Merge m-c to birch.

accessible/src/base/DocManager.cpp

@@ -117,10 +117,10 @@ DocManager::Shutdown()
 ////////////////////////////////////////////////////////////////////////////////
 // nsISupports
 
-NS_IMPL_THREADSAFE_ISUPPORTS3(DocManager,
+NS_IMPL_ISUPPORTS3(DocManager,
-                              nsIWebProgressListener,
+                   nsIWebProgressListener,
-                              nsIDOMEventListener,
+                   nsIDOMEventListener,
-                              nsISupportsWeakReference)
+                   nsISupportsWeakReference)
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsIWebProgressListener

accessible/src/base/DocManager.h

@@ -29,7 +29,7 @@ class DocManager : public nsIWebProgressListener,
 public:
   virtual ~DocManager() { }
 
-  NS_DECL_ISUPPORTS
+  NS_DECL_THREADSAFE_ISUPPORTS
   NS_DECL_NSIWEBPROGRESSLISTENER
   NS_DECL_NSIDOMEVENTLISTENER
 

accessible/src/base/nsTextEquivUtils.cpp

@@ -55,19 +55,6 @@ nsTextEquivUtils::GetNameFromSubtree(Accessible* aAccessible,
   return NS_OK;
 }
 
-void
-nsTextEquivUtils::GetTextEquivFromSubtree(Accessible* aAccessible,
-                                          nsString& aTextEquiv)
-{
-  aTextEquiv.Truncate();
-
-  uint32_t nameRule = GetRoleRule(aAccessible->Role());
-  if (nameRule & eNameFromSubtreeIfReqRule) {
-    AppendFromAccessibleChildren(aAccessible, &aTextEquiv);
-    aTextEquiv.CompressWhitespace();
-  }
-}
-
 nsresult
 nsTextEquivUtils::GetTextEquivFromIDRefs(Accessible* aAccessible,
                                          nsIAtom *aIDRefsAttr,

accessible/src/base/nsTextEquivUtils.h

@@ -55,11 +55,16 @@ public:
 
   /**
    * Calculates text equivalent from the subtree. Similar to GetNameFromSubtree.
-   * The difference it returns not empty result for things like HTML p, i.e.
+   * However it returns not empty result for things like HTML p.
-   * if the role has eNameFromSubtreeIfReq rule.
    */
   static void GetTextEquivFromSubtree(Accessible* aAccessible,
-                                      nsString& aTextEquiv);
+                                      nsString& aTextEquiv)
+  {
+    aTextEquiv.Truncate();
+
+    AppendFromAccessibleChildren(aAccessible, &aTextEquiv);
+    aTextEquiv.CompressWhitespace();
+  }
 
   /**
    * Calculates text equivalent for the given accessible from its IDRefs

accessible/src/generic/Accessible.cpp

@@ -1681,6 +1681,12 @@ Accessible::Value(nsString& aValue)
     return;
   }
 
+  // Value of textbox is a textified subtree.
+  if (mRoleMapEntry->Is(nsGkAtoms::textbox)) {
+    nsTextEquivUtils::GetTextEquivFromSubtree(this, aValue);
+    return;
+  }
+
   // Value of combobox is a text of current or selected item.
   if (mRoleMapEntry->Is(nsGkAtoms::combobox)) {
     Accessible* option = CurrentItem();

accessible/tests/mochitest/value/test_general.html

@@ -50,6 +50,11 @@
       testValue("aria_main_link", href);
       testValue("aria_navigation_link", href);
 
+      //////////////////////////////////////////////////////////////////////////
+      // ARIA textboxes
+
+      testValue("aria_textbox1", "helo");
+
       //////////////////////////////////////////////////////////////////////////
       // ARIA comboboxes
 
@@ -83,12 +88,17 @@
   <a target="_blank"
      href="https://bugzilla.mozilla.org/show_bug.cgi?id=494807"
      title="Do not expose a11y info specific to hyperlinks when role is overridden using ARIA">
-    Mozilla Bug 494807
+    Bug 494807
   </a>
   <a target="_blank"
      href="https://bugzilla.mozilla.org/show_bug.cgi?id=819273"
-     title=" ARIA combobox should have accessible value">
+     title="ARIA combobox should have accessible value">
-    Mozilla Bug 819273
+    Bug 819273
+  </a>
+  <a target="_blank"
+     href="https://bugzilla.mozilla.org/show_bug.cgi?id=887250"
+     title="ARIA textbox role doesn't expose value">
+    Bug 887250
   </a>
   <p id="display"></p>
   <div id="content" style="display: none">
@@ -108,6 +118,8 @@
   <!-- strange edge case: please don't do this in the wild -->
   <a id="aria_link_link" role="link" href="foo">link</a>
 
+  <div id="aria_textbox1" role="textbox">helo</div>
+
   <div id="aria_combobox1" role="combobox"
        aria-owns="aria_combobox1_owned_listbox"
        aria-activedescendant="aria_combobox1_selected_option">
@@ -142,5 +154,6 @@
     <option id="cb2_item1">item1</option>
     <option id="cb2_item2" selected="true">item2</option>
   </select>
+
 </body>
 </html>

browser/base/content/baseMenuOverlay.xul

@@ -52,6 +52,11 @@
 #else
                   />
 #endif
+        <menuitem id="menu_keyboardShortcuts"
+                  oncommand="openHelpLink('keyboard-shortcuts')"
+                  onclick="checkForMiddleClick(this, event);"
+                  label="&helpKeyboardShortcuts.label;"
+                  accesskey="&helpKeyboardShortcuts.accesskey;"/>
 #ifdef MOZ_SERVICES_HEALTHREPORT
         <menuitem id="healthReport"
                   label="&healthReport.label;"

browser/base/content/browser-appmenu.inc

@@ -371,6 +371,10 @@
                       label="&appMenuGettingStarted.label;"
                       oncommand="gBrowser.loadOneTab('https://www.mozilla.org/firefox/central/', {inBackground: false});"
                       onclick="checkForMiddleClick(this, event);"/>
+            <menuitem id="appmenu_keyboardShortcuts"
+                      label="&helpKeyboardShortcuts.label;"
+                      oncommand="openHelpLink('keyboard-shortcuts')"
+                      onclick="checkForMiddleClick(this, event);"/>
 #ifdef MOZ_SERVICES_HEALTHREPORT
             <menuitem id="appmenu_healthReport"
                       label="&healthReport.label;"

browser/base/content/browser-menubar.inc

@@ -488,14 +488,6 @@
                          onpopupshowing="gSyncUI.updateUI();"
 #endif
                          >
-              <menuitem id="menu_search"
-                        class="show-only-for-keyboard"
-                        label="&search.label;"
-                        accesskey="&search.accesskey;"
-                        key="key_search"
-                        command="Tools:Search"/>
-              <menuseparator id="browserToolsSeparator"
-                             class="show-only-for-keyboard"/>
               <menuitem id="menu_openDownloads"
                         label="&downloads.label;"
                         accesskey="&downloads.accesskey;"

browser/base/content/utilityOverlay.js

@@ -18,7 +18,8 @@ XPCOMUtils.defineLazyGetter(this, "BROWSER_NEW_TAB_URL", function () {
           !PrivateBrowsingUtils.permanentPrivateBrowsing)
         return "about:privatebrowsing";
     }
-    return Services.prefs.getCharPref(PREF) || "about:blank";
+    let url = Services.prefs.getComplexValue(PREF, Ci.nsISupportsString).data;
+    return url || "about:blank";
   }
 
   function update() {

browser/locales/en-US/chrome/browser/baseMenuOverlay.dtd

@@ -19,6 +19,10 @@
 <!ENTITY productHelp.label        "&brandShortName; Help">
 <!ENTITY productHelp.accesskey    "H">
 <!ENTITY helpMac.commandkey       "?">
+
+<!ENTITY helpKeyboardShortcuts.label     "Keyboard Shortcuts">
+<!ENTITY helpKeyboardShortcuts.accesskey "K">
+
 <!ENTITY helpSafeMode.label       "Restart with Add-ons Disabled…">
 <!ENTITY helpSafeMode.accesskey   "R">
 

browser/locales/en-US/chrome/browser/browser.dtd

@@ -194,8 +194,7 @@ These should match what Safari and other Apple applications use on OS X Lion. --
 
 <!ENTITY keywordfield.label           "Add a Keyword for this Search…">
 <!ENTITY keywordfield.accesskey       "K">
-<!ENTITY search.label                 "Web Search">
+
-<!ENTITY search.accesskey             "S">
 <!ENTITY downloads.label              "Downloads">
 <!ENTITY downloads.tooltip            "Display the progress of ongoing downloads">
 <!ENTITY downloads.accesskey          "D">

caps/src/nsNullPrincipal.cpp

@@ -22,6 +22,7 @@
 #include "nsError.h"
 #include "nsIScriptSecurityManager.h"
 #include "nsScriptSecurityManager.h"
+#include "pratom.h"
 
 using namespace mozilla;
 

caps/src/nsNullPrincipalURI.cpp

@@ -33,8 +33,8 @@ nsNullPrincipalURI::nsNullPrincipalURI(const nsCString &aSpec)
 static NS_DEFINE_CID(kNullPrincipalURIImplementationCID,
                      NS_NULLPRINCIPALURI_IMPLEMENTATION_CID);
 
-NS_IMPL_THREADSAFE_ADDREF(nsNullPrincipalURI)
+NS_IMPL_ADDREF(nsNullPrincipalURI)
-NS_IMPL_THREADSAFE_RELEASE(nsNullPrincipalURI)
+NS_IMPL_RELEASE(nsNullPrincipalURI)
 
 NS_INTERFACE_MAP_BEGIN(nsNullPrincipalURI)
   NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIURI)

caps/src/nsNullPrincipalURI.h

@@ -27,7 +27,7 @@ class nsNullPrincipalURI MOZ_FINAL : public nsIURI
                                    , public nsISizeOf
 {
 public:
-  NS_DECL_ISUPPORTS
+  NS_DECL_THREADSAFE_ISUPPORTS
   NS_DECL_NSIURI
 
   // nsISizeOf

caps/src/nsPrincipal.cpp

@@ -10,6 +10,7 @@
 #include "nsString.h"
 #include "nsReadableUtils.h"
 #include "plstr.h"
+#include "pratom.h"
 #include "nsCRT.h"
 #include "nsIURI.h"
 #include "nsIFileURL.h"

caps/src/nsSystemPrincipal.cpp

@@ -17,6 +17,7 @@
 #include "nsString.h"
 #include "nsIClassInfoImpl.h"
 #include "nsIScriptSecurityManager.h"
+#include "pratom.h"
 
 NS_IMPL_CLASSINFO(nsSystemPrincipal, nullptr,
                   nsIClassInfo::SINGLETON | nsIClassInfo::MAIN_THREAD_ONLY,

chrome/src/nsChromeProtocolHandler.cpp

@@ -39,9 +39,9 @@
 
 ////////////////////////////////////////////////////////////////////////////////
 
-NS_IMPL_THREADSAFE_ISUPPORTS2(nsChromeProtocolHandler,
+NS_IMPL_ISUPPORTS2(nsChromeProtocolHandler,
-                              nsIProtocolHandler,
+                   nsIProtocolHandler,
-                              nsISupportsWeakReference)
+                   nsISupportsWeakReference)
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsIProtocolHandler methods:

chrome/src/nsChromeProtocolHandler.h

@@ -22,7 +22,7 @@ class nsChromeProtocolHandler MOZ_FINAL : public nsIProtocolHandler,
                                           public nsSupportsWeakReference
 {
 public:
-    NS_DECL_ISUPPORTS
+    NS_DECL_THREADSAFE_ISUPPORTS
 
