Merge from m-c

2024-11-25 22:01:30 +00:00 · 2010-08-16 17:02:18 -07:00 · 2010-08-16 17:02:18 -07:00 · 557e618688
commit 557e618688
parent 1044e2fd0f a872b75d02
292 changed files with 7746 additions and 3533 deletions
--- a/accessible/src/atk/nsAccessibleWrap.cpp
+++ b/accessible/src/atk/nsAccessibleWrap.cpp
@ -848,9 +848,8 @@ getParentCB(AtkObject *aAtkObj)
            return nsnull;
        }

-        nsCOMPtr<nsIAccessible> accParent;
-        nsresult rv = accWrap->GetParent(getter_AddRefs(accParent));
-        if (NS_FAILED(rv) || !accParent)
+        nsAccessible* accParent = accWrap->GetParent();
+        if (!accParent)
            return nsnull;

        AtkObject *parent = nsAccessibleWrap::GetAtkObject(accParent);
@ -868,11 +867,7 @@ getChildCountCB(AtkObject *aAtkObj)
        return 0;
    }

-    // Links within hypertext accessible play role of accessible children in
-    // ATK since every embedded object is a link and text accessibles are
-    // ignored.
-    nsRefPtr<nsHyperTextAccessible> hyperText = do_QueryObject(accWrap);
-    return hyperText ? hyperText->GetLinkCount() : accWrap->GetChildCount();
+    return accWrap->GetEmbeddedChildCount();
 }

 AtkObject *
@ -888,12 +883,7 @@ refChildCB(AtkObject *aAtkObj, gint aChildIndex)
        return nsnull;
    }

-    // Links within hypertext accessible play role of accessible children in
-    // ATK since every embedded object is a link and text accessibles are
-    // ignored.
-    nsRefPtr<nsHyperTextAccessible> hyperText = do_QueryObject(accWrap);
-    nsAccessible* accChild = hyperText ? hyperText->GetLinkAt(aChildIndex) :
-                                         accWrap->GetChildAt(aChildIndex);
+    nsAccessible* accChild = accWrap->GetEmbeddedChildAt(aChildIndex);
    if (!accChild)
        return nsnull;

@ -924,12 +914,7 @@ getIndexInParentCB(AtkObject *aAtkObj)
        return -1; // No parent
    }

-    // Links within hypertext accessible play role of accessible children in
-    // ATK since every embedded object is a link and text accessibles are
-    // ignored.
-    nsRefPtr<nsHyperTextAccessible> hyperTextParent(do_QueryObject(parent));
-    return hyperTextParent ?
-        hyperTextParent->GetLinkIndex(accWrap) : accWrap->GetIndexInParent();
+    return parent->GetIndexOfEmbeddedChild(accWrap);
 }

 static void TranslateStates(PRUint32 aState, const AtkStateMap *aStateMap,
--- a/accessible/src/base/AccCollector.cpp
+++ b/accessible/src/base/AccCollector.cpp
@ -92,7 +92,7 @@ AccCollector::EnsureNGetObject(PRUint32 aIndex)
    if (!mFilterFunc(child))
      continue;

-    mObjects.AppendElement(child);
+    AppendObject(child);
    if (mObjects.Length() - 1 == aIndex)
      return mObjects[aIndex];
  }
@ -109,10 +109,39 @@ AccCollector::EnsureNGetIndex(nsAccessible* aAccessible)
    if (!mFilterFunc(child))
      continue;

-    mObjects.AppendElement(child);
+    AppendObject(child);
    if (child == aAccessible)
      return mObjects.Length() - 1;
  }

  return -1;
 }
+
+void
+AccCollector::AppendObject(nsAccessible* aAccessible)
+{
+  mObjects.AppendElement(aAccessible);
+}
+
+////////////////////////////////////////////////////////////////////////////////
+// EmbeddedObjCollector
+////////////////////////////////////////////////////////////////////////////////
+
+PRInt32
+EmbeddedObjCollector::GetIndexAt(nsAccessible *aAccessible)
+{
+  if (aAccessible->mParent != mRoot)
+    return -1;
+
+  if (aAccessible->mIndexOfEmbeddedChild != -1)
+    return aAccessible->mIndexOfEmbeddedChild;
+
+  return mFilterFunc(aAccessible) ? EnsureNGetIndex(aAccessible) : -1;
+}
+
+void
+EmbeddedObjCollector::AppendObject(nsAccessible* aAccessible)
+{
+  aAccessible->mIndexOfEmbeddedChild = mObjects.Length();
+  mObjects.AppendElement(aAccessible);
+}
--- a/accessible/src/base/AccCollector.h
+++ b/accessible/src/base/AccCollector.h
@ -66,7 +66,7 @@ public:
  /**
   * Return index of the given accessible within the collection.
   */
-  PRInt32 GetIndexAt(nsAccessible* aAccessible);
+  virtual PRInt32 GetIndexAt(nsAccessible* aAccessible);

 protected:
  /**
@ -79,6 +79,11 @@ protected:
   */
  PRInt32 EnsureNGetIndex(nsAccessible* aAccessible);

+  /**
+   * Append the object to collection.
+   */
+  virtual void AppendObject(nsAccessible* aAccessible);
+
  filters::FilterFuncPtr mFilterFunc;
  nsAccessible* mRoot;
  PRInt32 mRootChildIdx;
@ -91,4 +96,26 @@ private:
  AccCollector& operator =(const AccCollector&);
 };

+/**
+ * Collect embedded objects. Provide quick access to accessible by index and
+ * vice versa.
+ */
+class EmbeddedObjCollector : public AccCollector
+{
+public:
+  virtual ~EmbeddedObjCollector() { };
+
+public:
+  virtual PRInt32 GetIndexAt(nsAccessible* aAccessible);
+
+protected:
+  // Make sure it's used by nsAccessible class only.
+  EmbeddedObjCollector(nsAccessible* aRoot) :
+    AccCollector(aRoot, filters::GetEmbeddedObject) { }
+
+  virtual void AppendObject(nsAccessible* aAccessible);
+
+  friend class nsAccessible;
+};
+
 #endif
--- a/accessible/src/base/nsAccessible.cpp
+++ b/accessible/src/base/nsAccessible.cpp
@ -193,8 +193,8 @@ nsresult nsAccessible::QueryInterface(REFNSIID aIID, void** aInstancePtr)

 nsAccessible::nsAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
  nsAccessNodeWrap(aContent, aShell),
-  mParent(nsnull), mAreChildrenInitialized(PR_FALSE), mIndexInParent(-1),
-  mRoleMapEntry(nsnull)
+  mParent(nsnull), mIndexInParent(-1), mChildrenFlags(eChildrenUninitialized),
+  mIndexOfEmbeddedChild(-1), mRoleMapEntry(nsnull)
 {
 #ifdef NS_DEBUG_X
   {
@ -1100,7 +1100,7 @@ nsAccessible::TakeFocus()
  nsIContent* focusContent = mContent;

  // If the current element can't take real DOM focus and if it has an ID and
-  // ancestor with a the aria-activedescendant attribute present, then set DOM
+  // an ancestor with an aria-activedescendant attribute present, then set DOM
  // focus to that ancestor and set aria-activedescendant on the ancestor to
  // the ID of the desired element.
  if (!frame->IsFocusable()) {
@ -2751,6 +2751,7 @@ nsAccessible::UnbindFromParent()
 {
  mParent = nsnull;
  mIndexInParent = -1;
+  mIndexOfEmbeddedChild = -1;
  mGroupInfo = nsnull;
 }

@ -2763,8 +2764,9 @@ nsAccessible::InvalidateChildren()
    child->UnbindFromParent();
  }

+  mEmbeddedObjCollector = nsnull;
  mChildren.Clear();
-  mAreChildrenInitialized = PR_FALSE;
+  mChildrenFlags = eChildrenUninitialized;
 }

 PRBool
@ -2773,6 +2775,9 @@ nsAccessible::AppendChild(nsAccessible* aChild)
  if (!mChildren.AppendElement(aChild))
    return PR_FALSE;

+  if (nsAccUtils::IsText(aChild))
+    mChildrenFlags = eMixedChildren;
+
  aChild->BindToParent(this, mChildren.Length() - 1);
  return PR_TRUE;
 }
@ -2786,6 +2791,11 @@ nsAccessible::InsertChildAt(PRUint32 aIndex, nsAccessible* aChild)
  for (PRUint32 idx = aIndex + 1; idx < mChildren.Length(); idx++)
    mChildren[idx]->mIndexInParent++;

+  if (nsAccUtils::IsText(aChild))
+    mChildrenFlags = eMixedChildren;
+
+  mEmbeddedObjCollector = nsnull;
+
  aChild->BindToParent(this, aIndex);
  return PR_TRUE;
 }
@ -2800,6 +2810,8 @@ nsAccessible::RemoveChild(nsAccessible* aChild)
    mChildren[idx]->mIndexInParent--;

  mChildren.RemoveElementAt(aChild->mIndexInParent);
+  mEmbeddedObjCollector = nsnull;
+
  aChild->UnbindFromParent();
  return PR_TRUE;
 }
@ -2877,6 +2889,53 @@ nsAccessible::GetIndexInParent()
  return mIndexInParent;
 }

+PRInt32
+nsAccessible::GetEmbeddedChildCount()
+{
+  if (EnsureChildren())
+    return -1;
+
+  if (mChildrenFlags == eMixedChildren) {
+    if (!mEmbeddedObjCollector)
+      mEmbeddedObjCollector = new EmbeddedObjCollector(this);
+    return mEmbeddedObjCollector ? mEmbeddedObjCollector->Count() : -1;
+  }
+
+  return GetChildCount();
+}
+
+nsAccessible*
+nsAccessible::GetEmbeddedChildAt(PRUint32 aIndex)
+{
+  if (EnsureChildren())
+    return nsnull;
+
+  if (mChildrenFlags == eMixedChildren) {
+    if (!mEmbeddedObjCollector)
+      mEmbeddedObjCollector = new EmbeddedObjCollector(this);
+    return mEmbeddedObjCollector ?
+      mEmbeddedObjCollector->GetAccessibleAt(aIndex) : nsnull;
+  }
+
+  return GetChildAt(aIndex);
+}
+
+PRInt32
+nsAccessible::GetIndexOfEmbeddedChild(nsAccessible* aChild)
+{
+  if (EnsureChildren())
+    return -1;
+
+  if (mChildrenFlags == eMixedChildren) {
+    if (!mEmbeddedObjCollector)
+      mEmbeddedObjCollector = new EmbeddedObjCollector(this);
+    return mEmbeddedObjCollector ?
+      mEmbeddedObjCollector->GetIndexAt(aChild) : -1;
+  }
+
+  return GetIndexOf(aChild);
+}
+
 #ifdef DEBUG
 PRBool
 nsAccessible::IsInCache()
@ -2912,7 +2971,8 @@ nsAccessible::TestChildCache(nsAccessible *aCachedChild)
 #ifdef DEBUG
  PRInt32 childCount = mChildren.Length();
  if (childCount == 0) {
-    NS_ASSERTION(!mAreChildrenInitialized, "No children but initialized!");
+    NS_ASSERTION(mChildrenFlags == eChildrenUninitialized,
+                 "No children but initialized!");
    return;
  }

@ -2933,14 +2993,15 @@ PRBool
 nsAccessible::EnsureChildren()
 {
  if (IsDefunct()) {
-    mAreChildrenInitialized = PR_FALSE;
+    mChildrenFlags = eChildrenUninitialized;
    return PR_TRUE;
  }

-  if (mAreChildrenInitialized)
+  if (mChildrenFlags != eChildrenUninitialized)
    return PR_FALSE;

-  mAreChildrenInitialized = PR_TRUE; // Prevent reentry
+  // State is embedded children until text leaf accessible is appended.
+  mChildrenFlags = eEmbeddedChildren; // Prevent reentry
  CacheChildren();

  return PR_FALSE;
--- a/accessible/src/base/nsAccessible.h
+++ b/accessible/src/base/nsAccessible.h
@ -53,6 +53,7 @@
 #include "nsRefPtrHashtable.h"

 class AccGroupInfo;
+class EmbeddedObjCollector;
 class nsAccessible;
 class nsAccEvent;
 struct nsRoleMapEntry;
@ -256,6 +257,21 @@ public:
   */
  PRBool HasChildren() { return !!GetChildAt(0); }

+  /**
+   * Return embedded accessible children count.
+   */
+  PRInt32 GetEmbeddedChildCount();
+
+  /**
+   * Return embedded accessible child at the given index.
+   */
+  nsAccessible* GetEmbeddedChildAt(PRUint32 aIndex);
+
+  /**
+   * Return index of the given embedded accessible child.
+   */
+  PRInt32 GetIndexOfEmbeddedChild(nsAccessible* aChild);
+
  /**
   * Return cached accessible of parent-child relatives.
   */
@ -271,7 +287,7 @@ public:
      mParent->mChildren.SafeElementAt(mIndexInParent - 1, nsnull).get() : nsnull;
  }
  PRUint32 GetCachedChildCount() const { return mChildren.Length(); }
-  PRBool AreChildrenCached() const { return mAreChildrenInitialized; }
+  PRBool AreChildrenCached() const { return mChildrenFlags != eChildrenUninitialized; }

 #ifdef DEBUG
  /**
@ -443,9 +459,19 @@ protected:
  // Data Members
  nsRefPtr<nsAccessible> mParent;
  nsTArray<nsRefPtr<nsAccessible> > mChildren;
-  PRBool mAreChildrenInitialized;
  PRInt32 mIndexInParent;

+  enum ChildrenFlags {
+    eChildrenUninitialized = 0x00,
+    eMixedChildren = 0x01,
+    eEmbeddedChildren = 0x02
+  };
+  ChildrenFlags mChildrenFlags;
+
+  nsAutoPtr<EmbeddedObjCollector> mEmbeddedObjCollector;
+  PRInt32 mIndexOfEmbeddedChild;
+  friend class EmbeddedObjCollector;
+
  nsAutoPtr<AccGroupInfo> mGroupInfo;
  friend class AccGroupInfo;

--- a/accessible/src/base/nsOuterDocAccessible.cpp
+++ b/accessible/src/base/nsOuterDocAccessible.cpp
@ -191,7 +191,7 @@ nsOuterDocAccessible::InvalidateChildren()
  // then allow nsAccDocManager to handle this case since the document
  // accessible is created and appended as a child when it's requested.

-  mAreChildrenInitialized = PR_FALSE;
+  mChildrenFlags = eChildrenUninitialized;
 }

 PRBool
--- a/accessible/src/html/nsHyperTextAccessible.cpp
+++ b/accessible/src/html/nsHyperTextAccessible.cpp
@ -1091,11 +1091,8 @@ nsHyperTextAccessible::GetTextAttributes(PRBool aIncludeDefAttrs,
    NS_ADDREF(*aAttributes = attributes);
  }

-  PRInt32 offsetAccIdx = -1;
-  PRInt32 startOffset = 0, endOffset = 0;
-  nsAccessible *offsetAcc = GetAccessibleAtOffset(aOffset, &offsetAccIdx,
-                                                  &startOffset, &endOffset);
-  if (!offsetAcc) {
+  nsAccessible* accAtOffset = GetChildAtOffset(aOffset);
+  if (!accAtOffset) {
    // Offset 0 is correct offset when accessible has empty text. Include
    // default attributes if they were requested, otherwise return empty set.
    if (aOffset == 0) {
@ -1108,17 +1105,21 @@ nsHyperTextAccessible::GetTextAttributes(PRBool aIncludeDefAttrs,
    return NS_ERROR_INVALID_ARG;
  }

+  PRInt32 accAtOffsetIdx = accAtOffset->GetIndexInParent();
+  PRInt32 startOffset = GetChildOffset(accAtOffsetIdx);
+  PRInt32 endOffset = GetChildOffset(accAtOffsetIdx + 1);
  PRInt32 offsetInAcc = aOffset - startOffset;

-  nsTextAttrsMgr textAttrsMgr(this, aIncludeDefAttrs, offsetAcc, offsetAccIdx);
+  nsTextAttrsMgr textAttrsMgr(this, aIncludeDefAttrs, accAtOffset,
+                              accAtOffsetIdx);
  nsresult rv = textAttrsMgr.GetAttributes(*aAttributes, &startOffset,
                                           &endOffset);
  NS_ENSURE_SUCCESS(rv, rv);

  // Compute spelling attributes on text accessible only.
-  nsIFrame *offsetFrame = offsetAcc->GetFrame();
+  nsIFrame *offsetFrame = accAtOffset->GetFrame();
  if (offsetFrame && offsetFrame->GetType() == nsAccessibilityAtoms::textFrame) {
-    nsCOMPtr<nsIDOMNode> node = offsetAcc->GetDOMNode();
+    nsCOMPtr<nsIDOMNode> node = accAtOffset->GetDOMNode();

    PRInt32 nodeOffset = 0;
    nsresult rv = RenderedToContentOffset(offsetFrame, offsetInAcc,
@ -1369,7 +1370,7 @@ nsHyperTextAccessible::GetLinkIndex(nsIAccessibleHyperLink* aLink,
 }

 NS_IMETHODIMP
-nsHyperTextAccessible::GetLinkIndexAtOffset(PRInt32 aCharIndex,
+nsHyperTextAccessible::GetLinkIndexAtOffset(PRInt32 aOffset,
                                            PRInt32* aLinkIndex)
 {
  NS_ENSURE_ARG_POINTER(aLinkIndex);
@ -1378,29 +1379,7 @@ nsHyperTextAccessible::GetLinkIndexAtOffset(PRInt32 aCharIndex,
  if (IsDefunct())
    return NS_ERROR_FAILURE;

-  PRInt32 characterCount = 0;
-  PRInt32 linkIndex = 0;
-
-  PRInt32 childCount = GetChildCount();
-  for (PRInt32 childIdx = 0;
-       childIdx < childCount && characterCount <= aCharIndex; childIdx++) {
-    nsAccessible *childAcc = mChildren[childIdx];
-
-    PRUint32 role = nsAccUtils::Role(childAcc);
-    if (role == nsIAccessibleRole::ROLE_TEXT_LEAF ||
-        role == nsIAccessibleRole::ROLE_STATICTEXT) {
-      characterCount += nsAccUtils::TextLength(childAcc);
-    }
-    else {
-      if (characterCount ++ == aCharIndex) {
-        *aLinkIndex = linkIndex;
-        break;
-      }
-      if (role != nsIAccessibleRole::ROLE_WHITESPACE) {
-        ++ linkIndex;
-      }
-    }
-  }
+  *aLinkIndex = GetLinkIndexAtOffset(aOffset);
  return NS_OK;
 }

@ -2043,7 +2022,6 @@ nsHyperTextAccessible::ScrollSubstringToPoint(PRInt32 aStartIndex,
 void
 nsHyperTextAccessible::InvalidateChildren()
 {
-  mLinks = nsnull;
  mOffsets.Clear();

  nsAccessibleWrap::InvalidateChildren();
@ -2110,70 +2088,77 @@ nsresult nsHyperTextAccessible::RenderedToContentOffset(nsIFrame *aFrame, PRUint
 // nsHyperTextAccessible public

 PRInt32
-nsHyperTextAccessible::GetChildOffset(nsAccessible* aChild,
+nsHyperTextAccessible::GetChildOffset(PRUint32 aChildIndex,
                                      PRBool aInvalidateAfter)
 {
-  PRInt32 index = GetIndexOf(aChild);
-  if (index == -1 || index == 0)
-    return index;
+  if (aChildIndex == 0)
+    return aChildIndex;

-  PRInt32 count = mOffsets.Length() - index;
+  PRInt32 count = mOffsets.Length() - aChildIndex;
  if (count > 0) {
    if (aInvalidateAfter)
-      mOffsets.RemoveElementsAt(index, count);
+      mOffsets.RemoveElementsAt(aChildIndex, count);

-    return mOffsets[index - 1];
+    return mOffsets[aChildIndex - 1];
  }

  PRUint32 lastOffset = mOffsets.IsEmpty() ?
    0 : mOffsets[mOffsets.Length() - 1];

  EnsureChildren();
-  while (mOffsets.Length() < index) {
+  while (mOffsets.Length() < aChildIndex) {
    nsAccessible* child = mChildren[mOffsets.Length()];
    lastOffset += nsAccUtils::TextLength(child);
    mOffsets.AppendElement(lastOffset);
  }

-  return mOffsets[index - 1];
-}
-////////////////////////////////////////////////////////////////////////////////
-// nsHyperTextAccessible protected
-
-AccCollector*
-nsHyperTextAccessible::GetLinkCollector()
-{
-  if (IsDefunct())
-    return nsnull;
-
-  if (!mLinks)
-    mLinks = new AccCollector(this, filters::GetEmbeddedObject);
-  return mLinks;
+  return mOffsets[aChildIndex - 1];
 }

-nsAccessible *
-nsHyperTextAccessible::GetAccessibleAtOffset(PRInt32 aOffset, PRInt32 *aAccIdx,
-                                             PRInt32 *aStartOffset,
-                                             PRInt32 *aEndOffset)
+PRInt32
+nsHyperTextAccessible::GetChildIndexAtOffset(PRUint32 aOffset)
 {
-  PRInt32 startOffset = 0, endOffset = 0;
-  PRInt32 childCount = GetChildCount();
-  for (PRInt32 childIdx = 0; childIdx < childCount; childIdx++) {
-    nsAccessible *child = mChildren[childIdx];
-    endOffset += nsAccUtils::TextLength(child);
-    if (endOffset > aOffset) {
-      *aStartOffset = startOffset;
-      *aEndOffset = endOffset;
-      *aAccIdx = childIdx;
-      return child;
+  PRUint32 lastOffset = 0;
+  PRUint32 offsetCount = mOffsets.Length();
+  if (offsetCount > 0) {
+    lastOffset = mOffsets[offsetCount - 1];
+    if (aOffset < lastOffset) {
+      PRUint32 low = 0, high = offsetCount;
+      while (high > low) {
+        PRUint32 mid = (high + low) >> 1;
+        if (mOffsets[mid] == aOffset)
+          return mid < offsetCount - 1 ? mid + 1 : mid;
+
+        if (mOffsets[mid] < aOffset)
+          low = mid + 1;
+        else
+          high = mid;
+      }
+      if (high == offsetCount)
+        return -1;
+
+      return low < offsetCount - 1 ? low + 1 : low;
    }
-
-    startOffset = endOffset;
  }

-  return nsnull;
+  PRUint32 childCount = GetChildCount();
+  while (mOffsets.Length() < childCount) {
+    nsAccessible* child = GetChildAt(mOffsets.Length());
+    lastOffset += nsAccUtils::TextLength(child);
+    mOffsets.AppendElement(lastOffset);
+    if (aOffset < lastOffset)
+      return mOffsets.Length() - 1;
+  }
+
+  if (aOffset == lastOffset)
+    return mOffsets.Length() - 1;
+
+  return -1;
 }

+////////////////////////////////////////////////////////////////////////////////
+// nsHyperTextAccessible protected
+
 nsresult
 nsHyperTextAccessible::GetDOMPointByFrameOffset(nsIFrame *aFrame,
                                                PRInt32 aOffset,
--- a/accessible/src/html/nsHyperTextAccessible.h
+++ b/accessible/src/html/nsHyperTextAccessible.h
@ -106,8 +106,7 @@ public:
   */
  inline PRUint32 GetLinkCount()
  {
-    AccCollector* links = GetLinkCollector();
-    return links ? links->Count() : 0;
+    return GetEmbeddedChildCount();
  }

  /**
@ -115,8 +114,7 @@ public:
   */
  inline nsAccessible* GetLinkAt(PRUint32 aIndex)
  {
-    AccCollector* links = GetLinkCollector();
-    return links ? links->GetAccessibleAt(aIndex) : nsnull;
+    return GetEmbeddedChildAt(aIndex);
  }

  /**
@ -124,8 +122,16 @@ public:
   */
  inline PRInt32 GetLinkIndex(nsAccessible* aLink)
  {
-    AccCollector* links = GetLinkCollector();
-    return links ? links->GetIndexAt(aLink) : -1;
+    return GetIndexOfEmbeddedChild(aLink);
+  }
+
+  /**
+   * Return link accessible at the given text offset.
+   */
+  inline PRInt32 GetLinkIndexAtOffset(PRUint32 aOffset)
+  {
+    nsAccessible* child = GetChildAtOffset(aOffset);
+    return GetLinkIndex(child);
  }

  /**
@ -187,23 +193,46 @@ public:
                                      PRInt32 *aEndOffset);

  /**
-   * Return text offset the given child accessible of hypertext accessible.
+   * Return text offset of the given child accessible within hypertext
+   * accessible.
   *
   * @param  aChild           [in] accessible child to get text offset for
   * @param  aInvalidateAfter [in, optional] indicates whether invalidate
   *                           cached offsets for next siblings of the child
   */
  PRInt32 GetChildOffset(nsAccessible* aChild,
+                         PRBool aInvalidateAfter = PR_FALSE)
+  {
+    PRInt32 index = GetIndexOf(aChild);
+    return index == -1 ? -1 : GetChildOffset(index, aInvalidateAfter);
+  }
+
+  /**
+   * Return text offset for the child accessible index.
+   */
+  PRInt32 GetChildOffset(PRUint32 aChildIndex,
                         PRBool aInvalidateAfter = PR_FALSE);

