diff --git a/Makefile.in b/Makefile.in
index 6ae7359f5a2b..fba5cd3b3881 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -253,13 +253,6 @@ endif
 ifdef BUILD_JS
 js/src/Makefile: subsrcdir := js/src
 
-ifdef ENABLE_TESTS
-# Incorporate static tier directories into tests. This should be incorporated
-# into moz.build files someday.
-check::
-	$(call SUBMAKE,$@,js/src)
-endif
-
 ifdef MOZ_PSEUDO_DERECURSE
 # Interdependencies for parallel export.
 js/xpconnect/src/export: dom/bindings/export xpcom/xpidl/export
diff --git a/accessible/src/base/Logging.cpp b/accessible/src/base/Logging.cpp
index 0e5b79629abc..435b79f358b1 100644
--- a/accessible/src/base/Logging.cpp
+++ b/accessible/src/base/Logging.cpp
@@ -99,22 +99,19 @@ LogDocShellState(nsIDocument* aDocumentNode)
   printf("docshell busy: ");
 
   nsAutoCString docShellBusy;
-  nsCOMPtr<nsISupports> container = aDocumentNode->GetContainer();
-  if (container) {
-    nsCOMPtr<nsIDocShell> docShell = do_QueryInterface(container);
-    uint32_t busyFlags = nsIDocShell::BUSY_FLAGS_NONE;
-    docShell->GetBusyFlags(&busyFlags);
-    if (busyFlags == nsIDocShell::BUSY_FLAGS_NONE)
-      printf("'none'");
-    if (busyFlags & nsIDocShell::BUSY_FLAGS_BUSY)
-      printf("'busy'");
-    if (busyFlags & nsIDocShell::BUSY_FLAGS_BEFORE_PAGE_LOAD)
-      printf(", 'before page load'");
-    if (busyFlags & nsIDocShell::BUSY_FLAGS_PAGE_LOADING)
-      printf(", 'page loading'");
-  } else {
+  nsCOMPtr<nsIDocShell> docShell = aDocumentNode->GetDocShell();
+  uint32_t busyFlags = nsIDocShell::BUSY_FLAGS_NONE;
+  docShell->GetBusyFlags(&busyFlags);
+  if (busyFlags == nsIDocShell::BUSY_FLAGS_NONE)
+    printf("'none'");
+  if (busyFlags & nsIDocShell::BUSY_FLAGS_BUSY)
+    printf("'busy'");
+  if (busyFlags & nsIDocShell::BUSY_FLAGS_BEFORE_PAGE_LOAD)
+    printf(", 'before page load'");
+  if (busyFlags & nsIDocShell::BUSY_FLAGS_PAGE_LOADING)
+    printf(", 'page loading'");
+
     printf("[failed]");
-  }
 }
 
 static void
@@ -132,8 +129,7 @@ static void
 LogDocShellTree(nsIDocument* aDocumentNode)
 {
   if (aDocumentNode->IsActive()) {
-    nsCOMPtr<nsISupports> container = aDocumentNode->GetContainer();
-    nsCOMPtr<nsIDocShellTreeItem> treeItem(do_QueryInterface(container));
+    nsCOMPtr<nsIDocShellTreeItem> treeItem(aDocumentNode->GetDocShell());
     nsCOMPtr<nsIDocShellTreeItem> parentTreeItem;
     treeItem->GetParent(getter_AddRefs(parentTreeItem));
     nsCOMPtr<nsIDocShellTreeItem> rootTreeItem;
diff --git a/accessible/src/base/nsAccessibilityService.cpp b/accessible/src/base/nsAccessibilityService.cpp
index 5804fb435284..0ea3d82ef5f6 100644
--- a/accessible/src/base/nsAccessibilityService.cpp
+++ b/accessible/src/base/nsAccessibilityService.cpp
@@ -200,8 +200,7 @@ nsAccessibilityService::GetRootDocumentAccessible(nsIPresShell* aPresShell,
   nsIPresShell* ps = aPresShell;
   nsIDocument* documentNode = aPresShell->GetDocument();
   if (documentNode) {
-    nsCOMPtr<nsISupports> container = documentNode->GetContainer();
-    nsCOMPtr<nsIDocShellTreeItem> treeItem(do_QueryInterface(container));
+    nsCOMPtr<nsIDocShellTreeItem> treeItem(documentNode->GetDocShell());
     if (treeItem) {
       nsCOMPtr<nsIDocShellTreeItem> rootTreeItem;
       treeItem->GetRootTreeItem(getter_AddRefs(rootTreeItem));
diff --git a/accessible/src/base/nsCoreUtils.cpp b/accessible/src/base/nsCoreUtils.cpp
index 00ccb9a702aa..13aee385f1ff 100644
--- a/accessible/src/base/nsCoreUtils.cpp
+++ b/accessible/src/base/nsCoreUtils.cpp
@@ -394,17 +394,14 @@ nsCoreUtils::GetDocShellFor(nsINode *aNode)
   if (!aNode)
     return nullptr;
 