     // nsIProtocolHandler methods:
     NS_DECL_NSIPROTOCOLHANDLER

config/config.mk

@@ -240,6 +240,9 @@ endif
 ifdef MODULE_NAME
 $(error MODULE_NAME is $(MODULE_NAME) but MODULE_NAME and LIBXUL_LIBRARY are not compatible)
 endif
+ifdef FORCE_STATIC_LIB
+$(error Makefile sets FORCE_STATIC_LIB which was already implied by LIBXUL_LIBRARY)
+endif
 FORCE_STATIC_LIB=1
 ifneq ($(SHORT_LIBNAME),)
 $(error SHORT_LIBNAME is $(SHORT_LIBNAME) but SHORT_LIBNAME is not compatable with LIBXUL_LIBRARY)

content/base/public/Element.h

@@ -38,7 +38,6 @@
 #include "nsEvent.h"
 #include "nsAttrValue.h"
 #include "mozilla/dom/BindingDeclarations.h"
-#include "nsIHTMLCollection.h"
 #include "Units.h"
 
 class nsIDOMEventListener;
@@ -600,36 +599,6 @@ public:
                            ErrorResult& aError);
   already_AddRefed<nsIHTMLCollection>
     GetElementsByClassName(const nsAString& aClassNames);
-  Element* GetFirstElementChild() const;
-  Element* GetLastElementChild() const;
-  Element* GetPreviousElementSibling() const
-  {
-    nsIContent* previousSibling = GetPreviousSibling();
-    while (previousSibling) {
-      if (previousSibling->IsElement()) {
-        return previousSibling->AsElement();
-      }
-      previousSibling = previousSibling->GetPreviousSibling();
-    }
-
-    return nullptr;
-  }
-  Element* GetNextElementSibling() const
-  {
-    nsIContent* nextSibling = GetNextSibling();
-    while (nextSibling) {
-      if (nextSibling->IsElement()) {
-        return nextSibling->AsElement();
-      }
-      nextSibling = nextSibling->GetNextSibling();
-    }
-
-    return nullptr;
-  }
-  uint32_t ChildElementCount()
-  {
-    return Children()->Length();
-  }
   bool MozMatchesSelector(const nsAString& aSelector,
                           ErrorResult& aError);
   void SetCapture(bool aRetargetToElement)

content/base/public/FragmentOrElement.h

@@ -23,6 +23,7 @@
 #include "nsINodeList.h"                  // base class
 #include "nsIWeakReference.h"             // base class
 #include "nsNodeUtils.h"                  // class member nsNodeUtils::CloneNodeImpl
+#include "nsIHTMLCollection.h"
 
 class ContentUnbinder;
 class nsContentList;
@@ -32,7 +33,6 @@ class nsIControllers;
 class nsICSSDeclaration;
 class nsIDocument;
 class nsDOMStringMap;
-class nsIHTMLCollection;
 class nsINodeInfo;
 class nsIURI;
 
@@ -229,6 +229,10 @@ public:
   NS_IMETHOD WalkContentStyleRules(nsRuleWalker* aRuleWalker) MOZ_OVERRIDE;
 
   nsIHTMLCollection* Children();
+  uint32_t ChildElementCount()
+  {
+    return Children()->Length();
+  }
 
 public:
   /**

content/base/public/nsDOMFile.h

@@ -180,7 +180,7 @@ public:
   : nsDOMFileBase(aContentType, aStart, aLength)
   { }
 
-  NS_DECL_ISUPPORTS
+  NS_DECL_THREADSAFE_ISUPPORTS
 };
 
 class nsDOMFileCC : public nsDOMFileBase

content/base/public/nsIDocument.h

@@ -53,6 +53,7 @@ class nsIDOMElement;
 class nsIDOMNodeList;
 class nsIDOMXPathExpression;
 class nsIDOMXPathNSResolver;
+class nsIHTMLCollection;
 class nsILayoutHistoryState;
 class nsIObjectLoadingContent;
 class nsIObserver;
@@ -2120,6 +2121,10 @@ public:
 
   void ObsoleteSheet(const nsAString& aSheetURI, mozilla::ErrorResult& rv);
 
+  // ParentNode
+  nsIHTMLCollection* Children();
+  uint32_t ChildElementCount();
+
   virtual nsHTMLDocument* AsHTMLDocument() { return nullptr; }
 
   virtual JSObject* WrapObject(JSContext *aCx,
@@ -2211,6 +2216,9 @@ protected:
   nsPropertyTable mPropertyTable;
   nsTArray<nsAutoPtr<nsPropertyTable> > mExtraPropertyTables;
 
+  // Our cached .children collection
+  nsCOMPtr<nsIHTMLCollection> mChildrenCollection;
+
   // Compatibility mode
   nsCompatibility mCompatMode;
 

content/base/public/nsINode.h

@@ -1590,11 +1590,18 @@ public:
     return rv.ErrorCode();
   }
 
+  // ChildNode methods
+  mozilla::dom::Element* GetPreviousElementSibling() const;
+  mozilla::dom::Element* GetNextElementSibling() const;
   /**
    * Remove this node from its parent, if any.
    */
   void Remove();
 
+  // ParentNode methods
+  mozilla::dom::Element* GetFirstElementChild() const;
+  mozilla::dom::Element* GetLastElementChild() const;
+
 protected:
 
   // Override this function to create a custom slots class.

content/base/src/Element.cpp

@@ -416,34 +416,6 @@ Element::WrapObject(JSContext *aCx, JS::Handle<JSObject*> aScope)
   return obj;
 }
 
-Element*
-Element::GetFirstElementChild() const
-{
-  uint32_t i, count = mAttrsAndChildren.ChildCount();
-  for (i = 0; i < count; ++i) {
-    nsIContent* child = mAttrsAndChildren.ChildAt(i);
-    if (child->IsElement()) {
-      return child->AsElement();
-    }
-  }
-  
-  return nullptr;
-}
-
-Element*
-Element::GetLastElementChild() const
-{
-  uint32_t i = mAttrsAndChildren.ChildCount();
-  while (i > 0) {
-    nsIContent* child = mAttrsAndChildren.ChildAt(--i);
-    if (child->IsElement()) {
-      return child->AsElement();
-    }
-  }
-  
-  return nullptr;
-}
-
 nsDOMTokenList*
 Element::GetClassList()
 {

content/base/src/FragmentOrElement.cpp

@@ -339,10 +339,10 @@ GetJSObjectChild(nsWrapperCache* aCache)
 }
 
 static bool
-NeedsScriptTraverse(nsWrapperCache* aCache)
+NeedsScriptTraverse(nsINode* aNode)
 {
-  JSObject* o = GetJSObjectChild(aCache);
+  return aNode->PreservingWrapper() && aNode->GetWrapperPreserveColor() &&
-  return o && xpc_IsGrayGCThing(o);
+         !aNode->IsBlackAndDoesNotNeedTracing(aNode);
 }
 
 //----------------------------------------------------------------------
@@ -358,11 +358,11 @@ NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE_0(nsChildContentList)
 // nsChildContentList only ever has a single child, its wrapper, so if
 // the wrapper is black, the list can't be part of a garbage cycle.
 NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_BEGIN(nsChildContentList)
-  return !NeedsScriptTraverse(tmp);
+  return tmp->IsBlack();
 NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_END
 
 NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_IN_CC_BEGIN(nsChildContentList)
-  return !NeedsScriptTraverse(tmp);
+  return tmp->IsBlackAndDoesNotNeedTracing(tmp);
 NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_IN_CC_END
 
 // CanSkipThis returns false to avoid problems with incomplete unlinking.

content/base/src/nsContentUtils.cpp

@@ -1650,6 +1650,7 @@ nsContentUtils::TraceSafeJSContext(JSTracer* aTrc)
     return;
   }
   if (JSObject* global = js::GetDefaultGlobalForContext(cx)) {
+    JS::AssertGCThingMustBeTenured(global);
     JS_CallObjectTracer(aTrc, &global, "safe context");
     MOZ_ASSERT(global == js::GetDefaultGlobalForContext(cx));
   }

content/base/src/nsDOMFile.cpp

@@ -56,7 +56,7 @@ public:
                          uint32_t aLength,
                          nsIInputStream** _retval);
 
-  NS_DECL_ISUPPORTS
+  NS_DECL_THREADSAFE_ISUPPORTS
 
   // These are mandatory.
   NS_FORWARD_NSIINPUTSTREAM(mStream->)
@@ -82,8 +82,8 @@ private:
   nsCOMPtr<nsIIPCSerializableInputStream> mSerializableInputStream;
 };
 
-NS_IMPL_THREADSAFE_ADDREF(DataOwnerAdapter)
+NS_IMPL_ADDREF(DataOwnerAdapter)
-NS_IMPL_THREADSAFE_RELEASE(DataOwnerAdapter)
+NS_IMPL_RELEASE(DataOwnerAdapter)
 
 NS_INTERFACE_MAP_BEGIN(DataOwnerAdapter)
   NS_INTERFACE_MAP_ENTRY(nsIInputStream)
@@ -445,8 +445,8 @@ NS_INTERFACE_MAP_BEGIN(nsDOMFile)
 NS_INTERFACE_MAP_END
 
 // Threadsafe when GetMutable() == false
-NS_IMPL_THREADSAFE_ADDREF(nsDOMFile)
+NS_IMPL_ADDREF(nsDOMFile)
-NS_IMPL_THREADSAFE_RELEASE(nsDOMFile)
+NS_IMPL_RELEASE(nsDOMFile)
 
 ////////////////////////////////////////////////////////////////////////////
 // nsDOMFileCC implementation
@@ -624,7 +624,7 @@ NS_MEMORY_REPORTER_MALLOC_SIZEOF_FUN(DOMMemoryFileDataOwnerMallocSizeOf)
 class nsDOMMemoryFileDataOwnerMemoryReporter MOZ_FINAL
   : public nsIMemoryMultiReporter
 {
-  NS_DECL_ISUPPORTS
+  NS_DECL_THREADSAFE_ISUPPORTS
 
   NS_IMETHOD GetName(nsACString& aName)
   {
@@ -705,7 +705,7 @@ class nsDOMMemoryFileDataOwnerMemoryReporter MOZ_FINAL
   }
 };
 
-NS_IMPL_THREADSAFE_ISUPPORTS1(nsDOMMemoryFileDataOwnerMemoryReporter,
+NS_IMPL_ISUPPORTS1(nsDOMMemoryFileDataOwnerMemoryReporter,
                    nsIMemoryMultiReporter)
 
 /* static */ void

content/base/src/nsDocument.cpp

@@ -1793,6 +1793,7 @@ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INTERNAL(nsDocument)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mStateObjectCached)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mUndoManager)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mTemplateContentsOwner)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mChildrenCollection)
 
   // Traverse all our nsCOMArrays.
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mStyleSheets)
@@ -1877,6 +1878,7 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsDocument)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mCachedEncoder)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mUndoManager)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mTemplateContentsOwner)
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mChildrenCollection)
 
   tmp->mParentDocument = nullptr;
 
@@ -9475,6 +9477,25 @@ nsIDocument::ObsoleteSheet(const nsAString& aSheetURI, ErrorResult& rv)
   }
 }
 
+nsIHTMLCollection*
+nsIDocument::Children()
+{
+  if (!mChildrenCollection) {
+    mChildrenCollection = new nsContentList(this, kNameSpaceID_Wildcard,
+                                            nsGkAtoms::_asterix,
+                                            nsGkAtoms::_asterix,
+                                            false);
+  }
+
+  return mChildrenCollection;
+}
+
+uint32_t
+nsIDocument::ChildElementCount()
+{
+  return Children()->Length();
+}
+
 namespace mozilla {
 
 // Singleton class to manage the list of fullscreen documents which are the

content/base/src/nsINode.cpp

@@ -1404,6 +1404,34 @@ nsINode::doInsertChildAt(nsIContent* aKid, uint32_t aIndex,
   return NS_OK;
 }
 
+Element*
+nsINode::GetPreviousElementSibling() const
+{
+  nsIContent* previousSibling = GetPreviousSibling();
+  while (previousSibling) {
+    if (previousSibling->IsElement()) {
+      return previousSibling->AsElement();
+    }
+    previousSibling = previousSibling->GetPreviousSibling();
+  }
+
+  return nullptr;
+}
+
+Element*
+nsINode::GetNextElementSibling() const
+{
+  nsIContent* nextSibling = GetNextSibling();
+  while (nextSibling) {
+    if (nextSibling->IsElement()) {
+      return nextSibling->AsElement();
+    }
+    nextSibling = nextSibling->GetNextSibling();
+  }
+
+  return nullptr;
+}
+
 void
 nsINode::Remove()
 {
@@ -1419,6 +1447,34 @@ nsINode::Remove()
   parent->RemoveChildAt(uint32_t(index), true);
 }
 
+Element*
+nsINode::GetFirstElementChild() const
+{
+  for (nsIContent* child = GetFirstChild();
+       child;
+       child = child->GetNextSibling()) {
+    if (child->IsElement()) {
+      return child->AsElement();
+    }
+  }
+
+  return nullptr;
+}
+
+Element*
+nsINode::GetLastElementChild() const
+{
+  for (nsIContent* child = GetLastChild();
+       child;
+       child = child->GetPreviousSibling()) {
+    if (child->IsElement()) {
+      return child->AsElement();
+    }
+  }
+
+  return nullptr;
+}
+
 void
 nsINode::doRemoveChildAt(uint32_t aIndex, bool aNotify,
                          nsIContent* aKid, nsAttrAndChildArray& aChildArray)

content/base/src/nsScriptLoader.cpp

@@ -75,7 +75,7 @@ public:
   {
   }
 
-  NS_DECL_ISUPPORTS
+  NS_DECL_THREADSAFE_ISUPPORTS
 
   void FireScriptAvailable(nsresult aResult)
   {
@@ -105,7 +105,7 @@ public:
 // The nsScriptLoadRequest is passed as the context to necko, and thus
 // it needs to be threadsafe. Necko won't do anything with this
 // context, but it will AddRef and Release it on other threads.
-NS_IMPL_THREADSAFE_ISUPPORTS0(nsScriptLoadRequest)
+NS_IMPL_ISUPPORTS0(nsScriptLoadRequest)
 