+  /**
+   * Return child accessible at the given text offset.
+   *
+   * @param  aOffset  [in] the given text offset
+   */
+  PRInt32 GetChildIndexAtOffset(PRUint32 aOffset);
+
+  /**
+   * Return child accessible at the given text offset.
+   *
+   * @param  aOffset  [in] the given text offset
+   */
+  nsAccessible* GetChildAtOffset(PRUint32 aOffset)
+  {
+    return GetChildAt(GetChildIndexAtOffset(aOffset));
+  }
+
 protected:
  // nsHyperTextAccessible

-  /**
-   * Return link collection, create it if necessary.
-   */
-  AccCollector* GetLinkCollector();
-
  /*
   * This does the work for nsIAccessibleText::GetText[At|Before|After]Offset
   * @param aType, eGetBefore, eGetAt, eGetAfter
@ -299,18 +328,6 @@ protected:
   */
  PRInt32 GetCaretLineNumber();

-  /**
-   * Return an accessible at the given hypertext offset.
-   *
-   * @param  aOffset       [out] the given hypertext offset
-   * @param  aAccIdx       [out] child index of returned accessible
-   * @param  aStartOffset  [out] start hypertext offset of returned accessible
-   * @param  aEndOffset    [out] end hypertext offset of returned accessible
-   */
-  nsAccessible *GetAccessibleAtOffset(PRInt32 aOffset, PRInt32 *aAccIdx,
-                                      PRInt32 *aStartOffset,
-                                      PRInt32 *aEndOffset);
-
  // Helpers
  nsresult GetDOMPointByFrameOffset(nsIFrame *aFrame, PRInt32 aOffset,
                                    nsIAccessible *aAccessible,
--- a/accessible/src/msaa/CAccessibleHypertext.cpp
+++ b/accessible/src/msaa/CAccessibleHypertext.cpp
@ -117,16 +117,11 @@ CAccessibleHypertext::get_hyperlinkIndex(long aCharIndex, long *aHyperlinkIndex)
 __try {
  *aHyperlinkIndex = 0;

-  nsCOMPtr<nsIAccessibleHyperText> hyperAcc(do_QueryObject(this));
+  nsRefPtr<nsHyperTextAccessible> hyperAcc(do_QueryObject(this));
  if (!hyperAcc)
    return E_FAIL;

-  PRInt32 index = 0;
-  nsresult rv = hyperAcc->GetLinkIndexAtOffset(aCharIndex, &index);
-  if (NS_FAILED(rv))
-    return GetHRESULT(rv);
-
-  *aHyperlinkIndex = index;
+  *aHyperlinkIndex = hyperAcc->GetLinkIndexAtOffset(aCharIndex);
  return S_OK;

 } __except(nsAccessNodeWrap::FilterA11yExceptions(::GetExceptionCode(), GetExceptionInformation())) { }
--- a/accessible/tests/mochitest/attributes/test_text.html
+++ b/accessible/tests/mochitest/attributes/test_text.html
@ -428,8 +428,12 @@

      ID = "area14";
      defAttrs = buildDefaultTextAttrs(ID, kInputFontSize);
-      attrs = { };
-      testTextAttrs(ID, 0, attrs, defAttrs, 0, 0);
+
+      // XXX: While we expose text leaf accessibles for placeholder we grab its
+      // style, bug 545817.
+      // attrs = { color: "rgb(109, 109, 109)" };
+      //testTextAttrs(ID, 0, attrs, defAttrs, 0, 0);
+      todo(false, "enable commented tests when bug 545817 is fixed");

      //////////////////////////////////////////////////////////////////////////
      // area15, embed char tests, "*plain*plain**bold*bold*"
--- a/browser/app/profile/extensions/testpilot@labs.mozilla.com/modules/tasks.js
+++ b/browser/app/profile/extensions/testpilot@labs.mozilla.com/modules/tasks.js
@ -169,18 +169,26 @@ var TestPilotTask = {
  // event handlers:

  onExperimentStartup: function TestPilotTask_onExperimentStartup() {
+    // Called when experiment is to start running (either on Firefox
+    // startup, or when study first becomes IN_PROGRESS)
  },

  onExperimentShutdown: function TestPilotTask_onExperimentShutdown() {
+    // Called when experiment needs to stop running (either on Firefox
+    // shutdown, or on experiment reload, or on finishing or being canceled.)
+  },
+
+  doExperimentCleanup: function TestPilotTask_onExperimentCleanup() {
+    // Called when experiment has finished or been canceled; do any cleanup
+    // of user's profile.
  },

  onAppStartup: function TestPilotTask_onAppStartup() {
-    // Called by extension core when startup is complete.
+    // Called by extension core when Firefox startup is complete.
  },

  onAppShutdown: function TestPilotTask_onAppShutdown() {
-    // TODO: not implemented - should be called when firefox is ready to
-    // shut down.
+    // Called by extension core when Firefox is shutting down.
  },

  onEnterPrivateBrowsing: function TestPilotTask_onEnterPrivate() {
@ -494,6 +502,13 @@ TestPilotExperiment.prototype = {
    }
  },

+  doExperimentCleanup: function TestPilotExperiment_doExperimentCleanup() {
+    if (this._handlers.doExperimentCleanup) {
+      this._logger.trace("Doing experiment cleanup.");
+      this._handlers.doExperimentCleanup();
+    }
+  },
+
  onEnterPrivateBrowsing: function TestPilotExperiment_onEnterPrivate() {
    this._logger.trace("Task is entering private browsing.");
    if (this.experimentIsRunning()) {
@ -633,6 +648,7 @@ TestPilotExperiment.prototype = {
      this._logger.info("Passed End Date - Switched Task Status to Finished");
      this.changeStatus(TaskConstants.STATUS_FINISHED);
      this.onExperimentShutdown();
+      this.doExperimentCleanup();

      if (this._recursAutomatically) {
        this._reschedule();
@ -800,8 +816,11 @@ TestPilotExperiment.prototype = {
    // database table of just opt-out messages; include study ID in metadata.
    let url = Application.prefs.getValue(DATA_UPLOAD_PREF, "") + "opt-out";
    let logger = this._logger;
+
+    this.onExperimentShutdown();
    this.changeStatus(TaskConstants.STATUS_CANCELLED);
    this._dataStore.wipeAllData();
+    this.doExperimentCleanup();
    this._dateForDataDeletion = null;
    this._expirationDateForDataSubmission = null;
    logger.info("Opting out of test with reason " + reason);
--- a/browser/app/profile/firefox.js
+++ b/browser/app/profile/firefox.js
@ -183,7 +183,9 @@ pref("xpinstall.whitelist.add.36", "getpersonas.com");
 pref("lightweightThemes.update.enabled", true);

 pref("keyword.enabled", true);
-pref("keyword.URL", "chrome://browser-region/locale/region.properties");
+// Override the default keyword.URL. Empty value means
+// "use the search service's default engine"
+pref("keyword.URL", "");

 pref("general.useragent.locale", "@AB_CD@");
 pref("general.skins.selectedSkin", "classic/1.0");
--- a/browser/base/content/browser-menubar.inc
+++ b/browser/base/content/browser-menubar.inc
@ -209,8 +209,8 @@
                  accesskey="&viewMenu.accesskey;">
              <menupopup id="menu_viewPopup">
                <menuitem id="menu_tabview"
-                          label="&showTabView.label;"
-                          accesskey="&showTabView.accesskey;"
+                          label="&showTabView2.label;"
+                          accesskey="&showTabView2.accesskey;"
                          command="Browser:ToggleTabView"/>
                <menu id="viewToolbarsMenu"
                      label="&viewToolbarsMenu.label;"
--- a/browser/base/content/browser-tabview.js
+++ b/browser/base/content/browser-tabview.js
@ -46,7 +46,7 @@ let TabView = {
    delete this.windowTitle;
    let brandBundle = document.getElementById("bundle_brand");
    let brandShortName = brandBundle.getString("brandShortName");
-    let title = gNavigatorBundle.getFormattedString("tabView.title", [brandShortName]);
+    let title = gNavigatorBundle.getFormattedString("tabView2.title", [brandShortName]);
    return this.windowTitle = title;
  },

@ -197,8 +197,34 @@ let TabView = {
          charCode == 160) { // alt + space
 #else
      if (event.ctrlKey && !event.metaKey && !event.shiftKey &&
-          event.altKey && charCode == 32) { // ctrl + alt + space
+          !event.altKey && charCode == 32) { // ctrl + space
 #endif
+
+        // Don't handle this event if it's coming from a node that might allow
+        // multiple keyboard selection like selects or trees
+        let node = event.target;
+        switch (node.namespaceURI) {
+          case "http://www.w3.org/1999/xhtml":
+            // xhtml:select only allows multiple when the attr is set
+            if (node.localName == "select" && node.hasAttribute("multiple"))
+              return;
+            break;
+
+          case "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul":
+            switch (node.localName) {
+              case "listbox":
+                // xul:listbox is by default single
+                if (node.getAttribute("seltype") == "multiple")
+                  return;
+                break;
+              case "tree":
+                // xul:tree is by default multiple
+                if (node.getAttribute("seltype") != "single")
+                  return;
+                break;
+            }
+        }
+
        event.stopPropagation();
        event.preventDefault();
        self.show();
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@ -750,7 +750,7 @@ const gXPInstallObserver = {
        PopupNotifications.remove(notification);

      var needsRestart = installInfo.installs.some(function(i) {
-        return (i.addon.pendingOperations & AddonManager.PENDING_INSTALL) != 0;
+        return i.addon.pendingOperations != AddonManager.PENDING_NONE;
      });

      if (needsRestart) {
@ -6769,8 +6769,8 @@ var gBookmarkAllTabsHandler = {
    this._command = document.getElementById("Browser:BookmarkAllTabs");
    gBrowser.tabContainer.addEventListener("TabOpen", this, true);
    gBrowser.tabContainer.addEventListener("TabClose", this, true);
-    gBrowser.tabContainer.addEventListener("TabSelect", this, true);
-    gBrowser.tabContainer.addEventListener("TabMove", this, true);
+    gBrowser.tabContainer.addEventListener("TabShow", this, true);
+    gBrowser.tabContainer.addEventListener("TabHide", this, true);
    this._updateCommandState();
  },

--- a/browser/base/content/browser.xul
+++ b/browser/base/content/browser.xul
@ -102,10 +102,7 @@

 <script type="application/javascript" src="chrome://browser/content/places/editBookmarkOverlay.js"/>

-<deck flex="1" id="tab-view-deck">
-<vbox flex="1">
-
-# All sets except for popupsets (commands, keys, stringbundles and broadcasters) *must* go into the 
+# All sets except for popupsets (commands, keys, stringbundles and broadcasters) *must* go into the
 # browser-sets.inc file for sharing with hiddenWindow.xul.
 #include browser-sets.inc

@ -593,6 +590,9 @@
  </hbox>
 #endif

+<deck flex="1" id="tab-view-deck">
+<vbox flex="1">
+
  <toolbox id="navigator-toolbox"
           defaultmode="icons" mode="icons"
 #ifdef WINCE
@ -941,9 +941,9 @@
      </toolbarbutton>

      <toolbarbutton id="tabview-button" class="toolbarbutton-1 chromeclass-toolbar-additional"
-                     label="&tabViewButton.label;"
+                     label="&tabViewButton2.label;"
                     command="Browser:ToggleTabView"
-                     tooltiptext="&tabViewButton.tooltip;"
+                     tooltiptext="&tabViewButton2.tooltip;"
                     removable="true"/>

      <toolbarbutton id="tabs-closebutton"
--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
@ -726,7 +726,7 @@
      <method name="updateTitlebar">
        <body>
          <![CDATA[
-            if (TabView && TabView.isVisible()) {
+            if (window.TabView && TabView.isVisible()) {
              // ToDo: this will be removed when we gain ability to draw to the menu bar.
              // Bug 586175
              this.ownerDocument.title = TabView.windowTitle;
@ -769,7 +769,7 @@
            newBrowser.docShell.isActive = true;
            this.mCurrentBrowser = newBrowser;
            this.mCurrentTab = this.selectedTab;
-            this.mCurrentTab.hidden = false;
+            this.showTab(this.mCurrentTab);

            if (updatePageReport)
              this.mCurrentBrowser.updatePageReport();
@ -1791,8 +1791,39 @@
        <body>
        <![CDATA[
          Array.forEach(this.tabs, function(tab) {
-            tab.hidden = aTabs.indexOf(tab) == -1 && !tab.pinned && !tab.selected;
-          });
+            if (aTabs.indexOf(tab) == -1)
+              this.hideTab(tab);
+            else
+              this.showTab(tab);
+          }, this);
+        ]]>
+        </body>
+      </method>
+
+      <method name="showTab">
+        <parameter name="aTab"/>
+        <body>
+        <![CDATA[
+          if (aTab.hidden) {
+            aTab.hidden = false;
+            let event = document.createEvent("Events");
+            event.initEvent("TabShow", true, false);
+            aTab.dispatchEvent(event);
+          }
+        ]]>
+        </body>
+      </method>
+
+      <method name="hideTab">
+        <parameter name="aTab"/>
+        <body>
+        <![CDATA[
+          if (!aTab.hidden && !aTab.pinned && !aTab.selected) {
+            aTab.hidden = true;
+            let event = document.createEvent("Events");
+            event.initEvent("TabHide", true, false);
+            aTab.dispatchEvent(event);
+          }
        ]]>
        </body>
      </method>
@ -2618,8 +2649,7 @@
            if (this.childNodes.length == 1 && this._closeWindowWithLastTab)
              this.setAttribute("closebuttons", "noclose");
            else {
-              // Grab the last tab for size comparison
-              let tab = this.tabbrowser.visibleTabs.pop();
+              let tab = this.tabbrowser.visibleTabs[this.tabbrowser._numPinnedTabs];
              if (tab && tab.getBoundingClientRect().width > this.mTabClipWidth)
                this.setAttribute("closebuttons", "alltabs");
              else
--- a/browser/base/content/tabview/drag.js
+++ b/browser/base/content/tabview/drag.js
@ -108,8 +108,8 @@ Drag.prototype = {
  //                        proportionally or not
  //   checkItemStatus    - (boolean) make sure this is a valid item which should be snapped
  snapBounds: function Drag_snapBounds(bounds, stationaryCorner, assumeConstantSize, keepProportional, checkItemStatus) {
-		if (!stationaryCorner)
-			stationaryCorner || 'topleft';
+    if (!stationaryCorner)
+      stationaryCorner || 'topleft';
    var update = false; // need to update
    var updateX = false;
    var updateY = false;
--- a/browser/base/content/tabview/groupitems.js
+++ b/browser/base/content/tabview/groupitems.js
@ -126,15 +126,13 @@ let GroupItem = function GroupItem(listOfEls, options) {

  // ___ New Tab Button
  this.$ntb = iQ("<div>")
-    .appendTo($container);
-
-  this.$ntb
    .addClass('newTabButton')
    .click(function() {
      self.newTab();
-    });
-
-  (this.$ntb)[0].title = 'New tab';
+    })
+    .attr('title',
+          "New tab")
+    .appendTo($container);

  // ___ Resizer
  this.$resizer = iQ("<div>")
@ -169,7 +167,7 @@ let GroupItem = function GroupItem(listOfEls, options) {
  this.$titleContainer = iQ('.title-container', this.$titlebar);
  this.$title = iQ('.name', this.$titlebar);
  this.$titleShield = iQ('.title-shield', this.$titlebar);
-  this.setTitle(options.title || "");
+  this.setTitle(options.title || this.defaultName);

  var titleUnfocus = function() {
    self.$titleShield.show();
@ -298,7 +296,7 @@ window.GroupItem.prototype = Utils.extend(new Item(), new Subscribable(), {
  // ----------
  // Variable: defaultName
  // The prompt text for the title field.
-  defaultName: "name this groupItem...",
+  defaultName: "Name this tab group…",

  // -----------
  // Function: setActiveTab
@ -374,7 +372,7 @@ window.GroupItem.prototype = Utils.extend(new Item(), new Subscribable(), {
  adjustTitleSize: function() {
    Utils.assert(this.bounds, 'bounds needs to have been set');
    let closeButton = iQ('.close', this.container);
-    var w = Math.min(this.bounds.width - closeButton.width() - closeButton.css('right'),
+    var w = Math.min(this.bounds.width - parseInt(closeButton.width()) - parseInt(closeButton.css('right')),
                     Math.max(150, this.getTitle().length * 6));
    // The * 6 multiplier calculation is assuming that characters in the title
    // are approximately 6 pixels wide. Bug 586545
@ -658,11 +656,6 @@ window.GroupItem.prototype = Utils.extend(new Item(), new Subscribable(), {
        this.arrange();
      }
      UI.setReorderTabsOnHide(this);
-
-      if (this._nextNewTabCallback) {
-        this._nextNewTabCallback.apply(this, [item])
-        this._nextNewTabCallback = null;
-      }
    } catch(e) {
      Utils.log('GroupItem.add error', e);
    }
@ -1191,59 +1184,41 @@ window.GroupItem.prototype = Utils.extend(new Item(), new Subscribable(), {
    GroupItems.setActiveGroupItem(this);
    let newTab = gBrowser.loadOneTab(url || "about:blank", {inBackground: true});

+    // TabItems will have handled the new tab and added the tabItem property
+    let newItem = newTab.tabItem;
+
    var self = this;
-    var doNextTab = function(tab) {
-      var groupItem = GroupItems.getActiveGroupItem();
-
-      iQ(tab.container).css({opacity: 0});
-      var $anim = iQ("<div>")
-        .addClass('newTabAnimatee')
-        .css({
-          top: tab.bounds.top+5,
-          left: tab.bounds.left+5,
-          width: tab.bounds.width-10,
-          height: tab.bounds.height-10,
-          zIndex: 999,
-          opacity: 0
-        })
-        .appendTo("body")
-        .animate({
-          opacity: 1.0
-        }, {
-          duration: 500,
-          complete: function() {
-            $anim.animate({
-              top: 0,
-              left: 0,
-              width: window.innerWidth,
-              height: window.innerHeight
-            }, {
-              duration: 270,
-              complete: function() {
-                iQ(tab.container).css({opacity: 1});
-                newTab.tabItem.zoomIn(!url);
-                $anim.remove();
-                // We need a timeout here so that there is a chance for the
-                // new tab to get made! Otherwise it won't appear in the list
-                // of the groupItem's tab.
-                // TODO: This is probably a terrible hack that sets up a race
-                // condition. We need a better solution.
-                // Bug 586551
-                setTimeout(function() {
-                  self._sendToSubscribers("tabAdded", { groupItemId: self.id });
-                }, 1);
-              }
-            });
-          }
-        });
-    }
-
-    // TODO: Because this happens as a callback, there is
-    // sometimes a long delay before the animation occurs.
-    // We need to fix this--immediate response to a users
-    // actions is necessary for a good user experience.
-    // Bug 586552
-    self.onNextNewTab(doNextTab);
+    iQ(newItem.container).css({opacity: 0});
+    let $anim = iQ("<div>")
+      .addClass("newTabAnimatee")
+      .css({
+        top: newItem.bounds.top + 5,
+        left: newItem.bounds.left + 5,
+        width: newItem.bounds.width - 10,
+        height: newItem.bounds.height - 10,
+        zIndex: 999,
+        opacity: 0
+      })
+      .appendTo("body")
+      .animate({opacity: 1}, {
+        duration: 500,
+        complete: function() {
+          $anim.animate({
+            top: 0,
+            left: 0,
+            width: window.innerWidth,
+            height: window.innerHeight
+          }, {
+            duration: 270,
+            complete: function() {
+              iQ(newItem.container).css({opacity: 1});
+              newItem.zoomIn(!url);
+              $anim.remove();
+              self._sendToSubscribers("tabAdded", {groupItemId: self.id});
+            }
+          });
+        }
+      });
  },

  // ----------
@ -1322,19 +1297,6 @@ window.GroupItem.prototype = Utils.extend(new Item(), new Subscribable(), {
  // Returns all children.
  getChildren: function() {
    return this._children;
-  },
-
-  // ---------
-  // Function: onNextNewTab
-  // Sets up a one-time handler that gets called the next time a
-  // tab is added to the groupItem.
-  //
-  // Parameters:
-  //  callback - the one-time callback that is fired when the next
-  //             time a tab is added to a groupItem; it gets passed the
-  //             new tab
-  onNextNewTab: function(callback) {
-    this._nextNewTabCallback = callback;
  }
 });

@ -1759,6 +1721,7 @@ window.GroupItems = {
          gBrowser.selectTabAtIndex(index + 1);
        else
          gBrowser.selectTabAtIndex(index - 1);
+        shouldUpdateTabBar = true;
      } else {
        shouldShowTabView = true;
      }
@ -1797,8 +1760,9 @@ window.GroupItems = {
  // Function: killNewTabGroup
  // Removes the New Tab Group, which is now defunct. See bug 575851 and comments therein.
  killNewTabGroup: function() {
+    let newTabGroupTitle = "New Tabs";
    this.groupItems.forEach(function(groupItem) {
-      if (groupItem.getTitle() == 'New Tabs' && groupItem.locked.title) {
+      if (groupItem.getTitle() == newTabGroupTitle && groupItem.locked.title) {
        groupItem.removeAll();
        groupItem.close();
      }
--- a/browser/base/content/tabview/iq.js
+++ b/browser/base/content/tabview/iq.js
@ -531,9 +531,7 @@ iQClass.prototype = {
      options = {};

    let easings = {
-      tabviewBounce: "cubic-bezier(0.0, 0.63, .6, 1.0)", 
-      // TODO: change 1.0 above to 1.29 after bug 575672 is fixed
-      
+      tabviewBounce: "cubic-bezier(0.0, 0.63, .6, 1.29)", 
      easeInQuad: 'ease-in', // TODO: make it a real easeInQuad, or decide we don't care
      fast: 'cubic-bezier(0.7,0,1,1)'
    };
--- a/browser/base/content/tabview/items.js
+++ b/browser/base/content/tabview/items.js
@ -1048,7 +1048,7 @@ window.Items = {
          var bounds2 = pair2.bounds;
          if (bounds2.intersects(newBounds))
            blocked = true;
-					return;
+          return;
        });

        if (!blocked) {
--- a/browser/base/content/tabview/tabitems.js
+++ b/browser/base/content/tabview/tabitems.js
@ -684,9 +684,7 @@ window.TabItems = {
      if (tab.ownerDocument.defaultView != gWindow)
        return;

-      setTimeout(function() { // Marshal event from chrome thread to DOM thread
-        self.link(tab);
-      }, 1);
+      self.link(tab);
    }
    // When a tab's content is loaded, show the canvas and hide the cached data
    // if necessary.
@ -694,18 +692,14 @@ window.TabItems = {
      if (tab.ownerDocument.defaultView != gWindow)
        return;

-      setTimeout(function() { // Marshal event from chrome thread to DOM thread
-        self.update(tab);
-      }, 1);
+      self.update(tab);
    }
    // When a tab is closed, unlink.
    this._eventListeners["close"] = function(tab) {
      if (tab.ownerDocument.defaultView != gWindow)
        return;

-      setTimeout(function() { // Marshal event from chrome thread to DOM thread
-        self.unlink(tab);
-      }, 1);
+      self.unlink(tab);
    }
    for (let name in this._eventListeners) {
      AllTabs.register(name, this._eventListeners[name]);
@ -862,6 +856,7 @@ window.TabItems = {
      Items.unsquish(null, tab.tabItem);

      tab.tabItem = null;
+      Storage.saveTab(tab, null);

      let index = this._tabsWaitingForUpdate.indexOf(tab);
      if (index != -1)
--- a/browser/base/content/tabview/tabview.css
+++ b/browser/base/content/tabview/tabview.css
@ -347,11 +347,11 @@ input.name {
  padding-left: 20px;
 }

-input.name:hover {
+.title-container:hover input.name {
  border: 1px solid #ddd;
 }

-input.name-locked:hover {
+.title-container:hover input.name-locked {
  border: 1px solid transparent !important;
  cursor: default;
 }
@ -366,7 +366,7 @@ input.defaultName {
  color: transparent;
 }

-input.defaultName:hover {
+.title-container:hover input.defaultName {
  color: #CCC;
 }

--- a/browser/base/content/tabview/ui.js
+++ b/browser/base/content/tabview/ui.js
@ -66,10 +66,6 @@ var UIManager = {
  // If true, a select tab has just been closed in TabView.
  _closedSelectedTabInTabView : false,

-  // Variable: _stopZoomPreparation
-  // If true, prevent the next zoom preparation.
-  _stopZoomPreparation : false,
-
  // Variable: _reorderTabItemsOnShow
  // Keeps track of the <GroupItem>s which their tab items' tabs have been moved
  // and re-orders the tab items when switching to TabView.
@ -107,7 +103,12 @@ var UIManager = {
      this._currentTab = gBrowser.selectedTab;

      // ___ Dev Menu
-      this._addDevMenu();
+      // This dev menu is not meant for shipping, nor is it of general
+      // interest, but we still need it for the time being. Change the 
+      // false below to enable; just remember to change back before 
+      // committing. Bug 586721 will track the ultimate removal. 
+      if (false)
+        this._addDevMenu();

      // When you click on the background/empty part of TabView,
      // we create a new groupItem.
@ -124,7 +125,7 @@ var UIManager = {

      iQ(window).bind("beforeunload", function() {
        Array.forEach(gBrowser.tabs, function(tab) {
-          tab.hidden = false;
+          gBrowser.showTab(tab);
        });
      });
      iQ(window).bind("unload", function() {
@ -153,6 +154,10 @@ var UIManager = {
      GroupItems.reconstitute(groupItemsData, groupItemData);
      GroupItems.killNewTabGroup(); // temporary?