-  nsCOMPtr<nsISupports> container = aNode->OwnerDoc()->GetContainer();
-  nsCOMPtr<nsIDocShell> docShell = do_QueryInterface(container);
+  nsCOMPtr<nsIDocShell> docShell = aNode->OwnerDoc()->GetDocShell();
   return docShell.forget();
 }
 
 bool
 nsCoreUtils::IsRootDocument(nsIDocument *aDocument)
 {
-  nsCOMPtr<nsISupports> container = aDocument->GetContainer();
-  nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem =
-    do_QueryInterface(container);
+  nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem = aDocument->GetDocShell();
   NS_ASSERTION(docShellTreeItem, "No document shell for document!");
 
   nsCOMPtr<nsIDocShellTreeItem> parentTreeItem;
@@ -416,9 +413,7 @@ nsCoreUtils::IsRootDocument(nsIDocument *aDocument)
 bool
 nsCoreUtils::IsContentDocument(nsIDocument *aDocument)
 {
-  nsCOMPtr<nsISupports> container = aDocument->GetContainer();
-  nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem =
-    do_QueryInterface(container);
+  nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem = aDocument->GetDocShell();
   NS_ASSERTION(docShellTreeItem, "No document shell tree item for document!");
 
   int32_t contentType;
@@ -429,8 +424,7 @@ nsCoreUtils::IsContentDocument(nsIDocument *aDocument)
 bool
 nsCoreUtils::IsTabDocument(nsIDocument* aDocumentNode)
 {
-  nsCOMPtr<nsISupports> container = aDocumentNode->GetContainer();
-  nsCOMPtr<nsIDocShellTreeItem> treeItem(do_QueryInterface(container));
+  nsCOMPtr<nsIDocShellTreeItem> treeItem(aDocumentNode->GetDocShell());
 
   nsCOMPtr<nsIDocShellTreeItem> parentTreeItem;
   treeItem->GetParent(getter_AddRefs(parentTreeItem));
diff --git a/accessible/src/generic/Accessible.cpp b/accessible/src/generic/Accessible.cpp
index 6a02c47efb22..b4b6a103b679 100644
--- a/accessible/src/generic/Accessible.cpp
+++ b/accessible/src/generic/Accessible.cpp
@@ -377,10 +377,8 @@ Accessible::AccessKey() const
   nsIDocument* document = mContent->GetCurrentDoc();
   if (!document)
     return KeyBinding();
-  nsCOMPtr<nsISupports> container = document->GetContainer();
-  if (!container)
-    return KeyBinding();
-  nsCOMPtr<nsIDocShellTreeItem> treeItem(do_QueryInterface(container));
+
+  nsCOMPtr<nsIDocShellTreeItem> treeItem(document->GetDocShell());
   if (!treeItem)
     return KeyBinding();
 
@@ -1294,9 +1292,7 @@ Accessible::NativeAttributes()
                                            nsCoreUtils::GetRoleContent(doc));
 
     // Allow ARIA live region markup from outer documents to override
-    nsCOMPtr<nsISupports> container = doc->GetContainer(); 
-    nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem =
-      do_QueryInterface(container);
+    nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem = doc->GetDocShell();
     if (!docShellTreeItem)
       break;
 
diff --git a/accessible/src/generic/Accessible.h b/accessible/src/generic/Accessible.h
index 61468f9abfdd..279745603305 100644
--- a/accessible/src/generic/Accessible.h
+++ b/accessible/src/generic/Accessible.h
@@ -244,6 +244,16 @@ public:
     return state;
   }
 
+  /**
+   * Return if accessible is unavailable.
+   */
+  bool Unavailable() const
+  {
+    uint64_t state = NativelyUnavailable() ? states::UNAVAILABLE : 0;
+    ApplyARIAState(&state);
+    return state & states::UNAVAILABLE;
+  }
+
   /**
    * Return the states of accessible, not taking into account ARIA states.
    * Use State() to get complete set of states.
diff --git a/accessible/src/generic/DocAccessible.cpp b/accessible/src/generic/DocAccessible.cpp
index 909c41ab1ba7..5963ce45c03d 100644
--- a/accessible/src/generic/DocAccessible.cpp
+++ b/accessible/src/generic/DocAccessible.cpp
@@ -688,8 +688,7 @@ DocAccessible::GetBoundsRect(nsRect& aBounds, nsIFrame** aRelativeFrame)
 nsresult
 DocAccessible::AddEventListeners()
 {
-  nsCOMPtr<nsISupports> container = mDocumentNode->GetContainer();
-  nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem(do_QueryInterface(container));
+  nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem(mDocumentNode->GetDocShell());
 
   // We want to add a command observer only if the document is content and has
   // an editor.
@@ -721,8 +720,7 @@ DocAccessible::RemoveEventListeners()
   if (mDocumentNode) {
     mDocumentNode->RemoveObserver(this);
 
-    nsCOMPtr<nsISupports> container = mDocumentNode->GetContainer();
-    nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem(do_QueryInterface(container));
+    nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem(mDocumentNode->GetDocShell());
     NS_ASSERTION(docShellTreeItem, "doc should support nsIDocShellTreeItem.");
 
     if (docShellTreeItem) {
@@ -870,7 +868,12 @@ DocAccessible::AttributeWillChange(nsIDocument* aDocument,
       aAttribute == nsGkAtoms::aria_pressed) {
     mARIAAttrOldValue = (aModType != nsIDOMMutationEvent::ADDITION) ?
       nsAccUtils::GetARIAToken(aElement, aAttribute) : nullptr;
+    return;
   }
+
+  if (aAttribute == nsGkAtoms::aria_disabled ||
+      aAttribute == nsGkAtoms::disabled)
+    mStateBitWasOn = accessible->Unavailable();
 }
 
 void
@@ -938,22 +941,24 @@ DocAccessible::AttributeChangedImpl(Accessible* aAccessible,
 
