
   nsRefPtr<nsThread>       mThread;
-  nsThreadShutdownContext *mShutdownContext;
+  nsThreadShutdownContext* mShutdownContext;
 };
 
 //-----------------------------------------------------------------------------
@@ -272,8 +301,8 @@ SetupCurrentThreadForChaosMode()
   setpriority(PRIO_PROCESS, 0, ChaosMode::randomUint32LessThan(4));
 #else
   // We should set the affinity here but NSPR doesn't provide a way to expose it.
-  PR_SetThreadPriority(PR_GetCurrentThread(),
-    PRThreadPriority(ChaosMode::randomUint32LessThan(PR_PRIORITY_LAST + 1)));
+  uint32_t priority = ChaosMode::randomUint32LessThan(PR_PRIORITY_LAST + 1);
+  PR_SetThreadPriority(PR_GetCurrentThread(), PRThreadPriority(priority));
 #endif
 
 #ifdef HAVE_SCHED_SETAFFINITY
@@ -288,9 +317,9 @@ SetupCurrentThreadForChaosMode()
 }
 
 /*static*/ void
-nsThread::ThreadFunc(void *arg)
+nsThread::ThreadFunc(void* aArg)
 {
-  nsThread *self = static_cast<nsThread *>(arg);  // strong reference
+  nsThread* self = static_cast<nsThread*>(aArg);  // strong reference
   self->mThread = PR_GetCurrentThread();
   SetupCurrentThreadForChaosMode();
 
@@ -308,7 +337,8 @@ nsThread::ThreadFunc(void *arg)
   event->Run();  // unblocks nsThread::Init
   event = nullptr;
 
-  { // Scope for MessageLoop.
+  {
+    // Scope for MessageLoop.
     nsAutoPtr<MessageLoop> loop(
       new MessageLoop(MessageLoop::TYPE_MOZILLA_NONMAINTHREAD));
 
@@ -384,13 +414,13 @@ nsThread::Init()
 {
   // spawn thread and wait until it is fully setup
   nsRefPtr<nsThreadStartupEvent> startup = new nsThreadStartupEvent();
- 
+
   NS_ADDREF_THIS();
- 
+
   mShutdownRequired = true;
 
   // ThreadFunc is responsible for setting mThread
-  PRThread *thr = PR_CreateThread(PR_USER_THREAD, ThreadFunc, this,
+  PRThread* thr = PR_CreateThread(PR_USER_THREAD, ThreadFunc, this,
                                   PR_PRIORITY_NORMAL, PR_GLOBAL_THREAD,
                                   PR_JOINABLE_THREAD, mStackSize);
   if (!thr) {
@@ -423,84 +453,90 @@ nsThread::InitCurrentThread()
 }
 
 nsresult
-nsThread::PutEvent(nsIRunnable *event, nsNestedEventTarget *target)
+nsThread::PutEvent(nsIRunnable* aEvent, nsNestedEventTarget* aTarget)
 {
   {
     MutexAutoLock lock(mLock);
-    nsChainedEventQueue *queue = target ? target->mQueue : &mEventsRoot;
+    nsChainedEventQueue* queue = aTarget ? aTarget->mQueue : &mEventsRoot;
     if (!queue || (queue == &mEventsRoot && mEventsAreDoomed)) {
       NS_WARNING("An event was posted to a thread that will never run it (rejected)");
       return NS_ERROR_UNEXPECTED;
     }
-    queue->PutEvent(event);
+    queue->PutEvent(aEvent);
   }
 
   nsCOMPtr<nsIThreadObserver> obs = GetObserver();
-  if (obs)
+  if (obs) {
     obs->OnDispatchedEvent(this);
+  }
 
   return NS_OK;
 }
 
 nsresult
-nsThread::DispatchInternal(nsIRunnable *event, uint32_t flags,
-                           nsNestedEventTarget *target)
+nsThread::DispatchInternal(nsIRunnable* aEvent, uint32_t aFlags,
+                           nsNestedEventTarget* aTarget)
 {
-  if (NS_WARN_IF(!event))
+  if (NS_WARN_IF(!aEvent)) {
     return NS_ERROR_INVALID_ARG;
+  }
 
-  if (gXPCOMThreadsShutDown && MAIN_THREAD != mIsMainThread && !target) {
+  if (gXPCOMThreadsShutDown && MAIN_THREAD != mIsMainThread && !aTarget) {
     return NS_ERROR_ILLEGAL_DURING_SHUTDOWN;
   }
 
 #ifdef MOZ_TASK_TRACER
-  nsRefPtr<nsIRunnable> tracedRunnable = CreateTracedRunnable(event);
-  event = tracedRunnable;
+  nsRefPtr<nsIRunnable> tracedRunnable = CreateTracedRunnable(aEvent);
+  aEvent = tracedRunnable;
 #endif
 
-  if (flags & DISPATCH_SYNC) {
-    nsThread *thread = nsThreadManager::get()->GetCurrentThread();
-    if (NS_WARN_IF(!thread))
+  if (aFlags & DISPATCH_SYNC) {
+    nsThread* thread = nsThreadManager::get()->GetCurrentThread();
+    if (NS_WARN_IF(!thread)) {
       return NS_ERROR_NOT_AVAILABLE;
+    }
 
     // XXX we should be able to do something better here... we should
     //     be able to monitor the slot occupied by this event and use
     //     that to tell us when the event has been processed.
 
     nsRefPtr<nsThreadSyncDispatch> wrapper =
-        new nsThreadSyncDispatch(thread, event);
-    if (!wrapper)
+      new nsThreadSyncDispatch(thread, aEvent);
+    if (!wrapper) {
       return NS_ERROR_OUT_OF_MEMORY;
-    nsresult rv = PutEvent(wrapper, target);
+    }
+    nsresult rv = PutEvent(wrapper, aTarget);
     // Don't wait for the event to finish if we didn't dispatch it...
-    if (NS_FAILED(rv))
+    if (NS_FAILED(rv)) {
       return rv;
+    }
 
     // Allows waiting; ensure no locks are held that would deadlock us!
-    while (wrapper->IsPending())
+    while (wrapper->IsPending()) {
       NS_ProcessNextEvent(thread, true);
+    }
     return wrapper->Result();
   }
 
-  NS_ASSERTION(flags == NS_DISPATCH_NORMAL, "unexpected dispatch flags");
-  return PutEvent(event, target);
+  NS_ASSERTION(aFlags == NS_DISPATCH_NORMAL, "unexpected dispatch flags");
+  return PutEvent(aEvent, aTarget);
 }
 
 //-----------------------------------------------------------------------------
 // nsIEventTarget
 
 NS_IMETHODIMP
-nsThread::Dispatch(nsIRunnable *event, uint32_t flags)
+nsThread::Dispatch(nsIRunnable* aEvent, uint32_t aFlags)
 {
-  LOG(("THRD(%p) Dispatch [%p %x]\n", this, event, flags));
+  LOG(("THRD(%p) Dispatch [%p %x]\n", this, aEvent, aFlags));
 
-  return DispatchInternal(event, flags, nullptr);
+  return DispatchInternal(aEvent, aFlags, nullptr);
 }
 
 NS_IMETHODIMP
-nsThread::IsOnCurrentThread(bool *result)
+nsThread::IsOnCurrentThread(bool* aResult)
 {
-  *result = (PR_GetCurrentThread() == mThread);
+  *aResult = (PR_GetCurrentThread() == mThread);
   return NS_OK;
 }
 
@@ -508,9 +544,9 @@ nsThread::IsOnCurrentThread(bool *result)
 // nsIThread
 
 NS_IMETHODIMP
-nsThread::GetPRThread(PRThread **result)
+nsThread::GetPRThread(PRThread** aResult)
 {
-  *result = mThread;
+  *aResult = mThread;
   return NS_OK;
 }
 
@@ -522,17 +558,20 @@ nsThread::Shutdown()
   // XXX If we make this warn, then we hit that warning at xpcom shutdown while
   //     shutting down a thread in a thread pool.  That happens b/c the thread
   //     in the thread pool is already shutdown by the thread manager.
-  if (!mThread)
+  if (!mThread) {
     return NS_OK;
+  }
 
-  if (NS_WARN_IF(mThread == PR_GetCurrentThread()))
+  if (NS_WARN_IF(mThread == PR_GetCurrentThread())) {
     return NS_ERROR_UNEXPECTED;
+  }
 
   // Prevent multiple calls to this method
   {
     MutexAutoLock lock(mLock);
-    if (!mShutdownRequired)
+    if (!mShutdownRequired) {
       return NS_ERROR_UNEXPECTED;
+    }
     mShutdownRequired = false;
   }
 
@@ -543,19 +582,21 @@ nsThread::Shutdown()
   // Set mShutdownContext and wake up the thread in case it is waiting for
   // events to process.
   nsCOMPtr<nsIRunnable> event = new nsThreadShutdownEvent(this, &context);
-  if (!event)
+  if (!event) {
     return NS_ERROR_OUT_OF_MEMORY;
+  }
   // XXXroc What if posting the event fails due to OOM?
   PutEvent(event, nullptr);
 
   // We could still end up with other events being added after the shutdown
   // task, but that's okay because we process pending events in ThreadFunc
   // after setting mShutdownContext just before exiting.
-  
+
   // Process events on the current thread until we receive a shutdown ACK.
   // Allows waiting; ensure no locks are held that would deadlock us!
-  while (!context.shutdownAck)
+  while (!context.shutdownAck) {
     NS_ProcessNextEvent(context.joiningThread, true);
+  }
 
   // Now, it should be safe to join without fear of dead-locking.
 
@@ -578,44 +619,50 @@ nsThread::Shutdown()
 }
 
 NS_IMETHODIMP
-nsThread::HasPendingEvents(bool *result)
+nsThread::HasPendingEvents(bool* aResult)
 {
-  if (NS_WARN_IF(PR_GetCurrentThread() != mThread))
+  if (NS_WARN_IF(PR_GetCurrentThread() != mThread)) {
     return NS_ERROR_NOT_SAME_THREAD;
+  }
 
-  *result = mEvents->GetEvent(false, nullptr);
+  *aResult = mEvents->GetEvent(false, nullptr);
   return NS_OK;
 }
 
 #ifdef MOZ_CANARY
-void canary_alarm_handler (int signum);
+void canary_alarm_handler(int signum);
 
-class Canary {
-//XXX ToDo: support nested loops
+class Canary
+{
+  //XXX ToDo: support nested loops
 public:
-  Canary() {
+  Canary()
+  {
     if (sCanaryOutputFD > 0 && EventLatencyIsImportant()) {
       signal(SIGALRM, canary_alarm_handler);
-      ualarm(15000, 0);      
+      ualarm(15000, 0);
     }
   }
 
-  ~Canary() {
-    if (sCanaryOutputFD != 0 && EventLatencyIsImportant())
+  ~Canary()
+  {
+    if (sCanaryOutputFD != 0 && EventLatencyIsImportant()) {
       ualarm(0, 0);
+    }
   }
 
-  static bool EventLatencyIsImportant() {
+  static bool EventLatencyIsImportant()
+  {
     return NS_IsMainThread() && XRE_GetProcessType() == GeckoProcessType_Default;
   }
 };
 
-void canary_alarm_handler (int signum)
+void canary_alarm_handler(int signum)
 {
-  void *array[30];
+  void* array[30];
   const char msg[29] = "event took too long to run:\n";
   // use write to be safe in the signal handler
-  write(sCanaryOutputFD, msg, sizeof(msg)); 
+  write(sCanaryOutputFD, msg, sizeof(msg));
   backtrace_symbols_fd(array, backtrace(array, 30), sCanaryOutputFD);
 }
 
@@ -635,12 +682,13 @@ void canary_alarm_handler (int signum)
   PR_END_MACRO
 
 NS_IMETHODIMP
-nsThread::ProcessNextEvent(bool mayWait, bool *result)
+nsThread::ProcessNextEvent(bool aMayWait, bool* aResult)
 {
-  LOG(("THRD(%p) ProcessNextEvent [%u %u]\n", this, mayWait, mRunningEvent));
+  LOG(("THRD(%p) ProcessNextEvent [%u %u]\n", this, aMayWait, mRunningEvent));
 
-  if (NS_WARN_IF(PR_GetCurrentThread() != mThread))
+  if (NS_WARN_IF(PR_GetCurrentThread() != mThread)) {
     return NS_ERROR_NOT_SAME_THREAD;
+  }
 