+      // ___ tabs
+      TabItems.init();
+      TabItems.pausePainting();
+
      if (firstTime) {
        var padding = 10;
        var infoWidth = 350;
@ -180,11 +185,14 @@ var UIManager = {
        });

        // ___ make info item
+        let welcome = "How to organize your tabs";
+        let more = "";
+        let video = "http://videos-cdn.mozilla.net/firefox4beta/tabcandy_howto.webm";
        var html =
          "<div class='intro'>"
-            + "<h1>Welcome to Firefox Tab Sets</h1>" // TODO: This needs to be localized if it's kept in
-            + "<div>(more goes here)</div><br>"
-            + "<video src='http://people.mozilla.org/~araskin/movies/tabcandy_howto.webm' "
+            + "<h1>" + welcome + "</h1>"
+            + ( more && more.length ? "<div>" + more + "</div><br>" : "")
+            + "<video src='" + video + "' "
            + "width='100%' preload controls>"
          + "</div>";

@ -195,10 +203,6 @@ var UIManager = {
        infoItem.html(html);
      }

-      // ___ tabs
-      TabItems.init();
-      TabItems.pausePainting();
-
      // ___ resizing
      if (this._pageBounds)
        this._resize(true);
@ -304,7 +308,7 @@ var UIManager = {

 #ifdef XP_WIN
    // Restore the full height when showing TabView
-    gTabViewFrame.style.marginTop = 0;
+    gTabViewFrame.style.marginTop = "";
 #endif
    gTabViewDeck.selectedIndex = 1;
    gTabViewFrame.contentWindow.focus();
@ -432,14 +436,6 @@ var UIManager = {
              tab.tabItem.setZoomPrep(false);
            self.showTabView();
          }
-          // ToDo: When running unit tests, everything happens so quick so
-          // new tabs might be added after a tab is closing. Therefore, this
-          // hack is used. We should look for a better solution.
-          setTimeout(function() { // Marshal event from chrome thread to DOM thread
-            if ((groupItem && groupItem._children.length > 0) ||
-              (groupItem == null && gBrowser.visibleTabs.length > 0))
-              self.hideTabView();
-          }, 1);
        }
      }
    });
@ -448,11 +444,9 @@ var UIManager = {
      if (tab.ownerDocument.defaultView != gWindow)
        return;

-      setTimeout(function() { // Marshal event from chrome thread to DOM thread
-        var activeGroupItem = GroupItems.getActiveGroupItem();
-        if (activeGroupItem)
-          self.setReorderTabItemsOnShow(activeGroupItem);
-      }, 1);
+      let activeGroupItem = GroupItems.getActiveGroupItem();
+      if (activeGroupItem)
+        self.setReorderTabItemsOnShow(activeGroupItem);
    });

    AllTabs.register("select", function(tab) {
@ -489,54 +483,40 @@ var UIManager = {
    this._closedLastVisibleTab = false;
    this._closedSelectedTabInTabView = false;

-    setTimeout(function() { // Marshal event from chrome thread to DOM thread
-      // this value is true when TabView is open at browser startup.
-      if (self._stopZoomPreparation) {
-        self._stopZoomPreparation = false;
-        if (focusTab && focusTab.tabItem)
-          self.setActiveTab(focusTab.tabItem);
-        return;
+    // have things have changed while we were in timeout?
+    if (focusTab != self._currentTab)
+      return;
+
+    let newItem = null;
+    if (focusTab && focusTab.tabItem) {
+      newItem = focusTab.tabItem;
+      if (newItem.parent)
+        GroupItems.setActiveGroupItem(newItem.parent);
+      else {
+        GroupItems.setActiveGroupItem(null);
+        GroupItems.setActiveOrphanTab(newItem);
      }
+      GroupItems.updateTabBar();
+    }

-      if (focusTab != self._currentTab) {
-        // things have changed while we were in timeout
-        return;
-      }
+    // ___ prepare for when we return to TabView
+    let oldItem = null;
+    if (currentTab && currentTab.tabItem)
+      oldItem = currentTab.tabItem;

-      var visibleTabCount = gBrowser.visibleTabs.length;
+    if (newItem != oldItem) {
+      if (oldItem)
+        oldItem.setZoomPrep(false);

-      var newItem = null;
-      if (focusTab && focusTab.tabItem) {
-        newItem = focusTab.tabItem;
-        if (newItem.parent)
-          GroupItems.setActiveGroupItem(newItem.parent);
-        else {
-          GroupItems.setActiveGroupItem(null);
-          GroupItems.setActiveOrphanTab(newItem);
-        }
-        GroupItems.updateTabBar();
-      }
-
-      // ___ prepare for when we return to TabView
-      var oldItem = null;
-      if (currentTab && currentTab.tabItem)
-        oldItem = currentTab.tabItem;
-
-      if (newItem != oldItem) {
-        if (oldItem)
-          oldItem.setZoomPrep(false);
-
-        // if the last visible tab is removed, don't set zoom prep because
-        // we shoud be in the TabView interface.
-        if (visibleTabCount > 0 && newItem && !self._isTabViewVisible())
-          newItem.setZoomPrep(true);
-      } else {
-        // the tab is already focused so the new and old items are the
-        // same.
-        if (oldItem)
-          oldItem.setZoomPrep(!self._isTabViewVisible());
-      }
-    }, 1);
+      // if the last visible tab is removed, don't set zoom prep because
+      // we should be in the TabView interface.
+      let visibleTabCount = gBrowser.visibleTabs.length;
+      if (visibleTabCount > 0 && newItem && !self._isTabViewVisible())
+        newItem.setZoomPrep(true);
+    }
+    // the tab is already focused so the new and old items are the same.
+    else if (oldItem)
+      oldItem.setZoomPrep(!self._isTabViewVisible());
  },

  // ----------
@ -636,7 +616,7 @@ var UIManager = {
            !event.ctrlKey) {
 #else
        if (event.ctrlKey && !event.metaKey && !event.shiftKey &&
-            event.altKey) {
+            !event.altKey) {
 #endif
          var activeTab = self.getActiveTab();
          if (activeTab)
--- a/browser/base/content/test/Makefile.in
+++ b/browser/base/content/test/Makefile.in
@ -171,6 +171,7 @@ _BROWSER_FILES = \
                 browser_visibleTabs.js \
                 browser_visibleTabs_contextMenu.js \
                 browser_visibleTabs_bookmarkAllPages.js \
+                 browser_visibleTabs_bookmarkAllTabs.js \
                 browser_visibleTabs_tabPreview.js \
                 discovery.html \
                 moz.png \
--- a/browser/base/content/test/browser_bug553455.js
+++ b/browser/base/content/test/browser_bug553455.js
@ -406,6 +406,36 @@ function test_reload() {
      gBrowser.loadURI(TESTROOT2 + "enabled.html");
    });
  });
+},
+
+function test_theme() {
+  var pm = Services.perms;
+  pm.add(makeURI("http://example.com/"), "install", pm.ALLOW_ACTION);
+
+  var triggers = encodeURIComponent(JSON.stringify({
+    "Theme XPI": "theme.xpi"
+  }));
+  gBrowser.selectedTab = gBrowser.addTab();
+  gBrowser.loadURI(TESTROOT + "installtrigger.html?" + triggers);
+
+  // Wait for the install confirmation dialog
+  wait_for_install_dialog(function(aWindow) {
+    aWindow.document.documentElement.acceptDialog();
+
+    // Wait for the complete notification
+    wait_for_notification(function(aPanel) {
+      let notification = aPanel.childNodes[0];
+      is(notification.id, "addon-install-complete", "Should have seen the install complete");
+      is(notification.button.label, "Restart Now", "Should have seen the right button");
+      is(notification.getAttribute("label"),
+         "Theme Test will be installed after you restart " + gApp + ".",
+         "Should have seen the right message");
+
+      gBrowser.removeTab(gBrowser.selectedTab);
+      Services.perms.remove("example.com", "install");
+      runNextTest();
+    });
+  });
 }
 ];

--- a/browser/base/content/test/browser_visibleTabs_bookmarkAllPages.js
+++ b/browser/base/content/test/browser_visibleTabs_bookmarkAllPages.js
@ -58,7 +58,7 @@ function test() {
    gBrowser.removeTab(tabOne);
    gBrowser.removeTab(tabTwo);
    Array.forEach(gBrowser.tabs, function(tab) {
-      tab.hidden = false;
+      gBrowser.showTab(tab);
    });

    finish();
--- a/browser/base/content/test/tabview/browser_tabview_launch.js
+++ b/browser/base/content/test/tabview/browser_tabview_launch.js
@ -56,7 +56,7 @@ function test() {
          eventObject = { altKey: true };
        } else {
          charCode = 32;
-          eventObject = { altKey: true, ctrlKey: true };
+          eventObject = { ctrlKey: true };
        }
        var modifiers = EventUtils._parseModifiers(eventObject);
        var keyDownDefaultHappened =
--- a/browser/components/sessionstore/src/nsSessionStore.js
+++ b/browser/components/sessionstore/src/nsSessionStore.js
@ -1140,14 +1140,19 @@ SessionStoreService.prototype = {
   * Store all session data for a window
   * @param aWindow
   *        Window reference
+   * @param aPinnedOnly
+   *        Bool collect pinned tabs only
   */
-  _saveWindowHistory: function sss_saveWindowHistory(aWindow) {
+  _saveWindowHistory: function sss_saveWindowHistory(aWindow, aPinnedOnly) {
    var tabbrowser = aWindow.gBrowser;
    var tabs = tabbrowser.tabs;
    var tabsData = this._windows[aWindow.__SSi].tabs = [];
    
-    for (var i = 0; i < tabs.length; i++)
+    for (var i = 0; i < tabs.length; i++) {
+      if (aPinnedOnly && !tabs[i].pinned)
+        break;
      tabsData.push(this._collectTabData(tabs[i]));
+    }
    
    this._windows[aWindow.__SSi].selected = tabbrowser.mTabBox.selectedIndex + 1;
  },
@ -1435,16 +1440,15 @@ SessionStoreService.prototype = {
   */
  _updateTextAndScrollData: function sss_updateTextAndScrollData(aWindow) {
    var browsers = aWindow.gBrowser.browsers;
-    for (var i = 0; i < browsers.length; i++) {
+    this._windows[aWindow.__SSi].tabs.forEach(function (tabData, i) {
+      if (browsers[i].__SS_data &&
+          browsers[i].__SS_data._tabStillLoading)
+        return; // ignore incompletely initialized tabs
      try {
-        var tabData = this._windows[aWindow.__SSi].tabs[i];
-        if (browsers[i].__SS_data &&
-            browsers[i].__SS_data._tabStillLoading)
-          continue; // ignore incompletely initialized tabs
        this._updateTextAndScrollDataForTab(aWindow, browsers[i], tabData);
      }
      catch (ex) { debug(ex); } // get as much data as possible, ignore failures (might succeed the next time)
-    }
+    }, this);
  },

  /**
@ -1769,7 +1773,7 @@ SessionStoreService.prototype = {
        if (!this._isWindowLoaded(aWindow)) // window data is still in _statesToRestore
          return;
        if (aUpdateAll || this._dirtyWindows[aWindow.__SSi] || aWindow == activeWindow) {
-          this._collectWindowData(aWindow);
+          this._collectWindowData(aWindow, aPinnedOnly);
        }
        else { // always update the window features (whose change alone never triggers a save operation)
          this._updateWindowFeatures(aWindow);
@ -1857,12 +1861,12 @@ SessionStoreService.prototype = {
    return { windows: total };
  },

-  _collectWindowData: function sss_collectWindowData(aWindow) {
+  _collectWindowData: function sss_collectWindowData(aWindow, aPinnedOnly) {
    if (!this._isWindowLoaded(aWindow))
      return;
    
    // update the internal state data for this window
-    this._saveWindowHistory(aWindow);
+    this._saveWindowHistory(aWindow, aPinnedOnly);
    this._updateTextAndScrollData(aWindow);
    this._updateCookieHosts(aWindow);
    this._updateWindowFeatures(aWindow);
--- a/browser/installer/package-manifest.in
+++ b/browser/installer/package-manifest.in
@ -187,6 +187,7 @@
@BINPATH@/components/jetpack.xpt
@BINPATH@/components/jsdservice.xpt
@BINPATH@/components/layout_base.xpt
+@BINPATH@/components/layout_forms.xpt
 #ifdef NS_PRINTING
@BINPATH@/components/layout_printing.xpt
 #endif
@ -235,7 +236,6 @@
 #ifdef MOZ_ENABLE_XREMOTE
@BINPATH@/components/toolkitremote.xpt
 #endif
-@BINPATH@/components/toolkitsearch.xpt
@BINPATH@/components/txtsvc.xpt
@BINPATH@/components/txmgr.xpt
 #ifdef MOZ_USE_NATIVE_UCONV
--- a/browser/installer/removed-files.in
+++ b/browser/installer/removed-files.in
@ -9,6 +9,9 @@
@DLL_PREFIX@xpcom_compat@DLL_SUFFIX@
@DLL_PREFIX@xpistub@DLL_SUFFIX@
@DLL_PREFIX@zlib@DLL_SUFFIX@
+#ifdef MOZ_STATIC_JS
+@DLL_PREFIX@mozjs@DLL_SUFFIX@
+#endif
 LICENSE
 browserconfig.properties
 chrome/US.jar
--- a/browser/locales/en-US/chrome/browser-region/region.properties
+++ b/browser/locales/en-US/chrome/browser-region/region.properties
@ -14,9 +14,6 @@ browser.contentHandlers.types.1.uri=http://add.my.yahoo.com/rss?url=%s
 browser.contentHandlers.types.2.title=Google
 browser.contentHandlers.types.2.uri=http://fusion.google.com/add?feedurl=%s

-# Keyword URL (for location bar searches)
-keyword.URL=http://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&q=
-
 # URL for site-specific search engines
 # TRANSLATION NOTE: {moz:domain} and {searchTerms} are placeholders for the site
 # to be searched and the user's search query. Place them in the appropriate location
--- a/browser/locales/en-US/chrome/browser/browser.dtd
+++ b/browser/locales/en-US/chrome/browser/browser.dtd
@ -132,8 +132,8 @@

 <!-- Toolbar items --> 
 <!ENTITY  homeButton.label            "Home">
-<!ENTITY tabViewButton.label          "Tab Sets">
-<!ENTITY tabViewButton.tooltip        "Open a visual tab interface">
+<!ENTITY tabViewButton2.label         "Tab Groups">
+<!ENTITY tabViewButton2.tooltip       "Group Your Tabs">

 <!ENTITY bookmarksButton.label          "Bookmarks">
 <!ENTITY bookmarksButton.tooltip        "Display your bookmarks">
@ -240,8 +240,8 @@

 <!ENTITY viewMenu.label         "View"> 
 <!ENTITY viewMenu.accesskey       "V"> 
-<!ENTITY showTabView.label     "TabView">
-<!ENTITY showTabView.accesskey     "V">
+<!ENTITY showTabView2.label     "Group Your Tabs…">
+<!ENTITY showTabView2.accesskey     "G">
 <!ENTITY viewToolbarsMenu.label       "Toolbars"> 
 <!ENTITY viewToolbarsMenu.accesskey     "T"> 
 <!ENTITY viewSidebarMenu.label "Sidebar">
--- a/browser/locales/en-US/chrome/browser/browser.properties
+++ b/browser/locales/en-US/chrome/browser/browser.properties
@ -276,7 +276,7 @@ ctrlTab.showAll.label=;Show all #1 tabs
 addKeywordTitleAutoFill=Search %S

 # TabView
-tabView.title=%S Tab Sets
+tabView2.title=%S - Group Your Tabs

 extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name=Default
 extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description=The default theme.
--- a/browser/locales/shipped-locales
+++ b/browser/locales/shipped-locales
@ -5,18 +5,24 @@ da
 de
 el
 en-US
+eo
 es-AR
 es-ES
 et
 fi
 fr
 ga-IE
+he
 hu
+id
 is
 it
+ja linux win32
+ja-JP-mac osx
 ko
 ku
 lt
+lv
 nb-NO
 nl
 nn-NO
--- a/configure.in
+++ b/configure.in
@ -74,19 +74,6 @@ TARGET_OS="${target_os}"
 MOZ_DEB_TIMESTAMP=`date +"%a, %d  %b %Y %T %z"   2>&1` 
 AC_SUBST(MOZ_DEB_TIMESTAMP)

-MOZ_ARG_ENABLE_BOOL(shared-js,
-[  --enable-shared-js
-                          Create a shared JavaScript library.],
-    ENABLE_SHARED_JS=1,
-    ENABLE_SHARED_JS=0)
-
-if test "$ENABLE_SHARED_JS" = "1" ; then
-  JS_SHARED_LIBRARY=1
-else
-  AC_DEFINE(MOZ_STATIC_JS)
-fi
-AC_SUBST(JS_SHARED_LIBRARY)
-
 dnl ========================================================
 dnl =
 dnl = Don't change the following two lines.  Doing so breaks:
@ -1233,11 +1220,8 @@ MOZ_BZ2_LIBS='$(call EXPAND_LIBNAME_PATH,bz2,$(DEPTH)/modules/libbz2/src)'
 MOZ_PNG_CFLAGS=
 MOZ_PNG_LIBS='$(call EXPAND_LIBNAME_PATH,mozpng,$(DEPTH)/modules/libimg/png)'

-if test -z "$JS_SHARED_LIBRARY" ; then
-MOZ_JS_LIBS='-L$(LIBXUL_DIST)/bin -ljs_static'
-else
-MOZ_JS_LIBS='-L$(LIBXUL_DIST)/bin -lmozjs'
-fi
+MOZ_JS_STATIC_LIBS='-L$(LIBXUL_DIST)/bin -ljs_static'
+MOZ_JS_SHARED_LIBS='-L$(LIBXUL_DIST)/bin -lmozjs'
 DYNAMIC_XPCOM_LIBS='-L$(LIBXUL_DIST)/bin -lxpcom -lxpcom_core -lmozalloc'
 MOZ_FIX_LINK_PATHS='-Wl,-rpath-link,$(LIBXUL_DIST)/bin -Wl,-rpath-link,$(prefix)/lib'
 XPCOM_FROZEN_LDOPTS='-L$(LIBXUL_DIST)/bin -lxpcom -lmozalloc'
@ -2284,11 +2268,8 @@ ia64*-hpux*)
    MOZ_DEBUG_FLAGS='-Zi'
    MOZ_DEBUG_LDFLAGS='-DEBUG -DEBUGTYPE:CV'
    MOZ_FIX_LINK_PATHS=
-    if test -z "$JS_SHARED_LIBRARY" ; then
-       MOZ_JS_LIBS='$(LIBXUL_DIST)/lib/js_static.lib'
-    else
-       MOZ_JS_LIBS='$(LIBXUL_DIST)/lib/mozjs.lib'
-    fi
+    MOZ_JS_STATIC_LIBS='$(LIBXUL_DIST)/lib/js_static.lib'
+    MOZ_JS_SHARED_LIBS='$(LIBXUL_DIST)/lib/mozjs.lib'
    OBJ_SUFFIX=obj
    RANLIB='echo not_ranlib'
    STRIP='echo not_strip'
@ -2348,11 +2329,8 @@ ia64*-hpux*)
        RCFLAGS='-O coff --use-temp-file'
        # mingw doesn't require kernel32, user32, and advapi32 explicitly
        LIBS="$LIBS -luuid -lgdi32 -lwinmm -lwsock32"
-        if test -z "$JS_SHARED_LIBRARY" ; then
-           MOZ_JS_LIBS='-L$(LIBXUL_DIST)/bin -ljs_static'
-        else
-           MOZ_JS_LIBS='-L$(LIBXUL_DIST)/bin -lmozjs'
-        fi
+        MOZ_JS_STATIC_LIBS='-L$(LIBXUL_DIST)/bin -ljs_static'
+        MOZ_JS_SHARED_LIBS='-L$(LIBXUL_DIST)/bin -lmozjs'
        MOZ_FIX_LINK_PATHS=
        DYNAMIC_XPCOM_LIBS='-L$(LIBXUL_DIST)/lib -lxpcom -lxpcom_core -lmozalloc'
        XPCOM_FROZEN_LDOPTS='-L$(LIBXUL_DIST)/lib -lxpcom -lmozalloc'
@ -2398,11 +2376,8 @@ ia64*-hpux*)
        MOZ_DEBUG_LDFLAGS='-DEBUG -DEBUGTYPE:CV'
        WARNINGS_AS_ERRORS='-WX'
    	MOZ_OPTIMIZE_FLAGS='-O1'
-        if test -z "$JS_SHARED_LIBRARY" ; then
-           MOZ_JS_LIBS='$(LIBXUL_DIST)/lib/js_static.lib'
-        else
-           MOZ_JS_LIBS='$(LIBXUL_DIST)/lib/mozjs.lib'
-        fi
+        MOZ_JS_STATIC_LIBS='$(LIBXUL_DIST)/lib/js_static.lib'
+        MOZ_JS_SHARED_LIBS='$(LIBXUL_DIST)/lib/mozjs.lib'
        MOZ_FIX_LINK_PATHS=
        DYNAMIC_XPCOM_LIBS='$(LIBXUL_DIST)/lib/xpcom.lib $(LIBXUL_DIST)/lib/xpcom_core.lib $(LIBXUL_DIST)/lib/mozalloc.lib'
        XPCOM_FROZEN_LDOPTS='$(LIBXUL_DIST)/lib/xpcom.lib $(LIBXUL_DIST)/lib/mozalloc.lib'
@ -5977,7 +5952,7 @@ if test -n "$MOZ_WEBM"; then
        fi
      ;;
      esac
-      if test -n "$VPX_X86_ASM" -a -z "$VPX_AS"; then
+      if test "$COMPILE_ENVIRONMENT" -a -n "$VPX_X86_ASM" -a -z "$VPX_AS"; then
        AC_MSG_ERROR([yasm is a required build tool for this architecture when webm is enabled. You may either install yasm or --disable-webm (which disables the WebM video format). See https://developer.mozilla.org/en/YASM for more details.])
      fi
    fi # end !WINNT_x86_MSVC
@ -8058,6 +8033,26 @@ MOZ_ARG_ENABLE_BOOL(libxul,
    MOZ_ENABLE_LIBXUL=1,
    MOZ_ENABLE_LIBXUL=)

+MOZ_ARG_ENABLE_BOOL(shared-js,
+[  --enable-shared-js
+                          Create a shared JavaScript library.],
+    ENABLE_SHARED_JS=1,
+    ENABLE_SHARED_JS=)
+
+if test -z "$MOZ_ENABLE_LIBXUL"; then
+  dnl --disable-libxul implies shared js
+  ENABLE_SHARED_JS=1
+fi
+
+if test -n "$ENABLE_SHARED_JS"; then
+  JS_SHARED_LIBRARY=1
+  MOZ_JS_LIBS=$MOZ_JS_SHARED_LIBS
+else
+  MOZ_JS_LIBS=$MOZ_JS_STATIC_LIBS
+  AC_DEFINE(MOZ_STATIC_JS)
+fi
+AC_SUBST(JS_SHARED_LIBRARY)
+
 if test -n "$MOZ_STATIC_BUILD_UNSUPPORTED" -a -n "$BUILD_STATIC_LIBS"; then
 	AC_MSG_ERROR([--enable-static is not supported for building $MOZ_APP_NAME. You probably want --enable-libxul.])
 fi
--- a/content/base/public/nsIXMLHttpRequest.idl
+++ b/content/base/public/nsIXMLHttpRequest.idl
@ -47,6 +47,11 @@ interface nsIVariant;
 interface nsPIDOMWindow;
 interface nsIInputStream;

+%{C++
+// for jsval
+#include "jsapi.h"
+%}
+
 [scriptable, uuid(6ce0a193-b033-4c3d-b748-f851b09261f5)]
 interface nsIXMLHttpRequestEventTarget : nsIDOMEventTarget {
  // event handler attributes
@ -134,6 +139,12 @@ interface nsIXMLHttpRequest : nsISupports
   */
  readonly attribute AString responseText;

+  /**
+   * The response to the request as a typed array ArrayBuffer.
+   * NULL if the request is unsuccessful or
+   * has not yet been sent.
+   */
+  readonly attribute jsval /*ArrayBuffer*/ mozResponseArrayBuffer;

  /**
   * The status of the response to the request for HTTP requests.
--- a/content/base/src/CSPUtils.jsm
+++ b/content/base/src/CSPUtils.jsm
@ -272,8 +272,11 @@ CSPRep.fromString = function(aStr, self) {

  } // end directive: loop

-  aCSPR.makeExplicit();
-  return aCSPR;
+  // if makeExplicit fails for any reason, default to allow 'none'.  This
+  // includes the case where "allow" is not present.
+  if (aCSPR.makeExplicit())
+    return aCSPR;
+  return CSPRep.fromString("allow 'none'", self);
 };

 CSPRep.prototype = {
@ -409,6 +412,7 @@ CSPRep.prototype = {
    var SD = CSPRep.SRC_DIRECTIVES;
    var allowDir = this._directives[SD.ALLOW];
    if (!allowDir) {
+      CSPWarning("'allow' directive required but not present.  Reverting to \"allow 'none'\"");
      return false;
    }