   // Universal boolean properties that don't require a role. Fire the state
   // change when disabled or aria-disabled attribute is set.
+  // Note. Checking the XUL or HTML namespace would not seem to gain us
+  // anything, because disabled attribute really is going to mean the same
+  // thing in any namespace.
+  // Note. We use the attribute instead of the disabled state bit because
+  // ARIA's aria-disabled does not affect the disabled state bit.
   if (aAttribute == nsGkAtoms::disabled ||
       aAttribute == nsGkAtoms::aria_disabled) {
-
-    // Note. Checking the XUL or HTML namespace would not seem to gain us
-    // anything, because disabled attribute really is going to mean the same
-    // thing in any namespace.
-
-    // Note. We use the attribute instead of the disabled state bit because
-    // ARIA's aria-disabled does not affect the disabled state bit.
+    // Do nothing if state wasn't changed (like @aria-disabled was removed but
+    // @disabled is still presented).
+    if (aAccessible->Unavailable() == mStateBitWasOn)
+      return;
 
     nsRefPtr<AccEvent> enabledChangeEvent =
-      new AccStateChangeEvent(aAccessible, states::ENABLED);
+      new AccStateChangeEvent(aAccessible, states::ENABLED, mStateBitWasOn);
     FireDelayedEvent(enabledChangeEvent);
 
     nsRefPtr<AccEvent> sensitiveChangeEvent =
-      new AccStateChangeEvent(aAccessible, states::SENSITIVE);
+      new AccStateChangeEvent(aAccessible, states::SENSITIVE, mStateBitWasOn);
     FireDelayedEvent(sensitiveChangeEvent);
     return;
   }
@@ -1987,8 +1992,7 @@ DocAccessible::ShutdownChildrenInSubtree(Accessible* aAccessible)
 bool
 DocAccessible::IsLoadEventTarget() const
 {
-  nsCOMPtr<nsISupports> container = mDocumentNode->GetContainer();
-  nsCOMPtr<nsIDocShellTreeItem> treeItem = do_QueryInterface(container);
+  nsCOMPtr<nsIDocShellTreeItem> treeItem = mDocumentNode->GetDocShell();
   NS_ASSERTION(treeItem, "No document shell for document!");
 
   nsCOMPtr<nsIDocShellTreeItem> parentTreeItem;
diff --git a/accessible/src/generic/DocAccessible.h b/accessible/src/generic/DocAccessible.h
index 6de2c3d7cc2e..b17737d43077 100644
--- a/accessible/src/generic/DocAccessible.h
+++ b/accessible/src/generic/DocAccessible.h
@@ -533,10 +533,16 @@ protected:
   nsCOMPtr<nsIContent> mAnchorJumpElm;
 
   /**
-   * Keep the ARIA attribute old value that is initialized by
-   * AttributeWillChange and used by AttributeChanged notifications.
+   * A generic state (see items below) before the attribute value was changed.
+   * @see AttributeWillChange and AttributeChanged notifications.
    */
-  nsIAtom* mARIAAttrOldValue;
+  union {
+    // ARIA attribute value
+    nsIAtom* mARIAAttrOldValue;
+
+    // True if the accessible state bit was on
+    bool mStateBitWasOn;
+  };
 
   nsTArray<nsRefPtr<DocAccessible> > mChildDocuments;
 
diff --git a/accessible/src/windows/msaa/IUnknownImpl.cpp b/accessible/src/windows/msaa/IUnknownImpl.cpp
index f6ae9f6a132c..4a9fa5383b23 100644
--- a/accessible/src/windows/msaa/IUnknownImpl.cpp
+++ b/accessible/src/windows/msaa/IUnknownImpl.cpp
@@ -23,7 +23,7 @@ GetHRESULT(nsresult aResult)
     case NS_OK:
       return S_OK;
 
-    case NS_ERROR_INVALID_ARG: case NS_ERROR_INVALID_POINTER:
+    case NS_ERROR_INVALID_ARG:
       return E_INVALIDARG;
 
     case NS_ERROR_OUT_OF_MEMORY:
diff --git a/accessible/tests/mochitest/events.js b/accessible/tests/mochitest/events.js
index 2676a8187826..525d56d6631d 100644
--- a/accessible/tests/mochitest/events.js
+++ b/accessible/tests/mochitest/events.js
@@ -1959,7 +1959,12 @@ var gA11yEventObserver =
         var type = eventTypeToString(event.eventType);
         var info = "Event type: " + type;
 
-        if (event instanceof nsIAccessibleTextChangeEvent) {
+        if (event instanceof nsIAccessibleStateChangeEvent) {
+          var stateStr = statesToString(event.isExtraState ? 0 : event.state,
+                                        event.isExtraState ? event.state : 0);
+          info += ", state: " + stateStr + ", is enabled: " + event.isEnabled;
+
+        } else if (event instanceof nsIAccessibleTextChangeEvent) {
           info += ", start: " + event.start + ", length: " + event.length +
             ", " + (event.isInserted ? "inserted" : "removed") +
             " text: " + event.modifiedText;
diff --git a/accessible/tests/mochitest/events/test_statechange.html b/accessible/tests/mochitest/events/test_statechange.html
index d877f6dd4b86..f4557376b548 100644
--- a/accessible/tests/mochitest/events/test_statechange.html
+++ b/accessible/tests/mochitest/events/test_statechange.html
@@ -143,18 +143,46 @@
         new stateChangeChecker(aState, aIsExtraState, true, getNode(aID))
       ];
 