   // The toplevel event loop normally blocks waiting for the next event, but
   // if we're trying to shut this thread down, we must exit the event loop when
@@ -650,10 +698,11 @@ nsThread::ProcessNextEvent(bool mayWait, bool *result)
   // to block even if something has requested shutdown of the thread. Otherwise
   // we'll just busywait as we endlessly look for an event, fail to find one,
   // and repeat the nested event loop since its state change hasn't happened yet.
-  bool reallyWait = mayWait && (mRunningEvent > 0 || !ShuttingDown());
+  bool reallyWait = aMayWait && (mRunningEvent > 0 || !ShuttingDown());
 
-  if (MAIN_THREAD == mIsMainThread && reallyWait)
+  if (MAIN_THREAD == mIsMainThread && reallyWait) {
     HangMonitor::Suspend();
+  }
 
   // Fire a memory pressure notification, if we're the main thread and one is
   // pending.
@@ -670,7 +719,7 @@ nsThread::ProcessNextEvent(bool mayWait, bool *result)
       if (os) {
         os->NotifyObservers(nullptr, "memory-pressure",
                             mpPending == MemPressure_New ? lowMem.get() :
-                                                           lowMemOngoing.get());
+                            lowMemOngoing.get());
       } else {
         NS_WARNING("Can't get observer service!");
       }
@@ -679,12 +728,14 @@ nsThread::ProcessNextEvent(bool mayWait, bool *result)
 
   bool notifyMainThreadObserver =
     (MAIN_THREAD == mIsMainThread) && sMainThreadObserver;
-  if (notifyMainThreadObserver) 
-   sMainThreadObserver->OnProcessNextEvent(this, reallyWait, mRunningEvent);
+  if (notifyMainThreadObserver) {
+    sMainThreadObserver->OnProcessNextEvent(this, reallyWait, mRunningEvent);
+  }
 
   nsCOMPtr<nsIThreadObserver> obs = mObserver;
-  if (obs)
+  if (obs) {
     obs->OnProcessNextEvent(this, reallyWait, mRunningEvent);
+  }
 
   NOTIFY_EVENT_OBSERVERS(OnProcessNextEvent,
                          (this, reallyWait, mRunningEvent));
@@ -705,14 +756,15 @@ nsThread::ProcessNextEvent(bool mayWait, bool *result)
     nsCOMPtr<nsIRunnable> event;
     mEvents->GetEvent(reallyWait, getter_AddRefs(event));
 
-    *result = (event.get() != nullptr);
+    *aResult = (event.get() != nullptr);
 
     if (event) {
       LOG(("THRD(%p) running [%p]\n", this, event.get()));
-      if (MAIN_THREAD == mIsMainThread)
+      if (MAIN_THREAD == mIsMainThread) {
         HangMonitor::NotifyActivity();
+      }
       event->Run();
-    } else if (mayWait) {
+    } else if (aMayWait) {
       MOZ_ASSERT(ShuttingDown(),
                  "This should only happen when shutting down");
       rv = NS_ERROR_UNEXPECTED;
@@ -722,13 +774,15 @@ nsThread::ProcessNextEvent(bool mayWait, bool *result)
   --mRunningEvent;
 
   NOTIFY_EVENT_OBSERVERS(AfterProcessNextEvent,
-                         (this, mRunningEvent, *result));
+                         (this, mRunningEvent, *aResult));
 
-  if (obs)
-    obs->AfterProcessNextEvent(this, mRunningEvent, *result);
+  if (obs) {
+    obs->AfterProcessNextEvent(this, mRunningEvent, *aResult);
+  }
 
-  if (notifyMainThreadObserver && sMainThreadObserver)
-    sMainThreadObserver->AfterProcessNextEvent(this, mRunningEvent, *result);
+  if (notifyMainThreadObserver && sMainThreadObserver) {
+    sMainThreadObserver->AfterProcessNextEvent(this, mRunningEvent, *aResult);
+  }
 
   return rv;
 }
@@ -737,17 +791,18 @@ nsThread::ProcessNextEvent(bool mayWait, bool *result)
 // nsISupportsPriority
 
 NS_IMETHODIMP
-nsThread::GetPriority(int32_t *priority)
+nsThread::GetPriority(int32_t* aPriority)
 {
-  *priority = mPriority;
+  *aPriority = mPriority;
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsThread::SetPriority(int32_t priority)
+nsThread::SetPriority(int32_t aPriority)
 {
-  if (NS_WARN_IF(!mThread))
+  if (NS_WARN_IF(!mThread)) {
     return NS_ERROR_NOT_INITIALIZED;
+  }
 
   // NSPR defines the following four thread priorities:
   //   PR_PRIORITY_LOW
@@ -756,7 +811,7 @@ nsThread::SetPriority(int32_t priority)
   //   PR_PRIORITY_URGENT
   // We map the priority values defined on nsISupportsPriority to these values.
 
-  mPriority = priority;
+  mPriority = aPriority;
 
   PRThreadPriority pri;
   if (mPriority <= PRIORITY_HIGHEST) {
@@ -777,55 +832,59 @@ nsThread::SetPriority(int32_t priority)
 }
 
 NS_IMETHODIMP
-nsThread::AdjustPriority(int32_t delta)
+nsThread::AdjustPriority(int32_t aDelta)
 {
-  return SetPriority(mPriority + delta);
+  return SetPriority(mPriority + aDelta);
 }
 
 //-----------------------------------------------------------------------------
 // nsIThreadInternal
 
 NS_IMETHODIMP
-nsThread::GetObserver(nsIThreadObserver **obs)
+nsThread::GetObserver(nsIThreadObserver** aObs)
 {
   MutexAutoLock lock(mLock);
-  NS_IF_ADDREF(*obs = mObserver);
+  NS_IF_ADDREF(*aObs = mObserver);
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsThread::SetObserver(nsIThreadObserver *obs)
+nsThread::SetObserver(nsIThreadObserver* aObs)
 {
-  if (NS_WARN_IF(PR_GetCurrentThread() != mThread))
+  if (NS_WARN_IF(PR_GetCurrentThread() != mThread)) {
     return NS_ERROR_NOT_SAME_THREAD;
+  }
 
   MutexAutoLock lock(mLock);
-  mObserver = obs;
+  mObserver = aObs;
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsThread::GetRecursionDepth(uint32_t *depth)
+nsThread::GetRecursionDepth(uint32_t* aDepth)
 {
-  if (NS_WARN_IF(PR_GetCurrentThread() != mThread))
+  if (NS_WARN_IF(PR_GetCurrentThread() != mThread)) {
     return NS_ERROR_NOT_SAME_THREAD;
+  }
 
-  *depth = mRunningEvent;
+  *aDepth = mRunningEvent;
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsThread::AddObserver(nsIThreadObserver *observer)
+nsThread::AddObserver(nsIThreadObserver* aObserver)
 {
-  if (NS_WARN_IF(!observer))
+  if (NS_WARN_IF(!aObserver)) {
     return NS_ERROR_INVALID_ARG;
-  if (NS_WARN_IF(PR_GetCurrentThread() != mThread))
+  }
+  if (NS_WARN_IF(PR_GetCurrentThread() != mThread)) {
     return NS_ERROR_NOT_SAME_THREAD;
+  }
 
-  NS_WARN_IF_FALSE(!mEventObservers.Contains(observer),
+  NS_WARN_IF_FALSE(!mEventObservers.Contains(aObserver),
                    "Adding an observer twice!");
 
-  if (!mEventObservers.AppendElement(observer)) {
+  if (!mEventObservers.AppendElement(aObserver)) {
     NS_WARNING("Out of memory!");
     return NS_ERROR_OUT_OF_MEMORY;
   }
@@ -834,12 +893,13 @@ nsThread::AddObserver(nsIThreadObserver *observer)
 }
 
 NS_IMETHODIMP
-nsThread::RemoveObserver(nsIThreadObserver *observer)
+nsThread::RemoveObserver(nsIThreadObserver* aObserver)
 {
-  if (NS_WARN_IF(PR_GetCurrentThread() != mThread))
+  if (NS_WARN_IF(PR_GetCurrentThread() != mThread)) {
     return NS_ERROR_NOT_SAME_THREAD;
+  }
 
-  if (observer && !mEventObservers.RemoveElement(observer)) {
+  if (aObserver && !mEventObservers.RemoveElement(aObserver)) {
     NS_WARNING("Removing an observer that was never added!");
   }
 
@@ -847,12 +907,13 @@ nsThread::RemoveObserver(nsIThreadObserver *observer)
 }
 
 NS_IMETHODIMP
-nsThread::PushEventQueue(nsIEventTarget **result)
+nsThread::PushEventQueue(nsIEventTarget** aResult)
 {
-  if (NS_WARN_IF(PR_GetCurrentThread() != mThread))
+  if (NS_WARN_IF(PR_GetCurrentThread() != mThread)) {
     return NS_ERROR_NOT_SAME_THREAD;
+  }
 
-  nsChainedEventQueue *queue = new nsChainedEventQueue();
+  nsChainedEventQueue* queue = new nsChainedEventQueue();
   queue->mEventTarget = new nsNestedEventTarget(this, queue);
 
   {
@@ -861,18 +922,20 @@ nsThread::PushEventQueue(nsIEventTarget **result)
     mEvents = queue;
   }
 
-  NS_ADDREF(*result = queue->mEventTarget);
+  NS_ADDREF(*aResult = queue->mEventTarget);
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsThread::PopEventQueue(nsIEventTarget *innermostTarget)
+nsThread::PopEventQueue(nsIEventTarget* aInnermostTarget)
 {
-  if (NS_WARN_IF(PR_GetCurrentThread() != mThread))
+  if (NS_WARN_IF(PR_GetCurrentThread() != mThread)) {
     return NS_ERROR_NOT_SAME_THREAD;
+  }
 
-  if (NS_WARN_IF(!innermostTarget))
+  if (NS_WARN_IF(!aInnermostTarget)) {
     return NS_ERROR_NULL_POINTER;
+  }
 
   // Don't delete or release anything while holding the lock.
   nsAutoPtr<nsChainedEventQueue> queue;
@@ -882,8 +945,9 @@ nsThread::PopEventQueue(nsIEventTarget *innermostTarget)
     MutexAutoLock lock(mLock);
 
     // Make sure we're popping the innermost event target.
-    if (NS_WARN_IF(mEvents->mEventTarget != innermostTarget))
+    if (NS_WARN_IF(mEvents->mEventTarget != aInnermostTarget)) {
       return NS_ERROR_UNEXPECTED;
+    }
 
     MOZ_ASSERT(mEvents != &mEventsRoot);
 
@@ -891,8 +955,9 @@ nsThread::PopEventQueue(nsIEventTarget *innermostTarget)
     mEvents = mEvents->mNext;
 
     nsCOMPtr<nsIRunnable> event;
-    while (queue->GetEvent(false, getter_AddRefs(event)))
+    while (queue->GetEvent(false, getter_AddRefs(event))) {
       mEvents->PutEvent(event);
+    }
 
     // Don't let the event target post any more events.
     queue->mEventTarget.swap(target);
@@ -936,16 +1001,16 @@ nsThreadSyncDispatch::Run()
 NS_IMPL_ISUPPORTS(nsThread::nsNestedEventTarget, nsIEventTarget)
 
 NS_IMETHODIMP
-nsThread::nsNestedEventTarget::Dispatch(nsIRunnable *event, uint32_t flags)
+nsThread::nsNestedEventTarget::Dispatch(nsIRunnable* aEvent, uint32_t aFlags)
 {
-  LOG(("THRD(%p) Dispatch [%p %x] to nested loop %p\n", mThread.get(), event,
-       flags, this));
+  LOG(("THRD(%p) Dispatch [%p %x] to nested loop %p\n", mThread.get(), aEvent,
+       aFlags, this));
 
-  return mThread->DispatchInternal(event, flags, this);
+  return mThread->DispatchInternal(aEvent, aFlags, this);
 }
 
 NS_IMETHODIMP
-nsThread::nsNestedEventTarget::IsOnCurrentThread(bool *result)
+nsThread::nsNestedEventTarget::IsOnCurrentThread(bool* aResult)
 {
-  return mThread->IsOnCurrentThread(result);
+  return mThread->IsOnCurrentThread(aResult);
 }
diff --git a/xpcom/threads/nsThread.h b/xpcom/threads/nsThread.h
index 0c3c839a1d50..ac5c7b98ede1 100644
--- a/xpcom/threads/nsThread.h
+++ b/xpcom/threads/nsThread.h
@@ -18,8 +18,9 @@
 #include "nsAutoPtr.h"
 