--- a/content/base/src/nsContentUtils.cpp
+++ b/content/base/src/nsContentUtils.cpp
@ -5789,6 +5789,10 @@ CloneSimpleValues(JSContext* cx,
  // ArrayBuffer objects.
  if (js_IsArrayBuffer(obj)) {
    js::ArrayBuffer* src = js::ArrayBuffer::fromJSObject(obj);
+    if (!src) {
+      return NS_ERROR_FAILURE;
+    }
+
    JSObject* newBuffer = js_CreateArrayBuffer(cx, src->byteLength);
    if (!newBuffer) {
      return NS_ERROR_FAILURE;
--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@ -826,7 +826,9 @@ ExternalResourceHider(nsIURI* aKey,
                      nsExternalResourceMap::ExternalResource* aData,
                      void* aClosure)
 {
-  aData->mViewer->Hide();
+  if (aData->mViewer) {
+    aData->mViewer->Hide();
+  }
  return PL_DHASH_NEXT;
 }

--- a/content/base/src/nsXMLHttpRequest.cpp
+++ b/content/base/src/nsXMLHttpRequest.cpp
@ -100,6 +100,7 @@
 #include "nsChannelPolicy.h"
 #include "nsIContentSecurityPolicy.h"
 #include "nsAsyncRedirectVerifyHelper.h"
+#include "jstypedarray.h"

 #define LOAD_STR "load"
 #define ERROR_STR "error"
@ -1234,6 +1235,35 @@ NS_IMETHODIMP nsXMLHttpRequest::GetResponseText(nsAString& aResponseText)
  return rv;
 }

+/* readonly attribute jsval (ArrayBuffer) mozResponseArrayBuffer; */
+NS_IMETHODIMP nsXMLHttpRequest::GetMozResponseArrayBuffer(jsval *aResult)
+{
+  JSContext *cx = nsContentUtils::GetCurrentJSContext();
+  if (!cx)
+    return NS_ERROR_FAILURE;
+
+  if (!(mState & (XML_HTTP_REQUEST_COMPLETED |
+                  XML_HTTP_REQUEST_INTERACTIVE))) {
+    *aResult = JSVAL_NULL;
+    return NS_OK;
+  }
+
+  PRInt32 dataLen = mResponseBody.Length();
+  JSObject *obj = js_CreateArrayBuffer(cx, dataLen);
+  if (!obj)
+    return NS_ERROR_FAILURE;
+
+  *aResult = OBJECT_TO_JSVAL(obj);
+
+  if (dataLen > 0) {
+    js::ArrayBuffer *abuf = js::ArrayBuffer::fromJSObject(obj);
+    NS_ASSERTION(abuf, "What happened?");
+    memcpy(abuf->data, mResponseBody.BeginReading(), dataLen);
+  }
+
+  return NS_OK;
+}
+
 /* readonly attribute unsigned long status; */
 NS_IMETHODIMP
 nsXMLHttpRequest::GetStatus(PRUint32 *aStatus)
--- a/content/base/test/Makefile.in
+++ b/content/base/test/Makefile.in
@ -210,6 +210,8 @@ _TEST_FILES1 = 	test_bug5141.html \
 		file_XHR_pass3.txt^headers^ \
 		file_XHR_fail1.txt \
 		file_XHR_fail1.txt^headers^ \
+		file_XHR_binary1.bin \
+		file_XHR_binary1.bin^headers^ \
 		test_bug428847.html \
 		file_bug428847-1.xhtml \
 		file_bug428847-2.xhtml \
--- a/content/base/test/file_XHR_binary1.bin
+++ b/content/base/test/file_XHR_binary1.bin
--- a/content/base/test/file_XHR_binary1.bin^headers^
+++ b/content/base/test/file_XHR_binary1.bin^headers^
@ -0,0 +1 @@
+Content-Type: application/binary
--- a/content/base/test/test_XHR.html
+++ b/content/base/test/test_XHR.html
@ -59,6 +59,37 @@ for (i = 0; i < failFiles.length; ++i) {
    ok(1, "should have thrown or given incorrect result");
  }
 }
+
+// test mozResponseArrayBuffer
+
+// with a simple text file
+xhr = new XMLHttpRequest();
+xhr.open("GET", 'file_XHR_pass2.txt', false); 
+xhr.send(null);
+is(xhr.status, 200, "wrong status");
+ab = xhr.mozResponseArrayBuffer;
+ok(ab != null, "should have a non-null arraybuffer");
+is(ab.byteLength, "hello pass\n".length, "wrong arraybuffer byteLength");
+
+u8v = new Uint8Array(ab);
+ok(String.fromCharCode([u8v[0], u8v[1], u8v[2], u8v[3], u8v[4]]), "hello", "wrong values");
+
+// with a binary file
+xhr = new XMLHttpRequest();
+xhr.open("GET", 'file_XHR_binary1.bin', false); 
+xhr.send(null)
+is(xhr.status, 200, "wrong status");
+ab = xhr.mozResponseArrayBuffer;
+ok(ab != null, "should have a non-null arraybuffer");
+is(ab.byteLength, 12, "wrong arraybuffer byteLength");
+
+u8v = new Uint8Array(ab);
+i32v = new Int32Array(ab);
+u32v = new Uint32Array(ab, 8);
+ok(u8v[0] == 0xaa && u8v[1] == 0xee && u8v[2] == 0x00 && u8v[3] == 0x03, "wrong initial 4 bytes");
+is(i32v[1], -1, "wrong value, expected -1 (0xffffffff)");
+is(u32v[0], 0xbbbbbbbb, "wrong value, expected 0xbbbbbbbb");
+
 </script>
 </pre>
 </body>
--- a/content/canvas/src/WebGLContextGL.cpp
+++ b/content/canvas/src/WebGLContextGL.cpp
@ -2860,10 +2860,10 @@ WebGLContext::CompileShader(nsIWebGLShader *sobj)

        compiler = ShConstructCompiler(lang, EShSpecWebGL, &resources);

-        nsDependentCString src(shader->Source());
+        nsPromiseFlatCString src(shader->Source());
        const char *s = src.get();

-        if (!ShCompile(compiler, &s, 1, EShOptSimple, debugFlags)) {
+        if (!ShCompile(compiler, &s, 1, EShOptNone, debugFlags)) {
            const char* info = ShGetInfoLog(compiler);
            if (info) {
                shader->SetTranslationFailure(nsDependentCString(info));
--- a/content/canvas/test/test_canvas.html
+++ b/content/canvas/test/test_canvas.html
@ -8,6 +8,17 @@

 SimpleTest.waitForExplicitFinish();

+function IsD2DEnabled() {
+    var enabled = false;
+
+    try {
+        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
+        enabled = Components.classes["@mozilla.org/gfx/info;1"].getService(Components.interfaces.nsIGfxInfo).D2DEnabled;
+    } catch(e) {}
+    
+    return enabled;
+}
+
 </script>
 <!-- Includes all the tests in the content/canvas/tests except for test_bug397524.html -->

@ -5688,34 +5699,37 @@ function test_2d_gradient_interpolate_overlap() {
 var canvas = document.getElementById('c215');
 var ctx = canvas.getContext('2d');

-canvas.width = 200;
-var g = ctx.createLinearGradient(0, 0, 200, 0);
-g.addColorStop(0, '#f00');
-g.addColorStop(0, '#ff0');
-g.addColorStop(0.25, '#00f');
-g.addColorStop(0.25, '#0f0');
-g.addColorStop(0.25, '#0f0');
-g.addColorStop(0.25, '#0f0');
-g.addColorStop(0.25, '#ff0');
-g.addColorStop(0.5, '#00f');
-g.addColorStop(0.5, '#0f0');
-g.addColorStop(0.75, '#00f');
-g.addColorStop(0.75, '#f00');
-g.addColorStop(0.75, '#ff0');
-g.addColorStop(0.5, '#0f0');
-g.addColorStop(0.5, '#0f0');
-g.addColorStop(0.5, '#ff0');
-g.addColorStop(1, '#00f');
-ctx.fillStyle = g;
-ctx.fillRect(0, 0, 200, 50);
-isPixel(ctx, 49,25, 0,0,255,255, 16);
-isPixel(ctx, 51,25, 255,255,0,255, 16);
-isPixel(ctx, 99,25, 0,0,255,255, 16);
-isPixel(ctx, 101,25, 255,255,0,255, 16);
-isPixel(ctx, 149,25, 0,0,255,255, 16);
-isPixel(ctx, 151,25, 255,255,0,255, 16);
-
-
+if (!IsD2DEnabled()) {
+    // Only run this on non-D2D. On D2D the different nature of how gradients
+    // are drawn makes it so we cannot guarantee these stops are completely
+    // hard.
+    canvas.width = 200;
+    var g = ctx.createLinearGradient(0, 0, 200, 0);
+    g.addColorStop(0, '#f00');
+    g.addColorStop(0, '#ff0');
+    g.addColorStop(0.25, '#00f');
+    g.addColorStop(0.25, '#0f0');
+    g.addColorStop(0.25, '#0f0');
+    g.addColorStop(0.25, '#0f0');
+    g.addColorStop(0.25, '#ff0');
+    g.addColorStop(0.5, '#00f');
+    g.addColorStop(0.5, '#0f0');
+    g.addColorStop(0.75, '#00f');
+    g.addColorStop(0.75, '#f00');
+    g.addColorStop(0.75, '#ff0');
+    g.addColorStop(0.5, '#0f0');
+    g.addColorStop(0.5, '#0f0');
+    g.addColorStop(0.5, '#ff0');
+    g.addColorStop(1, '#00f');
+    ctx.fillStyle = g;
+    ctx.fillRect(0, 0, 200, 50);
+    isPixel(ctx, 49,25, 0,0,255,255, 16);
+    isPixel(ctx, 51,25, 255,255,0,255, 16);
+    isPixel(ctx, 99,25, 0,0,255,255, 16);
+    isPixel(ctx, 101,25, 255,255,0,255, 16);
+    isPixel(ctx, 149,25, 0,0,255,255, 16);
+    isPixel(ctx, 151,25, 255,255,0,255, 16);
+}
 }
 </script>

@ -13807,13 +13821,15 @@ function test_2d_path_rect_zero_3() {
 var canvas = document.getElementById('c438');
 var ctx = canvas.getContext('2d');

-ctx.strokeStyle = '#f00';
-ctx.lineWidth = 100;
-ctx.beginPath();
-ctx.rect(50, 25, 0, 0);
-ctx.stroke();
-isPixel(ctx, 50,25, 0,0,0,0, 0);
-
+if (!IsD2DEnabled()) {
+    // Disabled for D2D until we can figure out Bug 587554.
+    ctx.strokeStyle = '#f00';
+    ctx.lineWidth = 100;
+    ctx.beginPath();
+    ctx.rect(50, 25, 0, 0);
+    ctx.stroke();
+    isPixel(ctx, 50,25, 0,0,0,0, 0);
+}

 }
 </script>
@ -14223,37 +14239,39 @@ function test_2d_path_stroke_scale2() {
 var canvas = document.getElementById('c451');
 var ctx = canvas.getContext('2d');

-ctx.fillStyle = '#f00';
-ctx.fillRect(0, 0, 100, 50);
+if (!IsD2DEnabled()) {
+    // On D2D a rasterization bug causes a small discrepancy here. See bug 587316
+    ctx.fillStyle = '#f00';
+    ctx.fillRect(0, 0, 100, 50);

-ctx.beginPath();
-ctx.rect(25, 12.5, 50, 25);
-ctx.save();
-ctx.rotate(Math.PI/2);
-ctx.scale(25, 50);
-ctx.strokeStyle = '#0f0';
-ctx.stroke();
-ctx.restore();
+    ctx.beginPath();
+    ctx.rect(25, 12.5, 50, 25);
+    ctx.save();
+    ctx.rotate(Math.PI/2);
+    ctx.scale(25, 50);
+    ctx.strokeStyle = '#0f0';
+    ctx.stroke();
+    ctx.restore();

-ctx.beginPath();
-ctx.rect(-25, -12.5, 150, 75);
-ctx.save();
-ctx.rotate(Math.PI/2);
-ctx.scale(25, 50);
-ctx.strokeStyle = '#f00';
-ctx.stroke();
-ctx.restore();
-
-isPixel(ctx, 0,0, 0,255,0,255, 0);
-isPixel(ctx, 50,0, 0,255,0,255, 0);
-isPixel(ctx, 99,0, 0,255,0,255, 0);
-isPixel(ctx, 0,25, 0,255,0,255, 0);
-isPixel(ctx, 50,25, 0,255,0,255, 0);
-isPixel(ctx, 99,25, 0,255,0,255, 0);
-isPixel(ctx, 0,49, 0,255,0,255, 0);
-isPixel(ctx, 50,49, 0,255,0,255, 0);
-isPixel(ctx, 99,49, 0,255,0,255, 0);
+    ctx.beginPath();
+    ctx.rect(-25, -12.5, 150, 75);
+    ctx.save();
+    ctx.rotate(Math.PI/2);
+    ctx.scale(25, 50);
+    ctx.strokeStyle = '#f00';
+    ctx.stroke();
+    ctx.restore();

+    isPixel(ctx, 0,0, 0,255,0,255, 0);
+    isPixel(ctx, 50,0, 0,255,0,255, 0);
+    isPixel(ctx, 99,0, 0,255,0,255, 0);
+    isPixel(ctx, 0,25, 0,255,0,255, 0);
+    isPixel(ctx, 50,25, 0,255,0,255, 0);
+    isPixel(ctx, 99,25, 0,255,0,255, 0);
+    isPixel(ctx, 0,49, 0,255,0,255, 0);
+    isPixel(ctx, 50,49, 0,255,0,255, 0);
+    isPixel(ctx, 99,49, 0,255,0,255, 0);
+}

 }
 </script>
@ -18054,11 +18072,13 @@ function test_2d_strokeRect_zero_1() {
 var canvas = document.getElementById('c580');
 var ctx = canvas.getContext('2d');

-ctx.strokeStyle = '#f00';
-ctx.lineWidth = 250;
-ctx.strokeRect(50, 25, 0, 0);
-isPixel(ctx, 50,25, 0,0,0,0, 0);
-
+if (!IsD2DEnabled()) {
+    // Disabled for D2D until we can figure out Bug 587554.
+    ctx.strokeStyle = '#f00';
+    ctx.lineWidth = 250;
+    ctx.strokeRect(50, 25, 0, 0);
+    isPixel(ctx, 50,25, 0,0,0,0, 0);
+}

 }
 </script>
--- a/content/html/content/src/nsGenericHTMLElement.cpp
+++ b/content/html/content/src/nsGenericHTMLElement.cpp
@ -301,11 +301,8 @@ nsGenericHTMLElement::CopyInnerTo(nsGenericElement* aDst) const
        value->Type() == nsAttrValue::eCSSStyleRule) {
      // We can't just set this as a string, because that will fail
      // to reparse the string into style data until the node is
-      // inserted into the document.  Clone the HTMLValue instead.
-      nsCOMPtr<nsICSSRule> ruleClone;
-      rv = value->GetCSSStyleRuleValue()->Clone(*getter_AddRefs(ruleClone));
-      NS_ENSURE_SUCCESS(rv, rv);
-
+      // inserted into the document.  Clone the nsICSSRule instead.
+      nsCOMPtr<nsICSSRule> ruleClone = value->GetCSSStyleRuleValue()->Clone();
      nsCOMPtr<nsICSSStyleRule> styleRule = do_QueryInterface(ruleClone);
      NS_ENSURE_TRUE(styleRule, NS_ERROR_UNEXPECTED);

--- a/content/html/content/src/nsHTMLFormElement.cpp
+++ b/content/html/content/src/nsHTMLFormElement.cpp
@ -80,6 +80,23 @@

 static const int NS_FORM_CONTROL_LIST_HASHTABLE_SIZE = 16;

+static const nsAttrValue::EnumTable kFormMethodTable[] = {
+  { "get", NS_FORM_METHOD_GET },
+  { "post", NS_FORM_METHOD_POST },
+  { 0 }
+};
+// Default method is 'get'.
+static const nsAttrValue::EnumTable* kFormDefaultMethod = &kFormMethodTable[0];
+
+static const nsAttrValue::EnumTable kFormEnctypeTable[] = {
+  { "multipart/form-data", NS_FORM_ENCTYPE_MULTIPART },
+  { "application/x-www-form-urlencoded", NS_FORM_ENCTYPE_URLENCODED },
+  { "text/plain", NS_FORM_ENCTYPE_TEXTPLAIN },
+  { 0 }
+};
+// Default method is 'application/x-www-form-urlencoded'.
+static const nsAttrValue::EnumTable* kFormDefaultEnctype = &kFormEnctypeTable[1];
+
 // nsHTMLFormElement

 PRBool nsHTMLFormElement::gFirstFormSubmitted = PR_FALSE;
@ -356,8 +373,10 @@ nsHTMLFormElement::SetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
 }

 NS_IMPL_STRING_ATTR(nsHTMLFormElement, AcceptCharset, acceptcharset)
-NS_IMPL_STRING_ATTR(nsHTMLFormElement, Enctype, enctype)
-NS_IMPL_STRING_ATTR(nsHTMLFormElement, Method, method)
+NS_IMPL_ENUM_ATTR_DEFAULT_VALUE(nsHTMLFormElement, Enctype, enctype,
+                                kFormDefaultEnctype->tag)
+NS_IMPL_ENUM_ATTR_DEFAULT_VALUE(nsHTMLFormElement, Method, method,
+                                kFormDefaultMethod->tag)
 NS_IMPL_STRING_ATTR(nsHTMLFormElement, Name, name)
 NS_IMPL_STRING_ATTR(nsHTMLFormElement, Target, target)

@ -405,19 +424,6 @@ nsHTMLFormElement::Reset()
  return NS_OK;
 }

-static const nsAttrValue::EnumTable kFormMethodTable[] = {
-  { "get", NS_FORM_METHOD_GET },
-  { "post", NS_FORM_METHOD_POST },
-  { 0 }
-};
-
-static const nsAttrValue::EnumTable kFormEnctypeTable[] = {
-  { "multipart/form-data", NS_FORM_ENCTYPE_MULTIPART },
-  { "application/x-www-form-urlencoded", NS_FORM_ENCTYPE_URLENCODED },
-  { "text/plain", NS_FORM_ENCTYPE_TEXTPLAIN },
-  { 0 }
-};
-
 PRBool
 nsHTMLFormElement::ParseAttribute(PRInt32 aNamespaceID,
                                  nsIAtom* aAttribute,
--- a/content/html/content/test/Makefile.in
+++ b/content/html/content/test/Makefile.in
@ -190,6 +190,7 @@ _TEST_FILES = \
 		test_bug569955.html \
 		test_bug573969.html \
 		test_bug549475.html \
+		test_bug585508.html \
 		$(NULL)

 libs:: $(_TEST_FILES)
--- a/content/html/content/test/test_bug585508.html
+++ b/content/html/content/test/test_bug585508.html
@ -0,0 +1,84 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=585508
+-->
+<head>
+  <title>Test for Bug 585508</title>
+  <script type="application/javascript" src="/MochiKit/packed.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=585508">Mozilla Bug 585508</a>
+<p id="display"></p>
+<pre id="test">
+<script type="application/javascript">
+
+/** Test for Bug 585508 **/
+
+var enctypeTestData = [
+  // Default value.
+  [ "application/x-www-form-urlencoded" ],
+  // Valid values.
+  [ "application/x-www-form-urlencoded", "multipart/form-data", "text/plain" ],
+  // Invalid values.
+  [ "", " ", "foo", "multipart/foo" ]
+];
+
+var methodTestData = [
+  // Default value.
+  [ "get" ],
+  // Valid values.
+  [ "get", "post" ],
+  // Invalid values.
+  [ "", " ", "foo" ],
+  // TODO values, see bug 583289 and bug 583288.
+  [ "delete", "put" ],
+];
+
+var form = document.createElement('form');
+
+function checkAttribute(form, name, data)
+{
+  is(form.getAttribute(name), undefined,
+     "By default " + name + " content attribute should be undefined");
+  is(form[name], data[0][0],
+     "By default " + name + " IDL attribute should be equal to " +
+     data[0][0]);
+
+  // Valid values.
+  for (i in data[1]) {
+    form.setAttribute(name, data[1][i]);
+    is(form.getAttribute(name), data[1][i],
+       "getAttribute should return the content attribute");
+    is(form[name], data[1][i], "When getting, " + name + " IDL attribute " +
+       "should be equal to the content attribute if the value is known");
+  }
+
+  // Invalid values.
+  for (i in data[2]) {
+    form.setAttribute(name, data[2][i]);
+    is(form.getAttribute(name), data[2][i],
+       "getAttribute should return the content attribute");
+    is(form[name], data[0][0], "When getting, " + name + " IDL attribute " +
+       "should return the default value if the content attribute value isn't known");
+  }
+
+  // TODO values.
+  for (i in data[3]) {
+    form.setAttribute(name, data[3][i]);
+    is(form.getAttribute(name), data[3][i],
+       "getAttribute should return the content attribute");
+    todo_is(form[name], data[3][i], "When getting, " + name + " IDL attribute " +
+       "should be equal to the content attribute if the value is known");
+  }
+}
+
+checkAttribute(form, 'enctype', enctypeTestData);
+checkAttribute(form, 'method', methodTestData);
+
+</script>
+</pre>
+</body>
+</html>
--- a/content/html/document/src/nsHTMLDocument.cpp
+++ b/content/html/document/src/nsHTMLDocument.cpp
@ -2324,52 +2324,6 @@ nsHTMLDocument::GetNumFormsSynchronous()
  return mNumForms;
 }

-nsresult
-nsHTMLDocument::GetBodySize(PRInt32* aWidth,
-                            PRInt32* aHeight)
-{
-  *aWidth = *aHeight = 0;
-
-  FlushPendingNotifications(Flush_Layout);
-
-  // Find the <body> element: this is what we'll want to use for the
-  // document's width and height values.
-  Element* body = GetBodyElement();
-  if (!body) {
-    return NS_OK;
-  }
-
-  // Now grab its frame
-  nsIFrame* frame = body->GetPrimaryFrame();
-  if (!frame)
-    return NS_OK;
-  
-  nsSize size = frame->GetSize();
-
-  *aWidth = nsPresContext::AppUnitsToIntCSSPixels(size.width);
-  *aHeight = nsPresContext::AppUnitsToIntCSSPixels(size.height);
-
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-nsHTMLDocument::GetWidth(PRInt32* aWidth)
-{
-  NS_ENSURE_ARG_POINTER(aWidth);
-
-  PRInt32 height;
-  return GetBodySize(aWidth, &height);
-}
-
-NS_IMETHODIMP
-nsHTMLDocument::GetHeight(PRInt32* aHeight)
-{
-  NS_ENSURE_ARG_POINTER(aHeight);
-
-  PRInt32 width;
-  return GetBodySize(&width, aHeight);
-}
-
 NS_IMETHODIMP
 nsHTMLDocument::GetAlinkColor(nsAString& aAlinkColor)
 {
--- a/content/svg/content/src/nsSVGFilters.cpp
+++ b/content/svg/content/src/nsSVGFilters.cpp
@ -1068,7 +1068,7 @@ public:

  virtual nsXPCClassInfo* GetClassInfo();
 protected:
-  virtual PRBool OperatesOnPremultipledAlpha() { return PR_FALSE; }
+  virtual PRBool OperatesOnPremultipledAlpha(PRInt32) { return PR_FALSE; }

  virtual EnumAttributesInfo GetEnumInfo();
  virtual StringAttributesInfo GetStringInfo();
@ -1695,7 +1695,7 @@ public:

  virtual nsXPCClassInfo* GetClassInfo();
 protected:
-  virtual PRBool OperatesOnPremultipledAlpha() { return PR_FALSE; }
+  virtual PRBool OperatesOnPremultipledAlpha(PRInt32) { return PR_FALSE; }

  virtual StringAttributesInfo GetStringInfo();

@ -2715,7 +2715,7 @@ public:
  virtual nsXPCClassInfo* GetClassInfo();
 protected:
  virtual PRBool OperatesOnSRGB(nsSVGFilterInstance*,
-                                PRUint32, Image*) { return PR_TRUE; }
+                                PRInt32, Image*) { return PR_TRUE; }

  virtual StringAttributesInfo GetStringInfo();

@ -3898,7 +3898,7 @@ public:

  virtual nsXPCClassInfo* GetClassInfo();
 protected:
-  virtual PRBool OperatesOnPremultipledAlpha() {
+  virtual PRBool OperatesOnPremultipledAlpha(PRInt32) {
    return !mBooleanAttributes[PRESERVEALPHA].GetAnimValue();
  }