-      this.invoke = function dupeStateChange_invoke()
+      this.invoke = function oppositeStateChange_invoke()
       {
         getNode(aID).setAttribute(aAttr, "false");
         getNode(aID).setAttribute(aAttr, "true");
       }
 
-      this.getID = function dupeStateChange_getID()
+      this.getID = function oppositeStateChange_getID()
       {
         return "opposite state change events";
       }
     }
 
+    /**
+     * Change concomitant ARIA and native attribute at once.
+     */
+    function echoingStateChange(aID, aARIAAttr, aAttr, aValue,
+                               aState, aIsExtraState, aIsEnabled)
+    {
+      this.eventSeq = [
+        new stateChangeChecker(aState, aIsExtraState, aIsEnabled, getNode(aID))
+      ];
+
+      this.invoke = function echoingStateChange_invoke()
+      {
+        if (aValue == null) {
+          getNode(aID).removeAttribute(aARIAAttr);
+          getNode(aID).removeAttribute(aAttr);
+
+        } else {
+          getNode(aID).setAttribute(aARIAAttr, aValue);
+          getNode(aID).setAttribute(aAttr, aValue);
+        }
+      }
+
+      this.getID = function echoingStateChange_getID()
+      {
+        return "enchoing ARIA and native attributes change";
+      }
+    }
+
     ////////////////////////////////////////////////////////////////////////////
     // Do tests
 
@@ -193,6 +221,11 @@
       gQueue.push(new oppositeStateChange("div", "aria-busy",
                                           STATE_BUSY, false));
 
+      gQueue.push(new echoingStateChange("text1", "aria-disabled", "disabled", "true",
+                                         EXT_STATE_ENABLED, true, false));
+      gQueue.push(new echoingStateChange("text1", "aria-disabled", "disabled", null,
+                                         EXT_STATE_ENABLED, true, true));
+
       gQueue.invoke(); // Will call SimpleTest.finish();
     }
 
@@ -223,6 +256,11 @@
      title="Fire statechange event whenever checked state is changed not depending on focused state">
     Bug 788389
   </a>
+  <a target="_blank"
+     href="https://bugzilla.mozilla.org/show_bug.cgi?id=926812"
+     title="State change event not fired when both disabled and aria-disabled are toggled">
+    Bug 926812
+  </a>
 
   <p id="display"></p>
   <div id="content" style="display: none"></div>
@@ -242,6 +280,8 @@
 
   <div id="div"></div>
 
+  <input id="text1">
+
   <div id="eventdump"></div>
 </body>
 </html>
diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index eeace1170aaa..ab8d7cb2e790 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "14a570c0af0ad29420a47318576fc365ebf7b10a", 
+    "revision": "89c57a31cebe0d8d94cbce4bcb47788b18f4fe84", 
     "repo_path": "/integration/gaia-central"
 }
diff --git a/browser/base/content/abouthealthreport/abouthealth.js b/browser/base/content/abouthealthreport/abouthealth.js
index 84c054bca44b..1475ce3599ed 100644
--- a/browser/base/content/abouthealthreport/abouthealth.js
+++ b/browser/base/content/abouthealthreport/abouthealth.js
@@ -24,6 +24,11 @@ const prefs = new Preferences("datareporting.healthreport.");
 
 let healthReportWrapper = {
   init: function () {
+    if (!reporter) {
+      healthReportWrapper.handleInitFailure();
+      return;
+    }
+
     reporter.onInit().then(healthReportWrapper.refreshPayload,
                            healthReportWrapper.handleInitFailure);
 
diff --git a/browser/base/content/pageinfo/pageInfo.js b/browser/base/content/pageinfo/pageInfo.js
index f3ba788a8c1b..4999a17b29a6 100644
--- a/browser/base/content/pageinfo/pageInfo.js
+++ b/browser/base/content/pageinfo/pageInfo.js
@@ -475,8 +475,7 @@ function openCacheEntry(key, cb)
     },
     onCacheEntryAvailable: function(entry, isNew, appCache, status) {
       cb(entry);
-    },
-    get mainThreadOnly() { return true; }
+    }
   };
   diskStorage.asyncOpenURI(Services.io.newURI(key, null, null), "", nsICacheStorage.OPEN_READONLY, checkCacheListener);
 }
diff --git a/browser/components/privatebrowsing/test/browser/browser.ini b/browser/components/privatebrowsing/test/browser/browser.ini
index 493e3e1a333d..2b71c0723132 100644
--- a/browser/components/privatebrowsing/test/browser/browser.ini
+++ b/browser/components/privatebrowsing/test/browser/browser.ini
@@ -17,8 +17,7 @@ support-files =
 [browser_privatebrowsing_DownloadLastDirWithCPS.js]
 [browser_privatebrowsing_aboutHomeButtonAfterWindowClose.js]
 [browser_privatebrowsing_aboutSessionRestore.js]
-# [browser_privatebrowsing_cache.js]
-# Disabled for too many intermittent failures (bug 895390)
+[browser_privatebrowsing_cache.js]
 [browser_privatebrowsing_certexceptionsui.js]
 [browser_privatebrowsing_concurrent.js]
 [browser_privatebrowsing_cookieacceptdialog.js]
diff --git a/build/automationutils.py b/build/automationutils.py
index 053246683c95..e0a3364667a3 100644
--- a/build/automationutils.py
+++ b/build/automationutils.py
@@ -60,10 +60,6 @@ DEBUGGER_INFO = {
     "args": "-q --args"
   },
 