 // A native thread
-class nsThread : public nsIThreadInternal,
-                 public nsISupportsPriority
+class nsThread
+  : public nsIThreadInternal
+  , public nsISupportsPriority
 {
 public:
   NS_DECL_THREADSAFE_ISUPPORTS
@@ -28,7 +29,8 @@ public:
   NS_DECL_NSITHREADINTERNAL
   NS_DECL_NSISUPPORTSPRIORITY
 
-  enum MainThreadFlag {
+  enum MainThreadFlag
+  {
     MAIN_THREAD,
     NOT_MAIN_THREAD
   };
@@ -42,14 +44,23 @@ public:
   nsresult InitCurrentThread();
 
   // The PRThread corresponding to this thread.
-  PRThread *GetPRThread() { return mThread; }
+  PRThread* GetPRThread()
+  {
+    return mThread;
+  }
 
   // If this flag is true, then the nsThread was created using
   // nsIThreadManager::NewThread.
-  bool ShutdownRequired() { return mShutdownRequired; }
+  bool ShutdownRequired()
+  {
+    return mShutdownRequired;
+  }
 
   // Clear the observer list.
-  void ClearObservers() { mEventObservers.Clear(); }
+  void ClearObservers()
+  {
+    mEventObservers.Clear();
+  }
 
   static nsresult
   SetMainThreadObserver(nsIThreadObserver* aObserver);
@@ -66,59 +77,72 @@ protected:
 
   virtual ~nsThread();
 
-  bool ShuttingDown() { return mShutdownContext != nullptr; }
+  bool ShuttingDown()
+  {
+    return mShutdownContext != nullptr;
+  }
 
-  static void ThreadFunc(void *arg);
+  static void ThreadFunc(void* aArg);
 
   // Helper
-  already_AddRefed<nsIThreadObserver> GetObserver() {
-    nsIThreadObserver *obs;
+  already_AddRefed<nsIThreadObserver> GetObserver()
+  {
+    nsIThreadObserver* obs;
     nsThread::GetObserver(&obs);
     return already_AddRefed<nsIThreadObserver>(obs);
   }
 
   // Wrappers for event queue methods:
-  bool GetEvent(bool mayWait, nsIRunnable **event) {
-    return mEvents->GetEvent(mayWait, event);
+  bool GetEvent(bool aMayWait, nsIRunnable** aEvent)
+  {
+    return mEvents->GetEvent(aMayWait, aEvent);
   }
-  nsresult PutEvent(nsIRunnable *event, nsNestedEventTarget *target);
+  nsresult PutEvent(nsIRunnable* aEvent, nsNestedEventTarget* aTarget);
 
-  nsresult DispatchInternal(nsIRunnable *event, uint32_t flags,
-                            nsNestedEventTarget *target);
+  nsresult DispatchInternal(nsIRunnable* aEvent, uint32_t aFlags,
+                            nsNestedEventTarget* aTarget);
 
   // Wrapper for nsEventQueue that supports chaining.
-  class nsChainedEventQueue {
+  class nsChainedEventQueue
+  {
   public:
     nsChainedEventQueue()
-      : mNext(nullptr) {
+      : mNext(nullptr)
+    {
     }
 
-    bool GetEvent(bool mayWait, nsIRunnable **event) {
-      return mQueue.GetEvent(mayWait, event);
+    bool GetEvent(bool aMayWait, nsIRunnable** aEvent)
+    {
+      return mQueue.GetEvent(aMayWait, aEvent);
     }
 
-    void PutEvent(nsIRunnable *event) {
-      mQueue.PutEvent(event);
+    void PutEvent(nsIRunnable* aEvent)
+    {
+      mQueue.PutEvent(aEvent);
     }
 
-    bool HasPendingEvent() {
+    bool HasPendingEvent()
+    {
       return mQueue.HasPendingEvent();
     }
 
-    nsChainedEventQueue *mNext;
+    nsChainedEventQueue* mNext;
     nsRefPtr<nsNestedEventTarget> mEventTarget;
 
   private:
     nsEventQueue mQueue;
   };
 
-  class nsNestedEventTarget MOZ_FINAL : public nsIEventTarget {
+  class nsNestedEventTarget MOZ_FINAL : public nsIEventTarget
+  {
   public:
     NS_DECL_THREADSAFE_ISUPPORTS
     NS_DECL_NSIEVENTTARGET
 
-    nsNestedEventTarget(nsThread *thread, nsChainedEventQueue *queue)
-      : mThread(thread), mQueue(queue) {
+    nsNestedEventTarget(nsThread* aThread, nsChainedEventQueue* aQueue)
+      : mThread(aThread)
+      , mQueue(aQueue)
+    {
     }
 
     nsRefPtr<nsThread> mThread;
@@ -127,7 +151,9 @@ protected:
     nsChainedEventQueue* mQueue;
 
   private:
-    ~nsNestedEventTarget() {}
+    ~nsNestedEventTarget()
+    {
+    }
   };
 
   // This lock protects access to mObserver, mEvents and mEventsAreDoomed.
@@ -142,15 +168,15 @@ protected:
   // Only accessed on the target thread.
   nsAutoTObserverArray<nsCOMPtr<nsIThreadObserver>, 2> mEventObservers;
 
-  nsChainedEventQueue *mEvents;   // never null
+  nsChainedEventQueue* mEvents;  // never null
   nsChainedEventQueue  mEventsRoot;
 
   int32_t   mPriority;
-  PRThread *mThread;
+  PRThread* mThread;
   uint32_t  mRunningEvent;  // counter
   uint32_t  mStackSize;
 
-  struct nsThreadShutdownContext *mShutdownContext;
+  struct nsThreadShutdownContext* mShutdownContext;
 
   bool mShutdownRequired;
   // Set to true when events posted to this thread will never run.
@@ -160,17 +186,23 @@ protected:
 
 //-----------------------------------------------------------------------------
 
-class nsThreadSyncDispatch : public nsRunnable {
+class nsThreadSyncDispatch : public nsRunnable
+{
 public:
-  nsThreadSyncDispatch(nsIThread *origin, nsIRunnable *task)
-    : mOrigin(origin), mSyncTask(task), mResult(NS_ERROR_NOT_INITIALIZED) {
+  nsThreadSyncDispatch(nsIThread* aOrigin, nsIRunnable* aTask)
+    : mOrigin(aOrigin)
+    , mSyncTask(aTask)
+    , mResult(NS_ERROR_NOT_INITIALIZED)
+  {
   }
 
-  bool IsPending() {
+  bool IsPending()
+  {
     return mSyncTask != nullptr;
   }
 
-  nsresult Result() {
+  nsresult Result()
+  {
     return mResult;
   }
 
diff --git a/xpcom/threads/nsThreadManager.cpp b/xpcom/threads/nsThreadManager.cpp
index efe932109f71..25ab176218a6 100644
--- a/xpcom/threads/nsThreadManager.cpp
+++ b/xpcom/threads/nsThreadManager.cpp
@@ -24,27 +24,35 @@ DWORD gTLSThreadIDIndex = TlsAlloc();
 NS_TLS mozilla::threads::ID gTLSThreadID = mozilla::threads::Generic;
 #endif
 
-typedef nsTArray< nsRefPtr<nsThread> > nsThreadArray;
+typedef nsTArray<nsRefPtr<nsThread>> nsThreadArray;
 
 //-----------------------------------------------------------------------------
 
 static void
-ReleaseObject(void *data)
+ReleaseObject(void* aData)
 {
-  static_cast<nsISupports *>(data)->Release();
+  static_cast<nsISupports*>(aData)->Release();
 }
 
 static PLDHashOperator
-AppendAndRemoveThread(PRThread *key, nsRefPtr<nsThread> &thread, void *arg)
+AppendAndRemoveThread(PRThread* aKey, nsRefPtr<nsThread>& aThread, void* aArg)
 {
-  nsThreadArray *threads = static_cast<nsThreadArray *>(arg);
-  threads->AppendElement(thread);
+  nsThreadArray* threads = static_cast<nsThreadArray*>(aArg);
+  threads->AppendElement(aThread);
   return PL_DHASH_REMOVE;
 }
 
 // statically allocated instance
-NS_IMETHODIMP_(MozExternalRefCountType) nsThreadManager::AddRef() { return 2; }
-NS_IMETHODIMP_(MozExternalRefCountType) nsThreadManager::Release() { return 1; }
+NS_IMETHODIMP_(MozExternalRefCountType)
+nsThreadManager::AddRef()
+{
+  return 2;
+}
+NS_IMETHODIMP_(MozExternalRefCountType)
+nsThreadManager::Release()
+{
+  return 1;
+}
 NS_IMPL_CLASSINFO(nsThreadManager, nullptr,
                   nsIClassInfo::THREADSAFE | nsIClassInfo::SINGLETON,
                   NS_THREADMANAGER_CID)
@@ -59,11 +67,13 @@ nsThreadManager::Init()
   // Child processes need to initialize the thread manager before they
   // initialize XPCOM in order to set up the crash reporter. This leads to
   // situations where we get initialized twice.
-  if (mInitialized)
+  if (mInitialized) {
     return NS_OK;
+  }
 
-  if (PR_NewThreadPrivateIndex(&mCurThreadIndex, ReleaseObject) == PR_FAILURE)
+  if (PR_NewThreadPrivateIndex(&mCurThreadIndex, ReleaseObject) == PR_FAILURE) {
     return NS_ERROR_FAILURE;
+  }
 
   mLock = new Mutex("nsThreadManager.mLock");
 
@@ -71,9 +81,10 @@ nsThreadManager::Init()
   const int flags = O_WRONLY | O_APPEND | O_CREAT | O_NONBLOCK;
   const mode_t mode = S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH;
   char* env_var_flag = getenv("MOZ_KILL_CANARIES");
-  sCanaryOutputFD = env_var_flag ? (env_var_flag[0] ?
-      open(env_var_flag, flags, mode) :
-      STDERR_FILENO) : 0;
+  sCanaryOutputFD =
+    env_var_flag ? (env_var_flag[0] ? open(env_var_flag, flags, mode) :
+                                      STDERR_FILENO) :
+                   0;
 #endif
 
   // Setup "main" thread
@@ -90,7 +101,7 @@ nsThreadManager::Init()
   mMainThread->GetPRThread(&mMainPRThread);
 
 #ifdef XP_WIN
-  TlsSetValue(gTLSThreadIDIndex, (void*) mozilla::threads::Main);
+  TlsSetValue(gTLSThreadIDIndex, (void*)mozilla::threads::Main);
 #elif defined(NS_TLS)
   gTLSThreadID = mozilla::threads::Main;
 #endif
@@ -126,16 +137,17 @@ nsThreadManager::Shutdown()
   // accepting new events, but that could lead to badness if one of those
   // threads is stuck waiting for a response from another thread.  To do it
   // right, we'd need some way to interrupt the threads.
-  // 
+  //
   // Instead, we process events on the current thread while waiting for threads
   // to shutdown.  This means that we have to preserve a mostly functioning
   // world until such time as the threads exit.
 
   // Shutdown all threads that require it (join with threads that we created).
   for (uint32_t i = 0; i < threads.Length(); ++i) {
-    nsThread *thread = threads[i];
-    if (thread->ShutdownRequired())
+    nsThread* thread = threads[i];
+    if (thread->ShutdownRequired()) {
       thread->Shutdown();
+    }
   }
 
   // In case there are any more events somehow...
@@ -164,9 +176,9 @@ nsThreadManager::Shutdown()
 }
 
 void
-nsThreadManager::RegisterCurrentThread(nsThread *thread)
+nsThreadManager::RegisterCurrentThread(nsThread* aThread)
 {
-  MOZ_ASSERT(thread->GetPRThread() == PR_GetCurrentThread(), "bad thread");
+  MOZ_ASSERT(aThread->GetPRThread() == PR_GetCurrentThread(), "bad aThread");
 
   MutexAutoLock lock(*mLock);
 
@@ -175,33 +187,34 @@ nsThreadManager::RegisterCurrentThread(nsThread *thread)
     mHighestNumberOfThreads = mCurrentNumberOfThreads;
   }
 
-  mThreadsByPRThread.Put(thread->GetPRThread(), thread);  // XXX check OOM?
+  mThreadsByPRThread.Put(aThread->GetPRThread(), aThread);  // XXX check OOM?
 