@ -5354,7 +5354,7 @@ private:

 protected:
  virtual PRBool OperatesOnSRGB(nsSVGFilterInstance*,
-                                PRUint32, Image*) { return PR_TRUE; }
+                                PRInt32, Image*) { return PR_TRUE; }

  virtual nsSVGPreserveAspectRatio *GetPreserveAspectRatio();
  virtual StringAttributesInfo GetStringInfo();
@ -5689,13 +5689,16 @@ public:
  virtual nsXPCClassInfo* GetClassInfo();
 protected:
  virtual PRBool OperatesOnSRGB(nsSVGFilterInstance* aInstance,
-                                PRUint32 aInput, Image* aImage) {
-    if (aInput == 0 && aImage)
+                                PRInt32 aInput, Image* aImage) {
+    if (aInput == 0)
      return aImage->mColorModel.mColorSpace == ColorModel::SRGB;

    return nsSVGFEDisplacementMapElementBase::OperatesOnSRGB(aInstance,
                                                             aInput, aImage);
  }
+  virtual PRBool OperatesOnPremultipledAlpha(PRInt32 aInput) {
+    return !(aInput == 1);
+  }

  virtual NumberAttributesInfo GetNumberInfo();
  virtual EnumAttributesInfo GetEnumInfo();
--- a/content/svg/content/src/nsSVGFilters.h
+++ b/content/svg/content/src/nsSVGFilters.h
@ -119,21 +119,21 @@ protected:

 public:
  ColorModel
-  GetInputColorModel(nsSVGFilterInstance* aInstance, PRUint32 aInputIndex,
+  GetInputColorModel(nsSVGFilterInstance* aInstance, PRInt32 aInputIndex,
                     Image* aImage) {
    return ColorModel(
          (OperatesOnSRGB(aInstance, aInputIndex, aImage) ?
             ColorModel::SRGB : ColorModel::LINEAR_RGB),
-          (OperatesOnPremultipledAlpha() ?
+          (OperatesOnPremultipledAlpha(aInputIndex) ?
             ColorModel::PREMULTIPLIED : ColorModel::UNPREMULTIPLIED));
  }

  ColorModel
  GetOutputColorModel(nsSVGFilterInstance* aInstance) {
    return ColorModel(
-          (OperatesOnSRGB(aInstance, 0, nsnull) ?
+          (OperatesOnSRGB(aInstance, -1, nsnull) ?
             ColorModel::SRGB : ColorModel::LINEAR_RGB),
-          (OperatesOnPremultipledAlpha() ?
+          (OperatesOnPremultipledAlpha(-1) ?
             ColorModel::PREMULTIPLIED : ColorModel::UNPREMULTIPLIED));
  }

@ -199,13 +199,13 @@ public:
  operator nsISupports*() { return static_cast<nsIContent*>(this); }
  
 protected:
-  virtual PRBool OperatesOnPremultipledAlpha() { return PR_TRUE; }
+  virtual PRBool OperatesOnPremultipledAlpha(PRInt32) { return PR_TRUE; }

-  // Called either with aImage non-null, in which case this is
+  // Called either with aInputIndex >=0 in which case this is
  // testing whether the input 'aInputIndex' should be SRGB, or
-  // if aImage is null returns true if the output will be SRGB
+  // if aInputIndex is -1 returns true if the output will be SRGB
  virtual PRBool OperatesOnSRGB(nsSVGFilterInstance* aInstance,
-                                PRUint32 aInputIndex, Image* aImage) {
+                                PRInt32 aInputIndex, Image* aImage) {
    nsIFrame* frame = GetPrimaryFrame();
    if (!frame) return PR_FALSE;

--- a/content/svg/content/src/nsSVGSVGElement.cpp
+++ b/content/svg/content/src/nsSVGSVGElement.cpp
@ -68,11 +68,11 @@
 #include "nsSMILTypes.h"
 #include "nsIContentIterator.h"

-using namespace mozilla;
-
 nsresult NS_NewContentIterator(nsIContentIterator** aInstancePtrResult);
 #endif // MOZ_SMIL

+using namespace mozilla;
+
 NS_SVG_VAL_IMPL_CYCLE_COLLECTION(nsSVGTranslatePoint::DOMVal, mElement)

 NS_IMPL_CYCLE_COLLECTING_ADDREF(nsSVGTranslatePoint::DOMVal)
--- a/content/xbl/builtin/Makefile.in
+++ b/content/xbl/builtin/Makefile.in
@ -48,10 +48,10 @@ else
 ifeq (cocoa,$(MOZ_WIDGET_TOOLKIT))
 DIRS	= mac
 else
-ifeq ($(MOZ_WIDGET_TOOLKIT),gtk2)
-DIRS	= gtk2
-else
+ifneq (,$(filter qt gtk2,$(MOZ_WIDGET_TOOLKIT)))
 DIRS	= unix
+else
+DIRS	= emacs
 endif
 endif
 endif
--- a/content/xbl/builtin/emacs/Makefile.in
+++ b/content/xbl/builtin/emacs/Makefile.in
--- a/content/xbl/builtin/emacs/jar.mn
+++ b/content/xbl/builtin/emacs/jar.mn
--- a/content/xbl/builtin/emacs/platformHTMLBindings.xml
+++ b/content/xbl/builtin/emacs/platformHTMLBindings.xml
@ -0,0 +1,249 @@
+<?xml version="1.0"?>
+
+<bindings id="htmlBindings"
+   xmlns="http://www.mozilla.org/xbl"
+   xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+ 
+  <binding id="inputFields">
+    <handlers>
+#include ../input-fields-base.inc
+    <!-- Emacsish single-line motion and delete keys -->
+    <handler event="keypress" key="a" modifiers="control"
+        command="cmd_beginLine"/>
+    <handler event="keypress" key="e" modifiers="control"
+        command="cmd_endLine"/>
+    <handler event="keypress" key="b" modifiers="control"
+        command="cmd_charPrevious"/>
+    <handler event="keypress" key="f" modifiers="control"
+        command="cmd_charNext"/>
+    <handler event="keypress" key="h" modifiers="control"
+        command="cmd_deleteCharBackward"/>
+    <handler event="keypress" key="d" modifiers="control"
+        command="cmd_deleteCharForward"/>
+    <handler event="keypress" key="w" modifiers="control"
+        command="cmd_deleteWordBackward"/>
+    <handler event="keypress" key="u" modifiers="control"
+        command="cmd_deleteToBeginningOfLine"/>
+    <handler event="keypress" key="k" modifiers="control"
+        command="cmd_deleteToEndOfLine"/>
+
+    <!-- Alternate Windows copy/paste/undo/redo keys -->
+    <handler event="keypress" keycode="VK_DELETE" modifiers="shift"
+        command="cmd_cutOrDelete"/>
+    <handler event="keypress" keycode="VK_DELETE" modifiers="control"
+        command="cmd_copyOrDelete"/>
+    <handler event="keypress" keycode="VK_INSERT" modifiers="control" 
+        command="cmd_copy"/>
+    <handler event="keypress" keycode="VK_INSERT" modifiers="shift"
+        command="cmd_paste"/>
+
+    <!-- navigating by word keys -->
+    <handler event="keypress" keycode="VK_HOME" 
+        command="cmd_beginLine"/>
+    <handler event="keypress" keycode="VK_END" 
+        command="cmd_endLine"/>
+    <handler event="keypress" keycode="VK_HOME" modifiers="shift"
+        command="cmd_selectBeginLine"/>
+    <handler event="keypress" keycode="VK_END" modifiers="shift"
+        command="cmd_selectEndLine"/>
+    <handler event="keypress" keycode="VK_HOME" modifiers="control"
+        command="cmd_beginLine"/>
+    <handler event="keypress" keycode="VK_END" modifiers="control" 
+        command="cmd_endLine"/>
+    <handler event="keypress" keycode="VK_HOME" modifiers="control,shift"
+        command="cmd_selectBeginLine"/>
+    <handler event="keypress" keycode="VK_END" modifiers="control,shift"
+        command="cmd_selectEndLine"/>
+    <handler event="keypress" keycode="VK_BACK" modifiers="control"
+        command="cmd_deleteWordBackward"/>
+
+    <handler event="keypress" keycode="VK_LEFT" modifiers="control" 
+        command="cmd_wordPrevious"/>
+    <handler event="keypress" keycode="VK_RIGHT" modifiers="control"
+        command="cmd_wordNext"/>
+    <handler event="keypress" keycode="VK_LEFT" modifiers="shift,control" 
+        command="cmd_selectWordPrevious"/>
+    <handler event="keypress" keycode="VK_RIGHT" modifiers="shift,control" 
+        command="cmd_selectWordNext"/>
+    <handler event="keypress" key="y" modifiers="accel"
+        command="cmd_redo"/>
+    <handler event="keypress" key="a" modifiers="alt"
+        command="cmd_selectAll"/>
+    <handler event="keypress" keycode="VK_F20" command="cmd_cut" />
+    <handler event="keypress" keycode="VK_F16" command="cmd_copy" />
+    <handler event="keypress" keycode="VK_F18" command="cmd_paste" />
+    <handler event="keypress" keycode="VK_F14" command="cmd_undo" />
+    </handlers>
+  </binding>
+
+  <binding id="textAreas">
+    <handlers>
+#include ../textareas-base.inc
+    <!-- Emacsish single-line motion and delete keys -->
+    <handler event="keypress" key="a" modifiers="control"
+        command="cmd_beginLine"/>
+    <handler event="keypress" key="e" modifiers="control"
+        command="cmd_endLine"/>
+    <handler event="keypress" id="key_left" key="b" modifiers="control"
+        command="cmd_charPrevious"/>
+    <handler event="keypress" id="key_right" key="f" modifiers="control"
+        command="cmd_charNext"/>
+    <handler event="keypress" id="key_delback" key="h" modifiers="control"
+        command="cmd_deleteCharBackward"/>
+    <handler event="keypress" id="key_delforw" key="d" modifiers="control"
+        command="cmd_deleteCharForward"/>
+    <handler event="keypress" id="key_delwback" key="w" modifiers="control"
+        command="cmd_deleteWordBackward"/>
+    <handler event="keypress" id="key_del_bol" key="u" modifiers="control"
+        command="cmd_deleteToBeginningOfLine"/>
+    <handler event="keypress" id="key_del_eol" key="k" modifiers="control"
+        command="cmd_deleteToEndOfLine"/>
+
+    <!-- Alternate Windows copy/paste/undo/redo keys -->
+    <handler event="keypress" keycode="VK_DELETE" modifiers="shift"
+        command="cmd_cutOrDelete"/>
+    <handler event="keypress" keycode="VK_DELETE" modifiers="control"
+        command="cmd_copyOrDelete"/>
+    <handler event="keypress" keycode="VK_INSERT" modifiers="control"
+        command="cmd_copy"/>
+    <handler event="keypress" keycode="VK_INSERT" modifiers="shift"
+        command="cmd_paste"/>
+
+    <!-- Emacsish multi-line motion and delete keys -->
+    <handler event="keypress" id="key_linedown" key="n" modifiers="control"
+        command="cmd_lineNext"/>
+    <handler event="keypress" id="key_lineup" key="p" modifiers="control"
+        command="cmd_linePrevious"/>
+
+    <!-- handle home/end/arrow keys and redo -->
+    <handler event="keypress" keycode="VK_HOME" 
+        command="cmd_beginLine"/>
+    <handler event="keypress" keycode="VK_END" 
+        command="cmd_endLine"/>
+    <handler event="keypress" keycode="VK_HOME" modifiers="shift"
+        command="cmd_selectBeginLine"/>
+    <handler event="keypress" keycode="VK_END" modifiers="shift"
+        command="cmd_selectEndLine"/>
+
+    <handler event="keypress" keycode="VK_HOME" modifiers="control" 
+        command="cmd_moveTop"/>
+    <handler event="keypress" keycode="VK_END" modifiers="control" 
+        command="cmd_moveBottom"/>
+    <handler event="keypress" keycode="VK_HOME" modifiers="shift,control"
+        command="cmd_selectTop"/>
+    <handler event="keypress" keycode="VK_END" modifiers="shift,control"
+        command="cmd_selectBottom"/>
+
+    <handler event="keypress" keycode="VK_PAGE_UP" 
+        command="cmd_movePageUp"/>
+    <handler event="keypress" keycode="VK_PAGE_DOWN" 
+        command="cmd_movePageDown"/>
+    <handler event="keypress" keycode="VK_PAGE_UP" modifiers="shift"
+        command="cmd_selectPageUp"/>
+    <handler event="keypress" keycode="VK_PAGE_DOWN" modifiers="shift"
+        command="cmd_selectPageDown"/>
+
+    <handler event="keypress" keycode="VK_LEFT" modifiers="control" 
+        command="cmd_wordPrevious"/>
+    <handler event="keypress" keycode="VK_RIGHT" modifiers="control" 
+        command="cmd_wordNext"/>
+    <handler event="keypress" keycode="VK_LEFT" modifiers="shift,control" 
+        command="cmd_selectWordPrevious"/>
+    <handler event="keypress" keycode="VK_RIGHT" modifiers="shift,control" 
+        command="cmd_selectWordNext"/>
+    <handler event="keypress" keycode="VK_BACK" modifiers="control"
+        command="cmd_deleteWordBackward"/>
+    <handler event="keypress" key="y" modifiers="accel"
+        command="cmd_redo"/>
+    <handler event="keypress" key="a" modifiers="alt"
+        command="cmd_selectAll"/>
+    <handler event="keypress" keycode="VK_F20" command="cmd_cut" />
+    <handler event="keypress" keycode="VK_F16" command="cmd_copy" />
+    <handler event="keypress" keycode="VK_F18" command="cmd_paste" />
+    <handler event="keypress" keycode="VK_F14" command="cmd_undo" />
+    </handlers>
+  </binding>
+
+  <binding id="browser">
+    <handlers>
+#include ../browser-base.inc
+      <handler event="keypress" keycode="VK_PAGE_UP" command="cmd_movePageUp"/>
+      <handler event="keypress" keycode="VK_PAGE_DOWN" command="cmd_movePageDown"/>
+      <handler event="keypress" keycode="VK_PAGE_UP" modifiers="shift" command="cmd_selectPageUp"/>
+      <handler event="keypress" keycode="VK_PAGE_DOWN" modifiers="shift" command="cmd_selectPageDown"/>
+
+      <handler event="keypress" keycode="VK_DELETE" modifiers="shift" command="cmd_cut" /> 
+      <handler event="keypress" keycode="VK_DELETE" modifiers="control" command="cmd_copy" /> 
+      <handler event="keypress" keycode="VK_INSERT" modifiers="control" command="cmd_copy" /> 
+      <handler event="keypress" keycode="VK_HOME" command="cmd_beginLine"/>
+      <handler event="keypress" keycode="VK_END" command="cmd_endLine"/>
+      <handler event="keypress" keycode="VK_HOME" modifiers="control" command="cmd_scrollTop"/>
+      <handler event="keypress" keycode="VK_END" modifiers="control" command="cmd_scrollBottom"/>
+      <handler event="keypress" keycode="VK_HOME" modifiers="shift,control" command="cmd_selectTop" /> 
+      <handler event="keypress" keycode="VK_END" modifiers="shift,control" command="cmd_selectBottom" /> 
+
+      <handler event="keypress" keycode="VK_F20" command="cmd_cut" /> 
+      <handler event="keypress" keycode="VK_F16" command="cmd_copy" /> 
+      <handler event="keypress" keycode="VK_F18" command="cmd_paste" /> 
+      <handler event="keypress" keycode="VK_F14" command="cmd_undo" />
+      <handler event="keypress" keycode="VK_LEFT" modifiers="control" command="cmd_wordPrevious" />
+      <handler event="keypress" keycode="VK_RIGHT" modifiers="control" command="cmd_wordNext" />
+      <handler event="keypress" keycode="VK_LEFT" modifiers="control,shift" command="cmd_selectWordPrevious" />
+      <handler event="keypress" keycode="VK_RIGHT" modifiers="control,shift" command="cmd_selectWordNext" />
+      <handler event="keypress" keycode="VK_LEFT" modifiers="shift" command="cmd_selectCharPrevious" />
+      <handler event="keypress" keycode="VK_RIGHT" modifiers="shift" command="cmd_selectCharNext" />
+      <handler event="keypress" keycode="VK_HOME" modifiers="shift" command="cmd_selectBeginLine" />
+      <handler event="keypress" keycode="VK_END" modifiers="shift" command="cmd_selectEndLine" />
+      <handler event="keypress" keycode="VK_UP" modifiers="shift" command="cmd_selectLinePrevious" />
+      <handler event="keypress" keycode="VK_DOWN" modifiers="shift" command="cmd_selectLineNext" />
+      <handler event="keypress" key="a" modifiers="alt" command="cmd_selectAll"/>
+    </handlers>
+  </binding>
+
+  <binding id="editor">
+    <handlers>
+#include ../editor-base.inc
+      <handler event="keypress" key="h" modifiers="control" command="cmd_deleteCharBackward"/>
+      <handler event="keypress" key="d" modifiers="control" command="cmd_deleteCharForward"/>
+      <handler event="keypress" key="k" modifiers="control" command="cmd_deleteToEndOfLine"/>
+      <handler event="keypress" key="u" modifiers="control" command="cmd_deleteToBeginningOfLine"/>
+      <handler event="keypress" key="a" modifiers="control" command="cmd_beginLine"/>
+      <handler event="keypress" key="e" modifiers="control" command="cmd_endLine"/>
+      <handler event="keypress" key="b" modifiers="control" command="cmd_charPrevious"/>
+      <handler event="keypress" key="f" modifiers="control" command="cmd_charNext"/>
+      <handler event="keypress" key="p" modifiers="control" command="cmd_linePrevious"/>
+      <handler event="keypress" key="n" modifiers="control" command="cmd_lineNext"/>
+      <handler event="keypress" key="x" modifiers="control" command="cmd_cut"/>
+      <handler event="keypress" key="c" modifiers="control" command="cmd_copy"/>
+      <handler event="keypress" key="v" modifiers="control" command="cmd_paste"/>
+      <handler event="keypress" key="z" modifiers="control" command="cmd_undo"/>
+      <handler event="keypress" key="y" modifiers="accel"   command="cmd_redo"/>
+      <handler event="keypress" key="a" modifiers="alt" command="cmd_selectAll"/>
+      <handler event="keypress" keycode="VK_DELETE" modifiers="shift" command="cmd_cutOrDelete"/>
+      <handler event="keypress" keycode="VK_DELETE" modifiers="control" command="cmd_copyOrDelete"/>
+      <handler event="keypress" keycode="VK_INSERT" modifiers="control" command="cmd_copy"/>
+      <handler event="keypress" keycode="VK_INSERT" modifiers="shift" command="cmd_paste"/>
+      <handler event="keypress" keycode="VK_LEFT" modifiers="control" command="cmd_wordPrevious"/>
+      <handler event="keypress" keycode="VK_RIGHT" modifiers="control" command="cmd_wordNext"/>
+      <handler event="keypress" keycode="VK_LEFT" modifiers="shift,control" command="cmd_selectWordPrevious"/>
+      <handler event="keypress" keycode="VK_RIGHT" modifiers="shift,control" command="cmd_selectWordNext"/>
+      <handler event="keypress" keycode="VK_BACK" modifiers="control" command="cmd_deleteWordBackward"/>
+      <handler event="keypress" keycode="VK_HOME" command="cmd_beginLine"/>
+      <handler event="keypress" keycode="VK_END" command="cmd_endLine"/>
+      <handler event="keypress" keycode="VK_HOME" modifiers="shift" command="cmd_selectBeginLine"/>
+      <handler event="keypress" keycode="VK_END" modifiers="shift" command="cmd_selectEndLine"/>
+      <handler event="keypress" keycode="VK_HOME" modifiers="shift,control" command="cmd_selectTop"/>
+      <handler event="keypress" keycode="VK_END" modifiers="shift,control" command="cmd_selectBottom"/>
+      <handler event="keypress" keycode="VK_HOME" modifiers="control" command="cmd_moveTop"/>
+      <handler event="keypress" keycode="VK_END" modifiers="control" command="cmd_moveBottom"/>
+      <handler event="keypress" keycode="VK_PAGE_UP" command="cmd_movePageUp"/>
+      <handler event="keypress" keycode="VK_PAGE_DOWN" command="cmd_movePageDown"/>
+      <handler event="keypress" keycode="VK_PAGE_UP" modifiers="shift" command="cmd_selectPageUp"/>
+      <handler event="keypress" keycode="VK_PAGE_DOWN" modifiers="shift" command="cmd_selectPageDown"/>
+      <handler event="keypress" keycode="VK_F20" command="cmd_cut" />
+      <handler event="keypress" keycode="VK_F16" command="cmd_copy" />
+      <handler event="keypress" keycode="VK_F18" command="cmd_paste" />
+      <handler event="keypress" keycode="VK_F14" command="cmd_undo" />
+    </handlers>
+  </binding>
+</bindings>
--- a/content/xbl/builtin/gtk2/platformHTMLBindings.xml
+++ b/content/xbl/builtin/gtk2/platformHTMLBindings.xml
@ -1,82 +0,0 @@
-<?xml version="1.0"?>
-
-<bindings id="htmlBindings"
-   xmlns="http://www.mozilla.org/xbl"
-   xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
- 
-  <binding id="inputFields">
-    <handlers>
-    <handler event="keypress" key="a" modifiers="alt"
-        command="cmd_selectAll"/>
-    <handler event="keypress" key="y" modifiers="accel"
-        command="cmd_redo"/>
-    <handler event="keypress" key="z" modifiers="accel,shift" command="cmd_redo"/>
-    <handler event="keypress" key="z" modifiers="accel" command="cmd_undo"/>
-    <handler event="keypress" keycode="VK_F14" command="cmd_undo" />
-    </handlers>
-  </binding>
-
-  <binding id="textAreas">
-    <handlers>
-    <handler event="keypress" key="a" modifiers="alt"
-        command="cmd_selectAll"/>
-    <handler event="keypress" key="y" modifiers="accel"
-        command="cmd_redo"/>
-    <handler event="keypress" key="z" modifiers="accel" command="cmd_undo"/>
-    <handler event="keypress" key="z" modifiers="accel,shift" command="cmd_redo"/>
-    <handler event="keypress" keycode="VK_F20" command="cmd_cut" />
-    <handler event="keypress" keycode="VK_F16" command="cmd_copy" />
-    <handler event="keypress" keycode="VK_F18" command="cmd_paste" />
-    <handler event="keypress" keycode="VK_F14" command="cmd_undo" />
-    </handlers>
-  </binding>
-
-  <binding id="browser">
-    <handlers>
-#include ../browser-base.inc
-      <handler event="keypress" keycode="VK_PAGE_UP" command="cmd_movePageUp"/>
-      <handler event="keypress" keycode="VK_PAGE_DOWN" command="cmd_movePageDown"/>
-      <handler event="keypress" keycode="VK_PAGE_UP" modifiers="shift" command="cmd_selectPageUp"/>
-      <handler event="keypress" keycode="VK_PAGE_DOWN" modifiers="shift" command="cmd_selectPageDown"/>
-
-      <handler event="keypress" keycode="VK_DELETE" modifiers="shift" command="cmd_cut" /> 
-      <handler event="keypress" keycode="VK_DELETE" modifiers="control" command="cmd_copy" /> 
-      <handler event="keypress" keycode="VK_INSERT" modifiers="control" command="cmd_copy" /> 
-      <handler event="keypress" keycode="VK_HOME" command="cmd_beginLine"/>
-      <handler event="keypress" keycode="VK_END" command="cmd_endLine"/>
-      <handler event="keypress" keycode="VK_HOME" modifiers="control" command="cmd_scrollTop"/>
-      <handler event="keypress" keycode="VK_END" modifiers="control" command="cmd_scrollBottom"/>
-      <handler event="keypress" keycode="VK_HOME" modifiers="shift,control" command="cmd_selectTop" /> 
-      <handler event="keypress" keycode="VK_END" modifiers="shift,control" command="cmd_selectBottom" /> 
-
-      <handler event="keypress" keycode="VK_F20" command="cmd_cut" /> 
-      <handler event="keypress" keycode="VK_F16" command="cmd_copy" /> 
-      <handler event="keypress" keycode="VK_F18" command="cmd_paste" /> 
-      <handler event="keypress" keycode="VK_F14" command="cmd_undo" />
-      <handler event="keypress" keycode="VK_LEFT" modifiers="control" command="cmd_wordPrevious" />
-      <handler event="keypress" keycode="VK_RIGHT" modifiers="control" command="cmd_wordNext" />
-      <handler event="keypress" keycode="VK_LEFT" modifiers="control,shift" command="cmd_selectWordPrevious" />
-      <handler event="keypress" keycode="VK_RIGHT" modifiers="control,shift" command="cmd_selectWordNext" />
-      <handler event="keypress" keycode="VK_LEFT" modifiers="shift" command="cmd_selectCharPrevious" />
-      <handler event="keypress" keycode="VK_RIGHT" modifiers="shift" command="cmd_selectCharNext" />
-      <handler event="keypress" keycode="VK_HOME" modifiers="shift" command="cmd_selectBeginLine" />
-      <handler event="keypress" keycode="VK_END" modifiers="shift" command="cmd_selectEndLine" />
-      <handler event="keypress" keycode="VK_UP" modifiers="shift" command="cmd_selectLinePrevious" />
-      <handler event="keypress" keycode="VK_DOWN" modifiers="shift" command="cmd_selectLineNext" />
-      <handler event="keypress" key="a" modifiers="alt" command="cmd_selectAll"/>
-    </handlers>
-  </binding>
-
-  <binding id="editor">
-    <handlers>
-      <handler event="keypress" key="z" modifiers="accel" command="cmd_undo"/>
-      <handler event="keypress" key="z" modifiers="accel,shift" command="cmd_redo"/>
-      <handler event="keypress" key="y" modifiers="accel"   command="cmd_redo"/>
-      <handler event="keypress" key="a" modifiers="alt" command="cmd_selectAll"/>
-      <handler event="keypress" keycode="VK_F20" command="cmd_cut" />
-      <handler event="keypress" keycode="VK_F16" command="cmd_copy" />
-      <handler event="keypress" keycode="VK_F18" command="cmd_paste" />
-      <handler event="keypress" keycode="VK_F14" command="cmd_undo" />
-    </handlers>
-  </binding>
-</bindings>
--- a/content/xbl/builtin/unix/platformHTMLBindings.xml
+++ b/content/xbl/builtin/unix/platformHTMLBindings.xml
@ -6,157 +6,24 @@
 