-  "cgdb": {
-    "interactive": True,
-    "args": "-q --args"
-  },
   "cgdb": {
     "interactive": True,
     "args": "-q --args"
diff --git a/build/docs/index.rst b/build/docs/index.rst
index 0dd663db96af..8a7cb973b782 100644
--- a/build/docs/index.rst
+++ b/build/docs/index.rst
@@ -16,6 +16,7 @@ Important Concepts
    :maxdepth: 1
 
    build-overview
+   supported-configurations
    Mozconfig Files <mozconfigs>
    mozbuild-files
    mozbuild-symbols
diff --git a/build/docs/supported-configurations.rst b/build/docs/supported-configurations.rst
new file mode 100644
index 000000000000..cc2c1ea7282d
--- /dev/null
+++ b/build/docs/supported-configurations.rst
@@ -0,0 +1,55 @@
+.. _build_supported_configurations:
+
+========================
+Supported Configurations
+========================
+
+This page attempts to document supported build configurations.
+
+Windows
+=======
+
+We support building on Windows XP and newer operating systems using
+Visual Studio 2010 and newer.
+
+The following are not fully supported by Mozilla (but may work):
+
+* Building without the latest *MozillaBuild* Windows development
+  environment
+* Building with Mingw or any other non-Visual Studio toolchain.
+
+OS X
+====
+
+We support building on OS X 10.6 and newer with the OS X 10.6 SDK.
+
+The tree should build with the following OS X releases and SDK versions:
+
+* 10.6 Snow Leopard
+* 10.7 Lion
+* 10.8 Mountain Lion
+* 10.9 Mavericks
+
+The tree requires building with Clang 3.3 and newer. This corresponds to
+version of 4.2 of Apple's Clang that ships with Xcode. This corresponds
+to Xcode 4.6 and newer. Xcode 4.6 only runs on OS X 10.7.4 and newer.
+So, OS X 10.6 users will need to install a non-Apple toolchain. Running
+``mach bootstrap`` should install an appropriate toolchain from Homebrew
+or MacPorts automatically.
+
+The tree should build with GCC 4.4 and newer on OS X. However, this
+build configuration isn't as widely used (and differs from what Mozilla
+uses to produce OS X builds), so it's recommended to stick with Clang.
+
+Linux
+=====
+
+Linux 2.6 and later kernels are supported.
+
+Most distributions are supported as long as the proper package
+dependencies are in place. Running ``mach bootstrap`` should install
+packages for popular Linux distributions. ``configure`` will typically
+detect missing dependencies and inform you how to disable features to
+work around unsatisfied dependencies.
+
+Clang 3.3 or GCC 4.4 is required to build the tree.
diff --git a/chrome/src/nsChromeRegistry.cpp b/chrome/src/nsChromeRegistry.cpp
index d7dabde70631..1601fe88e29e 100644
--- a/chrome/src/nsChromeRegistry.cpp
+++ b/chrome/src/nsChromeRegistry.cpp
@@ -27,8 +27,10 @@
 #include "nsIPresShell.h"
 #include "nsIScriptError.h"
 #include "nsIWindowMediator.h"
+#include "mozilla/dom/URL.h"
 
 nsChromeRegistry* nsChromeRegistry::gChromeRegistry;
+using mozilla::dom::IsChromeURI;
 
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -371,14 +373,6 @@ nsChromeRegistry::FlushSkinCaches()
                           NS_CHROME_FLUSH_SKINS_TOPIC, nullptr);
 }
 