-  NS_ADDREF(thread);  // for TLS entry
-  PR_SetThreadPrivate(mCurThreadIndex, thread);
+  NS_ADDREF(aThread);  // for TLS entry
+  PR_SetThreadPrivate(mCurThreadIndex, aThread);
 }
 
 void
-nsThreadManager::UnregisterCurrentThread(nsThread *thread)
+nsThreadManager::UnregisterCurrentThread(nsThread* aThread)
 {
-  MOZ_ASSERT(thread->GetPRThread() == PR_GetCurrentThread(), "bad thread");
+  MOZ_ASSERT(aThread->GetPRThread() == PR_GetCurrentThread(), "bad aThread");
 
   MutexAutoLock lock(*mLock);
 
   --mCurrentNumberOfThreads;
-  mThreadsByPRThread.Remove(thread->GetPRThread());
+  mThreadsByPRThread.Remove(aThread->GetPRThread());
 
   PR_SetThreadPrivate(mCurThreadIndex, nullptr);
   // Ref-count balanced via ReleaseObject
 }
 
-nsThread *
+nsThread*
 nsThreadManager::GetCurrentThread()
 {
   // read thread local storage
-  void *data = PR_GetThreadPrivate(mCurThreadIndex);
-  if (data)
-    return static_cast<nsThread *>(data);
+  void* data = PR_GetThreadPrivate(mCurThreadIndex);
+  if (data) {
+    return static_cast<nsThread*>(data);
+  }
 
   if (!mInitialized) {
     return nullptr;
@@ -209,24 +222,27 @@ nsThreadManager::GetCurrentThread()
 
   // OK, that's fine.  We'll dynamically create one :-)
   nsRefPtr<nsThread> thread = new nsThread(nsThread::NOT_MAIN_THREAD, 0);
-  if (!thread || NS_FAILED(thread->InitCurrentThread()))
+  if (!thread || NS_FAILED(thread->InitCurrentThread())) {
     return nullptr;
+  }
 
   return thread.get();  // reference held in TLS
 }
 
 NS_IMETHODIMP
-nsThreadManager::NewThread(uint32_t creationFlags,
-                           uint32_t stackSize,
-                           nsIThread **result)
+nsThreadManager::NewThread(uint32_t aCreationFlags,
+                           uint32_t aStackSize,
+                           nsIThread** aResult)
 {
   // No new threads during Shutdown
-  if (NS_WARN_IF(!mInitialized))
+  if (NS_WARN_IF(!mInitialized)) {
     return NS_ERROR_NOT_INITIALIZED;
+  }
 
-  nsThread *thr = new nsThread(nsThread::NOT_MAIN_THREAD, stackSize);
-  if (!thr)
+  nsThread* thr = new nsThread(nsThread::NOT_MAIN_THREAD, aStackSize);
+  if (!thr) {
     return NS_ERROR_OUT_OF_MEMORY;
+  }
   NS_ADDREF(thr);
 
   nsresult rv = thr->Init();
@@ -239,58 +255,63 @@ nsThreadManager::NewThread(uint32_t creationFlags,
   // however, it is possible that it could have also been replaced by now, so
   // we cannot really assert that it was added.
 
-  *result = thr;
+  *aResult = thr;
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsThreadManager::GetThreadFromPRThread(PRThread *thread, nsIThread **result)
+nsThreadManager::GetThreadFromPRThread(PRThread* aThread, nsIThread** aResult)
 {
   // Keep this functioning during Shutdown
-  if (NS_WARN_IF(!mMainThread))
+  if (NS_WARN_IF(!mMainThread)) {
     return NS_ERROR_NOT_INITIALIZED;
-  if (NS_WARN_IF(!thread))
+  }
+  if (NS_WARN_IF(!aThread)) {
     return NS_ERROR_INVALID_ARG;
+  }
 
   nsRefPtr<nsThread> temp;
   {
     MutexAutoLock lock(*mLock);
-    mThreadsByPRThread.Get(thread, getter_AddRefs(temp));
+    mThreadsByPRThread.Get(aThread, getter_AddRefs(temp));
   }
 
-  NS_IF_ADDREF(*result = temp);
+  NS_IF_ADDREF(*aResult = temp);
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsThreadManager::GetMainThread(nsIThread **result)
+nsThreadManager::GetMainThread(nsIThread** aResult)
 {
   // Keep this functioning during Shutdown
-  if (NS_WARN_IF(!mMainThread))
+  if (NS_WARN_IF(!mMainThread)) {
     return NS_ERROR_NOT_INITIALIZED;
-  NS_ADDREF(*result = mMainThread);
+  }
+  NS_ADDREF(*aResult = mMainThread);
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsThreadManager::GetCurrentThread(nsIThread **result)
+nsThreadManager::GetCurrentThread(nsIThread** aResult)
 {
   // Keep this functioning during Shutdown
-  if (NS_WARN_IF(!mMainThread))
+  if (NS_WARN_IF(!mMainThread)) {
     return NS_ERROR_NOT_INITIALIZED;
-  *result = GetCurrentThread();
-  if (!*result)
+  }
+  *aResult = GetCurrentThread();
+  if (!*aResult) {
     return NS_ERROR_OUT_OF_MEMORY;
-  NS_ADDREF(*result);
+  }
+  NS_ADDREF(*aResult);
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsThreadManager::GetIsMainThread(bool *result)
+nsThreadManager::GetIsMainThread(bool* aResult)
 {
   // This method may be called post-Shutdown
 
-  *result = (PR_GetCurrentThread() == mMainPRThread);
+  *aResult = (PR_GetCurrentThread() == mMainPRThread);
   return NS_OK;
 }
 
diff --git a/xpcom/threads/nsThreadManager.h b/xpcom/threads/nsThreadManager.h
index 64d82cb9c146..36819e2f6b34 100644
--- a/xpcom/threads/nsThreadManager.h
+++ b/xpcom/threads/nsThreadManager.h
@@ -20,7 +20,8 @@ public:
   NS_DECL_ISUPPORTS
   NS_DECL_NSITHREADMANAGER
 
-  static nsThreadManager *get() {
+  static nsThreadManager* get()
+  {
     static nsThreadManager sInstance;
     return &sInstance;
   }
@@ -33,15 +34,15 @@ public:
 
   // Called by nsThread to inform the ThreadManager it exists.  This method
   // must be called when the given thread is the current thread.
-  void RegisterCurrentThread(nsThread *thread);
+  void RegisterCurrentThread(nsThread* aThread);
 
   // Called by nsThread to inform the ThreadManager it is going away.  This
   // method must be called when the given thread is the current thread.
-  void UnregisterCurrentThread(nsThread *thread);
+  void UnregisterCurrentThread(nsThread* aThread);
 
   // Returns the current thread.  Returns null if OOM or if ThreadManager isn't
   // initialized.
-  nsThread *GetCurrentThread();
+  nsThread* GetCurrentThread();
 
   // Returns the maximal number of threads that have been in existence
   // simultaneously during the execution of the thread manager.
@@ -49,7 +50,9 @@ public:
 
   // This needs to be public in order to support static instantiation of this
   // class with older compilers (e.g., egcs-2.91.66).
-  ~nsThreadManager() {}
+  ~nsThreadManager()
+  {
+  }
 
 private:
   nsThreadManager()
@@ -58,22 +61,23 @@ private:
     , mLock(nullptr)
     , mInitialized(false)
     , mCurrentNumberOfThreads(1)
-    , mHighestNumberOfThreads(1) {
+    , mHighestNumberOfThreads(1)
+  {
   }
 
   nsRefPtrHashtable<nsPtrHashKey<PRThread>, nsThread> mThreadsByPRThread;
   unsigned             mCurThreadIndex;  // thread-local-storage index
   nsRefPtr<nsThread>  mMainThread;
-  PRThread           *mMainPRThread;
+  PRThread*           mMainPRThread;
   // This is a pointer in order to allow creating nsThreadManager from
   // the static context in debug builds.
   nsAutoPtr<mozilla::Mutex> mLock;  // protects tables
   bool                mInitialized;
 
-   // The current number of threads
-   uint32_t           mCurrentNumberOfThreads;
-   // The highest number of threads encountered so far during the session
-   uint32_t           mHighestNumberOfThreads;
+  // The current number of threads
+  uint32_t            mCurrentNumberOfThreads;
+  // The highest number of threads encountered so far during the session
+  uint32_t            mHighestNumberOfThreads;
 };
 
 #define NS_THREADMANAGER_CID                       \
diff --git a/xpcom/threads/nsThreadPool.cpp b/xpcom/threads/nsThreadPool.cpp
index 4e1b90fc692f..55543b9f9807 100644
--- a/xpcom/threads/nsThreadPool.cpp
+++ b/xpcom/threads/nsThreadPool.cpp
@@ -16,12 +16,13 @@
 using namespace mozilla;
 
 #ifdef PR_LOGGING
-static PRLogModuleInfo *
+static PRLogModuleInfo*
 GetThreadPoolLog()
 {
-  static PRLogModuleInfo *sLog;
-  if (!sLog)
+  static PRLogModuleInfo* sLog;
+  if (!sLog) {
     sLog = PR_NewLogModule("nsThreadPool");
+  }
   return sLog;
 }
 #endif
@@ -66,7 +67,7 @@ nsThreadPool::~nsThreadPool()
 }
 
 nsresult
-nsThreadPool::PutEvent(nsIRunnable *event)
+nsThreadPool::PutEvent(nsIRunnable* aEvent)
 {
   // Avoid spawning a new thread while holding the event queue lock...
 
@@ -77,31 +78,34 @@ nsThreadPool::PutEvent(nsIRunnable *event)
 
     LOG(("THRD-P(%p) put [%d %d %d]\n", this, mIdleCount, mThreads.Count(),
          mThreadLimit));
-    MOZ_ASSERT(mIdleCount <= (uint32_t) mThreads.Count(), "oops");
+    MOZ_ASSERT(mIdleCount <= (uint32_t)mThreads.Count(), "oops");
 
     // Make sure we have a thread to service this event.
-    if (mIdleCount == 0 && mThreads.Count() < (int32_t) mThreadLimit)
+    if (mIdleCount == 0 && mThreads.Count() < (int32_t)mThreadLimit) {
       spawnThread = true;
+    }
 
-    mEvents.PutEvent(event);
+    mEvents.PutEvent(aEvent);
     stackSize = mStackSize;
   }
 
   LOG(("THRD-P(%p) put [spawn=%d]\n", this, spawnThread));
-  if (!spawnThread)
+  if (!spawnThread) {
     return NS_OK;
+  }
 
   nsCOMPtr<nsIThread> thread;
   nsThreadManager::get()->NewThread(0,
                                     stackSize,
                                     getter_AddRefs(thread));
-  if (NS_WARN_IF(!thread))
+  if (NS_WARN_IF(!thread)) {
     return NS_ERROR_UNEXPECTED;
+  }
 
   bool killThread = false;
   {
     ReentrantMonitorAutoEnter mon(mEvents.GetReentrantMonitor());
-    if (mThreads.Count() < (int32_t) mThreadLimit) {
+    if (mThreads.Count() < (int32_t)mThreadLimit) {
       mThreads.AppendObject(thread);
     } else {
       killThread = true;  // okay, we don't need this thread anymore
@@ -126,16 +130,16 @@ nsThreadPool::PutEvent(nsIRunnable *event)
 }
 
 void
-nsThreadPool::ShutdownThread(nsIThread *thread)
+nsThreadPool::ShutdownThread(nsIThread* aThread)
 {
-  LOG(("THRD-P(%p) shutdown async [%p]\n", this, thread));
+  LOG(("THRD-P(%p) shutdown async [%p]\n", this, aThread));
 
-  // This method is responsible for calling Shutdown on |thread|.  This must be
+  // This method is responsible for calling Shutdown on |aThread|.  This must be
   // done from some other thread, so we use the main thread of the application.
 