  <binding id="inputFields">
    <handlers>
-#include ../input-fields-base.inc
-    <!-- Emacsish single-line motion and delete keys -->
-    <handler event="keypress" key="a" modifiers="control"
-        command="cmd_beginLine"/>
-    <handler event="keypress" key="e" modifiers="control"
-        command="cmd_endLine"/>
-    <handler event="keypress" key="b" modifiers="control"
-        command="cmd_charPrevious"/>
-    <handler event="keypress" key="f" modifiers="control"
-        command="cmd_charNext"/>
-    <handler event="keypress" key="h" modifiers="control"
-        command="cmd_deleteCharBackward"/>
-    <handler event="keypress" key="d" modifiers="control"
-        command="cmd_deleteCharForward"/>
-    <handler event="keypress" key="w" modifiers="control"
-        command="cmd_deleteWordBackward"/>
-    <handler event="keypress" key="u" modifiers="control"
-        command="cmd_deleteToBeginningOfLine"/>
-    <handler event="keypress" key="k" modifiers="control"
-        command="cmd_deleteToEndOfLine"/>
-
-    <!-- Alternate Windows copy/paste/undo/redo keys -->
-    <handler event="keypress" keycode="VK_DELETE" modifiers="shift"
-        command="cmd_cutOrDelete"/>
-    <handler event="keypress" keycode="VK_DELETE" modifiers="control"
-        command="cmd_copyOrDelete"/>
-    <handler event="keypress" keycode="VK_INSERT" modifiers="control" 
-        command="cmd_copy"/>
-    <handler event="keypress" keycode="VK_INSERT" modifiers="shift"
-        command="cmd_paste"/>
-
-    <!-- navigating by word keys -->
-    <handler event="keypress" keycode="VK_HOME" 
-        command="cmd_beginLine"/>
-    <handler event="keypress" keycode="VK_END" 
-        command="cmd_endLine"/>
-    <handler event="keypress" keycode="VK_HOME" modifiers="shift"
-        command="cmd_selectBeginLine"/>
-    <handler event="keypress" keycode="VK_END" modifiers="shift"
-        command="cmd_selectEndLine"/>
-    <handler event="keypress" keycode="VK_HOME" modifiers="control"
-        command="cmd_beginLine"/>
-    <handler event="keypress" keycode="VK_END" modifiers="control" 
-        command="cmd_endLine"/>
-    <handler event="keypress" keycode="VK_HOME" modifiers="control,shift"
-        command="cmd_selectBeginLine"/>
-    <handler event="keypress" keycode="VK_END" modifiers="control,shift"
-        command="cmd_selectEndLine"/>
-    <handler event="keypress" keycode="VK_BACK" modifiers="control"
-        command="cmd_deleteWordBackward"/>
-
-    <handler event="keypress" keycode="VK_LEFT" modifiers="control" 
-        command="cmd_wordPrevious"/>
-    <handler event="keypress" keycode="VK_RIGHT" modifiers="control"
-        command="cmd_wordNext"/>
-    <handler event="keypress" keycode="VK_LEFT" modifiers="shift,control" 
-        command="cmd_selectWordPrevious"/>
-    <handler event="keypress" keycode="VK_RIGHT" modifiers="shift,control" 
-        command="cmd_selectWordNext"/>
-    <handler event="keypress" key="y" modifiers="accel"
-        command="cmd_redo"/>
    <handler event="keypress" key="a" modifiers="alt"
        command="cmd_selectAll"/>
-    <handler event="keypress" keycode="VK_F20" command="cmd_cut" />
-    <handler event="keypress" keycode="VK_F16" command="cmd_copy" />
-    <handler event="keypress" keycode="VK_F18" command="cmd_paste" />
+    <handler event="keypress" key="y" modifiers="accel"
+        command="cmd_redo"/>
+    <handler event="keypress" key="z" modifiers="accel,shift" command="cmd_redo"/>
+    <handler event="keypress" key="z" modifiers="accel" command="cmd_undo"/>
    <handler event="keypress" keycode="VK_F14" command="cmd_undo" />
    </handlers>
  </binding>

  <binding id="textAreas">
    <handlers>
-#include ../textareas-base.inc
-    <!-- Emacsish single-line motion and delete keys -->
-    <handler event="keypress" key="a" modifiers="control"
-        command="cmd_beginLine"/>
-    <handler event="keypress" key="e" modifiers="control"
-        command="cmd_endLine"/>
-    <handler event="keypress" id="key_left" key="b" modifiers="control"
-        command="cmd_charPrevious"/>
-    <handler event="keypress" id="key_right" key="f" modifiers="control"
-        command="cmd_charNext"/>
-    <handler event="keypress" id="key_delback" key="h" modifiers="control"
-        command="cmd_deleteCharBackward"/>
-    <handler event="keypress" id="key_delforw" key="d" modifiers="control"
-        command="cmd_deleteCharForward"/>
-    <handler event="keypress" id="key_delwback" key="w" modifiers="control"
-        command="cmd_deleteWordBackward"/>
-    <handler event="keypress" id="key_del_bol" key="u" modifiers="control"
-        command="cmd_deleteToBeginningOfLine"/>
-    <handler event="keypress" id="key_del_eol" key="k" modifiers="control"
-        command="cmd_deleteToEndOfLine"/>
-
-    <!-- Alternate Windows copy/paste/undo/redo keys -->
-    <handler event="keypress" keycode="VK_DELETE" modifiers="shift"
-        command="cmd_cutOrDelete"/>
-    <handler event="keypress" keycode="VK_DELETE" modifiers="control"
-        command="cmd_copyOrDelete"/>
-    <handler event="keypress" keycode="VK_INSERT" modifiers="control"
-        command="cmd_copy"/>
-    <handler event="keypress" keycode="VK_INSERT" modifiers="shift"
-        command="cmd_paste"/>
-
-    <!-- Emacsish multi-line motion and delete keys -->
-    <handler event="keypress" id="key_linedown" key="n" modifiers="control"
-        command="cmd_lineNext"/>
-    <handler event="keypress" id="key_lineup" key="p" modifiers="control"
-        command="cmd_linePrevious"/>
-
-    <!-- handle home/end/arrow keys and redo -->
-    <handler event="keypress" keycode="VK_HOME" 
-        command="cmd_beginLine"/>
-    <handler event="keypress" keycode="VK_END" 
-        command="cmd_endLine"/>
-    <handler event="keypress" keycode="VK_HOME" modifiers="shift"
-        command="cmd_selectBeginLine"/>
-    <handler event="keypress" keycode="VK_END" modifiers="shift"
-        command="cmd_selectEndLine"/>
-
-    <handler event="keypress" keycode="VK_HOME" modifiers="control" 
-        command="cmd_moveTop"/>
-    <handler event="keypress" keycode="VK_END" modifiers="control" 
-        command="cmd_moveBottom"/>
-    <handler event="keypress" keycode="VK_HOME" modifiers="shift,control"
-        command="cmd_selectTop"/>
-    <handler event="keypress" keycode="VK_END" modifiers="shift,control"
-        command="cmd_selectBottom"/>
-
-    <handler event="keypress" keycode="VK_PAGE_UP" 
-        command="cmd_movePageUp"/>
-    <handler event="keypress" keycode="VK_PAGE_DOWN" 
-        command="cmd_movePageDown"/>
-    <handler event="keypress" keycode="VK_PAGE_UP" modifiers="shift"
-        command="cmd_selectPageUp"/>
-    <handler event="keypress" keycode="VK_PAGE_DOWN" modifiers="shift"
-        command="cmd_selectPageDown"/>
-
-    <handler event="keypress" keycode="VK_LEFT" modifiers="control" 
-        command="cmd_wordPrevious"/>
-    <handler event="keypress" keycode="VK_RIGHT" modifiers="control" 
-        command="cmd_wordNext"/>
-    <handler event="keypress" keycode="VK_LEFT" modifiers="shift,control" 
-        command="cmd_selectWordPrevious"/>
-    <handler event="keypress" keycode="VK_RIGHT" modifiers="shift,control" 
-        command="cmd_selectWordNext"/>
-    <handler event="keypress" keycode="VK_BACK" modifiers="control"
-        command="cmd_deleteWordBackward"/>
-    <handler event="keypress" key="y" modifiers="accel"
-        command="cmd_redo"/>
    <handler event="keypress" key="a" modifiers="alt"
        command="cmd_selectAll"/>
+    <handler event="keypress" key="y" modifiers="accel"
+        command="cmd_redo"/>
+    <handler event="keypress" key="z" modifiers="accel" command="cmd_undo"/>
+    <handler event="keypress" key="z" modifiers="accel,shift" command="cmd_redo"/>
    <handler event="keypress" keycode="VK_F20" command="cmd_cut" />
    <handler event="keypress" keycode="VK_F16" command="cmd_copy" />
    <handler event="keypress" keycode="VK_F18" command="cmd_paste" />
@ -202,44 +69,10 @@

  <binding id="editor">
    <handlers>
-#include ../editor-base.inc
-      <handler event="keypress" key="h" modifiers="control" command="cmd_deleteCharBackward"/>
-      <handler event="keypress" key="d" modifiers="control" command="cmd_deleteCharForward"/>
-      <handler event="keypress" key="k" modifiers="control" command="cmd_deleteToEndOfLine"/>
-      <handler event="keypress" key="u" modifiers="control" command="cmd_deleteToBeginningOfLine"/>
-      <handler event="keypress" key="a" modifiers="control" command="cmd_beginLine"/>
-      <handler event="keypress" key="e" modifiers="control" command="cmd_endLine"/>
-      <handler event="keypress" key="b" modifiers="control" command="cmd_charPrevious"/>
-      <handler event="keypress" key="f" modifiers="control" command="cmd_charNext"/>
-      <handler event="keypress" key="p" modifiers="control" command="cmd_linePrevious"/>
-      <handler event="keypress" key="n" modifiers="control" command="cmd_lineNext"/>
-      <handler event="keypress" key="x" modifiers="control" command="cmd_cut"/>
-      <handler event="keypress" key="c" modifiers="control" command="cmd_copy"/>
-      <handler event="keypress" key="v" modifiers="control" command="cmd_paste"/>
-      <handler event="keypress" key="z" modifiers="control" command="cmd_undo"/>
+      <handler event="keypress" key="z" modifiers="accel" command="cmd_undo"/>
+      <handler event="keypress" key="z" modifiers="accel,shift" command="cmd_redo"/>
      <handler event="keypress" key="y" modifiers="accel"   command="cmd_redo"/>
      <handler event="keypress" key="a" modifiers="alt" command="cmd_selectAll"/>
-      <handler event="keypress" keycode="VK_DELETE" modifiers="shift" command="cmd_cutOrDelete"/>
-      <handler event="keypress" keycode="VK_DELETE" modifiers="control" command="cmd_copyOrDelete"/>
-      <handler event="keypress" keycode="VK_INSERT" modifiers="control" command="cmd_copy"/>
-      <handler event="keypress" keycode="VK_INSERT" modifiers="shift" command="cmd_paste"/>
-      <handler event="keypress" keycode="VK_LEFT" modifiers="control" command="cmd_wordPrevious"/>
-      <handler event="keypress" keycode="VK_RIGHT" modifiers="control" command="cmd_wordNext"/>
-      <handler event="keypress" keycode="VK_LEFT" modifiers="shift,control" command="cmd_selectWordPrevious"/>
-      <handler event="keypress" keycode="VK_RIGHT" modifiers="shift,control" command="cmd_selectWordNext"/>
-      <handler event="keypress" keycode="VK_BACK" modifiers="control" command="cmd_deleteWordBackward"/>
-      <handler event="keypress" keycode="VK_HOME" command="cmd_beginLine"/>
-      <handler event="keypress" keycode="VK_END" command="cmd_endLine"/>
-      <handler event="keypress" keycode="VK_HOME" modifiers="shift" command="cmd_selectBeginLine"/>
-      <handler event="keypress" keycode="VK_END" modifiers="shift" command="cmd_selectEndLine"/>
-      <handler event="keypress" keycode="VK_HOME" modifiers="shift,control" command="cmd_selectTop"/>
-      <handler event="keypress" keycode="VK_END" modifiers="shift,control" command="cmd_selectBottom"/>
-      <handler event="keypress" keycode="VK_HOME" modifiers="control" command="cmd_moveTop"/>
-      <handler event="keypress" keycode="VK_END" modifiers="control" command="cmd_moveBottom"/>
-      <handler event="keypress" keycode="VK_PAGE_UP" command="cmd_movePageUp"/>
-      <handler event="keypress" keycode="VK_PAGE_DOWN" command="cmd_movePageDown"/>
-      <handler event="keypress" keycode="VK_PAGE_UP" modifiers="shift" command="cmd_selectPageUp"/>
-      <handler event="keypress" keycode="VK_PAGE_DOWN" modifiers="shift" command="cmd_selectPageDown"/>
      <handler event="keypress" keycode="VK_F20" command="cmd_cut" />
      <handler event="keypress" keycode="VK_F16" command="cmd_copy" />
      <handler event="keypress" keycode="VK_F18" command="cmd_paste" />
--- a/content/xul/content/src/nsXULElement.cpp
+++ b/content/xul/content/src/nsXULElement.cpp
@ -1939,10 +1939,8 @@ nsXULElement::EnsureLocalStyle()
        nsXULPrototypeAttribute *protoattr =
                  FindPrototypeAttribute(kNameSpaceID_None, nsGkAtoms::style);
        if (protoattr && protoattr->mValue.Type() == nsAttrValue::eCSSStyleRule) {
-            nsCOMPtr<nsICSSRule> ruleClone;
-            nsresult rv = protoattr->mValue.GetCSSStyleRuleValue()->
-                Clone(*getter_AddRefs(ruleClone));
-            NS_ENSURE_SUCCESS(rv, rv);
+            nsCOMPtr<nsICSSRule> ruleClone =
+                protoattr->mValue.GetCSSStyleRuleValue()->Clone();

            nsString stringValue;
            protoattr->mValue.ToString(stringValue);
@ -1951,7 +1949,8 @@ nsXULElement::EnsureLocalStyle()
            nsCOMPtr<nsICSSStyleRule> styleRule = do_QueryInterface(ruleClone);
            value.SetTo(styleRule, &stringValue);

-            rv = mAttrsAndChildren.SetAndTakeAttr(nsGkAtoms::style, value);
+            nsresult rv =
+                mAttrsAndChildren.SetAndTakeAttr(nsGkAtoms::style, value);
            NS_ENSURE_SUCCESS(rv, rv);
        }
    }
@ -2315,9 +2314,8 @@ nsresult nsXULElement::MakeHeavyweight()
        
        // Style rules need to be cloned.
        if (protoattr->mValue.Type() == nsAttrValue::eCSSStyleRule) {
-            nsCOMPtr<nsICSSRule> ruleClone;
-            rv = protoattr->mValue.GetCSSStyleRuleValue()->Clone(*getter_AddRefs(ruleClone));
-            NS_ENSURE_SUCCESS(rv, rv);
+            nsCOMPtr<nsICSSRule> ruleClone =
+                protoattr->mValue.GetCSSStyleRuleValue()->Clone();

            nsString stringValue;
            protoattr->mValue.ToString(stringValue);
--- a/docshell/base/nsDefaultURIFixup.cpp
+++ b/docshell/base/nsDefaultURIFixup.cpp
@ -48,6 +48,7 @@
 #include "nsIPrefLocalizedString.h"
 #include "nsIPlatformCharset.h"
 #include "nsILocalFile.h"
+#include "nsIBrowserSearchService.h"

 #include "nsIURIFixup.h"
 #include "nsDefaultURIFixup.h"
@ -388,16 +389,56 @@ NS_IMETHODIMP nsDefaultURIFixup::KeywordToURI(const nsACString& aKeyword,
        mPrefBranch->GetCharPref("keyword.URL", getter_Copies(url));
    }

-    // if we can't find a keyword.URL keywords won't work.
-    if (url.IsEmpty())
-        return NS_ERROR_NOT_AVAILABLE;
+    // If the pref is set and non-empty, use it.
+    if (!url.IsEmpty()) {
+        nsCAutoString spec;
+        nsresult rv = MangleKeywordIntoURI(PromiseFlatCString(aKeyword).get(),
+                                           url.get(), spec);
+        if (NS_FAILED(rv)) return rv;

-    nsCAutoString spec;
-    nsresult rv = MangleKeywordIntoURI(PromiseFlatCString(aKeyword).get(),
-                                       url.get(), spec);
-    if (NS_FAILED(rv)) return rv;
+        return NS_NewURI(aURI, spec);
+    }

-    return NS_NewURI(aURI, spec);
+    // Try falling back to the search service's default search engine
+    nsCOMPtr<nsIBrowserSearchService> searchSvc = do_GetService("@mozilla.org/browser/search-service;1");
+    if (searchSvc) {
+        nsCOMPtr<nsISearchEngine> defaultEngine;
+        searchSvc->GetDefaultEngine(getter_AddRefs(defaultEngine));
+        if (defaultEngine) {
+            nsCOMPtr<nsISearchSubmission> submission;
+            // We want to allow default search plugins to specify alternate
+            // parameters that are specific to keyword searches. For the moment,
+            // do this by first looking for a magic
+            // "application/x-moz-keywordsearch" submission type. In the future,
+            // we should instead use a solution that relies on bug 587780.
+            defaultEngine->GetSubmission(NS_ConvertUTF8toUTF16(aKeyword),
+                                         NS_LITERAL_STRING("application/x-moz-keywordsearch"),
+                                         getter_AddRefs(submission));
+            // If getting the special x-moz-keywordsearch submission type failed,
+            // fall back to the default response type.
+            if (!submission) {
+                defaultEngine->GetSubmission(NS_ConvertUTF8toUTF16(aKeyword),
+                                             EmptyString(),
+                                             getter_AddRefs(submission));
+            }
+
+            if (submission) {
+                // The submission depends on POST data (i.e. the search engine's
+                // "method" is POST), we can't use this engine for keyword
+                // searches
+                nsCOMPtr<nsIInputStream> postData;
+                submission->GetPostData(getter_AddRefs(postData));
+                if (postData) {
+                    return NS_ERROR_NOT_AVAILABLE;
+                }
+
+                return submission->GetUri(aURI);
+            }
+        }
+    }
+
+    // out of options
+    return NS_ERROR_NOT_AVAILABLE;
 }

 PRBool nsDefaultURIFixup::MakeAlternateURI(nsIURI *aURI)
--- a/dom/interfaces/html/nsIDOMNSHTMLDocument.idl
+++ b/dom/interfaces/html/nsIDOMNSHTMLDocument.idl
@ -39,11 +39,9 @@

 #include "domstubs.idl"

-[scriptable, uuid(95cd5ad4-ae8a-4f0e-b168-35e03d5e0b9a)]
+[scriptable, uuid(386e9eee-1f06-40a6-a1a7-ed986646b793)]
 interface nsIDOMNSHTMLDocument : nsISupports
 {
-  readonly attribute long                 width;
-  readonly attribute long                 height;
           attribute DOMString            alinkColor;
           attribute DOMString            linkColor;
           attribute DOMString            vlinkColor;
--- a/dom/plugins/PluginInstanceChild.cpp
+++ b/dom/plugins/PluginInstanceChild.cpp
@ -86,8 +86,6 @@ using mozilla::gfx::SharedDIB;
 // helpers' section for details.
 const int kFlashWMUSERMessageThrottleDelayMs = 5;

-#define NS_OOPP_DOUBLEPASS_MSGID TEXT("MozDoublePassMsg")
-
 #elif defined(XP_MACOSX)
 #include <ApplicationServices/ApplicationServices.h>
 #endif // defined(XP_MACOSX)
@ -125,7 +123,6 @@ PluginInstanceChild::PluginInstanceChild(const NPPluginFuncs* aPluginIface,
 #endif // MOZ_X11 && XP_UNIX && !XP_MACOSX
 #if defined(OS_WIN)
    memset(&mAlphaExtract, 0, sizeof(mAlphaExtract));
-    mAlphaExtract.doublePassEvent = ::RegisterWindowMessage(NS_OOPP_DOUBLEPASS_MSGID);
 #endif // OS_WIN
    InitQuirksModes(aMimeType);
 #if defined(OS_WIN)
@ -565,7 +562,7 @@ PluginInstanceChild::AnswerNPP_HandleEvent(const NPRemoteEvent& event,
          *handled = SharedSurfacePaint(evcopy);
          return true;
       }
-       else if (evcopy.event == mAlphaExtract.doublePassEvent) {
+       else if (DoublePassRenderingEvent() == evcopy.event) {
            // We'll render to mSharedSurfaceDib first, then render to a cached bitmap
            // we store locally. The two passes are for alpha extraction, so the second
            // pass must be to a flat white surface in order for things to work.
--- a/dom/plugins/PluginInstanceChild.h
+++ b/dom/plugins/PluginInstanceChild.h
@ -352,7 +352,6 @@ private:
    };
    gfx::SharedDIBWin mSharedSurfaceDib;
    struct {
-      PRUint32        doublePassEvent;
      PRUint16        doublePass;
      HDC             hdc;
      HBITMAP         bmp;
--- a/dom/plugins/PluginInstanceParent.cpp
+++ b/dom/plugins/PluginInstanceParent.cpp
@ -638,7 +638,12 @@ PluginInstanceParent::NPP_HandleEvent(void* event)

 #if defined(OS_WIN)
    if (mWindowType == NPWindowTypeDrawable) {
-        switch(npevent->event) {
+        if (DoublePassRenderingEvent() == npevent->event) {
+            CallPaint(npremoteevent, &handled);
+            return handled;
+        }
+
+        switch (npevent->event) {
            case WM_PAINT:
            {
                RECT rect;
--- a/dom/plugins/PluginMessageUtils.cpp
+++ b/dom/plugins/PluginMessageUtils.cpp
@ -162,5 +162,18 @@ void DeferNPVariantLastRelease(const NPNetscapeFuncs* f, NPVariant* v)
  VOID_TO_NPVARIANT(*v);
 }

+#ifdef XP_WIN
+
+// The private event used for double-pass widgetless plugin rendering.
+UINT DoublePassRenderingEvent()
+{
+  static UINT gEventID = 0;
+  if (!gEventID)
+    gEventID = ::RegisterWindowMessage(L"MozDoublePassMsg");
+  return gEventID;
+}
+
+#endif
+
 } // namespace plugins
 } // namespace mozilla
--- a/dom/plugins/PluginMessageUtils.h
+++ b/dom/plugins/PluginMessageUtils.h
@ -271,6 +271,11 @@ struct DeletingObjectEntry : public nsPtrHashKey<NPObject>
  bool mDeleted;
 };

+#ifdef XP_WIN
+// The private event used for double-pass widgetless plugin rendering.
+UINT DoublePassRenderingEvent();
+#endif
+
 } /* namespace plugins */

 } /* namespace mozilla */
--- a/dom/plugins/PluginUtilsOSX.mm
+++ b/dom/plugins/PluginUtilsOSX.mm
@ -72,8 +72,6 @@ NPError mozilla::plugins::PluginUtilsOSX::ShowCocoaContextMenu(void* aMenu, int
 {
  NS_OBJC_BEGIN_TRY_ABORT_BLOCK;

-  // Leave out this code until we can fix painting. See bug 568513.
-  /*
  // Create a timer to process browser events while waiting
  // on the menu. This prevents the browser from hanging
  // during the lifetime of the menu.
@ -86,19 +84,18 @@ NPError mozilla::plugins::PluginUtilsOSX::ShowCocoaContextMenu(void* aMenu, int
  // not fire during the right click menu.
  [[NSRunLoop currentRunLoop] addTimer:eventTimer 
                              forMode:NSEventTrackingRunLoopMode];
-  */

  NSMenu* nsmenu = reinterpret_cast<NSMenu*>(aMenu);
  NSPoint screen_point = ::NSMakePoint(aX, aY);

  [nsmenu popUpMenuPositioningItem:nil atLocation:screen_point inView:nil];

-  //[eventTimer invalidate];
-  //[eventProcessor release];
+  [eventTimer invalidate];
+  [eventProcessor release];

  return NPERR_NO_ERROR;

-  NS_OBJC_END_TRY_ABORT_BLOCK;
+  NS_OBJC_END_TRY_ABORT_BLOCK_RETURN(NPERR_GENERIC_ERROR);
 }

 void mozilla::plugins::PluginUtilsOSX::InvokeNativeEventLoop()
--- a/dom/src/geolocation/nsGeolocation.cpp
+++ b/dom/src/geolocation/nsGeolocation.cpp
@ -1098,6 +1098,7 @@ nsGeolocationRequestProxy::Cancel()
 {
  NS_ASSERTION(mParent, "No parent for request");
  unused << mozilla::dom::GeolocationRequestParent::Send__delete__(mParent, false);
+  mParent = nsnull;
  return NS_OK;
 }

@ -1106,6 +1107,7 @@ nsGeolocationRequestProxy::Allow()
 {
  NS_ASSERTION(mParent, "No parent for request");
  unused << mozilla::dom::GeolocationRequestParent::Send__delete__(mParent, true);
+  mParent = nsnull;
  return NS_OK;
 }