-static bool IsChromeURI(nsIURI* aURI)
-{
-    bool isChrome=false;
-    if (NS_SUCCEEDED(aURI->SchemeIs("chrome", &isChrome)) && isChrome)
-        return true;
-    return false;
-}
-
 // XXXbsmedberg: move this to windowmediator
 nsresult nsChromeRegistry::RefreshWindow(nsIDOMWindow* aWindow)
 {
diff --git a/config/check_vanilla_allocations.py b/config/check_vanilla_allocations.py
new file mode 100644
index 000000000000..74ea5e61d0c0
--- /dev/null
+++ b/config/check_vanilla_allocations.py
@@ -0,0 +1,159 @@
+# vim: set ts=8 sts=4 et sw=4 tw=79:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+#----------------------------------------------------------------------------
+# All heap allocations in SpiderMonkey must go through js_malloc, js_calloc,
+# js_realloc, and js_free.  This is so that any embedder who uses a custom
+# allocator (by defining JS_USE_CUSTOM_ALLOCATOR) will see all heap allocation
+# go through that custom allocator.
+#
+# Therefore, the presence of any calls to "vanilla" allocation/free functions
+# (e.g. malloc(), free()) is a bug.
+#
+# This script checks for the presence of such disallowed vanilla
+# allocation/free function in SpiderMonkey when it's built as a library.  It
+# relies on |nm| from the GNU binutils, and so only works on Linux, but one
+# platform is good enough to catch almost all violations.
+#
+# This checking is only 100% reliable in a JS_USE_CUSTOM_ALLOCATOR build in
+# which the default definitions of js_malloc et al (in Utility.h) -- which call
+# malloc et al -- are replaced with empty definitions.  This is because the
+# presence and possible inlining of the default js_malloc et al can cause
+# malloc/calloc/realloc/free calls show up in unpredictable places.
+#
+# Unfortunately, that configuration cannot be tested on Mozilla's standard
+# testing infrastructure.  Instead, by default this script only tests that none
+# of the other vanilla allocation/free functions (operator new, memalign, etc)
+# are present.  If given the --aggressive flag, it will also check for
+# malloc/calloc/realloc/free.
+#
+# Note:  We don't check for |operator delete| and |operator delete[]|.  These
+# can be present somehow due to virtual destructors, but this is not too
+# because vanilla delete/delete[] calls don't make sense without corresponding
+# vanilla new/new[] calls, and any explicit calls will be caught by Valgrind's
+# mismatched alloc/free checking.
+#----------------------------------------------------------------------------
+
+from __future__ import print_function
+
+import argparse
+import re
+import subprocess
+import sys
+
+# The obvious way to implement this script is to search for occurrences of
+# malloc et al, succeed if none are found, and fail is some are found.
+# However, "none are found" does not necessarily mean "none are present" --
+# this script could be buggy.  (Or the output format of |nm| might change in
+# the future.)
+#
+# So jsutil.cpp deliberately contains a (never-called) function that contains a
+# single use of all the vanilla allocation/free functions.  And this script
+# fails if it (a) finds uses of those functions in files other than jsutil.cpp,
+# *or* (b) fails to find them in jsutil.cpp.
+
+# Tracks overall success of the test.
+has_failed = False
+
+
+def fail(msg):
+    print('TEST-UNEXPECTED-FAIL | check_vanilla_allocations.py |', msg)
+    global has_failed
+    has_failed = True
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument('--aggressive', action='store_true',
+                        help='also check for malloc, calloc, realloc and free')
+    parser.add_argument('file', type=str,
+                        help='name of the file to check')
+    args = parser.parse_args()
+
+    # Run |nm|.  Options:
+    # -u: show only undefined symbols
+    # -C: demangle symbol names
+    # -l: show a filename and line number for each undefined symbol
+    cmd = ['nm', '-u', '-C', '-l', args.file]
+    lines = subprocess.check_output(cmd, universal_newlines=True,
+                                    stderr=subprocess.PIPE).split('\n')
+
+    # alloc_fns contains all the vanilla allocation/free functions that we look
+    # for. Regexp chars are escaped appropriately.
+
+    alloc_fns = [
+        # Matches |operator new(unsigned T)|, where |T| is |int| or |long|.
+        r'operator new\(unsigned',
+
+        # Matches |operator new[](unsigned T)|, where |T| is |int| or |long|.
+        r'operator new\[\]\(unsigned',
+
+        r'memalign',
+        # These two aren't available on all Linux configurations.
+        #r'posix_memalign',
+        #r'aligned_alloc',
+        r'valloc',
+        r'strdup'
+    ]
+
+    if args.aggressive:
+        alloc_fns += [
+            r'malloc',
+            r'calloc',
+            r'realloc',
+            r'free'
+        ]
+
+    # This is like alloc_fns, but regexp chars are not escaped.
+    alloc_fns_unescaped = [fn.translate(None, r'\\') for fn in alloc_fns]
+
+    # This regexp matches the relevant lines in the output of |nm|, which look
+    # like the following.
+    #
+    #   U malloc  /path/to/objdir/dist/include/js/Utility.h:142
+    #
+    alloc_fns_re = r'U (' + r'|'.join(alloc_fns) + r').*\/([\w\.]+):(\d+)$'
+
+    # This tracks which allocation/free functions have been seen in jsutil.cpp.
+    jsutil_cpp = set([])
+
+    for line in lines:
+        m = re.search(alloc_fns_re, line)
+        if m is None:
+            continue
+
+        fn = m.group(1)
+        filename = m.group(2)
+        linenum = m.group(3)
+        if filename == 'jsutil.cpp':
+            jsutil_cpp.add(fn)
+        else:
+            # An allocation is present in a non-special file.  Fail!
+            fail("'" + fn + "' present at " + filename + ':' + linenum)
+
+
+    # Check that all functions we expect are used in jsutil.cpp.  (This will
+    # fail if the function-detection code breaks at any point.)
+    for fn in alloc_fns_unescaped:
+        if fn not in jsutil_cpp:
+            fail("'" + fn + "' isn't used as expected in jsutil.cpp")
+        else:
+            jsutil_cpp.remove(fn)
+
+    # This should never happen, but check just in case.
+    if jsutil_cpp:
+        fail('unexpected allocation fns used in jsutil.cpp: ' +
+             ', '.join(jsutil_cpp))
+
+    if has_failed:
+        sys.exit(1)
+
+    print('TEST-PASS | check_vanilla_allocations.py | ok')
+    sys.exit(0)
+
+
+if __name__ == '__main__':
+    main()
+
diff --git a/config/find_vanilla_new_calls b/config/find_vanilla_new_calls
deleted file mode 100755
index 320abc1403eb..000000000000
--- a/config/find_vanilla_new_calls
+++ /dev/null
@@ -1,80 +0,0 @@
-# /bin/bash
-
-#----------------------------------------------------------------------------
-# We must avoid using the vanilla new/new[] operators (and consequently, the
-# vanilla delete/delete[] operators) in SpiderMonkey, see bug 624878 for why.
-#
-# This script:
-# - Detects if any of the vanilla new/new[] operators are used in a file.
-#   Its exit code is 1 if it found some, and 0 if it didn't.
-# - Doesn't detect delete/delete[] because it appears they can be present
-#   somehow due to virtual destructors, but this is ok because vanilla
-#   delete/delete[] calls don't make sense without corresponding new/new[]
-#   calls, and any explicit calls will be caught by Valgrind's mismatched
-#   alloc/free checking.
-# - Doesn't detect the 'nothrow' variants, which are ok but probably still
-#   best avoided.
-# - Is designed to only run on Linux (though it may also work on Mac);  one
-#   platform will be enough to catch any violations.
-#
-# If this script fails:
-# - You need to find the uses of vanilla new/delete and replace them with
-#   {js::OffTheBooks,JSContext,JSRuntime}::{new_,/array_new}.
-# - Run this script on each of the .o files, that should narrow it down.
-# - After that, one way to find them is to run 'objdump -r -C' on the
-#   relevant .o files.  For example, you might search for 'operator new' and
-#   find a record like this:
-#
-#  RELOCATION RECORDS FOR [.text._ZN3JSC14ExecutablePool6createEj]:
-#  OFFSET   TYPE              VALUE
-#  00000009 R_386_PC32        __i686.get_pc_thunk.bx
-#  0000000f R_386_GOTPC       _GLOBAL_OFFSET_TABLE_
-#  0000001b R_386_PLT32       operator new(unsigned int)
-#  0000002e R_386_PC32        JSC::ExecutablePool::ExecutablePool(unsigned int)
-#  0000004a R_386_PC32        JSC::ExecutablePool::~ExecutablePool()
-#  00000052 R_386_PLT32       operator delete(void*)
-#
-#   This says that vanilla 'new' and 'delete' are both used in
-#   JSC::ExecutablePool::create(unsigned int).  This doesn't always work,
-#   though.  (Nb: use 'c++filt' to demangle names like
-#   _ZN3JSC14ExecutablePool6createEj.)
-#
-# If that doesn't work, use grep.
-#----------------------------------------------------------------------------
-
-if [ -z $1 ] ; then
-    echo "usage: find_vanilla_new_calls <file>"
-    exit 1
-fi
-
-file=$1
-
-if [ ! -f $file ] ; then
-    echo "TEST-UNEXPECTED-FAIL | find_vanilla_new_calls | file '$file' not found"
-    exit 1
-fi
-
-tmpfile1=`mktemp`
-tmpfile2=`mktemp`
-nm -C $file > $tmpfile1
-
-# Need to double-escape '[' and ']' to stop grep from interpreting them
-# specially.
-grep '^operator new(unsigned int)'        $tmpfile1 >> $tmpfile2
-grep '^operator new(unsigned long)'       $tmpfile1 >> $tmpfile2
-grep '^operator new\\[\\](unsigned int)'  $tmpfile1 >> $tmpfile2
-grep '^operator new\\[\\](unsigned long)' $tmpfile1 >> $tmpfile2
-rm -f $tmpfile1
-
-if [ -s $tmpfile2 ] ; then
-    echo "TEST-UNEXPECTED-FAIL | find_vanilla_new_calls | found calls are listed below"
-    cat $tmpfile2
-    echo
-    rm -f $tmpfile2
-    exit 1
-fi
-
-echo "TEST-PASS | find_vanilla_new_calls | ok"
-echo
-
-exit 0
diff --git a/configure.in b/configure.in
index b5f39812ad6f..6e983105fa3d 100644
--- a/configure.in
+++ b/configure.in
@@ -3942,6 +3942,7 @@ MOZ_OPUS=1
 MOZ_WEBM=1
 MOZ_DIRECTSHOW=
 MOZ_WMF=
+MOZ_FMP4=
 MOZ_WEBRTC=1
 MOZ_PEERCONNECTION=
 MOZ_SRTP=
@@ -5275,6 +5276,26 @@ if test -n "$MOZ_WMF"; then
     MOZ_CUBEB=1
 fi;
 