   MOZ_ASSERT(!NS_IsMainThread(), "wrong thread");
 
-  nsRefPtr<nsIRunnable> r = NS_NewRunnableMethod(thread, &nsIThread::Shutdown);
+  nsRefPtr<nsIRunnable> r = NS_NewRunnableMethod(aThread, &nsIThread::Shutdown);
   NS_DispatchToMainThread(r);
 }
 
@@ -178,8 +182,9 @@ nsThreadPool::Run()
         } else {
           if (wasIdle) {
             // if too many idle threads or idle for too long, then bail.
-            if (mIdleCount > mIdleThreadLimit || (now - idleSince) >= timeout)
+            if (mIdleCount > mIdleThreadLimit || (now - idleSince) >= timeout) {
               exitThread = true;
+            }
           } else {
             // if would be too many idle threads...
             if (mIdleCount == mIdleThreadLimit) {
@@ -193,8 +198,9 @@ nsThreadPool::Run()
         }
 
         if (exitThread) {
-          if (wasIdle)
+          if (wasIdle) {
             --mIdleCount;
+          }
           shutdownThreadOnExit = mThreads.RemoveObject(current);
         } else {
           PRIntervalTime delta = timeout - (now - idleSince);
@@ -225,44 +231,47 @@ nsThreadPool::Run()
 }
 
 NS_IMETHODIMP
-nsThreadPool::Dispatch(nsIRunnable *event, uint32_t flags)
+nsThreadPool::Dispatch(nsIRunnable* aEvent, uint32_t aFlags)
 {
-  LOG(("THRD-P(%p) dispatch [%p %x]\n", this, event, flags));
+  LOG(("THRD-P(%p) dispatch [%p %x]\n", this, aEvent, aFlags));
 
-  if (NS_WARN_IF(mShutdown))
+  if (NS_WARN_IF(mShutdown)) {
     return NS_ERROR_NOT_AVAILABLE;
+  }
 
-  if (flags & DISPATCH_SYNC) {
+  if (aFlags & DISPATCH_SYNC) {
     nsCOMPtr<nsIThread> thread;
     nsThreadManager::get()->GetCurrentThread(getter_AddRefs(thread));
-    if (NS_WARN_IF(!thread))
+    if (NS_WARN_IF(!thread)) {
       return NS_ERROR_NOT_AVAILABLE;
+    }
 
     nsRefPtr<nsThreadSyncDispatch> wrapper =
-        new nsThreadSyncDispatch(thread, event);
+      new nsThreadSyncDispatch(thread, aEvent);
     PutEvent(wrapper);
 
-    while (wrapper->IsPending())
+    while (wrapper->IsPending()) {
       NS_ProcessNextEvent(thread);
+    }
   } else {
-    NS_ASSERTION(flags == NS_DISPATCH_NORMAL, "unexpected dispatch flags");
-    PutEvent(event);
+    NS_ASSERTION(aFlags == NS_DISPATCH_NORMAL, "unexpected dispatch flags");
+    PutEvent(aEvent);
   }
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsThreadPool::IsOnCurrentThread(bool *result)
+nsThreadPool::IsOnCurrentThread(bool* aResult)
 {
   ReentrantMonitorAutoEnter mon(mEvents.GetReentrantMonitor());
   nsIThread* thread = NS_GetCurrentThread();
   for (uint32_t i = 0; i < static_cast<uint32_t>(mThreads.Count()); ++i) {
     if (mThreads[i] == thread) {
-      *result = true;
+      *aResult = true;
       return NS_OK;
     }
   }
-  *result = false;
+  *aResult = false;
   return NS_OK;
 }
 
@@ -288,26 +297,28 @@ nsThreadPool::Shutdown()
   // It's important that we shutdown the threads while outside the event queue
   // monitor.  Otherwise, we could end up dead-locking.
 
-  for (int32_t i = 0; i < threads.Count(); ++i)
+  for (int32_t i = 0; i < threads.Count(); ++i) {
     threads[i]->Shutdown();
+  }
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsThreadPool::GetThreadLimit(uint32_t *value)
+nsThreadPool::GetThreadLimit(uint32_t* aValue)
 {
-  *value = mThreadLimit;
+  *aValue = mThreadLimit;
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsThreadPool::SetThreadLimit(uint32_t value)
+nsThreadPool::SetThreadLimit(uint32_t aValue)
 {
   ReentrantMonitorAutoEnter mon(mEvents.GetReentrantMonitor());
-  mThreadLimit = value;
-  if (mIdleThreadLimit > mThreadLimit)
+  mThreadLimit = aValue;
+  if (mIdleThreadLimit > mThreadLimit) {
     mIdleThreadLimit = mThreadLimit;
+  }
 
   if (static_cast<uint32_t>(mThreads.Count()) > mThreadLimit) {
     mon.NotifyAll();  // wake up threads so they observe this change
@@ -316,19 +327,20 @@ nsThreadPool::SetThreadLimit(uint32_t value)
 }
 
 NS_IMETHODIMP
-nsThreadPool::GetIdleThreadLimit(uint32_t *value)
+nsThreadPool::GetIdleThreadLimit(uint32_t* aValue)
 {
-  *value = mIdleThreadLimit;
+  *aValue = mIdleThreadLimit;
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsThreadPool::SetIdleThreadLimit(uint32_t value)
+nsThreadPool::SetIdleThreadLimit(uint32_t aValue)
 {
   ReentrantMonitorAutoEnter mon(mEvents.GetReentrantMonitor());
-  mIdleThreadLimit = value;
-  if (mIdleThreadLimit > mThreadLimit)
+  mIdleThreadLimit = aValue;
+  if (mIdleThreadLimit > mThreadLimit) {
     mIdleThreadLimit = mThreadLimit;
+  }
 
   // Do we need to kill some idle threads?
   if (mIdleCount > mIdleThreadLimit) {
@@ -338,18 +350,18 @@ nsThreadPool::SetIdleThreadLimit(uint32_t value)
 }
 
 NS_IMETHODIMP
-nsThreadPool::GetIdleThreadTimeout(uint32_t *value)
+nsThreadPool::GetIdleThreadTimeout(uint32_t* aValue)
 {
-  *value = mIdleThreadTimeout;
+  *aValue = mIdleThreadTimeout;
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsThreadPool::SetIdleThreadTimeout(uint32_t value)
+nsThreadPool::SetIdleThreadTimeout(uint32_t aValue)
 {
   ReentrantMonitorAutoEnter mon(mEvents.GetReentrantMonitor());
   uint32_t oldTimeout = mIdleThreadTimeout;
-  mIdleThreadTimeout = value;
+  mIdleThreadTimeout = aValue;
 
   // Do we need to notify any idle threads that their sleep time has shortened?
   if (mIdleThreadTimeout < oldTimeout && mIdleCount > 0) {
@@ -359,18 +371,18 @@ nsThreadPool::SetIdleThreadTimeout(uint32_t value)
 }
 
 NS_IMETHODIMP
-nsThreadPool::GetThreadStackSize(uint32_t* value)
+nsThreadPool::GetThreadStackSize(uint32_t* aValue)
 {
   ReentrantMonitorAutoEnter mon(mEvents.GetReentrantMonitor());
-  *value = mStackSize;
+  *aValue = mStackSize;
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsThreadPool::SetThreadStackSize(uint32_t value)
+nsThreadPool::SetThreadStackSize(uint32_t aValue)
 {
   ReentrantMonitorAutoEnter mon(mEvents.GetReentrantMonitor());
-  mStackSize = value;
+  mStackSize = aValue;
   return NS_OK;
 }
 
@@ -398,8 +410,9 @@ nsThreadPool::SetName(const nsACString& aName)
 {
   {
     ReentrantMonitorAutoEnter mon(mEvents.GetReentrantMonitor());
-    if (mThreads.Count())
+    if (mThreads.Count()) {
       return NS_ERROR_NOT_AVAILABLE;
+    }
   }
 
   mName = aName;
diff --git a/xpcom/threads/nsThreadPool.h b/xpcom/threads/nsThreadPool.h
index 4da8efaafb20..d6e79c662ddd 100644
--- a/xpcom/threads/nsThreadPool.h
+++ b/xpcom/threads/nsThreadPool.h
@@ -16,8 +16,9 @@
 #include "nsThreadUtils.h"
 #include "mozilla/Attributes.h"
 
-class nsThreadPool MOZ_FINAL : public nsIThreadPool,
-                               public nsIRunnable
+class nsThreadPool MOZ_FINAL
+  : public nsIThreadPool
+  , public nsIRunnable
 {
 public:
   NS_DECL_THREADSAFE_ISUPPORTS
@@ -30,8 +31,8 @@ public:
 private:
   ~nsThreadPool();
 
-  void ShutdownThread(nsIThread *thread);
-  nsresult PutEvent(nsIRunnable *event);
+  void ShutdownThread(nsIThread* aThread);
+  nsresult PutEvent(nsIRunnable* aEvent);
 
   nsCOMArray<nsIThread> mThreads;
   nsEventQueue          mEvents;
diff --git a/xpcom/threads/nsTimerImpl.cpp b/xpcom/threads/nsTimerImpl.cpp
index 0982631a1763..149ef4c6898f 100644
--- a/xpcom/threads/nsTimerImpl.cpp
+++ b/xpcom/threads/nsTimerImpl.cpp
@@ -26,9 +26,10 @@ static TimerThread*     gThread = nullptr;
 PRLogModuleInfo*
 GetTimerLog()
 {
-  static PRLogModuleInfo *sLog;
-  if (!sLog)
+  static PRLogModuleInfo* sLog;
+  if (!sLog) {
     sLog = PR_NewLogModule("nsTimerImpl");
+  }
   return sLog;
 }
 
@@ -40,16 +41,17 @@ double nsTimerImpl::sDeltaNum = 0;
 
 static void
 myNS_MeanAndStdDev(double n, double sumOfValues, double sumOfSquaredValues,
-                   double *meanResult, double *stdDevResult)
+                   double* meanResult, double* stdDevResult)
 {
   double mean = 0.0, var = 0.0, stdDev = 0.0;
   if (n > 0.0 && sumOfValues >= 0) {
     mean = sumOfValues / n;
     double temp = (n * sumOfSquaredValues) - (sumOfValues * sumOfValues);
-    if (temp < 0.0 || n <= 1)
+    if (temp < 0.0 || n <= 1) {
       var = 0.0;
-    else
+    } else {
       var = temp / (n * (n - 1));
+    }
     // for some reason, Windows says sqrt(0.0) is "-1.#J" (?!) so do this:
     stdDev = var != 0.0 ? sqrt(var) : 0.0;
   }
@@ -77,7 +79,8 @@ namespace {
 class TimerEventAllocator
 {
 private:
-  struct FreeEntry {
+  struct FreeEntry
+  {
     FreeEntry* mNext;
   };
 
@@ -87,8 +90,8 @@ private:
 
 public:
   TimerEventAllocator()
-    : mFirstFree(nullptr),
-      mMonitor("TimerEventAllocator")
+    : mFirstFree(nullptr)
+    , mMonitor("TimerEventAllocator")
   {
     PL_InitArenaPool(&mPool, "TimerEventPool", 4096, /* align = */ 0);
   }
@@ -104,13 +107,16 @@ public:
 
 } // anonymous namespace
 
-class nsTimerEvent : public nsRunnable {
+class nsTimerEvent : public nsRunnable
+{
 public:
   NS_IMETHOD Run();
 
-  nsTimerEvent(nsTimerImpl *timer, int32_t generation)
-    : mTimer(dont_AddRef(timer)), mGeneration(generation) {
-    // timer is already addref'd for us
+  nsTimerEvent(nsTimerImpl* aTimer, int32_t aGeneration)
+    : mTimer(dont_AddRef(aTimer))
+    , mGeneration(aGeneration)
+  {
+    // aTimer is already addref'd for us
     MOZ_COUNT_CTOR(nsTimerEvent);
 
     MOZ_ASSERT(gThread->IsOnTimerThread(),
@@ -127,17 +133,20 @@ public:
   static void Shutdown();
   static void DeleteAllocatorIfNeeded();
 
-  static void* operator new(size_t size) CPP_THROW_NEW {
-    return sAllocator->Alloc(size);
+  static void* operator new(size_t aSize) CPP_THROW_NEW
+  {
+    return sAllocator->Alloc(aSize);
   }
-  void operator delete(void* p) {
-    sAllocator->Free(p);
+  void operator delete(void* aPtr)
+  {
+    sAllocator->Free(aPtr);
     DeleteAllocatorIfNeeded();
   }
 
 private:
   nsTimerEvent(); // Not implemented
-  ~nsTimerEvent() {
+  ~nsTimerEvent()
+  {
     MOZ_COUNT_DTOR(nsTimerEvent);
 
     MOZ_ASSERT(!sCanDeleteAllocator || sAllocatorUsers > 0,
@@ -159,7 +168,8 @@ bool nsTimerEvent::sCanDeleteAllocator = false;
 
 namespace {
 
-void* TimerEventAllocator::Alloc(size_t aSize)
+void*
+TimerEventAllocator::Alloc(size_t aSize)
 {
   MOZ_ASSERT(aSize == sizeof(nsTimerEvent));
 
@@ -169,17 +179,18 @@ void* TimerEventAllocator::Alloc(size_t aSize)
   if (mFirstFree) {
     p = mFirstFree;
     mFirstFree = mFirstFree->mNext;
-  }
-  else {
+  } else {
     PL_ARENA_ALLOCATE(p, &mPool, aSize);
-    if (!p)
+    if (!p) {
       return nullptr;
+    }
   }
 
   return p;
 }
 
-void TimerEventAllocator::Free(void* aPtr)
+void
+TimerEventAllocator::Free(void* aPtr)
 {
   mozilla::MonitorAutoLock lock(mMonitor);
 