 //////////////////////////////////////////////////////////////
 //

content/base/test/Makefile.in

@@ -249,6 +249,7 @@ MOCHITEST_FILES_A = \
 		test_bug820909.html \
 		test_bug704063.html \
 		test_bug894874.html \
+		test_bug895974.html \
 		$(NULL)
 
 MOCHITEST_FILES_B = \

content/base/test/test_bug895974.html

@@ -0,0 +1,69 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=895974
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 895974</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+  <script type="application/javascript">
+
+  /** Test for Bug 895974 **/
+  SimpleTest.waitForExplicitFinish();
+
+  addLoadEvent(function() {
+  var frag = document.createDocumentFragment();
+  var span = document.createElement("span");
+  var div = document.createElement("div");
+  var text = document.createTextNode("help");
+  frag.appendChild(document.createTextNode("fail"));
+  frag.appendChild(span);
+  frag.appendChild(text);
+  frag.appendChild(div);
+  frag.appendChild(document.createTextNode("fail"));
+
+  is(text.nextElementSibling, div, "nextElementSibling should work on text");
+  is(text.previousElementSibling, span,
+    "previousElementSibling should work on text");
+
+  is(document.firstElementChild, document.documentElement,
+     "firstElementChild should work on document");
+  is(document.lastElementChild, document.documentElement,
+     "lastElementChild should work on document");
+  is(document.children.length, 1, "Document has one element kid");
+  is(document.children[0], document.documentElement,
+     "Document only element child is <html>");
+
+  is(frag.firstElementChild, span,
+     "firstElementChild should work on document fragment");
+  is(frag.lastElementChild, div,
+     "lastElementChild should work on document fragment");
+  is(frag.children.length, 2, "Document fragment has two element kids");
+  is(frag.children[0], span, "Document fragment first element child is span");
+  is(frag.children[1], div, "Document fragment second element child is div");
+
+  is(document.documentElement.firstElementChild, document.head,
+     "firstElementChild should work on element");
+  is(document.documentElement.lastElementChild, document.body,
+     "lastElementChild should work on element");
+  is(document.documentElement.children.length, 2, "<html> has two element kids");
+  is(document.documentElement.children[0], document.head,
+     "<html> first element child is head");
+  is(document.documentElement.children[1], document.body,
+     "<html>  second element child is body");
+  SimpleTest.finish();
+  });
+  </script>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=895974">Mozilla Bug 895974</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+
+</div>
+<pre id="test">
+</pre>
+</body>
+</html>

content/canvas/src/WebGLContext.h

@@ -522,7 +522,8 @@ public:
     template<class ElementType>
     void TexImage2D(WebGLenum target, WebGLint level,
                     WebGLenum internalformat, WebGLenum format, WebGLenum type,
-                    const ElementType& elt, ErrorResult& rv) {
+                    ElementType& elt, ErrorResult& rv)
+    {
         if (!IsContextStable())
             return;
         nsRefPtr<gfxImageSurface> isurf;
@@ -559,7 +560,8 @@ public:
     template<class ElementType>
     void TexSubImage2D(WebGLenum target, WebGLint level,
                        WebGLint xoffset, WebGLint yoffset, WebGLenum format,
-                       WebGLenum type, const ElementType& elt, ErrorResult& rv) {
+                       WebGLenum type, ElementType& elt, ErrorResult& rv)
+    {
         if (!IsContextStable())
             return;
         nsRefPtr<gfxImageSurface> isurf;
@@ -976,8 +978,9 @@ protected:
         return nsLayoutUtils::SurfaceFromElement(aElement, flags);
     }
     template<class ElementType>
-    nsLayoutUtils::SurfaceFromElementResult SurfaceFromElement(const dom::NonNull<ElementType>& aElement) {
+    nsLayoutUtils::SurfaceFromElementResult SurfaceFromElement(ElementType& aElement)
-      return SurfaceFromElement(aElement.get());
+    {
+      return SurfaceFromElement(&aElement);
     }
 
     nsresult SurfaceFromElementResultToImageSurface(nsLayoutUtils::SurfaceFromElementResult& res,

content/html/content/src/Makefile.in

@@ -42,3 +42,7 @@ INCLUDES	+= \
 DEFINES		+= \
 		-D_IMPL_NS_LAYOUT \
 		$(NULL)
+
+ifdef MOZ_WEBGL
+DEFINES += -DMOZ_WEBGL
+endif

content/html/content/src/nsHTMLDNSPrefetch.cpp

@@ -229,8 +229,8 @@ nsHTMLDNSPrefetch::CancelPrefetchLow(const nsAString &hostname, nsresult aReason
 
 /////////////////////////////////////////////////////////////////////////////////////////////////////////
 
-NS_IMPL_THREADSAFE_ISUPPORTS1(nsHTMLDNSPrefetch::nsListener,
+NS_IMPL_ISUPPORTS1(nsHTMLDNSPrefetch::nsListener,
-                              nsIDNSListener)
+                   nsIDNSListener)
 
 NS_IMETHODIMP
 nsHTMLDNSPrefetch::nsListener::OnLookupComplete(nsICancelable *request,

content/html/content/src/nsHTMLDNSPrefetch.h

@@ -73,7 +73,7 @@ public:
   {
     // This class exists to give a safe callback no-op DNSListener
   public:
-    NS_DECL_ISUPPORTS
+    NS_DECL_THREADSAFE_ISUPPORTS
     NS_DECL_NSIDNSLISTENER
 
     nsListener()  {}

content/html/document/src/MediaDocument.cpp

@@ -35,9 +35,9 @@ MediaDocumentStreamListener::~MediaDocumentStreamListener()
 }
 
 
-NS_IMPL_THREADSAFE_ISUPPORTS2(MediaDocumentStreamListener,
+NS_IMPL_ISUPPORTS2(MediaDocumentStreamListener,
-                              nsIRequestObserver,
+                   nsIRequestObserver,
-                              nsIStreamListener)
+                   nsIStreamListener)
 
 
 void

content/html/document/src/MediaDocument.h

@@ -80,7 +80,7 @@ public:
   virtual ~MediaDocumentStreamListener();
   void SetStreamListener(nsIStreamListener *aListener);
 
-  NS_DECL_ISUPPORTS
+  NS_DECL_THREADSAFE_ISUPPORTS
 
   NS_DECL_NSIREQUESTOBSERVER
 

content/media/MediaDecoder.cpp

@@ -110,7 +110,7 @@ public:
   }
 };
 
-NS_IMPL_THREADSAFE_ISUPPORTS1(MediaDecoder, nsIObserver)
+NS_IMPL_ISUPPORTS1(MediaDecoder, nsIObserver)
 
 void MediaDecoder::SetDormantIfNecessary(bool aDormant)
 {

content/media/MediaDecoder.h

@@ -241,7 +241,7 @@ class MediaDecoder : public nsIObserver,
 public:
   typedef mozilla::layers::Image Image;
 
-  NS_DECL_ISUPPORTS
+  NS_DECL_THREADSAFE_ISUPPORTS
   NS_DECL_NSIOBSERVER
 
   // Enumeration for the valid play states (see mPlayState)

content/media/MediaResource.h

@@ -55,7 +55,10 @@ public:
   MediaChannelStatistics(MediaChannelStatistics * aCopyFrom)
   {
     MOZ_ASSERT(aCopyFrom);
-    *this = *aCopyFrom;
+    mAccumulatedBytes = aCopyFrom->mAccumulatedBytes;
+    mAccumulatedTime = aCopyFrom->mAccumulatedTime;
+    mLastStartTime = aCopyFrom->mLastStartTime;
+    mIsStarted = aCopyFrom->mIsStarted;
   }
 
   NS_INLINE_DECL_THREADSAFE_REFCOUNTING(MediaChannelStatistics)

content/media/test/test_playback_rate_playpause.html

@@ -14,6 +14,9 @@ if (navigator.platform.startsWith("Win")) {
   SimpleTest.expectAssertions(0, 1);
 } else if (navigator.platform.startsWith("Mac")) {
   SimpleTest.expectAssertions(0, 2);
+} else if (navigator.platform.startsWith("Linux")) {
+  // Bug 897024
+  SimpleTest.expectAssertions(0, 2);
 }
 
 let manager = new MediaTestManager;

content/media/webaudio/MediaBufferDecoder.cpp

@@ -66,7 +66,7 @@ public:
   explicit BufferDecoder(MediaResource* aResource);
   virtual ~BufferDecoder();
 
-  NS_DECL_ISUPPORTS
+  NS_DECL_THREADSAFE_ISUPPORTS
 
   // This has to be called before decoding begins
   void BeginDecoding(nsIThread* aDecodeThread)
@@ -126,7 +126,7 @@ private:
   nsRefPtr<MediaResource> mResource;
 };
 
-NS_IMPL_THREADSAFE_ISUPPORTS0(BufferDecoder)
+NS_IMPL_ISUPPORTS0(BufferDecoder)
 
 BufferDecoder::BufferDecoder(MediaResource* aResource)
   : mReentrantMonitor("BufferDecoder")

content/media/webrtc/MediaEngineDefault.cpp

@@ -25,7 +25,7 @@
 
 namespace mozilla {
 
-NS_IMPL_THREADSAFE_ISUPPORTS1(MediaEngineDefaultVideoSource, nsITimerCallback)
+NS_IMPL_ISUPPORTS1(MediaEngineDefaultVideoSource, nsITimerCallback)
 /**
  * Default video source.
  */
@@ -258,7 +258,7 @@ MediaEngineDefaultVideoSource::NotifyPull(MediaStreamGraph* aGraph,
 /**
  * Default audio source.
  */
-NS_IMPL_THREADSAFE_ISUPPORTS1(MediaEngineDefaultAudioSource, nsITimerCallback)
+NS_IMPL_ISUPPORTS1(MediaEngineDefaultAudioSource, nsITimerCallback)
 
 MediaEngineDefaultAudioSource::MediaEngineDefaultAudioSource()
   : mTimer(nullptr)

content/media/webrtc/MediaEngineDefault.h

@@ -59,7 +59,7 @@ public:
     return true;
   }
 
-  NS_DECL_ISUPPORTS
+  NS_DECL_THREADSAFE_ISUPPORTS
   NS_DECL_NSITIMERCALLBACK
 
 protected:
@@ -105,7 +105,7 @@ public:
     return true;
   }
 
-  NS_DECL_ISUPPORTS
+  NS_DECL_THREADSAFE_ISUPPORTS
   NS_DECL_NSITIMERCALLBACK
 
 protected:
@@ -115,6 +115,7 @@ protected:
   SourceMediaStream* mSource;
 };
 
+
 class MediaEngineDefault : public MediaEngine
 {
 public:

content/media/webrtc/MediaEngineWebRTC.h

@@ -158,7 +158,7 @@ public:
     return false;
   }
 
-  NS_DECL_ISUPPORTS
+  NS_DECL_THREADSAFE_ISUPPORTS
 #ifdef MOZ_B2G_CAMERA
   NS_DECL_NSICAMERAGETCAMERACALLBACK
   NS_DECL_NSICAMERAPREVIEWSTREAMCALLBACK
@@ -305,7 +305,7 @@ public:
                WebRtc_Word16 audio10ms[], const int length,
                const int samplingFreq, const bool isStereo);
 
-  NS_DECL_ISUPPORTS
+  NS_DECL_THREADSAFE_ISUPPORTS
 
 private:
   static const unsigned int KMaxDeviceNameLength = 128;

content/media/webrtc/MediaEngineWebRTCAudio.cpp

@@ -24,7 +24,7 @@ extern PRLogModuleInfo* GetMediaManagerLog();
 /**
  * Webrtc audio source.
  */
-NS_IMPL_THREADSAFE_ISUPPORTS0(MediaEngineWebRTCAudioSource)
+NS_IMPL_ISUPPORTS0(MediaEngineWebRTCAudioSource)
 
 void
 MediaEngineWebRTCAudioSource::GetName(nsAString& aName)

content/media/webrtc/MediaEngineWebRTCVideo.cpp

@@ -22,7 +22,7 @@ extern PRLogModuleInfo* GetMediaManagerLog();
 /**
  * Webrtc video source.
  */
-NS_IMPL_THREADSAFE_ISUPPORTS1(MediaEngineWebRTCVideoSource, nsIRunnable)
+NS_IMPL_ISUPPORTS1(MediaEngineWebRTCVideoSource, nsIRunnable)
 
 // ViEExternalRenderer Callback.
 #ifndef MOZ_B2G_CAMERA

content/media/wmf/WMFByteStream.cpp

@@ -36,11 +36,11 @@ static const uint32_t NumWMFIoThreads = 4;
 // on this thread, so we need MSCOM working.
 class ThreadPoolListener MOZ_FINAL : public nsIThreadPoolListener {
 public:
-  NS_DECL_ISUPPORTS
+  NS_DECL_THREADSAFE_ISUPPORTS
   NS_DECL_NSITHREADPOOLLISTENER
 };
 