+dnl ========================================================
+dnl = Built-in fragmented MP4 support.
+dnl ========================================================
+if test -n "$MOZ_WMF"; then
+    dnl Enable fragmented MP4 parser on Windows by default.
+    dnl We will also need to enable it on other platforms as we implement
+    dnl platform decoder support there too.
+    MOZ_FMP4=1
+fi
+
+MOZ_ARG_DISABLE_BOOL(fmp4,
+[  --disable-fmp4  Disable support for in built Fragmented MP4 parsing],
+    MOZ_FMP4=,
+    MOZ_FMP4=1)
+
+if test -n "$MOZ_FMP4"; then
+    AC_DEFINE(MOZ_FMP4)
+fi;
+
+
 dnl ========================================================
 dnl = Enable media plugin support
 dnl ========================================================
@@ -8627,6 +8648,7 @@ AC_SUBST(MOZ_TREMOR)
 AC_SUBST(MOZ_OPUS)
 AC_SUBST(MOZ_WEBM)
 AC_SUBST(MOZ_WMF)
+AC_SUBST(MOZ_FMP4)
 AC_SUBST(MOZ_DIRECTSHOW)
 AC_SUBST(MOZ_MEDIA_PLUGINS)
 AC_SUBST(MOZ_APPLEMEDIA)
diff --git a/content/base/public/nsContentUtils.h b/content/base/public/nsContentUtils.h
index 1e8b5825fe0f..09275fb98ac4 100644
--- a/content/base/public/nsContentUtils.h
+++ b/content/base/public/nsContentUtils.h
@@ -1886,6 +1886,15 @@ public:
    */
   static bool IsSubDocumentTabbable(nsIContent* aContent);
 