@@ -194,7 +205,8 @@ void TimerEventAllocator::Free(void* aPtr)
 NS_IMPL_QUERY_INTERFACE(nsTimerImpl, nsITimer)
 NS_IMPL_ADDREF(nsTimerImpl)
 
-NS_IMETHODIMP_(MozExternalRefCountType) nsTimerImpl::Release(void)
+NS_IMETHODIMP_(MozExternalRefCountType)
+nsTimerImpl::Release(void)
 {
   nsrefcnt count;
 
@@ -243,8 +255,9 @@ NS_IMETHODIMP_(MozExternalRefCountType) nsTimerImpl::Release(void)
     mCanceled = true;
 
     MOZ_ASSERT(gThread, "Armed timer exists after the thread timer stopped.");
-    if (NS_SUCCEEDED(gThread->RemoveTimer(this)))
+    if (NS_SUCCEEDED(gThread->RemoveTimer(this))) {
       return 0;
+    }
   }
 
   return count;
@@ -279,7 +292,9 @@ nsTimerImpl::Startup()
   nsTimerEvent::Init();
 
   gThread = new TimerThread();
-  if (!gThread) return NS_ERROR_OUT_OF_MEMORY;
+  if (!gThread) {
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
 
   NS_ADDREF(gThread);
   rv = gThread->InitLocks();
@@ -291,20 +306,25 @@ nsTimerImpl::Startup()
   return rv;
 }
 
-void nsTimerImpl::Shutdown()
+void
+nsTimerImpl::Shutdown()
 {
 #ifdef DEBUG_TIMERS
   if (PR_LOG_TEST(GetTimerLog(), PR_LOG_DEBUG)) {
     double mean = 0, stddev = 0;
     myNS_MeanAndStdDev(sDeltaNum, sDeltaSum, sDeltaSumSquared, &mean, &stddev);
 
-    PR_LOG(GetTimerLog(), PR_LOG_DEBUG, ("sDeltaNum = %f, sDeltaSum = %f, sDeltaSumSquared = %f\n", sDeltaNum, sDeltaSum, sDeltaSumSquared));
-    PR_LOG(GetTimerLog(), PR_LOG_DEBUG, ("mean: %fms, stddev: %fms\n", mean, stddev));
+    PR_LOG(GetTimerLog(), PR_LOG_DEBUG,
+           ("sDeltaNum = %f, sDeltaSum = %f, sDeltaSumSquared = %f\n",
+            sDeltaNum, sDeltaSum, sDeltaSumSquared));
+    PR_LOG(GetTimerLog(), PR_LOG_DEBUG,
+           ("mean: %fms, stddev: %fms\n", mean, stddev));
   }
 #endif
 
-  if (!gThread)
+  if (!gThread) {
     return;
+  }
 
   gThread->Shutdown();
   NS_RELEASE(gThread);
@@ -313,20 +333,23 @@ void nsTimerImpl::Shutdown()
 }
 
 
-nsresult nsTimerImpl::InitCommon(uint32_t aType, uint32_t aDelay)
+nsresult
+nsTimerImpl::InitCommon(uint32_t aType, uint32_t aDelay)
 {
   nsresult rv;
 
-  if (NS_WARN_IF(!gThread))
+  if (NS_WARN_IF(!gThread)) {
     return NS_ERROR_NOT_INITIALIZED;
+  }
   if (!mEventTarget) {
     NS_ERROR("mEventTarget is NULL");
     return NS_ERROR_NOT_INITIALIZED;
   }
 
   rv = gThread->Init();
-  if (NS_WARN_IF(NS_FAILED(rv)))
+  if (NS_WARN_IF(NS_FAILED(rv))) {
     return rv;
+  }
 
   /**
    * In case of re-Init, both with and without a preceding Cancel, clear the
@@ -342,8 +365,9 @@ nsresult nsTimerImpl::InitCommon(uint32_t aType, uint32_t aDelay)
    * be cleared by another CPU whose store hasn't reached our CPU's cache),
    * because RemoveTimer is idempotent.
    */
-  if (mArmed)
+  if (mArmed) {
     gThread->RemoveTimer(this);
+  }
   mCanceled = false;
   mTimeout = TimeStamp();
   mGeneration = gGenerator++;
@@ -354,14 +378,16 @@ nsresult nsTimerImpl::InitCommon(uint32_t aType, uint32_t aDelay)
   return gThread->AddTimer(this);
 }
 
-NS_IMETHODIMP nsTimerImpl::InitWithFuncCallback(nsTimerCallbackFunc aFunc,
-                                                void *aClosure,
-                                                uint32_t aDelay,
-                                                uint32_t aType)
+NS_IMETHODIMP
+nsTimerImpl::InitWithFuncCallback(nsTimerCallbackFunc aFunc,
+                                  void* aClosure,
+                                  uint32_t aDelay,
+                                  uint32_t aType)
 {
-  if (NS_WARN_IF(!aFunc))
+  if (NS_WARN_IF(!aFunc)) {
     return NS_ERROR_INVALID_ARG;
-  
+  }
+
   ReleaseCallback();
   mCallbackType = CALLBACK_TYPE_FUNC;
   mCallback.c = aFunc;
@@ -370,12 +396,14 @@ NS_IMETHODIMP nsTimerImpl::InitWithFuncCallback(nsTimerCallbackFunc aFunc,
   return InitCommon(aType, aDelay);
 }
 
-NS_IMETHODIMP nsTimerImpl::InitWithCallback(nsITimerCallback *aCallback,
-                                            uint32_t aDelay,
-                                            uint32_t aType)
+NS_IMETHODIMP
+nsTimerImpl::InitWithCallback(nsITimerCallback* aCallback,
+                              uint32_t aDelay,
+                              uint32_t aType)
 {
-  if (NS_WARN_IF(!aCallback))
+  if (NS_WARN_IF(!aCallback)) {
     return NS_ERROR_INVALID_ARG;
+  }
 
   ReleaseCallback();
   mCallbackType = CALLBACK_TYPE_INTERFACE;
@@ -385,12 +413,12 @@ NS_IMETHODIMP nsTimerImpl::InitWithCallback(nsITimerCallback *aCallback,
   return InitCommon(aType, aDelay);
 }
 
-NS_IMETHODIMP nsTimerImpl::Init(nsIObserver *aObserver,
-                                uint32_t aDelay,
-                                uint32_t aType)
+NS_IMETHODIMP
+nsTimerImpl::Init(nsIObserver* aObserver, uint32_t aDelay, uint32_t aType)
 {
-  if (NS_WARN_IF(!aObserver))
+  if (NS_WARN_IF(!aObserver)) {
     return NS_ERROR_INVALID_ARG;
+  }
 
   ReleaseCallback();
   mCallbackType = CALLBACK_TYPE_OBSERVER;
@@ -400,19 +428,22 @@ NS_IMETHODIMP nsTimerImpl::Init(nsIObserver *aObserver,
   return InitCommon(aType, aDelay);
 }
 
-NS_IMETHODIMP nsTimerImpl::Cancel()
+NS_IMETHODIMP
+nsTimerImpl::Cancel()
 {
   mCanceled = true;
 
-  if (gThread)
+  if (gThread) {
     gThread->RemoveTimer(this);
+  }
 
   ReleaseCallback();
 
   return NS_OK;
 }
 
-NS_IMETHODIMP nsTimerImpl::SetDelay(uint32_t aDelay)
+NS_IMETHODIMP
+nsTimerImpl::SetDelay(uint32_t aDelay)
 {
   if (mCallbackType == CALLBACK_TYPE_UNKNOWN && mType == TYPE_ONE_SHOT) {
     // This may happen if someone tries to re-use a one-shot timer
@@ -424,24 +455,28 @@ NS_IMETHODIMP nsTimerImpl::SetDelay(uint32_t aDelay)
 
   // If we're already repeating precisely, update mTimeout now so that the
   // new delay takes effect in the future.
-  if (!mTimeout.IsNull() && mType == TYPE_REPEATING_PRECISE)
+  if (!mTimeout.IsNull() && mType == TYPE_REPEATING_PRECISE) {
     mTimeout = TimeStamp::Now();
+  }
 
   SetDelayInternal(aDelay);
 
-  if (!mFiring && gThread)
+  if (!mFiring && gThread) {
     gThread->TimerDelayChanged(this);
+  }
 
   return NS_OK;
 }
 
-NS_IMETHODIMP nsTimerImpl::GetDelay(uint32_t* aDelay)
+NS_IMETHODIMP
+nsTimerImpl::GetDelay(uint32_t* aDelay)
 {
   *aDelay = mDelay;
   return NS_OK;
 }
 
-NS_IMETHODIMP nsTimerImpl::SetType(uint32_t aType)
+NS_IMETHODIMP
+nsTimerImpl::SetType(uint32_t aType)
 {
   mType = (uint8_t)aType;
   // XXX if this is called, we should change the actual type.. this could effect
@@ -450,57 +485,67 @@ NS_IMETHODIMP nsTimerImpl::SetType(uint32_t aType)
   return NS_OK;
 }
 
-NS_IMETHODIMP nsTimerImpl::GetType(uint32_t* aType)
+NS_IMETHODIMP
+nsTimerImpl::GetType(uint32_t* aType)
 {
   *aType = mType;
   return NS_OK;
 }
 
 
-NS_IMETHODIMP nsTimerImpl::GetClosure(void** aClosure)
+NS_IMETHODIMP
+nsTimerImpl::GetClosure(void** aClosure)
 {
   *aClosure = mClosure;
   return NS_OK;
 }
 
 
-NS_IMETHODIMP nsTimerImpl::GetCallback(nsITimerCallback **aCallback)
+NS_IMETHODIMP
+nsTimerImpl::GetCallback(nsITimerCallback** aCallback)
 {
-  if (mCallbackType == CALLBACK_TYPE_INTERFACE)
+  if (mCallbackType == CALLBACK_TYPE_INTERFACE) {
     NS_IF_ADDREF(*aCallback = mCallback.i);
-  else if (mTimerCallbackWhileFiring)
+  } else if (mTimerCallbackWhileFiring) {
     NS_ADDREF(*aCallback = mTimerCallbackWhileFiring);
-  else
+  } else {
     *aCallback = nullptr;
+  }
 
   return NS_OK;
 }
 
 
-NS_IMETHODIMP nsTimerImpl::GetTarget(nsIEventTarget** aTarget)
+NS_IMETHODIMP
+nsTimerImpl::GetTarget(nsIEventTarget** aTarget)
 {
   NS_IF_ADDREF(*aTarget = mEventTarget);
   return NS_OK;
 }
 
 
-NS_IMETHODIMP nsTimerImpl::SetTarget(nsIEventTarget* aTarget)
+NS_IMETHODIMP
+nsTimerImpl::SetTarget(nsIEventTarget* aTarget)
 {
-  if (NS_WARN_IF(mCallbackType != CALLBACK_TYPE_UNKNOWN))
+  if (NS_WARN_IF(mCallbackType != CALLBACK_TYPE_UNKNOWN)) {
     return NS_ERROR_ALREADY_INITIALIZED;
+  }
 
-  if (aTarget)
+  if (aTarget) {
     mEventTarget = aTarget;
-  else
+  } else {
     mEventTarget = static_cast<nsIEventTarget*>(NS_GetCurrentThread());
+  }
   return NS_OK;
 }
 
 
-void nsTimerImpl::Fire()
+void
+nsTimerImpl::Fire()
 {
-  if (mCanceled)
+  if (mCanceled) {
     return;
+  }
 
   PROFILER_LABEL("Timer", "Fire");
 
@@ -519,10 +564,16 @@ void nsTimerImpl::Fire()
     sDeltaSumSquared += double(d) * double(d);
     sDeltaNum++;
 