-NS_IMPL_THREADSAFE_ISUPPORTS1(ThreadPoolListener, nsIThreadPoolListener)
+NS_IMPL_ISUPPORTS1(ThreadPoolListener, nsIThreadPoolListener)
 
 NS_IMETHODIMP
 ThreadPoolListener::OnThreadCreated()
@@ -214,8 +214,8 @@ WMFByteStream::QueryInterface(REFIID aIId, void **aInterface)
   return E_NOINTERFACE;
 }
 
-NS_IMPL_THREADSAFE_ADDREF(WMFByteStream)
+NS_IMPL_ADDREF(WMFByteStream)
-NS_IMPL_THREADSAFE_RELEASE(WMFByteStream)
+NS_IMPL_RELEASE(WMFByteStream)
 
 
 // Stores data regarding an async read opreation.
@@ -239,12 +239,12 @@ public:
   ULONG mBytesRead;
 
   // IUnknown ref counting.
-  nsAutoRefCnt mRefCnt;
+  ThreadSafeAutoRefCnt mRefCnt;
   NS_DECL_OWNINGTHREAD
 };
 
-NS_IMPL_THREADSAFE_ADDREF(ReadRequest)
+NS_IMPL_ADDREF(ReadRequest)
-NS_IMPL_THREADSAFE_RELEASE(ReadRequest)
+NS_IMPL_RELEASE(ReadRequest)
 
 // IUnknown Methods
 STDMETHODIMP

content/media/wmf/WMFByteStream.h

@@ -162,7 +162,7 @@ private:
   bool mIsShutdown;
 
   // IUnknown ref counting.
-  nsAutoRefCnt mRefCnt;
+  ThreadSafeAutoRefCnt mRefCnt;
   NS_DECL_OWNINGTHREAD
 };
 

content/media/wmf/WMFSourceReaderCallback.cpp

@@ -33,8 +33,8 @@ WMFSourceReaderCallback::QueryInterface(REFIID aIId, void **aInterface)
   return E_NOINTERFACE;
 }
 
-NS_IMPL_THREADSAFE_ADDREF(WMFSourceReaderCallback)
+NS_IMPL_ADDREF(WMFSourceReaderCallback)
-NS_IMPL_THREADSAFE_RELEASE(WMFSourceReaderCallback)
+NS_IMPL_RELEASE(WMFSourceReaderCallback)
 
 WMFSourceReaderCallback::WMFSourceReaderCallback()
   : mMonitor("WMFSourceReaderCallback")

content/media/wmf/WMFSourceReaderCallback.h

@@ -73,7 +73,7 @@ private:
   bool mReadFinished;
 
   // IUnknown ref counting.
-  nsAutoRefCnt mRefCnt;
+  ThreadSafeAutoRefCnt mRefCnt;
   NS_DECL_OWNINGTHREAD
 
 };

content/xbl/src/nsXBLProtoImplMethod.cpp

@@ -237,6 +237,8 @@ nsresult
 nsXBLProtoImplMethod::Read(nsIScriptContext* aContext,
                            nsIObjectInputStream* aStream)
 {
+  MOZ_ASSERT(!IsCompiled() && !GetUncompiledMethod());
+
   JS::Rooted<JSObject*> methodObject(aContext->GetNativeContext());
   nsresult rv = XBL_DeserializeFunction(aContext, aStream, &methodObject);
   if (NS_FAILED(rv)) {
@@ -261,7 +263,12 @@ nsXBLProtoImplMethod::Write(nsIScriptContext* aContext,
     rv = aStream->WriteWStringZ(mName);
     NS_ENSURE_SUCCESS(rv, rv);
 
-    return XBL_SerializeFunction(aContext, aStream, mMethod.AsHeapObject());
+    // Calling fromMarkedLocation() is safe because mMethod is traced by the
+    // Trace() method above, and because its value is never changed after it has
+    // been set to a compiled method.
+    JS::Handle<JSObject*> method =
+      JS::Handle<JSObject*>::fromMarkedLocation(mMethod.AsHeapObject().address());
+    return XBL_SerializeFunction(aContext, aStream, method);
   }
 
   return NS_OK;
@@ -271,7 +278,7 @@ nsresult
 nsXBLProtoImplAnonymousMethod::Execute(nsIContent* aBoundElement)
 {
   NS_PRECONDITION(IsCompiled(), "Can't execute uncompiled method");
-  
+
   if (!GetCompiledMethod()) {
     // Nothing to do here
     return NS_OK;
@@ -364,7 +371,12 @@ nsXBLProtoImplAnonymousMethod::Write(nsIScriptContext* aContext,
     nsresult rv = aStream->Write8(aType);
     NS_ENSURE_SUCCESS(rv, rv);
 
-    rv = XBL_SerializeFunction(aContext, aStream, mMethod.AsHeapObject());
+    // Calling fromMarkedLocation() is safe because mMethod is traced by the
+    // Trace() method above, and because its value is never changed after it has
+    // been set to a compiled method.
+    JS::Handle<JSObject*> method =
+      JS::Handle<JSObject*>::fromMarkedLocation(mMethod.AsHeapObject().address());
+    rv = XBL_SerializeFunction(aContext, aStream, method);
     NS_ENSURE_SUCCESS(rv, rv);
   }
 

content/xbl/src/nsXBLProtoImplProperty.cpp

@@ -357,13 +357,22 @@ nsXBLProtoImplProperty::Write(nsIScriptContext* aContext,
   rv = aStream->WriteWStringZ(mName);
   NS_ENSURE_SUCCESS(rv, rv);
 
+  // The calls to fromMarkedLocation() below are safe because mSetter and
+  // mGetter are traced by the Trace() method above, and because their values
+  // are never changed after they have been set to a compiled function.
+  MOZ_ASSERT_IF(mJSAttributes & (JSPROP_GETTER | JSPROP_SETTER), mIsCompiled);
+
   if (mJSAttributes & JSPROP_GETTER) {
-    rv = XBL_SerializeFunction(aContext, aStream, mGetter.AsHeapObject());
+    JS::Handle<JSObject*> function =
+      JS::Handle<JSObject*>::fromMarkedLocation(mGetter.AsHeapObject().address());
+    rv = XBL_SerializeFunction(aContext, aStream, function);
     NS_ENSURE_SUCCESS(rv, rv);
   }
 
   if (mJSAttributes & JSPROP_SETTER) {
-    rv = XBL_SerializeFunction(aContext, aStream, mSetter.AsHeapObject());
+     JS::Handle<JSObject*> function =
+      JS::Handle<JSObject*>::fromMarkedLocation(mSetter.AsHeapObject().address());
+    rv = XBL_SerializeFunction(aContext, aStream, function);
     NS_ENSURE_SUCCESS(rv, rv);
   }
 

content/xul/content/src/nsXULElement.cpp

@@ -2380,8 +2380,15 @@ nsXULPrototypeScript::Serialize(nsIObjectOutputStream* aStream,
     if (NS_FAILED(rv)) return rv;
     rv = aStream->Write32(mLangVersion);
     if (NS_FAILED(rv)) return rv;
-    // And delegate the writing to the nsIScriptContext
+
-    rv = context->Serialize(aStream, mScriptObject);
+    // And delegate the writing to the nsIScriptContext.
+    //
+    // Calling fromMarkedLocation() is safe because we trace mScriptObject in
+    // TraceScriptObject() and because its value is never changed after it has
+    // been set.
+    JS::Handle<JSScript*> script =
+        JS::Handle<JSScript*>::fromMarkedLocation(mScriptObject.address());
+    rv = context->Serialize(aStream, script);
     if (NS_FAILED(rv)) return rv;
 
     return NS_OK;
@@ -2406,8 +2413,7 @@ nsXULPrototypeScript::SerializeOutOfLine(nsIObjectOutputStream* aStream,
                  "writing to the cache file, but the XUL cache is off?");
     bool exists;
     cache->HasData(mSrcURI, &exists);
-    
+
-    
     /* return will be NS_OK from GetAsciiSpec.
      * that makes no sense.
      * nor does returning NS_OK from HasMuxedDocument.

content/xul/content/src/nsXULElement.h

@@ -243,7 +243,10 @@ public:
     // &mScriptObject pointer can't go stale.
     JS::Handle<JSScript*> GetScriptObject()
     {
-        return JS::Handle<JSScript*>(mScriptObject);
+        // Calling fromMarkedLocation() is safe because we trace mScriptObject in
+        // TraceScriptObject() and because its value is never changed after it has
+        // been set.
+        return JS::Handle<JSScript*>::fromMarkedLocation(mScriptObject.address());
     }
 
     void TraceScriptObject(JSTracer* aTrc)

content/xul/document/src/nsXULPrototypeCache.cpp

@@ -83,7 +83,7 @@ nsXULPrototypeCache::~nsXULPrototypeCache()
 }
 
 
-NS_IMPL_THREADSAFE_ISUPPORTS1(nsXULPrototypeCache, nsIObserver)
+NS_IMPL_ISUPPORTS1(nsXULPrototypeCache, nsIObserver)
 
 /* static */ nsXULPrototypeCache*
 nsXULPrototypeCache::GetInstance()
@@ -197,11 +197,7 @@ nsXULPrototypeCache::PutStyleSheet(nsCSSStyleSheet* aStyleSheet)
 JSScript*
 nsXULPrototypeCache::GetScript(nsIURI* aURI)
 {
-    JSScript* script;
+    return mScriptTable.Get(aURI);
-    if (!mScriptTable.Get(aURI, &script)) {
-        return nullptr;
-    }
-    return script;
 }
 
 nsresult
@@ -209,8 +205,7 @@ nsXULPrototypeCache::PutScript(nsIURI* aURI,
                                JS::Handle<JSScript*> aScriptObject)
 {
 #ifdef DEBUG
-    JSScript* existingScript;
+    if (JSScript* existingScript = mScriptTable.Get(aURI)) {
-    if (mScriptTable.Get(aURI, &existingScript)) {
         nsAutoCString scriptName;
         aURI->GetSpec(scriptName);
         nsAutoCString message("Loaded script ");
@@ -656,10 +651,10 @@ nsXULPrototypeCache::MarkInCCGeneration(uint32_t aGeneration)
 }
 
 static PLDHashOperator
-MarkScriptsInGC(nsIURI* aKey, JSScript*& aScript, void* aClosure)
+MarkScriptsInGC(nsIURI* aKey, JS::Heap<JSScript*>& aScript, void* aClosure)
 {
     JSTracer* trc = static_cast<JSTracer*>(aClosure);
-    JS_CallScriptTracer(trc, &aScript, "nsXULPrototypeCache script");
+    JS_CallHeapScriptTracer(trc, &aScript, "nsXULPrototypeCache script");
     return PL_DHASH_NEXT;
 }
 

content/xul/document/src/nsXULPrototypeCache.h

@@ -9,7 +9,7 @@
 #include "nsCOMPtr.h"
 #include "nsIObserver.h"
 #include "nsXBLDocumentInfo.h"
-#include "nsDataHashtable.h"
+#include "nsJSThingHashtable.h"
 #include "nsInterfaceHashtable.h"
 #include "nsRefPtrHashtable.h"
 #include "nsURIHashKey.h"
@@ -36,7 +36,7 @@ class nsXULPrototypeCache : public nsIObserver
 {
 public:
     // nsISupports
-    NS_DECL_ISUPPORTS
+    NS_DECL_THREADSAFE_ISUPPORTS
     NS_DECL_NSIOBSERVER
 
     bool IsCached(nsIURI* aURI) {
@@ -123,14 +123,14 @@ protected:
 
     void FlushSkinFiles();
 
-    nsRefPtrHashtable<nsURIHashKey,nsXULPrototypeDocument>  mPrototypeTable; // owns the prototypes
+    nsRefPtrHashtable<nsURIHashKey,nsXULPrototypeDocument>   mPrototypeTable; // owns the prototypes
-    nsRefPtrHashtable<nsURIHashKey,nsCSSStyleSheet>        mStyleSheetTable;
+    nsRefPtrHashtable<nsURIHashKey,nsCSSStyleSheet>          mStyleSheetTable;
-    nsDataHashtable<nsURIHashKey, JSScript*>               mScriptTable;
+    nsJSThingHashtable<nsURIHashKey, JSScript*>              mScriptTable;
-    nsRefPtrHashtable<nsURIHashKey,nsXBLDocumentInfo>  mXBLDocTable;
+    nsRefPtrHashtable<nsURIHashKey,nsXBLDocumentInfo>        mXBLDocTable;
 
-    nsTHashtable<nsURIHashKey> mCacheURITable;
+    nsTHashtable<nsURIHashKey>                               mCacheURITable;
 
-    nsInterfaceHashtable<nsURIHashKey, nsIStorageStream> mOutputStreamTable;
+    nsInterfaceHashtable<nsURIHashKey, nsIStorageStream>     mOutputStreamTable;
     nsInterfaceHashtable<nsURIHashKey, nsIObjectInputStream> mInputStreamTable;
 