@ -1118,13 +1120,11 @@ GeolocationRequestParent::GeolocationRequestParent(nsIDOMElement *element, const
  
  mURI       = uri;
  mElement   = element;
-  mProxy     = nsnull;
 }

 GeolocationRequestParent::~GeolocationRequestParent()
 {
  MOZ_COUNT_DTOR(GeolocationRequestParent);
-  delete mProxy;
 }
  
 bool
--- a/dom/src/geolocation/nsGeolocationOOP.h
+++ b/dom/src/geolocation/nsGeolocationOOP.h
@ -60,13 +60,13 @@ class GeolocationRequestParent : public PGeolocationRequestParent
  
  nsCOMPtr<nsIURI>           mURI;
  nsCOMPtr<nsIDOMElement>    mElement;
-  nsGeolocationRequestProxy *mProxy;
+  nsCOMPtr<nsGeolocationRequestProxy> mProxy;

 private:  
  virtual bool Recvprompt();
 };
  
-} // namespace dom                                                                                                                                                                                                                   
+} // namespace dom
 } // namespace mozilla

 class nsGeolocationRequestProxy : public nsIGeolocationRequest
--- a/dom/src/threads/nsDOMWorkerXHR.cpp
+++ b/dom/src/threads/nsDOMWorkerXHR.cpp
@ -889,3 +889,10 @@ nsDOMWorkerXHR::SetWithCredentials(PRBool aWithCredentials)

  return NS_OK;
 }
+
+/* readonly attribute jsval (ArrayBuffer) mozResponseArrayBuffer; */
+NS_IMETHODIMP
+nsDOMWorkerXHR::GetMozResponseArrayBuffer(jsval *aResult)
+{
+    return NS_ERROR_NOT_IMPLEMENTED;
+}
--- a/dom/system/NetworkGeolocationProvider.js
+++ b/dom/system/NetworkGeolocationProvider.js
@ -369,8 +369,12 @@ WifiGeoPositionProvider.prototype = {
                    // no match, lets cache
                    LOG("New Access Token: " + newAccessToken + "\n" + accessTokenPrefName);
                    
-                    prefService.setIntPref(accessTokenPrefName + ".time", nowInSeconds());
-                    prefService.setCharPref(accessTokenPrefName, newAccessToken);
+                    try {
+                        prefService.setIntPref(accessTokenPrefName + ".time", nowInSeconds());
+                        prefService.setCharPref(accessTokenPrefName, newAccessToken);
+                    } catch (x) {
+                        // XXX temporary hack for bug 575346 to allow geolocation to function
+                    }
                }
            }

--- a/dom/tests/mochitest/general/test_offsets.js
+++ b/dom/tests/mochitest/general/test_offsets.js
@ -26,6 +26,22 @@ function testElements(baseid, callback)
  callback();
 }

+function toNearestAppunit(v)
+{
+  // 60 appunits per CSS pixel; round result to the nearest appunit
+  return Math.round(v*60)/60;
+}
+
+function floorToNearestAppunit(v)
+{
+  return Math.floor(toNearestAppunit(v));
+}
+
+function isEqualAppunits(a, b, msg)
+{
+  is(toNearestAppunit(a), toNearestAppunit(b), msg);
+}
+
 function testElement(element)
 {
  var offsetParent = element.getAttribute("_offsetParent");
@ -51,10 +67,11 @@ function testElement(element)
  var scrollWidth, scrollHeight, clientWidth, clientHeight;
  if (element.id == "scrollbox") {
    var lastchild = $("lastline");
-    scrollWidth = Math.floor(lastchild.getBoundingClientRect().width) + paddingLeft + paddingRight;
-    var contentsHeight = element.lastChild.getBoundingClientRect().bottom -
-        element.firstChild.getBoundingClientRect().top;
-    scrollHeight = Math.floor(contentsHeight) + paddingTop + paddingBottom;
+    scrollWidth = floorToNearestAppunit(lastchild.getBoundingClientRect().width + paddingLeft + paddingRight);
+    var top = element.firstChild.getBoundingClientRect().top;
+    var bottom = element.lastChild.getBoundingClientRect().bottom;
+    var contentsHeight = bottom - top;
+    scrollHeight = floorToNearestAppunit(contentsHeight + paddingTop + paddingBottom);
    clientWidth = paddingLeft + width + paddingRight - scrollbarWidth;
    clientHeight = paddingTop + height + paddingBottom - scrollbarHeight;
  }
@ -77,15 +94,13 @@ function testElement(element)
    checkClientState(element, borderLeft, borderTop, clientWidth, clientHeight, element.id);

  var boundingrect = element.getBoundingClientRect();
-  is(Math.round(boundingrect.width), borderLeft + paddingLeft + width + paddingRight + borderRight,
+  isEqualAppunits(boundingrect.width, borderLeft + paddingLeft + width + paddingRight + borderRight,
     element.id + " bounding rect width");
-  is(Math.round(boundingrect.height), borderTop + paddingTop + height + paddingBottom + borderBottom,
+  isEqualAppunits(boundingrect.height, borderTop + paddingTop + height + paddingBottom + borderBottom,
     element.id + " bounding rect height");
-  is(Math.round(boundingrect.right - boundingrect.left),
-     borderLeft + paddingLeft + width + paddingRight + borderRight,
+  isEqualAppunits(boundingrect.right - boundingrect.left, boundingrect.width,
     element.id + " bounding rect right");
-  is(Math.round(boundingrect.bottom - boundingrect.top),
-     borderTop + paddingTop + height + paddingBottom + borderBottom,
+  isEqualAppunits(boundingrect.bottom - boundingrect.top, boundingrect.height,
     element.id + " bounding rect bottom");

  var rects = element.getClientRects();
@ -98,12 +113,6 @@ function testElement(element)
    is(rects[0].right, boundingrect.right, element.id + " getClientRects right");
    is(rects[0].bottom, boundingrect.bottom, element.id + " getClientRects bottom");
  }
-
-  var root = document.documentElement;
-  gPreviousRight = Math.round(boundingrect.right) -
-                   gcs(root, "paddingLeft") - gcs(root, "borderLeftWidth");
-  gPreviousBottom = Math.round(boundingrect.bottom) -
-                   gcs(root, "paddingTop") - gcs(root, "borderTopWidth");
 }

 function checkScrolledElement(element, child)
@ -159,7 +168,7 @@ function checkClientState(element, left, top, width, height, testname)
 function checkCoord(element, type, val, testname)
 {
  if (val != -10000)
-    is(element[type], val, testname + " " + type);
+    is(element[type], Math.round(val), testname + " " + type);
 }

 function checkCoords(element, type, left, top, width, height, testname)
@ -188,7 +197,6 @@ function gcs(element, prop)
  var propVal = (element instanceof SVGElement && (prop == "width" || prop == "height")) ?
                   element.getAttribute(prop) : getComputedStyle(element, "")[prop];
  if (propVal == "auto")
-    propVal = 0;
-  var propValFloat = parseFloat(propVal);
-  return (isNaN(propValFloat) ? propVal : Math.round(propValFloat));
+    return 0;
+  return parseFloat(propVal);
 }
--- a/editor/libeditor/html/tests/test_htmleditor_keyevent_handling.html
+++ b/editor/libeditor/html/tests/test_htmleditor_keyevent_handling.html
@ -29,7 +29,7 @@ var htmlEditor = document.getElementById("htmlEditor");

 const kIsMac = navigator.platform.indexOf("Mac") == 0;
 const kIsWin = navigator.platform.indexOf("Win") == 0;
-const kIsLinux = navigator.platform.indexOf("Linux") == 0;
+const kIsLinux = navigator.platform.indexOf("Linux") == 0 || navigator.platform.indexOf("SunOS") == 0 ;

 function runTests()
 {
--- a/embedding/android/GeckoAppShell.java
+++ b/embedding/android/GeckoAppShell.java
@ -132,9 +132,6 @@ class GeckoAppShell
        System.loadLibrary("ssl3");
        System.loadLibrary("smime3");

-        // JS
-        System.loadLibrary("mozjs");
-
        // XUL
        System.loadLibrary("xul");

--- a/extensions/spellcheck/src/mozInlineSpellChecker.h
+++ b/extensions/spellcheck/src/mozInlineSpellChecker.h
@ -279,7 +279,7 @@ public:
                        mozInlineSpellStatus* aStatus,
                        PRBool* aDoneChecking);

-  // helper routine to determine if a point is inside of a the passed in selection.
+  // helper routine to determine if a point is inside of the passed in selection.
  nsresult IsPointInSelection(nsISelection *aSelection,
                              nsIDOMNode *aNode,
                              PRInt32 aOffset,
--- a/gfx/cairo/cairo/src/cairo-d2d-surface.cpp
+++ b/gfx/cairo/cairo/src/cairo-d2d-surface.cpp
@ -162,8 +162,9 @@ _cairo_d2d_set_operator(cairo_d2d_device_t *device,
 }

 cairo_device_t *
-cairo_d2d_create_device()
+cairo_d2d_create_device_from_d3d10device(ID3D10Device1 *d3d10device)
 {
+    HRESULT hr;
    D3D10_RASTERIZER_DESC rastDesc;
    D3D10_INPUT_ELEMENT_DESC layout[] =
    {
@ -176,68 +177,15 @@ cairo_d2d_create_device()
    D3D10_SUBRESOURCE_DATA data;

    cairo_d2d_device_t *device = new cairo_d2d_device_t;
+
+    device->mD3D10Device = d3d10device;
+
    device->mD3D10_1 = LoadLibraryA("d3d10_1.dll");
-    D3D10CreateDevice1Func createD3DDevice = (D3D10CreateDevice1Func)
-	GetProcAddress(device->mD3D10_1, "D3D10CreateDevice1");
    D3D10CreateEffectFromMemoryFunc createEffect = (D3D10CreateEffectFromMemoryFunc)
 	GetProcAddress(device->mD3D10_1, "D3D10CreateEffectFromMemory");
    D2D1CreateFactoryFunc createD2DFactory;

-    if (!createD3DDevice || !createEffect) {
-	goto FAILED;
-    }
-
-    /**
-     * On usage of D3D10_CREATE_DEVICE_PREVENT_INTERNAL_THREADING_OPTIMIZATIONS:
-     * documentation on D3D10_CREATE_DEVICE_PREVENT_INTERNAL_THREADING_OPTIMIZATIONS
-     * can be misleading. In fact, that flag gives no such indication. I pointed this
-     * out to Bas in my email. However, Microsoft is in fact using this flag to
-     * indicate "light weight" DX applications. By light weight they are essentially
-     * referring to applications that are not games. The idea is that when you create
-     * a DX game, the driver assumes that you will pretty much have a single instance
-     * and therefore it doesn't try to hold back when it comes to GPU resource
-     * allocation as long as it can crank out performance. In other words, the
-     * priority in regular DX applications is to make that one application run as fast
-     * as you can. For "light weight" applications, including D2D applications, the
-     * priorities are a bit different. Now you are no longer going to have a single
-     * (or very few) instances. You can have a lot of them (say, for example, a
-     * separate DX context/device per browser tab). In such cases, the GPU resource
-     * allocation scheme changes.
-     */
-    HRESULT hr = createD3DDevice(
-	NULL, 
-	D3D10_DRIVER_TYPE_HARDWARE,
-	NULL,
-	D3D10_CREATE_DEVICE_BGRA_SUPPORT |
-	D3D10_CREATE_DEVICE_PREVENT_INTERNAL_THREADING_OPTIMIZATIONS,
-	D3D10_FEATURE_LEVEL_10_1,
-	D3D10_1_SDK_VERSION,
-	&device->mD3D10Device);
-    if (FAILED(hr)) {
-	hr = createD3DDevice(
-	    NULL, 
-	    D3D10_DRIVER_TYPE_HARDWARE,
-	    NULL,
-	    D3D10_CREATE_DEVICE_BGRA_SUPPORT |
-	    D3D10_CREATE_DEVICE_PREVENT_INTERNAL_THREADING_OPTIMIZATIONS,
-	    D3D10_FEATURE_LEVEL_10_0,
-	    D3D10_1_SDK_VERSION,
-	    &device->mD3D10Device);
-	if (FAILED(hr)) {
-	    /* This is not guaranteed to be too fast! */
-	    hr = createD3DDevice(
-		NULL, 
-		D3D10_DRIVER_TYPE_HARDWARE,
-		NULL,
-		D3D10_CREATE_DEVICE_BGRA_SUPPORT |
-		D3D10_CREATE_DEVICE_PREVENT_INTERNAL_THREADING_OPTIMIZATIONS,
-		D3D10_FEATURE_LEVEL_9_3,
-		D3D10_1_SDK_VERSION,
-		&device->mD3D10Device);
-
-	}
-    }
-    if (FAILED(hr)) {
+    if (!createEffect) {
 	goto FAILED;
    }

@ -302,6 +250,80 @@ FAILED:
    return NULL;
 }

+cairo_device_t *
+cairo_d2d_create_device()
+{
+    HMODULE d3d10module = LoadLibraryA("d3d10_1.dll");
+    D3D10CreateDevice1Func createD3DDevice = (D3D10CreateDevice1Func)
+	GetProcAddress(d3d10module, "D3D10CreateDevice1");
+
+    if (!createD3DDevice) {
+	return NULL;
+    }
+
+    RefPtr<ID3D10Device1> d3ddevice;
+
+    /**
+     * On usage of D3D10_CREATE_DEVICE_PREVENT_INTERNAL_THREADING_OPTIMIZATIONS:
+     * documentation on D3D10_CREATE_DEVICE_PREVENT_INTERNAL_THREADING_OPTIMIZATIONS
+     * can be misleading. In fact, that flag gives no such indication. I pointed this
+     * out to Bas in my email. However, Microsoft is in fact using this flag to
+     * indicate "light weight" DX applications. By light weight they are essentially
+     * referring to applications that are not games. The idea is that when you create
+     * a DX game, the driver assumes that you will pretty much have a single instance
+     * and therefore it doesn't try to hold back when it comes to GPU resource
+     * allocation as long as it can crank out performance. In other words, the
+     * priority in regular DX applications is to make that one application run as fast
+     * as you can. For "light weight" applications, including D2D applications, the
+     * priorities are a bit different. Now you are no longer going to have a single
+     * (or very few) instances. You can have a lot of them (say, for example, a
+     * separate DX context/device per browser tab). In such cases, the GPU resource
+     * allocation scheme changes.
+     */
+    HRESULT hr = createD3DDevice(
+	NULL, 
+	D3D10_DRIVER_TYPE_HARDWARE,
+	NULL,
+	D3D10_CREATE_DEVICE_BGRA_SUPPORT |
+	D3D10_CREATE_DEVICE_PREVENT_INTERNAL_THREADING_OPTIMIZATIONS,
+	D3D10_FEATURE_LEVEL_10_1,
+	D3D10_1_SDK_VERSION,
+	&d3ddevice);
+    if (FAILED(hr)) {
+	hr = createD3DDevice(
+	    NULL, 
+	    D3D10_DRIVER_TYPE_HARDWARE,
+	    NULL,
+	    D3D10_CREATE_DEVICE_BGRA_SUPPORT |
+	    D3D10_CREATE_DEVICE_PREVENT_INTERNAL_THREADING_OPTIMIZATIONS,
+	    D3D10_FEATURE_LEVEL_10_0,
+	    D3D10_1_SDK_VERSION,
+	    &d3ddevice);
+	if (FAILED(hr)) {
+	    /* This is not guaranteed to be too fast! */
+	    hr = createD3DDevice(
+		NULL, 
+		D3D10_DRIVER_TYPE_HARDWARE,
+		NULL,
+		D3D10_CREATE_DEVICE_BGRA_SUPPORT |
+		D3D10_CREATE_DEVICE_PREVENT_INTERNAL_THREADING_OPTIMIZATIONS,
+		D3D10_FEATURE_LEVEL_9_3,
+		D3D10_1_SDK_VERSION,
+		&d3ddevice);
+
+	}
+    }
+    if (FAILED(hr)) {
+	return NULL;
+    }
+
+    cairo_device_t *device = cairo_d2d_create_device_from_d3d10device(d3ddevice);
+
+    // Free our reference to the modules. The created device should have its own.
+    FreeLibrary(d3d10module);
+    return device;
+}
+
 int
 cairo_release_device(cairo_device_t *device)
 {
@ -309,9 +331,10 @@ cairo_release_device(cairo_device_t *device)
    if (!newrefcnt) {
 	// Call the correct destructor
 	cairo_d2d_device_t *d2d_device = reinterpret_cast<cairo_d2d_device_t*>(device);
-	FreeLibrary(d2d_device->mD3D10_1);
+        HMODULE d3d10_1 = d2d_device->mD3D10_1;
 	delete d2d_device;
 	_cairo_d2d_release_factory();
+        FreeLibrary(d3d10_1);
    }
    return newrefcnt;
 }
@ -1041,7 +1064,7 @@ _cairo_d2d_create_strokestyle_for_stroke_style(const cairo_stroke_style_t *style
    D2D1_LINE_JOIN line_join = D2D1_LINE_JOIN_MITER;
    switch (style->line_join) {
 	case CAIRO_LINE_JOIN_MITER:
-	    line_join = D2D1_LINE_JOIN_MITER;
+	    line_join = D2D1_LINE_JOIN_MITER_OR_BEVEL;
 	    break;
 	case CAIRO_LINE_JOIN_ROUND:
 	    line_join = D2D1_LINE_JOIN_ROUND;
@ -1637,13 +1660,10 @@ _cairo_d2d_create_brush_for_pattern(cairo_d2d_surface_t *d2dsurf,
 	    extendMode = D2D1_EXTEND_MODE_CLAMP;
 	    key = &bitmap_key_nonextend;
 	    /** 
-	     * For image surfaces we create a slightly larger bitmap with
-	     * a transparent border around it for this case. Need to translate
-	     * for that.
+	     * We create a slightly larger bitmap with a transparent border
+	     * around it for this case. Need to translate for that.
 	     */
-	    if (surfacePattern->surface->type == CAIRO_SURFACE_TYPE_IMAGE) {
-		cairo_matrix_translate(&mat, -1.0, -1.0);
-	    }
+	    cairo_matrix_translate(&mat, -1.0, -1.0);
 	} else if (pattern->extend == CAIRO_EXTEND_REPEAT) {
 	    extendMode = D2D1_EXTEND_MODE_WRAP;
 	} else if (pattern->extend == CAIRO_EXTEND_REFLECT) {
@ -1678,9 +1698,21 @@ _cairo_d2d_create_brush_for_pattern(cairo_d2d_surface_t *d2dsurf,
 	    }

 	    _cairo_d2d_update_surface_bitmap(srcSurf);
-	    sourceBitmap = srcSurf->surfaceBitmap;
-
 	    _cairo_d2d_flush(srcSurf);
+
+	    if (pattern->extend == CAIRO_EXTEND_NONE) {
+		ID2D1Bitmap *srcSurfBitmap = srcSurf->surfaceBitmap;
+		d2dsurf->rt->CreateBitmap(
+		    D2D1::SizeU(srcSurfBitmap->GetPixelSize().width + 2,
+				srcSurfBitmap->GetPixelSize().height + 2),
+		    D2D1::BitmapProperties(srcSurfBitmap->GetPixelFormat()),
+		    &sourceBitmap);
+		D2D1_POINT_2U point = D2D1::Point2U(1, 1);
+		sourceBitmap->CopyFromBitmap(&point, srcSurfBitmap, NULL);
+	    } else {
+		sourceBitmap = srcSurf->surfaceBitmap;
+	    }
+
 	} else if (surfacePattern->surface->type == CAIRO_SURFACE_TYPE_IMAGE) {
 	    cairo_image_surface_t *srcSurf = 
 		reinterpret_cast<cairo_image_surface_t*>(surfacePattern->surface);
@ -2460,7 +2492,7 @@ _cairo_d2d_acquire_dest_image(void                    *abstract_surface,
    }
    *image_out = 
 	(cairo_image_surface_t*)_cairo_image_surface_create_for_data_with_content((unsigned char*)data.pData,
-										  CAIRO_CONTENT_COLOR_ALPHA,
+										  d2dsurf->base.content,
 										  size.width,
 										  size.height,
 										  data.RowPitch);
@ -2930,12 +2962,23 @@ _cairo_d2d_mask(void			*surface,

    cairo_int_status_t status;

-    _begin_draw_state(d2dsurf);
-    status = (cairo_int_status_t)_cairo_d2d_set_clip (d2dsurf, clip);
-
-    if (unlikely (status))
-	return status;
+    RefPtr<ID2D1RenderTarget> target_rt = d2dsurf->rt;
+#ifndef ALWAYS_MANUAL_COMPOSITE
+    if (op != CAIRO_OPERATOR_OVER) {
+#endif
+	target_rt = _cairo_d2d_get_temp_rt(d2dsurf, clip);
+	if (!target_rt) {
+	    return CAIRO_INT_STATUS_UNSUPPORTED;
+	}
+#ifndef ALWAYS_MANUAL_COMPOSITE
+    } else {
+	_begin_draw_state(d2dsurf);
+	status = (cairo_int_status_t)_cairo_d2d_set_clip (d2dsurf, clip);

+	if (unlikely(status))
+	    return status;
+    }
+#endif

    status = (cairo_int_status_t)_cairo_surface_mask_extents (&d2dsurf->base,
 		    op, source,
@ -2966,9 +3009,13 @@ _cairo_d2d_mask(void			*surface,
 	    (cairo_solid_pattern_t*)mask;
 	if (solidPattern->content = CAIRO_CONTENT_ALPHA) {
 	    brush->SetOpacity((FLOAT)solidPattern->color.alpha);
-	    d2dsurf->rt->FillRectangle(rect,
-				       brush);
+	    target_rt->FillRectangle(rect,
+				     brush);
 	    brush->SetOpacity(1.0);
+
+	    if (target_rt.get() != d2dsurf->rt.get()) {
+		return _cairo_d2d_blend_temp_surface(d2dsurf, op, target_rt, clip);
+	    }
 	    return CAIRO_INT_STATUS_SUCCESS;
 	}
    }
@ -2981,17 +3028,21 @@ _cairo_d2d_mask(void			*surface,
    if (!d2dsurf->maskLayer) {
 	d2dsurf->rt->CreateLayer(&d2dsurf->maskLayer);
    }
-    d2dsurf->rt->PushLayer(D2D1::LayerParameters(D2D1::InfiniteRect(),
-						 0,
-						 D2D1_ANTIALIAS_MODE_ALIASED,
-						 D2D1::IdentityMatrix(),
-						 1.0,
-						 opacityBrush),
-			   d2dsurf->maskLayer);
+    target_rt->PushLayer(D2D1::LayerParameters(D2D1::InfiniteRect(),
+					       0,
+					       D2D1_ANTIALIAS_MODE_ALIASED,
+					       D2D1::IdentityMatrix(),
+					       1.0,
+					       opacityBrush),
+			 d2dsurf->maskLayer);

-    d2dsurf->rt->FillRectangle(rect,
-			       brush);
-    d2dsurf->rt->PopLayer();
+    target_rt->FillRectangle(rect,
+			     brush);
+    target_rt->PopLayer();
+
+    if (target_rt.get() != d2dsurf->rt.get()) {
+	return _cairo_d2d_blend_temp_surface(d2dsurf, op, target_rt, clip);
+    }
    return CAIRO_INT_STATUS_SUCCESS;
 }

--- a/gfx/cairo/cairo/src/cairo-dwrite-font.cpp
+++ b/gfx/cairo/cairo/src/cairo-dwrite-font.cpp
@ -604,8 +604,6 @@ _cairo_dwrite_scaled_font_init_glyph_metrics(cairo_dwrite_scaled_font_t *scaled_
        extents.width > 0 && extents.height > 0) {
        extents.width += scaled_font->mat_inverse.xx * 2;
        extents.x_bearing -= scaled_font->mat_inverse.xx;
-        extents.height += scaled_font->mat_inverse.yy * 2;
-        extents.y_bearing -= scaled_font->mat_inverse.yy;
    }

    _cairo_scaled_glyph_set_metrics (scaled_glyph,
--- a/gfx/cairo/cairo/src/cairo-win32.h
+++ b/gfx/cairo/cairo/src/cairo-win32.h
@ -142,6 +142,9 @@ typedef struct _cairo_device cairo_device_t;
 cairo_device_t *
 cairo_d2d_create_device();

+cairo_device_t *
+cairo_d2d_create_device_from_d3d10device(struct ID3D10Device1 *device);
+
 /**
 * Releases a D2D device.
 *
--- a/gfx/layers/d3d9/DeviceManagerD3D9.cpp
+++ b/gfx/layers/d3d9/DeviceManagerD3D9.cpp
@ -182,6 +182,11 @@ DeviceManagerD3D9::DeviceManagerD3D9()
 {
 }

+DeviceManagerD3D9::~DeviceManagerD3D9()
+{
+  LayerManagerD3D9::OnDeviceManagerDestroy(this);
+}
+
 bool
 DeviceManagerD3D9::Init()
 {
--- a/gfx/layers/d3d9/DeviceManagerD3D9.h
+++ b/gfx/layers/d3d9/DeviceManagerD3D9.h
@ -106,9 +106,7 @@ class THEBES_API DeviceManagerD3D9
 public:
  DeviceManagerD3D9();

-  // We want the nsrefcnt return value. So we cannot use the inline refcnt macro
-  NS_IMPL_ADDREF(DeviceManagerD3D9)
-  NS_IMPL_RELEASE(DeviceManagerD3D9)
+  NS_INLINE_DECL_REFCOUNTING(DeviceManagerD3D9)

  bool Init();