-    PR_LOG(GetTimerLog(), PR_LOG_DEBUG, ("[this=%p] expected delay time %4ums\n", this, mDelay));
-    PR_LOG(GetTimerLog(), PR_LOG_DEBUG, ("[this=%p] actual delay time   %fms\n", this, a.ToMilliseconds()));
-    PR_LOG(GetTimerLog(), PR_LOG_DEBUG, ("[this=%p] (mType is %d)       -------\n", this, mType));
-    PR_LOG(GetTimerLog(), PR_LOG_DEBUG, ("[this=%p]     delta           %4dms\n", this, (a > b) ? (int32_t)d : -(int32_t)d));
+    PR_LOG(GetTimerLog(), PR_LOG_DEBUG,
+           ("[this=%p] expected delay time %4ums\n", this, mDelay));
+    PR_LOG(GetTimerLog(), PR_LOG_DEBUG,
+           ("[this=%p] actual delay time   %fms\n", this,
+            a.ToMilliseconds()));
+    PR_LOG(GetTimerLog(), PR_LOG_DEBUG,
+           ("[this=%p] (mType is %d)       -------\n", this, mType));
+    PR_LOG(GetTimerLog(), PR_LOG_DEBUG,
+           ("[this=%p]     delta           %4dms\n",
+            this, (a > b) ? (int32_t)d : -(int32_t)d));
 
     mStart = mStart2;
     mStart2 = TimeStamp();
@@ -536,18 +587,20 @@ void nsTimerImpl::Fire()
     timeout -= TimeDuration::FromMilliseconds(mDelay);
   }
 
-  if (mCallbackType == CALLBACK_TYPE_INTERFACE)
+  if (mCallbackType == CALLBACK_TYPE_INTERFACE) {
     mTimerCallbackWhileFiring = mCallback.i;
+  }
   mFiring = true;
 
   // Handle callbacks that re-init the timer, but avoid leaking.
   // See bug 330128.
   CallbackUnion callback = mCallback;
   unsigned callbackType = mCallbackType;
-  if (callbackType == CALLBACK_TYPE_INTERFACE)
+  if (callbackType == CALLBACK_TYPE_INTERFACE) {
     NS_ADDREF(callback.i);
-  else if (callbackType == CALLBACK_TYPE_OBSERVER)
+  } else if (callbackType == CALLBACK_TYPE_OBSERVER) {
     NS_ADDREF(callback.o);
+  }
   ReleaseCallback();
 
   switch (callbackType) {
@@ -562,7 +615,8 @@ void nsTimerImpl::Fire()
                           NS_TIMER_CALLBACK_TOPIC,
                           nullptr);
       break;
-    default:;
+    default:
+      ;
   }
 
   // If the callback didn't re-init the timer, and it's not a one-shot timer,
@@ -573,10 +627,11 @@ void nsTimerImpl::Fire()
     mCallbackType = callbackType;
   } else {
     // The timer was a one-shot, or the callback was reinitialized.
-    if (callbackType == CALLBACK_TYPE_INTERFACE)
+    if (callbackType == CALLBACK_TYPE_INTERFACE) {
       NS_RELEASE(callback.i);
-    else if (callbackType == CALLBACK_TYPE_OBSERVER)
+    } else if (callbackType == CALLBACK_TYPE_OBSERVER) {
       NS_RELEASE(callback.o);
+    }
   }
 
   mFiring = false;
@@ -594,27 +649,32 @@ void nsTimerImpl::Fire()
   // that in PostTimerEvent, but make sure that we aren't armed already (which
   // can happen if the callback reinitialized the timer).
   if (IsRepeating() && mType != TYPE_REPEATING_PRECISE && !mArmed) {
-    if (mType == TYPE_REPEATING_SLACK)
-      SetDelayInternal(mDelay); // force mTimeout to be recomputed.  For
-                                // REPEATING_PRECISE_CAN_SKIP timers this has
-                                // already happened.
-    if (gThread)
+    if (mType == TYPE_REPEATING_SLACK) {
+      SetDelayInternal(mDelay);  // force mTimeout to be recomputed.  For
+    }
+    // REPEATING_PRECISE_CAN_SKIP timers this has
+    // already happened.
+    if (gThread) {
       gThread->AddTimer(this);
+    }
   }
 }
 
-void nsTimerEvent::Init()
+void
+nsTimerEvent::Init()
 {
   sAllocator = new TimerEventAllocator();
 }
 
-void nsTimerEvent::Shutdown()
+void
+nsTimerEvent::Shutdown()
 {
   sCanDeleteAllocator = true;
   DeleteAllocatorIfNeeded();
 }
 
-void nsTimerEvent::DeleteAllocatorIfNeeded()
+void
+nsTimerEvent::DeleteAllocatorIfNeeded()
 {
   if (sCanDeleteAllocator && sAllocatorUsers == 0) {
     delete sAllocator;
@@ -622,10 +682,12 @@ void nsTimerEvent::DeleteAllocatorIfNeeded()
   }
 }
 
-NS_IMETHODIMP nsTimerEvent::Run()
+NS_IMETHODIMP
+nsTimerEvent::Run()
 {
-  if (mGeneration != mTimer->GetGeneration())
+  if (mGeneration != mTimer->GetGeneration()) {
     return NS_OK;
+  }
 
 #ifdef DEBUG_TIMERS
   if (PR_LOG_TEST(GetTimerLog(), PR_LOG_DEBUG)) {
@@ -641,7 +703,8 @@ NS_IMETHODIMP nsTimerEvent::Run()
   return NS_OK;
 }
 
-nsresult nsTimerImpl::PostTimerEvent()
+nsresult
+nsTimerImpl::PostTimerEvent()
 {
   if (!mEventTarget) {
     NS_ERROR("Attempt to post timer event to NULL event target");
@@ -656,8 +719,9 @@ nsresult nsTimerImpl::PostTimerEvent()
   // re-initialized after being canceled.
 
   nsRefPtr<nsTimerEvent> event = new nsTimerEvent(this, mGeneration);
-  if (!event)
+  if (!event) {
     return NS_ERROR_OUT_OF_MEMORY;
+  }
 
 #ifdef DEBUG_TIMERS
   if (PR_LOG_TEST(GetTimerLog(), PR_LOG_DEBUG)) {
@@ -673,56 +737,62 @@ nsresult nsTimerImpl::PostTimerEvent()
     // But only re-arm REPEATING_PRECISE timers.
     if (gThread && mType == TYPE_REPEATING_PRECISE) {
       nsresult rv = gThread->AddTimer(this);
-      if (NS_FAILED(rv))
+      if (NS_FAILED(rv)) {
         return rv;
+      }
     }
   }
 
   nsresult rv = mEventTarget->Dispatch(event, NS_DISPATCH_NORMAL);
-  if (NS_FAILED(rv) && gThread)
+  if (NS_FAILED(rv) && gThread) {
     gThread->RemoveTimer(this);
+  }
   return rv;
 }
 
-void nsTimerImpl::SetDelayInternal(uint32_t aDelay)
+void
+nsTimerImpl::SetDelayInternal(uint32_t aDelay)
 {
   TimeDuration delayInterval = TimeDuration::FromMilliseconds(aDelay);
 
   mDelay = aDelay;
 
   TimeStamp now = TimeStamp::Now();
-  if (mTimeout.IsNull() || mType != TYPE_REPEATING_PRECISE)
+  if (mTimeout.IsNull() || mType != TYPE_REPEATING_PRECISE) {
     mTimeout = now;
+  }
 
   mTimeout += delayInterval;
 
 #ifdef DEBUG_TIMERS
   if (PR_LOG_TEST(GetTimerLog(), PR_LOG_DEBUG)) {
-    if (mStart.IsNull())
+    if (mStart.IsNull()) {
       mStart = now;
-    else
+    } else {
       mStart2 = now;
+    }
   }
 #endif
 }
 
 // NOT FOR PUBLIC CONSUMPTION!
 nsresult
-NS_NewTimer(nsITimer* *aResult, nsTimerCallbackFunc aCallback, void *aClosure,
+NS_NewTimer(nsITimer** aResult, nsTimerCallbackFunc aCallback, void* aClosure,
             uint32_t aDelay, uint32_t aType)
 {
-    nsTimerImpl* timer = new nsTimerImpl();
-    if (timer == nullptr)
-        return NS_ERROR_OUT_OF_MEMORY;
-    NS_ADDREF(timer);
+  nsTimerImpl* timer = new nsTimerImpl();
+  if (!timer) {
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+  NS_ADDREF(timer);
 
-    nsresult rv = timer->InitWithFuncCallback(aCallback, aClosure, 
-                                              aDelay, aType);
-    if (NS_FAILED(rv)) {
-        NS_RELEASE(timer);
-        return rv;
-    }
+  nsresult rv = timer->InitWithFuncCallback(aCallback, aClosure,
+                                            aDelay, aType);
+  if (NS_FAILED(rv)) {
+    NS_RELEASE(timer);
+    return rv;
+  }
 
-    *aResult = timer;
-    return NS_OK;
+  *aResult = timer;
+  return NS_OK;
 }
diff --git a/xpcom/threads/nsTimerImpl.h b/xpcom/threads/nsTimerImpl.h
index 5ff35fb0eed0..e33b8ee1265e 100644
--- a/xpcom/threads/nsTimerImpl.h
+++ b/xpcom/threads/nsTimerImpl.h
@@ -23,7 +23,7 @@
 #endif
 
 #if defined(PR_LOGGING)
-extern PRLogModuleInfo *GetTimerLog();
+extern PRLogModuleInfo* GetTimerLog();
 #define DEBUG_TIMERS 1
 #else
 #undef DEBUG_TIMERS
@@ -37,7 +37,8 @@ extern PRLogModuleInfo *GetTimerLog();
     {0x84, 0x27, 0xfb, 0xab, 0x44, 0xf2, 0x9b, 0xc8} \
 }
 
-enum {
+enum
+{
   CALLBACK_TYPE_UNKNOWN   = 0,
   CALLBACK_TYPE_INTERFACE = 1,
   CALLBACK_TYPE_FUNC      = 2,
@@ -64,7 +65,10 @@ public:
   NS_DECL_THREADSAFE_ISUPPORTS
   NS_DECL_NSITIMER
 
-  int32_t GetGeneration() { return mGeneration; }
+  int32_t GetGeneration()
+  {
+    return mGeneration;
+  }
 
 #ifdef MOZ_TASK_TRACER
   void DispatchTracedTask()
@@ -83,33 +87,37 @@ private:
     // sure that we don't recurse into ReleaseCallback in case
     // the callback's destructor calls Cancel() or similar.
     uint8_t cbType = mCallbackType;
-    mCallbackType = CALLBACK_TYPE_UNKNOWN; 
+    mCallbackType = CALLBACK_TYPE_UNKNOWN;
 
-    if (cbType == CALLBACK_TYPE_INTERFACE)
+    if (cbType == CALLBACK_TYPE_INTERFACE) {
       NS_RELEASE(mCallback.i);
-    else if (cbType == CALLBACK_TYPE_OBSERVER)
+    } else if (cbType == CALLBACK_TYPE_OBSERVER) {
       NS_RELEASE(mCallback.o);
+    }
   }
 
-  bool IsRepeating() const {
+  bool IsRepeating() const
+  {
     PR_STATIC_ASSERT(TYPE_ONE_SHOT < TYPE_REPEATING_SLACK);
     PR_STATIC_ASSERT(TYPE_REPEATING_SLACK < TYPE_REPEATING_PRECISE);
     PR_STATIC_ASSERT(TYPE_REPEATING_PRECISE < TYPE_REPEATING_PRECISE_CAN_SKIP);
     return mType >= TYPE_REPEATING_SLACK;
   }
 
-  bool IsRepeatingPrecisely() const {
+  bool IsRepeatingPrecisely() const
+  {
     return mType >= TYPE_REPEATING_PRECISE;
   }
 
   nsCOMPtr<nsIEventTarget> mEventTarget;
 
-  void *                mClosure;
+  void*                 mClosure;
 
-  union CallbackUnion {
+  union CallbackUnion
+  {
     nsTimerCallbackFunc c;
-    nsITimerCallback *  i;
-    nsIObserver *       o;
+    nsITimerCallback*   i;
+    nsIObserver*        o;
   } mCallback;
 
   // Some callers expect to be able to access the callback while the
diff --git a/xpfe/appshell/src/nsAppShellService.cpp b/xpfe/appshell/src/nsAppShellService.cpp
index 666c2de3e26d..df0e37e45c25 100644
--- a/xpfe/appshell/src/nsAppShellService.cpp
+++ b/xpfe/appshell/src/nsAppShellService.cpp
@@ -656,13 +656,11 @@ nsAppShellService::GetHiddenDOMWindow(nsIDOMWindow **aWindow)
 
   rv = mHiddenWindow->GetDocShell(getter_AddRefs(docShell));
   NS_ENSURE_SUCCESS(rv, rv);
+  NS_ENSURE_TRUE(docShell, NS_ERROR_FAILURE);
 