     // Bootstrap caching service

content/xul/document/src/nsXULPrototypeDocument.cpp

@@ -89,13 +89,8 @@ uint32_t nsXULPrototypeDocument::gRefCnt;
 void
 nsXULPDGlobalObject_finalize(JSFreeOp *fop, JSObject *obj)
 {
-    nsISupports *nativeThis = (nsISupports*)JS_GetPrivate(obj);
+    nsXULPDGlobalObject* nativeThis = static_cast<nsXULPDGlobalObject*>(JS_GetPrivate(obj));
-
+    nativeThis->OnFinalize(obj);
-    nsCOMPtr<nsIScriptGlobalObject> sgo(do_QueryInterface(nativeThis));
-
-    if (sgo) {
-        sgo->OnFinalize(obj);
-    }
 
     // The addref was part of JSObject construction
     NS_RELEASE(nativeThis);

docshell/base/nsDSURIContentListener.cpp

@@ -52,8 +52,8 @@ nsDSURIContentListener::Init()
 // nsDSURIContentListener::nsISupports
 //*****************************************************************************   
 
-NS_IMPL_THREADSAFE_ADDREF(nsDSURIContentListener)
+NS_IMPL_ADDREF(nsDSURIContentListener)
-NS_IMPL_THREADSAFE_RELEASE(nsDSURIContentListener)
+NS_IMPL_RELEASE(nsDSURIContentListener)
 
 NS_INTERFACE_MAP_BEGIN(nsDSURIContentListener)
     NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIURIContentListener)

docshell/base/nsDSURIContentListener.h

@@ -23,7 +23,7 @@ class nsDSURIContentListener :
 {
 friend class nsDocShell;
 public:
-    NS_DECL_ISUPPORTS
+    NS_DECL_THREADSAFE_ISUPPORTS
     NS_DECL_NSIURICONTENTLISTENER
 
     nsresult Init();

docshell/base/nsDocShell.cpp

@@ -11730,8 +11730,8 @@ nsRefreshTimer::~nsRefreshTimer()
 // nsRefreshTimer::nsISupports
 //*****************************************************************************   
 
-NS_IMPL_THREADSAFE_ADDREF(nsRefreshTimer)
+NS_IMPL_ADDREF(nsRefreshTimer)
-NS_IMPL_THREADSAFE_RELEASE(nsRefreshTimer)
+NS_IMPL_RELEASE(nsRefreshTimer)
 
 NS_INTERFACE_MAP_BEGIN(nsRefreshTimer)
     NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsITimerCallback)
@@ -11770,7 +11770,7 @@ nsDocShell::InterfaceRequestorProxy::~InterfaceRequestorProxy()
     mWeakPtr = nullptr;
 }
 
-NS_IMPL_THREADSAFE_ISUPPORTS1(nsDocShell::InterfaceRequestorProxy, nsIInterfaceRequestor) 
+NS_IMPL_ISUPPORTS1(nsDocShell::InterfaceRequestorProxy, nsIInterfaceRequestor) 
   
 NS_IMETHODIMP 
 nsDocShell::InterfaceRequestorProxy::GetInterface(const nsIID & aIID, void **aSink)

docshell/base/nsDocShell.h

@@ -109,7 +109,7 @@ class nsRefreshTimer : public nsITimerCallback
 public:
     nsRefreshTimer();
 
-    NS_DECL_ISUPPORTS
+    NS_DECL_THREADSAFE_ISUPPORTS
     NS_DECL_NSITIMERCALLBACK
 
     int32_t GetDelay() { return mDelay ;}
@@ -899,7 +899,7 @@ public:
     public:
         InterfaceRequestorProxy(nsIInterfaceRequestor* p);
         virtual ~InterfaceRequestorProxy();
-        NS_DECL_ISUPPORTS
+        NS_DECL_THREADSAFE_ISUPPORTS
         NS_DECL_NSIINTERFACEREQUESTOR
  
     protected:

dom/base/nsDOMScriptObjectFactory.cpp

@@ -209,7 +209,7 @@ nsresult NS_GetScriptRuntimeByID(uint32_t aScriptTypeID,
 }
 
 
-NS_IMPL_THREADSAFE_ISUPPORTS1(nsDOMExceptionProvider, nsIExceptionProvider)
+NS_IMPL_ISUPPORTS1(nsDOMExceptionProvider, nsIExceptionProvider)
 
 NS_IMETHODIMP
 nsDOMExceptionProvider::GetException(nsresult result,

dom/base/nsDOMScriptObjectFactory.h

@@ -51,6 +51,6 @@ public:
 class nsDOMExceptionProvider MOZ_FINAL : public nsIExceptionProvider
 {
 public:
-  NS_DECL_ISUPPORTS
+  NS_DECL_THREADSAFE_ISUPPORTS
   NS_DECL_NSIEXCEPTIONPROVIDER
 };

dom/base/nsDOMWindowUtils.cpp

@@ -3347,7 +3347,7 @@ nsDOMWindowUtils::SetPaintFlashing(bool aPaintFlashing)
 {
   nsPresContext* presContext = GetPresContext();
   if (presContext) {
-    presContext->RefreshDriver()->SetPaintFlashing(aPaintFlashing);
+    presContext->SetPaintFlashing(aPaintFlashing);
     // Clear paint flashing colors
     nsIPresShell* presShell = GetPresShell();
     if (!aPaintFlashing && presShell) {
@@ -3366,7 +3366,7 @@ nsDOMWindowUtils::GetPaintFlashing(bool* aRetVal)
   *aRetVal = false;
   nsPresContext* presContext = GetPresContext();
   if (presContext) {
-    *aRetVal = presContext->RefreshDriver()->GetPaintFlashing();
+    *aRetVal = presContext->GetPaintFlashing();
   }
   return NS_OK;
 }

dom/base/nsGlobalWindow.cpp

@@ -1027,7 +1027,6 @@ nsGlobalWindow::nsGlobalWindow(nsGlobalWindow *aOuterWindow)
     mTimeoutInsertionPoint(nullptr),
     mTimeoutPublicIdCounter(1),
     mTimeoutFiringDepth(0),
-    mJSObject(nullptr),
     mTimeoutsSuspendDepth(0),
     mFocusMethod(0),
     mSerial(0),
@@ -1865,7 +1864,7 @@ void
 nsGlobalWindow::TraceGlobalJSObject(JSTracer* aTrc)
 {
   if (mJSObject) {
-    JS_CallObjectTracer(aTrc, &mJSObject, "active window global");
+    JS_CallTenuredObjectTracer(aTrc, &mJSObject, "active window global");
   }
 }
 
@@ -2117,14 +2116,13 @@ CreateNativeGlobalForInner(JSContext* aCx,
                            nsGlobalWindow* aNewInner,
                            nsIURI* aURI,
                            nsIPrincipal* aPrincipal,
-                           JSObject** aNativeGlobal,
+                           JS::TenuredHeap<JSObject*>& aNativeGlobal,
                            nsIXPConnectJSObjectHolder** aHolder)
 {
   MOZ_ASSERT(aCx);
   MOZ_ASSERT(aNewInner);
   MOZ_ASSERT(aNewInner->IsInnerWindow());
   MOZ_ASSERT(aPrincipal);
-  MOZ_ASSERT(aNativeGlobal);
   MOZ_ASSERT(aHolder);
 
   nsGlobalWindow *top = NULL;
@@ -2154,13 +2152,13 @@ CreateNativeGlobalForInner(JSContext* aCx,
   NS_ENSURE_SUCCESS(rv, rv);
 
   MOZ_ASSERT(jsholder);
-  *aNativeGlobal = jsholder->GetJSObject();
+  aNativeGlobal = jsholder->GetJSObject();
   jsholder.forget(aHolder);
 
   // Set the location information for the new global, so that tools like
   // about:memory may use that information
-  MOZ_ASSERT(*aNativeGlobal);
+  MOZ_ASSERT(aNativeGlobal.getPtr());
-  xpc::SetLocationForGlobal(*aNativeGlobal, aURI);
+  xpc::SetLocationForGlobal(aNativeGlobal, aURI);
 
   return NS_OK;
 }
@@ -2353,7 +2351,7 @@ nsGlobalWindow::SetNewDocument(nsIDocument* aDocument,
       rv = CreateNativeGlobalForInner(cx, newInnerWindow,
                                       aDocument->GetDocumentURI(),
                                       aDocument->NodePrincipal(),
-                                      &newInnerWindow->mJSObject,
+                                      newInnerWindow->mJSObject,
                                       getter_AddRefs(mInnerWindowHolder));
       NS_ASSERTION(NS_SUCCEEDED(rv) && newInnerWindow->mJSObject && mInnerWindowHolder,
                    "Failed to get script global and holder");
@@ -3153,7 +3151,7 @@ nsGlobalWindow::PoisonOuterWindowProxy(JSObject *aObject)
 {
   MOZ_ASSERT(IsOuterWindow());
   if (aObject == mJSObject) {
-    mJSObject = reinterpret_cast<JSObject*>(0x1);
+    mJSObject.setToCrashOnTouch();
   }
 }
 

dom/base/nsGlobalWindow.h

@@ -1225,7 +1225,9 @@ protected:
 
   // These member variables are used on both inner and the outer windows.
   nsCOMPtr<nsIPrincipal> mDocumentPrincipal;
-  JSObject* mJSObject;
+
+  // The JS global object.  Global objects are always allocated tenured.
+  JS::TenuredHeap<JSObject*> mJSObject;
 
   typedef nsCOMArray<nsIDOMStorageEvent> nsDOMStorageEventArray;
   nsDOMStorageEventArray mPendingStorageEvents;

dom/base/nsJSEnvironment.cpp

@@ -469,11 +469,12 @@ NS_ScriptErrorReporter(JSContext *cx,
   // We don't want to report exceptions too eagerly, but warnings in the
   // absence of werror are swallowed whole, so report those now.
   if (!JSREPORT_IS_WARNING(report->flags)) {
+    nsIXPConnect* xpc = nsContentUtils::XPConnect();
     if (JS_DescribeScriptedCaller(cx, nullptr, nullptr)) {
+      xpc->MarkErrorUnreported(cx);
       return;
     }
 
-    nsIXPConnect* xpc = nsContentUtils::XPConnect();
     if (xpc) {
       nsAXPCNativeCallContext *cc = nullptr;
       xpc->GetCurrentNativeCallContext(&cc);
@@ -483,6 +484,7 @@ NS_ScriptErrorReporter(JSContext *cx,
           uint16_t lang;
           if (NS_SUCCEEDED(prev->GetLanguage(&lang)) &&
             lang == nsAXPCNativeCallContext::LANG_JS) {
+            xpc->MarkErrorUnreported(cx);
             return;
           }
         }

dom/bindings/BindingUtils.cpp

@@ -553,11 +553,11 @@ CreateInterfacePrototypeObject(JSContext* cx, JS::Handle<JSObject*> global,
 void
 CreateInterfaceObjects(JSContext* cx, JS::Handle<JSObject*> global,
                        JS::Handle<JSObject*> protoProto,
-                       JSClass* protoClass, JSObject** protoCache,
+                       JSClass* protoClass, JS::Heap<JSObject*>* protoCache,
                        JS::Handle<JSObject*> constructorProto,
                        JSClass* constructorClass, const JSNativeHolder* constructor,
                        unsigned ctorNargs, const NamedConstructor* namedConstructors,
-                       JSObject** constructorCache, const DOMClass* domClass,
+                       JS::Heap<JSObject*>* constructorCache, const DOMClass* domClass,
                        const NativeProperties* properties,
                        const NativeProperties* chromeOnlyProperties,
                        const char* name)
@@ -990,7 +990,7 @@ ResolvePrototypeOrConstructor(JSContext* cx, JS::Handle<JSObject*> wrapper,
   JS::Rooted<JSObject*> global(cx, js::GetGlobalForObjectCrossCompartment(obj));
   {
     JSAutoCompartment ac(cx, global);
-    JSObject** protoAndIfaceArray = GetProtoAndIfaceArray(global);
+    JS::Heap<JSObject*>* protoAndIfaceArray = GetProtoAndIfaceArray(global);
     JSObject* protoOrIface = protoAndIfaceArray[protoAndIfaceArrayIndex];
     if (!protoOrIface) {
       return false;

dom/bindings/BindingUtils.h

@@ -277,8 +277,7 @@ AllocateProtoAndIfaceCache(JSObject* obj)
   MOZ_ASSERT(js::GetObjectClass(obj)->flags & JSCLASS_DOM_GLOBAL);
   MOZ_ASSERT(js::GetReservedSlot(obj, DOM_PROTOTYPE_SLOT).isUndefined());
 