@ -144,6 +142,8 @@ public:
 private:
  friend class SwapChainD3D9;

+  ~DeviceManagerD3D9();
+
  /**
   * This function verifies the device is ready for rendering, internally this
   * will test the cooperative level of the device and reset the device if
@ -192,9 +192,6 @@ private:
  /* If this device supports dynamic textures */
  bool mHasDynamicTextures;

-  nsAutoRefCnt mRefCnt;
-  NS_DECL_OWNINGTHREAD
-
  /**
   * Verifies all required device capabilities are present.
   */
--- a/gfx/layers/d3d9/LayerManagerD3D9.cpp
+++ b/gfx/layers/d3d9/LayerManagerD3D9.cpp
@ -63,9 +63,7 @@ LayerManagerD3D9::~LayerManagerD3D9()
  mSwapChain = nsnull;

  if (mDeviceManager) {
-    if (!mDeviceManager->Release()) {
-      mDeviceManager = nsnull;
-    }
+    mDeviceManager->Release();
  }
 }

--- a/gfx/layers/d3d9/LayerManagerD3D9.h
+++ b/gfx/layers/d3d9/LayerManagerD3D9.h
@ -130,6 +130,11 @@ public:
  IDirect3DDevice9 *device() const { return mDeviceManager->device(); }
  DeviceManagerD3D9 *deviceManager() const { return mDeviceManager; }

+  static void OnDeviceManagerDestroy(DeviceManagerD3D9 *aDeviceManager) {
+    if(aDeviceManager == mDeviceManager)
+      mDeviceManager = nsnull;
+  }
+
 private:
  /* Device manager instance */
  static DeviceManagerD3D9 *mDeviceManager;
--- a/gfx/layers/opengl/LayerManagerOGL.cpp
+++ b/gfx/layers/opengl/LayerManagerOGL.cpp
@ -501,7 +501,7 @@ LayerManagerOGL::Render()
  }

  nsIntRect rect;
-  mWidget->GetBounds(rect);
+  mWidget->GetClientBounds(rect);
  GLint width = rect.width;
  GLint height = rect.height;

--- a/gfx/thebes/GLContextProviderEGL.cpp
+++ b/gfx/thebes/GLContextProviderEGL.cpp
@ -437,7 +437,7 @@ public:
            }                                                           \
        } while(0)

-        printf_stderr("EGL Config: %d [0x%08x]", (int)cfg, (PRUint32)cfg);
+        printf_stderr("EGL Config: %d [%p]", (int)(intptr_t)cfg, cfg);

        ATTR(BUFFER_SIZE);
        ATTR(ALPHA_SIZE);
--- a/gfx/thebes/gfxBlur.cpp
+++ b/gfx/thebes/gfxBlur.cpp
@ -315,10 +315,17 @@ gfxAlphaBoxBlur::Paint(gfxContext* aDestinationCtx, const gfxPoint& offset)
    // no need to do all this if not blurring
    if (mBlurRadius.width != 0 || mBlurRadius.height != 0) {
        nsTArray<unsigned char> tempAlphaDataBuf;
-        if (!tempAlphaDataBuf.SetLength(mImageSurface->GetDataSize()))
-            return; // OOM
+        PRSize szB = mImageSurface->GetDataSize();
+        if (!tempAlphaDataBuf.SetLength(szB))
+           return; // OOM

        unsigned char* tmpData = tempAlphaDataBuf.Elements();
+        // .SetLength above doesn't initialise the new elements since
+        // they are unsigned chars and so have no default constructor.
+        // So we have to initialise them by hand.
+        // https://bugzilla.mozilla.org/show_bug.cgi?id=582668#c10
+        memset(tmpData, 0, szB);
+
        PRInt32 stride = mImageSurface->Stride();
        PRInt32 rows = mImageSurface->Height();

--- a/gfx/thebes/gfxWindowsPlatform.cpp
+++ b/gfx/thebes/gfxWindowsPlatform.cpp
@ -76,6 +76,8 @@
 #ifdef CAIRO_HAS_D2D_SURFACE
 #include "gfxD2DSurface.h"

+#include <d3d10_1.h>
+
 #include "nsIMemoryReporter.h"
 #include "nsMemory.h"

@ -136,6 +138,18 @@ typedef HRESULT (WINAPI*DWriteCreateFactoryFunc)(
 );
 #endif

+#ifdef CAIRO_HAS_D2D_SURFACE
+typedef HRESULT (WINAPI*D3D10CreateDevice1Func)(
+  IDXGIAdapter *pAdapter,
+  D3D10_DRIVER_TYPE DriverType,
+  HMODULE Software,
+  UINT Flags,
+  D3D10_FEATURE_LEVEL1 HardwareLevel,
+  UINT SDKVersion,
+  ID3D10Device1 **ppDevice
+);
+#endif
+
 static __inline void
 BuildKeyNameFromFontName(nsAString &aName)
 {
@ -167,11 +181,65 @@ gfxWindowsPlatform::gfxWindowsPlatform()
 #endif

    nsCOMPtr<nsIPrefBranch2> pref = do_GetService(NS_PREFSERVICE_CONTRACTID);
+    
+    OSVERSIONINFOA versionInfo;
+    versionInfo.dwOSVersionInfoSize = sizeof(OSVERSIONINFOA);
+    ::GetVersionExA(&versionInfo);
+    bool isVistaOrHigher = versionInfo.dwMajorVersion >= 6;

 #ifdef CAIRO_HAS_D2D_SURFACE
    NS_RegisterMemoryReporter(new D2DCacheReporter());
    mD2DDevice = NULL;
+
+    if (isVistaOrHigher && 0) {
+        // We need a DWriteFactory to work.
+        HMODULE d3d10module = LoadLibraryA("d3d10_1.dll");
+        D3D10CreateDevice1Func createD3DDevice = (D3D10CreateDevice1Func)
+            GetProcAddress(d3d10module, "D3D10CreateDevice1");
+        nsRefPtr<ID3D10Device1> device;
+
+        if (createD3DDevice) {
+            // We try 10.0 first even though we prefer 10.1, since we want to
+            // fail as fast as possible if 10.x isn't supported.
+            HRESULT hr = createD3DDevice(
+	        NULL, 
+	        D3D10_DRIVER_TYPE_HARDWARE,
+	        NULL,
+	        D3D10_CREATE_DEVICE_BGRA_SUPPORT |
+	        D3D10_CREATE_DEVICE_PREVENT_INTERNAL_THREADING_OPTIMIZATIONS,
+	        D3D10_FEATURE_LEVEL_10_0,
+	        D3D10_1_SDK_VERSION,
+	        getter_AddRefs(device));
+
+            if (SUCCEEDED(hr)) {
+                // We have 10.0, let's try 10.1.
+                // XXX - This adds an additional 10-20ms for people who are
+                // getting direct2d. We'd really like to do something more
+                // clever.
+                nsRefPtr<ID3D10Device1> device1;
+                hr = createD3DDevice(
+	            NULL, 
+	            D3D10_DRIVER_TYPE_HARDWARE,
+	            NULL,
+	            D3D10_CREATE_DEVICE_BGRA_SUPPORT |
+	            D3D10_CREATE_DEVICE_PREVENT_INTERNAL_THREADING_OPTIMIZATIONS,
+	            D3D10_FEATURE_LEVEL_10_1,
+	            D3D10_1_SDK_VERSION,
+	            getter_AddRefs(device1));
+
+                if (SUCCEEDED(hr)) {
+                    device = device1;
+                }
+
+                mD2DDevice = cairo_d2d_create_device_from_d3d10device(device);
+                if (mD2DDevice) {
+                    mRenderMode = RENDER_DIRECT2D;
+                }
+            }
+        }
+    }
 #endif
+
 #ifdef CAIRO_HAS_DWRITE_FONT
    nsresult rv;
    PRBool useDirectWrite = PR_FALSE;
@ -181,8 +249,10 @@ gfxWindowsPlatform::gfxWindowsPlatform()
    if (NS_FAILED(rv)) {
        useDirectWrite = PR_FALSE;
    }
-            
-    if (useDirectWrite) {
+
+    // Enable when it's preffed on -and- we're using Vista or higher. Or when
+    // we're going to use D2D.
+    if ((useDirectWrite && isVistaOrHigher) || mRenderMode == RENDER_DIRECT2D) {
        DWriteCreateFactoryFunc createDWriteFactory = (DWriteCreateFactoryFunc)
            GetProcAddress(LoadLibraryW(L"dwrite.dll"), "DWriteCreateFactory");

@ -206,6 +276,11 @@ gfxWindowsPlatform::gfxWindowsPlatform()
    PRInt32 rmode;
    if (NS_SUCCEEDED(pref->GetIntPref("mozilla.widget.render-mode", &rmode))) {
        if (rmode >= 0 && rmode < RENDER_MODE_MAX) {
+#ifdef CAIRO_HAS_DWRITE_FONT
+	    if (rmode != RENDER_DIRECT2D && !useDirectWrite) {
+		mDWriteFactory = nsnull;
+	    }
+#endif
 #ifndef CAIRO_HAS_DDRAW_SURFACE
            if (rmode == RENDER_DDRAW || rmode == RENDER_DDRAW_GL)
                rmode = RENDER_IMAGE_STRETCH24;
@ -214,9 +289,11 @@ gfxWindowsPlatform::gfxWindowsPlatform()
 #ifndef CAIRO_HAS_D2D_SURFACE
                return;
 #else
-		mD2DDevice = cairo_d2d_create_device();
                if (!mD2DDevice) {
-                    return;
+		    mD2DDevice = cairo_d2d_create_device();
+                    if (!mD2DDevice) {
+                        return;
+                    }
                }
 #ifdef CAIRO_HAS_DWRITE_FONT
                if (!GetDWriteFactory()) {
@ -555,4 +632,4 @@ gfxWindowsPlatform::FontsPrefsChanged(nsIPrefBranch *aPrefBranch, const char *aP
        }
        gfxTextRunWordCache::Flush();
    }
-}
+}
--- a/gfx/thebes/gfxWindowsPlatform.h
+++ b/gfx/thebes/gfxWindowsPlatform.h
@ -213,6 +213,9 @@ public:

 #ifdef CAIRO_HAS_DWRITE_FONT
    IDWriteFactory *GetDWriteFactory() { return mDWriteFactory; }
+    inline PRBool DWriteEnabled() { return !!mDWriteFactory; }
+#else
+    inline PRBool DWriteEnabled() { return PR_FALSE; }
 #endif
 #ifdef CAIRO_HAS_D2D_SURFACE
    cairo_device_t *GetD2DDevice() { return mD2DDevice; }
--- a/ipc/app/MozillaRuntimeMain.cpp
+++ b/ipc/app/MozillaRuntimeMain.cpp
@ -54,13 +54,13 @@
 int
 main(int argc, char* argv[])
 {
-#if defined(MOZ_CRASHREPORTER) && !defined(XP_MACOSX)
+#if defined(MOZ_CRASHREPORTER)
    if (argc < 2)
        return 1;
    const char* const crashReporterArg = argv[--argc];

-#  if defined(XP_WIN)
-    // on windows, |crashReporterArg| is the named pipe on which the
+#  if defined(XP_WIN) || defined(XP_MACOSX)
+    // on windows and mac, |crashReporterArg| is the named pipe on which the
    // server is listening for requests, or "-" if crash reporting is
    // disabled.
    if (0 != strcmp("-", crashReporterArg)
--- a/ipc/chromium/src/base/path_service.h
+++ b/ipc/chromium/src/base/path_service.h
@ -62,7 +62,7 @@ class PathService {
  // Otherwise, true is returned.
  //
  // WARNING: This function could be called on any thread from which the
-  // PathService is used, so a the ProviderFunc MUST BE THREADSAFE.
+  // PathService is used, so the ProviderFunc MUST BE THREADSAFE.
  //
  typedef bool (*ProviderFunc)(int, FilePath*);

--- a/ipc/chromium/src/chrome/common/win_util.cc
+++ b/ipc/chromium/src/chrome/common/win_util.cc
@ -658,7 +658,7 @@ bool IsNumPadDigit(int key_code, bool extended_key) {
    return true;

  // Check for num pad keys without NumLock.
-  // Note: there is no easy way to know if a the key that was pressed comes from
+  // Note: there is no easy way to know if a key that was pressed comes from
  //       the num pad or the rest of the keyboard.  Investigating how
  //       TranslateMessage() generates the WM_KEYCHAR from an
  //       ALT + <NumPad sequences> it appears it looks at the extended key flag
--- a/ipc/glue/GeckoChildProcessHost.cpp
+++ b/ipc/glue/GeckoChildProcessHost.cpp
@ -318,9 +318,7 @@ GeckoChildProcessHost::PerformAsyncLaunch(std::vector<std::string> aExtraOpts)
    childArgv.push_back("false");
  }
 #  elif defined(XP_MACOSX)
-  // Call the stub for initialization side effects.  Eventually this
-  // code will be unified with that above.
-  CrashReporter::CreateNotificationPipeForChild();
+  childArgv.push_back(CrashReporter::GetChildNotificationPipe());
 #  endif  // OS_LINUX
 #endif

--- a/js/src/Makefile.in
+++ b/js/src/Makefile.in
@ -831,12 +831,12 @@ endif
 # BEGIN kludges for the Nitro assembler
 #

-INCLUDES +=	-I$(srcdir)/assembler -I$(srcdir)/yarr
-#
 # Needed to "configure" it correctly.  Unfortunately these
 # flags wind up being applied to all code in js/src, not just
 # the code in js/src/assembler.
-CXXFLAGS += -DENABLE_ASSEMBLER=1 -DUSE_SYSTEM_MALLOC=1 -DENABLE_JIT=1
+CXXFLAGS += -DUSE_SYSTEM_MALLOC=1 -DENABLE_ASSEMBLER=1 -DENABLE_JIT=1
+
+INCLUDES +=	-I$(srcdir)/assembler -I$(srcdir)/yarr

 #
 # END kludges for the Nitro assembler
--- a/js/src/assembler/assembler/ARMAssembler.cpp
+++ b/js/src/assembler/assembler/ARMAssembler.cpp
@ -262,29 +262,54 @@ ARMWord ARMAssembler::encodeComplexImm(ARMWord imm, int dest)

 // Memory load/store helpers

-void ARMAssembler::dataTransfer32(bool isLoad, RegisterID srcDst, RegisterID base, int32_t offset, bool bytes)
+void ARMAssembler::dataTransfer32(bool isLoad, RegisterID srcDst, RegisterID base, int32_t offset)
 {
-    ARMWord transferFlag = bytes ? DT_BYTE : 0;
    if (offset >= 0) {
        if (offset <= 0xfff)
-            dtr_u(isLoad, srcDst, base, offset | transferFlag);
+            dtr_u(isLoad, srcDst, base, offset);
        else if (offset <= 0xfffff) {
            add_r(ARMRegisters::S0, base, OP2_IMM | (offset >> 12) | (10 << 8));
-            dtr_u(isLoad, srcDst, ARMRegisters::S0, (offset & 0xfff) | transferFlag);
+            dtr_u(isLoad, srcDst, ARMRegisters::S0, (offset & 0xfff));
        } else {
            ARMWord reg = getImm(offset, ARMRegisters::S0);
-            dtr_ur(isLoad, srcDst, base, reg | transferFlag);
+            dtr_ur(isLoad, srcDst, base, reg);
        }
    } else {
        offset = -offset;
        if (offset <= 0xfff)
-            dtr_d(isLoad, srcDst, base, offset | transferFlag);
+            dtr_d(isLoad, srcDst, base, offset);
        else if (offset <= 0xfffff) {
            sub_r(ARMRegisters::S0, base, OP2_IMM | (offset >> 12) | (10 << 8));
-            dtr_d(isLoad, srcDst, ARMRegisters::S0, (offset & 0xfff) | transferFlag);
+            dtr_d(isLoad, srcDst, ARMRegisters::S0, (offset & 0xfff));
        } else {
            ARMWord reg = getImm(offset, ARMRegisters::S0);
-            dtr_dr(isLoad, srcDst, base, reg | transferFlag);
+            dtr_dr(isLoad, srcDst, base, reg);
+        }
+    }
+}
+
+void ARMAssembler::dataTransfer8(bool isLoad, RegisterID srcDst, RegisterID base, int32_t offset)
+{
+    if (offset >= 0) {
+        if (offset <= 0xfff)
+            dtrb_u(isLoad, srcDst, base, offset);
+        else if (offset <= 0xfffff) {
+            add_r(ARMRegisters::S0, base, OP2_IMM | (offset >> 12) | (10 << 8));
+            dtrb_u(isLoad, srcDst, ARMRegisters::S0, (offset & 0xfff));
+        } else {
+            ARMWord reg = getImm(offset, ARMRegisters::S0);
+            dtrb_ur(isLoad, srcDst, base, reg);
+        }
+    } else {
+        offset = -offset;
+        if (offset <= 0xfff)
+            dtrb_d(isLoad, srcDst, base, offset);
+        else if (offset <= 0xfffff) {
+            sub_r(ARMRegisters::S0, base, OP2_IMM | (offset >> 12) | (10 << 8));
+            dtrb_d(isLoad, srcDst, ARMRegisters::S0, (offset & 0xfff));
+        } else {
+            ARMWord reg = getImm(offset, ARMRegisters::S0);
+            dtrb_dr(isLoad, srcDst, base, reg);
        }
    }
 }
--- a/js/src/assembler/assembler/ARMAssembler.h
+++ b/js/src/assembler/assembler/ARMAssembler.h
@ -643,6 +643,50 @@ namespace JSC {
            emitInst(static_cast<ARMWord>(cc) | DTR | (isLoad ? DT_LOAD : 0) | OP2_OFSREG, rd, rb, rm);
        }

+        // Data transfers like this:
+        //  LDRB rd, [rb, +offset]
+        //  STRB rd, [rb, +offset]
+        void dtrb_u(bool isLoad, int rd, int rb, ARMWord offset, Condition cc = AL)
+        {
+            char const * mnemonic = (isLoad) ? ("ldrb") : ("strb");
+            js::JaegerSpew(js::JSpew_Insns,
+                    IPFX   "%-15s %s, [%s, #+%u]\n", MAYBE_PAD, mnemonic, nameGpReg(rd), nameGpReg(rb), offset);
+            emitInst(static_cast<ARMWord>(cc) | DTR | DT_BYTE | (isLoad ? DT_LOAD : 0) | DT_UP, rd, rb, offset);
+        }
+
+        // Data transfers like this:
+        //  LDRB rd, [rb, +rm]
+        //  STRB rd, [rb, +rm]
+        void dtrb_ur(bool isLoad, int rd, int rb, int rm, Condition cc = AL)
+        {
+            char const * mnemonic = (isLoad) ? ("ldrb") : ("strb");
+            js::JaegerSpew(js::JSpew_Insns,
+                    IPFX   "%-15s %s, [%s, +%s]\n", MAYBE_PAD, mnemonic, nameGpReg(rd), nameGpReg(rb), nameGpReg(rm));
+            emitInst(static_cast<ARMWord>(cc) | DTR | DT_BYTE | (isLoad ? DT_LOAD : 0) | DT_UP | OP2_OFSREG, rd, rb, rm);
+        }
+
+        // Data transfers like this:
+        //  LDRB rd, [rb, -offset]
+        //  STRB rd, [rb, -offset]
+        void dtrb_d(bool isLoad, int rd, int rb, ARMWord offset, Condition cc = AL)
+        {
+            char const * mnemonic = (isLoad) ? ("ldrb") : ("strb");
+            js::JaegerSpew(js::JSpew_Insns,
+                    IPFX   "%-15s %s, [%s, #-%u]\n", MAYBE_PAD, mnemonic, nameGpReg(rd), nameGpReg(rb), offset);
+            emitInst(static_cast<ARMWord>(cc) | DTR | DT_BYTE | (isLoad ? DT_LOAD : 0), rd, rb, offset);
+        }
+
+        // Data transfers like this:
+        //  LDRB rd, [rb, -rm]
+        //  STRB rd, [rb, -rm]
+        void dtrb_dr(bool isLoad, int rd, int rb, int rm, Condition cc = AL)
+        {
+            char const * mnemonic = (isLoad) ? ("ldrb") : ("strb");
+            js::JaegerSpew(js::JSpew_Insns,
+                    IPFX   "%-15s %s, [%s, -%s]\n", MAYBE_PAD, mnemonic, nameGpReg(rd), nameGpReg(rb), nameGpReg(rm));
+            emitInst(static_cast<ARMWord>(cc) | DTR | DT_BYTE | (isLoad ? DT_LOAD : 0) | OP2_OFSREG, rd, rb, rm);
+        }
+
        void ldrh_r(int rd, int rb, int rm, Condition cc = AL)
        {
            js::JaegerSpew(js::JSpew_Insns,
@ -1105,7 +1149,8 @@ namespace JSC {

        // Memory load/store helpers

-        void dataTransfer32(bool isLoad, RegisterID srcDst, RegisterID base, int32_t offset, bool bytes = false);
+        void dataTransfer32(bool isLoad, RegisterID srcDst, RegisterID base, int32_t offset);
+        void dataTransfer8(bool isLoad, RegisterID srcDst, RegisterID base, int32_t offset);
        void baseIndexTransfer32(bool isLoad, RegisterID srcDst, RegisterID base, RegisterID index, int scale, int32_t offset);
        void doubleTransfer(bool isLoad, FPRegisterID srcDst, RegisterID base, int32_t offset);

--- a/js/src/assembler/assembler/MacroAssemblerARM.cpp
+++ b/js/src/assembler/assembler/MacroAssemblerARM.cpp
@ -30,7 +30,7 @@

 #include "MacroAssemblerARM.h"

-#if WTF_PLATFORM_LINUX
+#if WTF_PLATFORM_LINUX || WTF_PLATFORM_ANDROID
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <fcntl.h>
--- a/js/src/assembler/assembler/MacroAssemblerARM.h
+++ b/js/src/assembler/assembler/MacroAssemblerARM.h
@ -249,7 +249,7 @@ public:

    void load8(ImplicitAddress address, RegisterID dest)
    {
-        m_assembler.dataTransfer32(true, dest, address.base, address.offset, true);
+        m_assembler.dataTransfer8(true, dest, address.base, address.offset);
    }

    void load32(ImplicitAddress address, RegisterID dest)
--- a/js/src/assembler/jit/ExecutableAllocator.h
+++ b/js/src/assembler/jit/ExecutableAllocator.h
@ -28,11 +28,12 @@

 #include <stddef.h> // for ptrdiff_t
 #include <limits>
-#include <wtf/Assertions.h>
+#include "assembler/wtf/Assertions.h"

 #include "jsapi.h"
 #include "jsprvtd.h"
 #include "jsvector.h"
+#include "jslock.h"

 #if WTF_PLATFORM_IPHONE
 #include <libkern/OSCacheControl.h>
@ -80,7 +81,7 @@ inline size_t roundUpAllocationSize(size_t request, size_t granularity)
    // Round up to next page boundary
    size_t size = request + (granularity - 1);
    size = size & ~(granularity - 1);
-    ASSERT(size >= request);
+    JS_ASSERT(size >= request);
    return size;
 }

@ -104,16 +105,16 @@ private:
    typedef js::Vector<Allocation, 2 ,js::SystemAllocPolicy > AllocationList;

    // Reference count for automatic reclamation.
-    unsigned m_refCount;
+    jsrefcount m_refCount;

 public:
      // It should be impossible for us to roll over, because only small
      // pools have multiple holders, and they have one holder per chunk
      // of generated code, and they only hold 16KB or so of code.
-      void addRef() { ++m_refCount; }
+      void addRef() { JS_ATOMIC_INCREMENT(&m_refCount); }
      void release() { 
-	  ASSERT(m_refCount != 0);
-	  if (--m_refCount == 0) 
+	  JS_ASSERT(m_refCount != 0);
+	  if (JS_ATOMIC_DECREMENT(&m_refCount) == 0) 
 	      delete this; 
      }

@ -125,7 +126,7 @@ public:

    void* alloc(size_t n)
    {
-        ASSERT(m_freePtr <= m_end);
+        JS_ASSERT(m_freePtr <= m_end);

        // Round 'n' up to a multiple of word size; if all allocations are of
        // word sized quantities, then all subsequent allocations will be aligned.
@ -285,7 +286,7 @@ public:
    }
 #elif WTF_CPU_ARM_TRADITIONAL && WTF_PLATFORM_LINUX && WTF_COMPILER_RVCT
    static __asm void cacheFlush(void* code, size_t size);
-#elif WTF_CPU_ARM_TRADITIONAL && WTF_PLATFORM_LINUX && WTF_COMPILER_GCC
+#elif WTF_CPU_ARM_TRADITIONAL && (WTF_PLATFORM_LINUX || WTF_PLATFORM_ANDROID) && WTF_COMPILER_GCC
    static void cacheFlush(void* code, size_t size)
    {
        asm volatile (
@ -339,7 +340,7 @@ inline void* ExecutablePool::poolAllocate(size_t n)
    if (!result.pages)
        CRASH(); // Failed to allocate
    
-    ASSERT(m_end >= m_freePtr);
+    JS_ASSERT(m_end >= m_freePtr);
    if ((allocSize - n) > static_cast<size_t>(m_end - m_freePtr)) {
        // Replace allocation pool
        m_freePtr = result.pages + n;
--- a/Show More
+++ b/Show More