-  nsCOMPtr<nsIDOMWindow> hiddenDOMWindow(do_GetInterface(docShell, &rv));
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  *aWindow = hiddenDOMWindow;
-  NS_IF_ADDREF(*aWindow);
-  return NS_OK;
+  nsCOMPtr<nsIDOMWindow> hiddenDOMWindow(docShell->GetWindow());
+  hiddenDOMWindow.forget(aWindow);
+  return *aWindow ? NS_OK : NS_ERROR_FAILURE;
 }
 
 NS_IMETHODIMP
@@ -688,13 +686,11 @@ nsAppShellService::GetHiddenPrivateDOMWindow(nsIDOMWindow **aWindow)
 
   rv = mHiddenPrivateWindow->GetDocShell(getter_AddRefs(docShell));
   NS_ENSURE_SUCCESS(rv, rv);
+  NS_ENSURE_TRUE(docShell, NS_ERROR_FAILURE);
 
-  nsCOMPtr<nsIDOMWindow> hiddenPrivateDOMWindow(do_GetInterface(docShell, &rv));
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  *aWindow = hiddenPrivateDOMWindow;
-  NS_IF_ADDREF(*aWindow);
-  return NS_OK;
+  nsCOMPtr<nsIDOMWindow> hiddenPrivateDOMWindow(docShell->GetWindow());
+  hiddenPrivateDOMWindow.forget(aWindow);
+  return *aWindow ? NS_OK : NS_ERROR_FAILURE;
 }
 
 NS_IMETHODIMP
@@ -722,14 +718,16 @@ nsAppShellService::GetHiddenWindowAndJSContext(nsIDOMWindow **aWindow,
                 nsCOMPtr<nsIDocShell> docShell;
                 rv = mHiddenWindow->GetDocShell(getter_AddRefs(docShell));
                 if (NS_FAILED(rv)) break;
+                if (!docShell) {
+                  break;
+                }
 
                 // 2. Convert that to an nsIDOMWindow.
-                nsCOMPtr<nsIDOMWindow> hiddenDOMWindow(do_GetInterface(docShell));
+                nsCOMPtr<nsIDOMWindow> hiddenDOMWindow(docShell->GetWindow());
                 if(!hiddenDOMWindow) break;
 
                 // 3. Get script global object for the window.
-                nsCOMPtr<nsIScriptGlobalObject> sgo;
-                sgo = do_QueryInterface( hiddenDOMWindow );
+                nsCOMPtr<nsIScriptGlobalObject> sgo = docShell->GetScriptGlobalObject();
                 if (!sgo) { rv = NS_ERROR_FAILURE; break; }
 
                 // 4. Get script context from that.
@@ -771,7 +769,9 @@ nsAppShellService::RegisterTopLevelWindow(nsIXULWindow* aWindow)
 
   nsCOMPtr<nsIDocShell> docShell;
   aWindow->GetDocShell(getter_AddRefs(docShell));
-  nsCOMPtr<nsPIDOMWindow> domWindow(do_GetInterface(docShell));
+  NS_ENSURE_TRUE(docShell, NS_ERROR_FAILURE);
+
+  nsCOMPtr<nsPIDOMWindow> domWindow(docShell->GetWindow());
   NS_ENSURE_TRUE(domWindow, NS_ERROR_FAILURE);
   domWindow->SetInitialPrincipalToSubject();
 
@@ -843,7 +843,7 @@ nsAppShellService::UnregisterTopLevelWindow(nsIXULWindow* aWindow)
     nsCOMPtr<nsIDocShell> docShell;
     aWindow->GetDocShell(getter_AddRefs(docShell));
     if (docShell) {
-      nsCOMPtr<nsIDOMWindow> domWindow(do_GetInterface(docShell));
+      nsCOMPtr<nsIDOMWindow> domWindow(docShell->GetWindow());
       if (domWindow)
         wwatcher->RemoveWindow(domWindow);
     }
diff --git a/xpfe/appshell/src/nsContentTreeOwner.cpp b/xpfe/appshell/src/nsContentTreeOwner.cpp
index 3c3b1471f1b9..c3e69f224e95 100644
--- a/xpfe/appshell/src/nsContentTreeOwner.cpp
+++ b/xpfe/appshell/src/nsContentTreeOwner.cpp
@@ -754,8 +754,8 @@ NS_IMETHODIMP nsContentTreeOwner::SetTitle(const char16_t* aTitle)
       //
       nsCOMPtr<nsIDocShellTreeItem> dsitem;
       GetPrimaryContentShell(getter_AddRefs(dsitem));
-      nsCOMPtr<nsIDOMDocument> domdoc(do_GetInterface(dsitem));
-      nsCOMPtr<nsIScriptObjectPrincipal> doc(do_QueryInterface(domdoc));
+      nsCOMPtr<nsIScriptObjectPrincipal> doc =
+        do_QueryInterface(dsitem ? dsitem->GetDocument() : nullptr);
       if (doc) {
         nsCOMPtr<nsIURI> uri;
         nsIPrincipal* principal = doc->GetPrincipal();
@@ -1078,9 +1078,11 @@ nsSiteWindow::SetFocus(void)
   if (window) {
     nsCOMPtr<nsIDocShell> docshell;
     window->GetDocShell(getter_AddRefs(docshell));
-    nsCOMPtr<nsIDOMWindow> domWindow(do_GetInterface(docshell));
-    if (domWindow)
-      domWindow->Focus();
+    if (docShell) {
+      nsCOMPtr<nsIDOMWindow> domWindow(docShell->GetWindow());
+      if (domWindow)
+        domWindow->Focus();
+    }
   }
 #endif
   return NS_OK;
@@ -1140,7 +1142,11 @@ nsSiteWindow::Blur(void)
   if (xulWindow) {
     nsCOMPtr<nsIDocShell> docshell;
     xulWindow->GetDocShell(getter_AddRefs(docshell));
-    nsCOMPtr<nsIDOMWindow> domWindow(do_GetInterface(docshell));
+    if (!docshell) {
+      return NS_OK;
+    }
+
+    nsCOMPtr<nsIDOMWindow> domWindow(docshell->GetWindow());
     if (domWindow)
       domWindow->Focus();
   }
diff --git a/xpfe/appshell/src/nsWebShellWindow.cpp b/xpfe/appshell/src/nsWebShellWindow.cpp
index 185bd175bf9d..cbfb8dd502bb 100644
--- a/xpfe/appshell/src/nsWebShellWindow.cpp
+++ b/xpfe/appshell/src/nsWebShellWindow.cpp
@@ -212,7 +212,7 @@ nsresult nsWebShellWindow::Initialize(nsIXULWindow* aParent,
   if (nsContentUtils::IsInitialized()) { // Sometimes this happens really early  See bug 793370.
     rv = mDocShell->CreateAboutBlankContentViewer(nsContentUtils::SubjectPrincipal());
     NS_ENSURE_SUCCESS(rv, rv);
-    nsCOMPtr<nsIDocument> doc = do_GetInterface(mDocShell);
+    nsCOMPtr<nsIDocument> doc = mDocShell ? mDocShell->GetDocument() : nullptr;
     NS_ENSURE_TRUE(!!doc, NS_ERROR_FAILURE);
     doc->SetIsInitialDocument(true);
   }
@@ -251,7 +251,8 @@ nsWebShellWindow::WindowMoved(nsIWidget* aWidget, int32_t x, int32_t y)
 {
   nsXULPopupManager* pm = nsXULPopupManager::GetInstance();
   if (pm) {
-    nsCOMPtr<nsPIDOMWindow> window = do_GetInterface(mDocShell);
+    nsCOMPtr<nsPIDOMWindow> window =
+      mDocShell ? mDocShell->GetWindow() : nullptr;
     pm->AdjustPopupsOnWindowChange(window);
   }
 
@@ -281,11 +282,10 @@ nsWebShellWindow::RequestWindowClose(nsIWidget* aWidget)
   // Maintain a reference to this as it is about to get destroyed.
   nsCOMPtr<nsIXULWindow> xulWindow(this);
 
-  nsCOMPtr<nsPIDOMWindow> window(do_GetInterface(mDocShell));
+  nsCOMPtr<nsPIDOMWindow> window(mDocShell ? mDocShell->GetWindow() : nullptr);
   nsCOMPtr<EventTarget> eventTarget = do_QueryInterface(window);
 
   nsCOMPtr<nsIPresShell> presShell = mDocShell->GetPresShell();
-
   if (!presShell) {
     mozilla::DebugOnly<bool> dying;
     MOZ_ASSERT(NS_SUCCEEDED(mDocShell->IsBeingDestroyed(&dying)) && dying,
@@ -324,7 +324,8 @@ nsWebShellWindow::SizeModeChanged(nsSizeMode sizeMode)
   // cases this will merge with the similar call in NS_SIZE and
   // write the attribute values only once.
   SetPersistenceTimer(PAD_MISC);
-  nsCOMPtr<nsPIDOMWindow> ourWindow = do_GetInterface(mDocShell);
+  nsCOMPtr<nsPIDOMWindow> ourWindow =
+    mDocShell ? mDocShell->GetWindow() : nullptr;
   if (ourWindow) {
     // Let the application know if it's in fullscreen mode so it
     // can update its UI.
@@ -388,7 +389,7 @@ nsWebShellWindow::WindowActivated()
   nsCOMPtr<nsIXULWindow> xulWindow(this);
 
   // focusing the window could cause it to close, so keep a reference to it
-  nsCOMPtr<nsIDOMWindow> window = do_GetInterface(mDocShell);
+  nsCOMPtr<nsIDOMWindow> window = mDocShell ? mDocShell->GetWindow() : nullptr;
   nsCOMPtr<nsIFocusManager> fm = do_GetService(FOCUSMANAGER_CONTRACTID);
   if (fm && window)
     fm->WindowRaised(window);
@@ -404,7 +405,8 @@ nsWebShellWindow::WindowDeactivated()
 {
   nsCOMPtr<nsIXULWindow> xulWindow(this);
 
-  nsCOMPtr<nsPIDOMWindow> window = do_GetInterface(mDocShell);
+  nsCOMPtr<nsPIDOMWindow> window =
+    mDocShell ? mDocShell->GetWindow() : nullptr;
   nsCOMPtr<nsIFocusManager> fm = do_GetService(FOCUSMANAGER_CONTRACTID);
   if (fm && window)
     fm->WindowLowered(window);
@@ -671,8 +673,10 @@ bool nsWebShellWindow::ExecuteCloseHandler()
      than it otherwise would.) */
   nsCOMPtr<nsIXULWindow> kungFuDeathGrip(this);
 
-  nsCOMPtr<nsPIDOMWindow> window(do_GetInterface(mDocShell));
-  nsCOMPtr<EventTarget> eventTarget = do_QueryInterface(window);
+  nsCOMPtr<EventTarget> eventTarget;
+  if (mDocShell) {
+    eventTarget = do_QueryInterface(mDocShell->GetWindow());
+  }
 
   if (eventTarget) {
     nsCOMPtr<nsIContentViewer> contentViewer;
diff --git a/xpfe/appshell/src/nsWindowMediator.cpp b/xpfe/appshell/src/nsWindowMediator.cpp
index eb28d1d8baf7..2d8f0baddc01 100644
--- a/xpfe/appshell/src/nsWindowMediator.cpp
+++ b/xpfe/appshell/src/nsWindowMediator.cpp
@@ -43,8 +43,11 @@ nsWindowMediator::GetDOMWindow(nsIXULWindow* inWindow,
 {
   nsCOMPtr<nsIDocShell> docShell;
 
+  outDOMWindow = nullptr;
   inWindow->GetDocShell(getter_AddRefs(docShell));
-  outDOMWindow = do_GetInterface(docShell);
+  NS_ENSURE_TRUE(docShell, NS_ERROR_FAILURE);
+
+  outDOMWindow = docShell->GetWindow();
   return outDOMWindow ? NS_OK : NS_ERROR_FAILURE;
 }
 
diff --git a/xpfe/appshell/src/nsXULWindow.cpp b/xpfe/appshell/src/nsXULWindow.cpp
index 80987eba455e..200ac8c8d143 100644
--- a/xpfe/appshell/src/nsXULWindow.cpp
+++ b/xpfe/appshell/src/nsXULWindow.cpp
@@ -1547,7 +1547,7 @@ NS_IMETHODIMP nsXULWindow::GetWindowDOMWindow(nsIDOMWindow** aDOMWindow)
   NS_ENSURE_STATE(mDocShell);
 
   if (!mDOMWindow)
-    mDOMWindow = do_GetInterface(mDocShell);
+    mDOMWindow = mDocShell->GetWindow();
   NS_ENSURE_TRUE(mDOMWindow, NS_ERROR_FAILURE);
 
   *aDOMWindow = mDOMWindow;