-  // Important: The () at the end ensure zero-initialization
+  JS::Heap<JSObject*>* protoAndIfaceArray = new JS::Heap<JSObject*>[kProtoAndIfaceCacheCount];
-  JSObject** protoAndIfaceArray = new JSObject*[kProtoAndIfaceCacheCount]();
 
   js::SetReservedSlot(obj, DOM_PROTOTYPE_SLOT,
                       JS::PrivateValue(protoAndIfaceArray));
@@ -291,10 +290,10 @@ TraceProtoAndIfaceCache(JSTracer* trc, JSObject* obj)
 
   if (!HasProtoAndIfaceArray(obj))
     return;
-  JSObject** protoAndIfaceArray = GetProtoAndIfaceArray(obj);
+  JS::Heap<JSObject*>* protoAndIfaceArray = GetProtoAndIfaceArray(obj);
   for (size_t i = 0; i < kProtoAndIfaceCacheCount; ++i) {
     if (protoAndIfaceArray[i]) {
-      JS_CallObjectTracer(trc, &protoAndIfaceArray[i], "protoAndIfaceArray[i]");
+      JS_CallHeapObjectTracer(trc, &protoAndIfaceArray[i], "protoAndIfaceArray[i]");
     }
   }
 }
@@ -304,7 +303,7 @@ DestroyProtoAndIfaceCache(JSObject* obj)
 {
   MOZ_ASSERT(js::GetObjectClass(obj)->flags & JSCLASS_DOM_GLOBAL);
 
-  JSObject** protoAndIfaceArray = GetProtoAndIfaceArray(obj);
+  JS::Heap<JSObject*>* protoAndIfaceArray = GetProtoAndIfaceArray(obj);
 
   delete [] protoAndIfaceArray;
 }
@@ -371,11 +370,11 @@ struct NamedConstructor
 void
 CreateInterfaceObjects(JSContext* cx, JS::Handle<JSObject*> global,
                        JS::Handle<JSObject*> protoProto,
-                       JSClass* protoClass, JSObject** protoCache,
+                       JSClass* protoClass, JS::Heap<JSObject*>* protoCache,
                        JS::Handle<JSObject*> interfaceProto,
                        JSClass* constructorClass, const JSNativeHolder* constructor,
                        unsigned ctorNargs, const NamedConstructor* namedConstructors,
-                       JSObject** constructorCache, const DOMClass* domClass,
+                       JS::Heap<JSObject*>* constructorCache, const DOMClass* domClass,
                        const NativeProperties* regularProperties,
                        const NativeProperties* chromeOnlyProperties,
                        const char* name);
@@ -2022,6 +2021,37 @@ const T& Constify(T& arg)
   return arg;
 }
 
+// Helper for turning (Owning)NonNull<T> into T&
+template<typename T>
+T& NonNullHelper(T& aArg)
+{
+  return aArg;
+}
+
+template<typename T>
+T& NonNullHelper(NonNull<T>& aArg)
+{
+  return aArg;
+}
+
+template<typename T>
+const T& NonNullHelper(const NonNull<T>& aArg)
+{
+  return aArg;
+}
+
+template<typename T>
+T& NonNullHelper(OwningNonNull<T>& aArg)
+{
+  return aArg;
+}
+
+template<typename T>
+const T& NonNullHelper(const OwningNonNull<T>& aArg)
+{
+  return aArg;
+}
+
 // Reparent the wrapper of aObj to whatever its native now thinks its
 // parent should be.
 nsresult
@@ -2048,7 +2078,7 @@ ReportLenientThisUnwrappingFailure(JSContext* cx, JS::Handle<JSObject*> obj);
 inline JSObject*
 GetUnforgeableHolder(JSObject* aGlobal, prototypes::ID aId)
 {
-  JSObject** protoAndIfaceArray = GetProtoAndIfaceArray(aGlobal);
+  JS::Heap<JSObject*>* protoAndIfaceArray = GetProtoAndIfaceArray(aGlobal);
   JSObject* interfaceProto = protoAndIfaceArray[aId];
   return &js::GetReservedSlot(interfaceProto,
                               DOM_INTERFACE_PROTO_SLOTS_BASE).toObject();

dom/bindings/CallbackObject.h

@@ -71,12 +71,12 @@ public:
    * This should only be called if you are certain that the return value won't
    * be passed into a JS API function and that it won't be stored without being
    * rooted (or otherwise signaling the stored value to the CC).
-   *
-   * This can return a handle because we trace our mCallback.
    */
   JS::Handle<JSObject*> CallbackPreserveColor() const
   {
-    return mCallback;
+    // Calling fromMarkedLocation() is safe because we trace our mCallback, and
+    // because the value of mCallback cannot change after if has been set.
+    return JS::Handle<JSObject*>::fromMarkedLocation(mCallback.address());
   }
 
   enum ExceptionHandling {
@@ -93,6 +93,7 @@ protected:
 private:
   inline void Init(JSObject* aCallback)
   {
+    MOZ_ASSERT(aCallback && !mCallback);
     // Set mCallback before we hold, on the off chance that a GC could somehow
     // happen in there... (which would be pretty odd, granted).
     mCallback = aCallback;

dom/bindings/Codegen.py

@@ -1068,7 +1068,7 @@ class CGClassConstructor(CGAbstractStaticMethod):
     def generate_code(self):
         preamble = """
   JS::CallArgs args = JS::CallArgsFromVp(argc, vp);
-  JS::Rooted<JSObject*> obj(cx, JSVAL_TO_OBJECT(JS_CALLEE(cx, vp)));
+  JS::Rooted<JSObject*> obj(cx, &args.callee());
 """
         name = self._ctor.identifier.name
         nativeName = MakeNativeName(self.descriptor.binaryNames.get(name, name))
@@ -1090,7 +1090,7 @@ class CGConstructNavigatorObjectHelper(CGAbstractStaticMethod):
         CGAbstractStaticMethod.__init__(self, descriptor, name, rtype, args)
 
     def definition_body(self):
-        return genConstructorBody(self.descriptor)
+        return CGIndenter(CGGeneric(genConstructorBody(self.descriptor))).define()
 
 class CGConstructNavigatorObject(CGAbstractMethod):
     """
@@ -1485,6 +1485,15 @@ class MethodDefiner(PropertyDefiner):
                     self.chrome.append(toStringDesc)
                 else:
                     self.regular.append(toStringDesc)
+        elif (descriptor.interface.isJSImplemented() and
+              descriptor.interface.hasInterfaceObject()):
+            self.chrome.append({"name": '_create',
+                                "nativeName": ("%s::_Create" %
+                                               descriptor.name),
+                                "methodInfo": False,
+                                "length": 2,
+                                "flags": "0",
+                                "condition": MemberCondition(None, None) })
 
         if static:
             if not descriptor.interface.hasInterfaceObject():
@@ -1684,7 +1693,7 @@ class CGCreateInterfaceObjectsMethod(CGAbstractMethod):
     def __init__(self, descriptor, properties):
         args = [Argument('JSContext*', 'aCx'),
                 Argument('JS::Handle<JSObject*>', 'aGlobal'),
-                Argument('JSObject**', 'protoAndIfaceArray')]
+                Argument('JS::Heap<JSObject*>*', 'protoAndIfaceArray')]
         CGAbstractMethod.__init__(self, descriptor, 'CreateInterfaceObjects', 'void', args)
         self.properties = properties
     def definition_body(self):
@@ -1887,13 +1896,19 @@ class CGGetPerInterfaceObject(CGAbstractMethod):
     return JS::NullPtr();
   }
   /* Check to see whether the interface objects are already installed */
-  JSObject** protoAndIfaceArray = GetProtoAndIfaceArray(aGlobal);
+  JS::Heap<JSObject*>* protoAndIfaceArray = GetProtoAndIfaceArray(aGlobal);
   if (!protoAndIfaceArray[%s]) {
     CreateInterfaceObjects(aCx, aGlobal, protoAndIfaceArray);
   }
 
-  /* The object might _still_ be null, but that's OK */
+  /* 
-  return JS::Handle<JSObject*>::fromMarkedLocation(&protoAndIfaceArray[%s]);""" %
+   * The object might _still_ be null, but that's OK.
+   *
+   * Calling fromMarkedLocation() is safe because protoAndIfaceArray is
+   * traced by TraceProtoAndIfaceCache() and its contents are never
+   * changed after they have been set.
+   */
+  return JS::Handle<JSObject*>::fromMarkedLocation(protoAndIfaceArray[%s].address());""" %
                 (self.id, self.id))
 
 class CGGetProtoObjectMethod(CGGetPerInterfaceObject):
@@ -4420,6 +4435,11 @@ class CGCallGenerator(CGThing):
                 return False
             if needsConst(a):
                 arg = CGWrapper(arg, pre="Constify(", post=")")
+            # And convert NonNull<T> to T&
+            if (((a.type.isInterface() or a.type.isCallback()) and
+                 not a.type.nullable()) or
+                a.type.isDOMString()):
+                arg = CGWrapper(arg, pre="NonNullHelper(", post=")")
             args.append(arg)
 
         # Return values that go in outparams go here
@@ -8427,7 +8447,11 @@ class CGBindingRoot(CGThing):
         requiresContentUtils = any(d.interface.hasInterfaceObject() for d in descriptors)
         def descriptorHasChromeOnly(desc):
             return (any(isChromeOnly(a) for a in desc.interface.members) or
-                    desc.interface.getExtendedAttribute("ChromeOnly") is not None)
+                    desc.interface.getExtendedAttribute("ChromeOnly") is not None or
+                    # JS-implemented interfaces with an interface object get a
+                    # chromeonly _create method.
+                    (desc.interface.isJSImplemented() and
+                     desc.interface.hasInterfaceObject()))
         hasChromeOnly = any(descriptorHasChromeOnly(d) for d in descriptors)
         # XXXkhuey ugly hack but this is going away soon.
         isEventTarget = webIDLFile.endswith("EventTarget.webidl")
@@ -9229,20 +9253,20 @@ class CGJSImplMethod(CGNativeMember):
             args = args[2:]
             constructorArgs = [arg.name for arg in args]
             initCall = """
-  // Wrap the object before calling __Init so that __DOM_IMPL__ is available.
+// Wrap the object before calling __Init so that __DOM_IMPL__ is available.
-  nsCOMPtr<nsIGlobalObject> globalHolder = do_QueryInterface(window);
+nsCOMPtr<nsIGlobalObject> globalHolder = do_QueryInterface(window);
-  JS::Rooted<JSObject*> scopeObj(cx, globalHolder->GetGlobalJSObject());
+JS::Rooted<JSObject*> scopeObj(cx, globalHolder->GetGlobalJSObject());
-  JS::Rooted<JS::Value> wrappedVal(cx);
+JS::Rooted<JS::Value> wrappedVal(cx);
-  if (!WrapNewBindingObject(cx, scopeObj, impl, &wrappedVal)) {
+if (!WrapNewBindingObject(cx, scopeObj, impl, &wrappedVal)) {
-    MOZ_ASSERT(JS_IsExceptionPending(cx));
+  MOZ_ASSERT(JS_IsExceptionPending(cx));
-    aRv.Throw(NS_ERROR_UNEXPECTED);
+  aRv.Throw(NS_ERROR_UNEXPECTED);
-    return nullptr;
+  return nullptr;
-  }
+}
-  // Initialize the object with the constructor arguments.
+// Initialize the object with the constructor arguments.
-  impl->mImpl->__Init(%s);
+impl->mImpl->__Init(%s);
-  if (aRv.Failed()) {
+if (aRv.Failed()) {
-    return nullptr;
+  return nullptr;
-  }""" % (", ".join(constructorArgs))
+}""" % (", ".join(constructorArgs))
         else:
             initCall = ""
         return genConstructorBody(self.descriptor, initCall)
@@ -9385,6 +9409,15 @@ class CGJSImplClass(CGBindingImplClass):
             baseConstructors=baseConstructors,
             body=constructorBody)
 
+        self.methodDecls.append(
+            ClassMethod("_Create",
+                        "JSBool",
+                        [Argument("JSContext*", "cx"),
+                         Argument("unsigned", "argc"),
+                         Argument("JS::Value*", "vp")],
+                        static=True,
+                        body=self.getCreateFromExistingBody()))
+
         CGClass.__init__(self, descriptor.name,
                          bases=baseClasses,
                          constructors=[constructor],
@@ -9416,6 +9449,41 @@ class CGJSImplClass(CGBindingImplClass):
     def getGetParentObjectBody(self):
         return "return mParent;"
 
+    def getCreateFromExistingBody(self):
+        # XXXbz we could try to get parts of this (e.g. the argument
+        # conversions) auto-generated by somehow creating an IDLMethod and
+        # adding it to our interface, but we'd still need to special-case the
+        # implementation slightly to have it not try to forward to the JS
+        # object...
+        return string.Template(
+            "JS::CallArgs args = JS::CallArgsFromVp(argc, vp);\n"
+            "if (args.length() < 2) {\n"
+            '  return ThrowErrorMessage(cx, MSG_MISSING_ARGUMENTS, "${ifaceName}._create");\n'
+            "}\n"
+            "if (!args[0].isObject()) {\n"
+            '  return ThrowErrorMessage(cx, MSG_NOT_OBJECT, "Argument 1 of ${ifaceName}._create");\n'
+            "}\n"
+            "if (!args[1].isObject()) {\n"
+            '  return ThrowErrorMessage(cx, MSG_NOT_OBJECT, "Argument 2 of ${ifaceName}._create");\n'
+            "}\n"
+            "\n"
+            "// GlobalObject will go through wrappers as needed for us, and\n"
+            "// is simpler than the right UnwrapArg incantation.\n"
+            "GlobalObject global(cx, &args[0].toObject());\n"
+            "if (global.Failed()) {\n"
+            "  return false;\n"
+            "}\n"
+            "nsCOMPtr<nsPIDOMWindow> window = do_QueryInterface(global.Get());\n"
+            "if (!window) {\n"
+            '  return ThrowErrorMessage(cx, MSG_DOES_NOT_IMPLEMENT_INTERFACE, "Argument 1 of ${ifaceName}._create");\n'
+            "}\n"
+            "JS::Rooted<JSObject*> arg(cx, &args[1].toObject());\n"
+            "nsRefPtr<${implName}> impl = new ${implName}(arg, window);\n"
+            "return WrapNewBindingObject(cx, arg, impl, args.rval());").substitute({
+                "ifaceName": self.descriptor.interface.identifier.name,
+                "implName": self.descriptor.name
+                })
+
 def isJSImplementedDescriptor(descriptorProvider):
     return (isinstance(descriptorProvider, Descriptor) and
             descriptorProvider.interface.isJSImplemented())
@@ -9842,7 +9910,7 @@ class CallbackOperationBase(CallbackMethod):
         # This relies on getCallableDecl declaring a boolean
         # isCallable in the case when we're a single-operation
         # interface.
-        return "isCallable ? aThisObj : mCallback"
+        return "isCallable ? aThisObj.get() : mCallback"
 
     def getCallableDecl(self):
         replacements = {

dom/bindings/DOMJSClass.h

@@ -260,11 +260,11 @@ HasProtoAndIfaceArray(JSObject* global)
   return !js::GetReservedSlot(global, DOM_PROTOTYPE_SLOT).isUndefined();
 }
 
-inline JSObject**
+inline JS::Heap<JSObject*>*
 GetProtoAndIfaceArray(JSObject* global)
 {
   MOZ_ASSERT(js::GetObjectClass(global)->flags & JSCLASS_DOM_GLOBAL);
-  return static_cast<JSObject**>(
+  return static_cast<JS::Heap<JSObject*>*>(
     js::GetReservedSlot(global, DOM_PROTOTYPE_SLOT).toPrivate());
 }
 

dom/bindings/test/TestBindingHeader.h

@@ -275,7 +275,6 @@ public:
   TestInterface* ReceiveWeakSelf();
   TestInterface* ReceiveWeakNullableSelf();
   void PassSelf(TestInterface&);
-  void PassSelf2(NonNull<TestInterface>&);
   void PassNullableSelf(TestInterface*);
   already_AddRefed<TestInterface> NonNullSelf();
   void SetNonNullSelf(TestInterface&);
@@ -297,7 +296,6 @@ public:
   IndirectlyImplementedInterface* ReceiveWeakOther();
   IndirectlyImplementedInterface* ReceiveWeakNullableOther();
   void PassOther(IndirectlyImplementedInterface&);
-  void PassOther2(NonNull<IndirectlyImplementedInterface>&);
   void PassNullableOther(IndirectlyImplementedInterface*);
   already_AddRefed<IndirectlyImplementedInterface> NonNullOther();
   void SetNonNullOther(IndirectlyImplementedInterface&);
@@ -312,7 +310,6 @@ public:
   TestExternalInterface* ReceiveWeakExternal();
   TestExternalInterface* ReceiveWeakNullableExternal();
   void PassExternal(TestExternalInterface*);
-  void PassExternal2(TestExternalInterface*);
   void PassNullableExternal(TestExternalInterface*);
   already_AddRefed<TestExternalInterface> NonNullExternal();
   void SetNonNullExternal(TestExternalInterface*);
@@ -327,7 +324,6 @@ public:
   TestCallbackInterface* ReceiveWeakCallbackInterface();
   TestCallbackInterface* ReceiveWeakNullableCallbackInterface();
   void PassCallbackInterface(TestCallbackInterface&);
-  void PassCallbackInterface2(OwningNonNull<TestCallbackInterface>);
   void PassNullableCallbackInterface(TestCallbackInterface*);
   already_AddRefed<TestCallbackInterface> NonNullCallbackInterface();
   void SetNonNullCallbackInterface(TestCallbackInterface&);
@@ -808,6 +804,28 @@ private:
   void PassVariadicAny(JSContext*, Sequence<JS::Value>&) MOZ_DELETE;
   void PassVariadicObject(JSContext*, Sequence<JSObject*>&) MOZ_DELETE;
   void PassVariadicNullableObject(JSContext*, Sequence<JSObject*>&) MOZ_DELETE;
+
+  // Ensure NonNull does not leak in
+  void PassSelf(NonNull<TestInterface>&) MOZ_DELETE;
+  void PassSelf(OwningNonNull<TestInterface>&) MOZ_DELETE;
+  void PassSelf(const NonNull<TestInterface>&) MOZ_DELETE;
+  void PassSelf(const OwningNonNull<TestInterface>&) MOZ_DELETE;
+  void PassOther(NonNull<IndirectlyImplementedInterface>&) MOZ_DELETE;
+  void PassOther(const NonNull<IndirectlyImplementedInterface>&) MOZ_DELETE;
+  void PassOther(OwningNonNull<IndirectlyImplementedInterface>&) MOZ_DELETE;
+  void PassOther(const OwningNonNull<IndirectlyImplementedInterface>&) MOZ_DELETE;
+  void PassCallbackInterface(OwningNonNull<TestCallbackInterface>&) MOZ_DELETE;
+  void PassCallbackInterface(const OwningNonNull<TestCallbackInterface>&) MOZ_DELETE;
+  void PassCallbackInterface(NonNull<TestCallbackInterface>&) MOZ_DELETE;
+  void PassCallbackInterface(const NonNull<TestCallbackInterface>&) MOZ_DELETE;
+  void PassCallback(OwningNonNull<TestCallback>&) MOZ_DELETE;
+  void PassCallback(const OwningNonNull<TestCallback>&) MOZ_DELETE;
+  void PassCallback(NonNull<TestCallback>&) MOZ_DELETE;
+  void PassCallback(const NonNull<TestCallback>&) MOZ_DELETE;
+  void PassString(const NonNull<nsAString>&) MOZ_DELETE;
+  void PassString(NonNull<nsAString>&) MOZ_DELETE;
+  void PassString(const OwningNonNull<nsAString>&) MOZ_DELETE;
+  void PassString(OwningNonNull<nsAString>&) MOZ_DELETE;
 };
 
 class TestIndexedGetterInterface : public nsISupports,

dom/bindings/test/TestCodeGen.webidl

@@ -223,10 +223,7 @@ interface TestInterface {
   TestInterface? receiveNullableSelf();
   TestInterface receiveWeakSelf();
   TestInterface? receiveWeakNullableSelf();
-  // A verstion to test for casting to TestInterface&
   void passSelf(TestInterface arg);
-  // A version we can use to test for the exact type passed in
-  void passSelf2(TestInterface arg);
   void passNullableSelf(TestInterface? arg);
   attribute TestInterface nonNullSelf;
   attribute TestInterface? nullableSelf;
@@ -254,10 +251,7 @@ interface TestInterface {
   IndirectlyImplementedInterface? receiveNullableOther();
   IndirectlyImplementedInterface receiveWeakOther();
   IndirectlyImplementedInterface? receiveWeakNullableOther();
-  // A verstion to test for casting to IndirectlyImplementedInterface&
   void passOther(IndirectlyImplementedInterface arg);
-  // A version we can use to test for the exact type passed in
-  void passOther2(IndirectlyImplementedInterface arg);
   void passNullableOther(IndirectlyImplementedInterface? arg);
   attribute IndirectlyImplementedInterface nonNullOther;
   attribute IndirectlyImplementedInterface? nullableOther;
@@ -271,10 +265,7 @@ interface TestInterface {
   TestExternalInterface? receiveNullableExternal();
   TestExternalInterface receiveWeakExternal();
   TestExternalInterface? receiveWeakNullableExternal();
-  // A verstion to test for casting to TestExternalInterface&
   void passExternal(TestExternalInterface arg);
-  // A version we can use to test for the exact type passed in
-  void passExternal2(TestExternalInterface arg);
   void passNullableExternal(TestExternalInterface? arg);
   attribute TestExternalInterface nonNullExternal;
   attribute TestExternalInterface? nullableExternal;
@@ -288,10 +279,7 @@ interface TestInterface {
   TestCallbackInterface? receiveNullableCallbackInterface();
   TestCallbackInterface receiveWeakCallbackInterface();
   TestCallbackInterface? receiveWeakNullableCallbackInterface();
-  // A verstion to test for casting to TestCallbackInterface&
   void passCallbackInterface(TestCallbackInterface arg);
-  // A version we can use to test for the exact type passed in
-  void passCallbackInterface2(TestCallbackInterface arg);
   void passNullableCallbackInterface(TestCallbackInterface? arg);
   attribute TestCallbackInterface nonNullCallbackInterface;
   attribute TestCallbackInterface? nullableCallbackInterface;

dom/bindings/test/TestExampleGen.webidl

@@ -119,10 +119,7 @@ interface TestExampleInterface {
   TestInterface? receiveNullableSelf();
   TestInterface receiveWeakSelf();
   TestInterface? receiveWeakNullableSelf();
-  // A verstion to test for casting to TestInterface&
   void passSelf(TestInterface arg);
-  // A version we can use to test for the exact type passed in
-  void passSelf2(TestInterface arg);
   void passNullableSelf(TestInterface? arg);
   attribute TestInterface nonNullSelf;
   attribute TestInterface? nullableSelf;
@@ -150,10 +147,7 @@ interface TestExampleInterface {
   IndirectlyImplementedInterface? receiveNullableOther();
   IndirectlyImplementedInterface receiveWeakOther();
   IndirectlyImplementedInterface? receiveWeakNullableOther();
-  // A verstion to test for casting to IndirectlyImplementedInterface&
   void passOther(IndirectlyImplementedInterface arg);
-  // A version we can use to test for the exact type passed in
-  void passOther2(IndirectlyImplementedInterface arg);
   void passNullableOther(IndirectlyImplementedInterface? arg);
   attribute IndirectlyImplementedInterface nonNullOther;
   attribute IndirectlyImplementedInterface? nullableOther;
@@ -167,10 +161,7 @@ interface TestExampleInterface {
   TestExternalInterface? receiveNullableExternal();
   TestExternalInterface receiveWeakExternal();
   TestExternalInterface? receiveWeakNullableExternal();
-  // A verstion to test for casting to TestExternalInterface&
   void passExternal(TestExternalInterface arg);
-  // A version we can use to test for the exact type passed in
-  void passExternal2(TestExternalInterface arg);
   void passNullableExternal(TestExternalInterface? arg);
   attribute TestExternalInterface nonNullExternal;
   attribute TestExternalInterface? nullableExternal;
@@ -184,10 +175,7 @@ interface TestExampleInterface {
   TestCallbackInterface? receiveNullableCallbackInterface();
   TestCallbackInterface receiveWeakCallbackInterface();
   TestCallbackInterface? receiveWeakNullableCallbackInterface();
-  // A verstion to test for casting to TestCallbackInterface&
   void passCallbackInterface(TestCallbackInterface arg);
-  // A version we can use to test for the exact type passed in
-  void passCallbackInterface2(TestCallbackInterface arg);
   void passNullableCallbackInterface(TestCallbackInterface? arg);
   attribute TestCallbackInterface nonNullCallbackInterface;
   attribute TestCallbackInterface? nullableCallbackInterface;

dom/bindings/test/TestJSImplGen.webidl

@@ -136,8 +136,6 @@ interface TestJSImplInterface {
 
   // A version to test for casting to TestJSImplInterface&
   void passSelf(TestJSImplInterface arg);
-  // A version we can use to test for the exact type passed in
-  void passSelf2(TestJSImplInterface arg);
   void passNullableSelf(TestJSImplInterface? arg);
   attribute TestJSImplInterface nonNullSelf;
   attribute TestJSImplInterface? nullableSelf;
@@ -168,10 +166,7 @@ interface TestJSImplInterface {
   //IndirectlyImplementedInterface receiveWeakOther();
   //IndirectlyImplementedInterface? receiveWeakNullableOther();
 
-  // A verstion to test for casting to IndirectlyImplementedInterface&
   void passOther(IndirectlyImplementedInterface arg);
-  // A version we can use to test for the exact type passed in
-  void passOther2(IndirectlyImplementedInterface arg);
   void passNullableOther(IndirectlyImplementedInterface? arg);
   attribute IndirectlyImplementedInterface nonNullOther;
   attribute IndirectlyImplementedInterface? nullableOther;
@@ -186,10 +181,7 @@ interface TestJSImplInterface {
   // Callback interface ignores 'resultNotAddRefed'. See bug 843272.
   //TestExternalInterface receiveWeakExternal();
   //TestExternalInterface? receiveWeakNullableExternal();
-  // A verstion to test for casting to TestExternalInterface&
   void passExternal(TestExternalInterface arg);
-  // A version we can use to test for the exact type passed in
-  void passExternal2(TestExternalInterface arg);
   void passNullableExternal(TestExternalInterface? arg);
   attribute TestExternalInterface nonNullExternal;
   attribute TestExternalInterface? nullableExternal;
@@ -204,10 +196,7 @@ interface TestJSImplInterface {
   // Callback interface ignores 'resultNotAddRefed'. See bug 843272.
   //TestCallbackInterface receiveWeakCallbackInterface();
   //TestCallbackInterface? receiveWeakNullableCallbackInterface();
-  // A verstion to test for casting to TestCallbackInterface&
   void passCallbackInterface(TestCallbackInterface arg);
-  // A version we can use to test for the exact type passed in
-  void passCallbackInterface2(TestCallbackInterface arg);
   void passNullableCallbackInterface(TestCallbackInterface? arg);
   attribute TestCallbackInterface nonNullCallbackInterface;
   attribute TestCallbackInterface? nullableCallbackInterface;

dom/devicestorage/DeviceStorage.h

@@ -65,7 +65,7 @@ public:
                                                           uint32_t aFileType,
                                                           uint32_t aFileAttributes);
 
-  NS_DECL_ISUPPORTS
+  NS_DECL_THREADSAFE_ISUPPORTS
 
   bool IsAvailable();
   bool IsComposite();

dom/devicestorage/DeviceStorageRequestParent.cpp

@@ -250,8 +250,8 @@ DeviceStorageRequestParent::~DeviceStorageRequestParent()
   MOZ_COUNT_DTOR(DeviceStorageRequestParent);
 }
 
-NS_IMPL_THREADSAFE_ADDREF(DeviceStorageRequestParent)
+NS_IMPL_ADDREF(DeviceStorageRequestParent)
-NS_IMPL_THREADSAFE_RELEASE(DeviceStorageRequestParent)
+NS_IMPL_RELEASE(DeviceStorageRequestParent)
 
 void
 DeviceStorageRequestParent::ActorDestroy(ActorDestroyReason)

dom/devicestorage/DeviceStorageRequestParent.h

@@ -36,7 +36,8 @@ protected:
   ~DeviceStorageRequestParent();
 
 private:
-  nsAutoRefCnt mRefCnt;
+  ThreadSafeAutoRefCnt mRefCnt;
+  NS_DECL_OWNINGTHREAD
   DeviceStorageParams mParams;
 
   class CancelableRunnable : public nsRunnable

dom/devicestorage/nsDeviceStorage.cpp

@@ -1300,7 +1300,7 @@ DeviceStorageFile::GetStatusInternal(nsAString& aStorageName, nsAString& aStatus
 #endif
 }
 
-NS_IMPL_THREADSAFE_ISUPPORTS0(DeviceStorageFile)
+NS_IMPL_ISUPPORTS0(DeviceStorageFile)
 
 static void
 RegisterForSDCardChanges(nsIObserver* aObserver)

dom/file/ArchiveEvent.cpp

@@ -12,7 +12,7 @@
 
 USING_FILE_NAMESPACE
 
-NS_IMPL_THREADSAFE_ISUPPORTS0(ArchiveItem)
+NS_IMPL_ISUPPORTS0(ArchiveItem)
 
 ArchiveItem::ArchiveItem()
 {

dom/file/ArchiveEvent.h

@@ -24,7 +24,7 @@ BEGIN_FILE_NAMESPACE
 class ArchiveItem : public nsISupports
 {
 public:
-  NS_DECL_ISUPPORTS
+  NS_DECL_THREADSAFE_ISUPPORTS
 
   ArchiveItem();
   virtual ~ArchiveItem();

dom/file/ArchiveZipFile.cpp

@@ -49,7 +49,7 @@ public:
     Close();
   }
 
-  NS_DECL_ISUPPORTS
+  NS_DECL_THREADSAFE_ISUPPORTS
   NS_DECL_NSIINPUTSTREAM
   NS_DECL_NSISEEKABLESTREAM
 
@@ -82,9 +82,9 @@ private: // data
   } mData;
 };
 
-NS_IMPL_THREADSAFE_ISUPPORTS2(ArchiveInputStream,
+NS_IMPL_ISUPPORTS2(ArchiveInputStream,
-                              nsIInputStream,
+                   nsIInputStream,
-                              nsISeekableStream)
+                   nsISeekableStream)
 
 nsresult
 ArchiveInputStream::Init()

dom/file/AsyncHelper.cpp

@@ -14,7 +14,7 @@
 
 USING_FILE_NAMESPACE
 
-NS_IMPL_THREADSAFE_ISUPPORTS2(AsyncHelper, nsIRunnable, nsIRequest)
+NS_IMPL_ISUPPORTS2(AsyncHelper, nsIRunnable, nsIRequest)
 
 nsresult
 AsyncHelper::AsyncWork(nsIRequestObserver* aObserver, nsISupports* aCtxt)

dom/file/AsyncHelper.h

@@ -25,7 +25,7 @@ class AsyncHelper : public nsIRunnable,
                     public nsIRequest
 {
 public:
-  NS_DECL_ISUPPORTS
+  NS_DECL_THREADSAFE_ISUPPORTS
   NS_DECL_NSIRUNNABLE
   NS_DECL_NSIREQUEST
 

dom/file/FileHelper.cpp

@@ -41,7 +41,7 @@ FileHelper::~FileHelper()
                !mRequest, "Should have cleared this!");
 }
 
-NS_IMPL_THREADSAFE_ISUPPORTS1(FileHelper, nsIRequestObserver)
+NS_IMPL_ISUPPORTS1(FileHelper, nsIRequestObserver)
 
 nsresult
 FileHelper::Enqueue()

dom/file/FileHelper.h

@@ -45,7 +45,7 @@ class FileHelper : public nsIRequestObserver
   friend class FileOutputStreamWrapper;
 
 public:
-  NS_DECL_ISUPPORTS
+  NS_DECL_THREADSAFE_ISUPPORTS
   NS_DECL_NSIREQUESTOBSERVER
 
   nsresult

dom/file/FileService.cpp

@@ -343,8 +343,8 @@ FileService::LockedFileQueue::LockedFileQueue(LockedFile* aLockedFile)
   NS_ASSERTION(aLockedFile, "Null pointer!");
 }
 
-NS_IMPL_THREADSAFE_ADDREF(FileService::LockedFileQueue)
+NS_IMPL_ADDREF(FileService::LockedFileQueue)
-NS_IMPL_THREADSAFE_RELEASE(FileService::LockedFileQueue)
+NS_IMPL_RELEASE(FileService::LockedFileQueue)
 
 nsresult
 FileService::LockedFileQueue::Enqueue(FileHelper* aFileHelper)

dom/file/FileService.h

@@ -88,7 +88,7 @@ private:
     nsresult
     ProcessQueue();
 
-    nsAutoRefCnt mRefCnt;
+    ThreadSafeAutoRefCnt mRefCnt;
     NS_DECL_OWNINGTHREAD
     nsRefPtr<LockedFile> mLockedFile;
     nsTArray<nsRefPtr<FileHelper> > mQueue;

dom/file/FileStreamWrappers.cpp

@@ -19,7 +19,7 @@ namespace {
 class ProgressRunnable MOZ_FINAL : public nsIRunnable
 {
 public:
-  NS_DECL_ISUPPORTS
+  NS_DECL_THREADSAFE_ISUPPORTS
   NS_DECL_NSIRUNNABLE
 
   ProgressRunnable(FileHelper* aFileHelper,
@@ -40,7 +40,7 @@ private:
 class CloseRunnable MOZ_FINAL : public nsIRunnable
 {
 public:
-  NS_DECL_ISUPPORTS
+  NS_DECL_THREADSAFE_ISUPPORTS
   NS_DECL_NSIRUNNABLE
 
   CloseRunnable(FileHelper* aFileHelper)
@@ -54,7 +54,7 @@ private:
 class DestroyRunnable MOZ_FINAL : public nsIRunnable
 {
 public:
-  NS_DECL_ISUPPORTS
+  NS_DECL_THREADSAFE_ISUPPORTS
   NS_DECL_NSIRUNNABLE
 
   DestroyRunnable(FileHelper* aFileHelper)
@@ -101,7 +101,7 @@ FileStreamWrapper::~FileStreamWrapper()
   }
 }
 
-NS_IMPL_THREADSAFE_ISUPPORTS0(FileStreamWrapper)
+NS_IMPL_ISUPPORTS0(FileStreamWrapper)
 
 FileInputStreamWrapper::FileInputStreamWrapper(nsISupports* aFileStream,
                                                FileHelper* aFileHelper,
@@ -347,7 +347,7 @@ FileOutputStreamWrapper::IsNonBlocking(bool* _retval)
   return NS_OK;
 }
 
-NS_IMPL_THREADSAFE_ISUPPORTS1(ProgressRunnable, nsIRunnable)
+NS_IMPL_ISUPPORTS1(ProgressRunnable, nsIRunnable)
 
 NS_IMETHODIMP
 ProgressRunnable::Run()
@@ -360,7 +360,7 @@ ProgressRunnable::Run()
   return NS_OK;
 }
 
-NS_IMPL_THREADSAFE_ISUPPORTS1(CloseRunnable, nsIRunnable)
+NS_IMPL_ISUPPORTS1(CloseRunnable, nsIRunnable)
 
 NS_IMETHODIMP
 CloseRunnable::Run()
@@ -373,7 +373,7 @@ CloseRunnable::Run()
   return NS_OK;
 }
 
-NS_IMPL_THREADSAFE_ISUPPORTS1(DestroyRunnable, nsIRunnable)
+NS_IMPL_ISUPPORTS1(DestroyRunnable, nsIRunnable)
 
 NS_IMETHODIMP
 DestroyRunnable::Run()

dom/file/FileStreamWrappers.h

@@ -19,7 +19,7 @@ class FileHelper;
 class FileStreamWrapper : public nsISupports
 {
 public:
-  NS_DECL_ISUPPORTS
+  NS_DECL_THREADSAFE_ISUPPORTS
 
   FileStreamWrapper(nsISupports* aFileStream,
                     FileHelper* aFileHelper,

dom/file/LockedFile.cpp

@@ -923,7 +923,7 @@ FinishHelper::FinishHelper(LockedFile* aLockedFile)
   mStream.swap(aLockedFile->mStream);
 }
 
-NS_IMPL_THREADSAFE_ISUPPORTS1(FinishHelper, nsIRunnable)
+NS_IMPL_ISUPPORTS1(FinishHelper, nsIRunnable)
 
 NS_IMETHODIMP
 FinishHelper::Run()

dom/file/LockedFile.h

@@ -126,7 +126,7 @@ class FinishHelper MOZ_FINAL : public nsIRunnable
   friend class LockedFile;
 
 public:
-  NS_DECL_ISUPPORTS
+  NS_DECL_THREADSAFE_ISUPPORTS
   NS_DECL_NSIRUNNABLE
 
 private:

dom/file/MemoryStreams.cpp

@@ -27,7 +27,7 @@ MemoryOutputStream::Create(uint64_t aSize)
   return stream.forget();
 }
 
-NS_IMPL_THREADSAFE_ISUPPORTS1(MemoryOutputStream, nsIOutputStream)
+NS_IMPL_ISUPPORTS1(MemoryOutputStream, nsIOutputStream)
 
 NS_IMETHODIMP
 MemoryOutputStream::Close()

dom/file/MemoryStreams.h

@@ -16,7 +16,7 @@ BEGIN_FILE_NAMESPACE
 class MemoryOutputStream : public nsIOutputStream
 {
 public:
-  NS_DECL_ISUPPORTS
+  NS_DECL_THREADSAFE_ISUPPORTS
   NS_DECL_NSIOUTPUTSTREAM
 
   static already_AddRefed<MemoryOutputStream>

dom/indexedDB/AsyncConnectionHelper.cpp

@@ -185,8 +185,8 @@ AsyncConnectionHelper::~AsyncConnectionHelper()
   NS_ASSERTION(!mOldProgressHandler, "Should not have anything here!");
 }
 
-NS_IMPL_THREADSAFE_ISUPPORTS2(AsyncConnectionHelper, nsIRunnable,
+NS_IMPL_ISUPPORTS2(AsyncConnectionHelper, nsIRunnable,
-                                                     mozIStorageProgressHandler)
+                   mozIStorageProgressHandler)
 
 NS_IMETHODIMP
 AsyncConnectionHelper::Run()