+  /**
+   * Returns if aNode ignores user focus.
+   *
+   * @param aNode node to test
+   *
+   * @return Whether the node ignores user focus.
+   */
+  static bool IsUserFocusIgnored(nsINode* aNode);
+
   /**
    * Flushes the layout tree (recursively)
    *
diff --git a/content/base/public/nsIContent.h b/content/base/public/nsIContent.h
index a81dd3f656e4..a9a668e1ed57 100644
--- a/content/base/public/nsIContent.h
+++ b/content/base/public/nsIContent.h
@@ -34,8 +34,8 @@ enum nsLinkState {
 
 // IID for the nsIContent interface
 #define NS_ICONTENT_IID \
-{ 0x976f4cd1, 0xbdfc, 0x4a1e, \
-  { 0x82, 0x46, 0x1c, 0x13, 0x9c, 0xd3, 0x73, 0x7f } }
+{ 0x34117ca3, 0x45d0, 0x479e, \
+  { 0x91, 0x30, 0x54, 0x49, 0xa9, 0x5f, 0x25, 0x99 } }
 
 /**
  * A node of content in a document's content model. This interface
@@ -557,12 +557,8 @@ public:
    *         > 0 can be tabbed to in the order specified by this value
    * @return whether the content is focusable via mouse, kbd or script.
    */
-  virtual bool IsFocusable(int32_t *aTabIndex = nullptr, bool aWithMouse = false)
-  {
-    if (aTabIndex) 
-      *aTabIndex = -1; // Default, not tabbable
-    return false;
-  }
+  bool IsFocusable(int32_t* aTabIndex = nullptr, bool aWithMouse = false);
+  virtual bool IsFocusableInternal(int32_t* aTabIndex, bool aWithMouse);
 
   /**
    * The method focuses (or activates) element that accesskey is bound to. It is
diff --git a/content/base/public/nsIDocument.h b/content/base/public/nsIDocument.h
index 1e94bb1fea7b..3dd94806355b 100644
--- a/content/base/public/nsIDocument.h
+++ b/content/base/public/nsIDocument.h
@@ -20,6 +20,7 @@
 #include "nsPropertyTable.h"             // for member
 #include "nsTHashtable.h"                // for member
 #include "mozilla/dom/DocumentBinding.h"
+#include "mozilla/WeakPtr.h"
 #include "Units.h"
 #include "nsExpirationTracker.h"
 #include "nsClassHashtable.h"
@@ -28,6 +29,8 @@ class imgIRequest;
 class nsAString;
 class nsBindingManager;
 class nsCSSStyleSheet;
+class nsIDocShell;
+class nsDocShell;
 class nsDOMNavigationTiming;
 class nsDOMTouchList;
 class nsEventStates;
@@ -1150,22 +1153,23 @@ public:
    * Set the container (docshell) for this document. Virtual so that
    * docshell can call it.
    */
-  virtual void SetContainer(nsISupports *aContainer);
+  virtual void SetContainer(nsDocShell* aContainer);
 
   /**
    * Get the container (docshell) for this document.
    */
-  already_AddRefed<nsISupports> GetContainer() const
-  {
-    nsCOMPtr<nsISupports> container = do_QueryReferent(mDocumentContainer);
-    return container.forget();
-  }
+  virtual nsISupports* GetContainer() const;
 
   /**
    * Get the container's load context for this document.
    */
   nsILoadContext* GetLoadContext() const;
 
+  /**
+   * Get docshell the for this document.
+   */
+  nsIDocShell* GetDocShell() const;
+
   /**
    * Set and get XML declaration. If aVersion is null there is no declaration.
    * aStandalone takes values -1, 0 and 1 indicating respectively that there
@@ -1526,7 +1530,7 @@ public:
   void SetDisplayDocument(nsIDocument* aDisplayDocument)
   {
     NS_PRECONDITION(!GetShell() &&
-                    !nsCOMPtr<nsISupports>(GetContainer()) &&
+                    !GetContainer() &&
                     !GetWindow(),
                     "Shouldn't set mDisplayDocument on documents that already "
                     "have a presentation or a docshell or a window");
@@ -1696,7 +1700,7 @@ public:
    * @param aCloneContainer The container for the clone document.
    */
   virtual already_AddRefed<nsIDocument>
-  CreateStaticClone(nsISupports* aCloneContainer);
+  CreateStaticClone(nsIDocShell* aCloneContainer);
 
   /**
    * If this document is a static clone, this returns the original
@@ -2227,7 +2231,7 @@ protected:
 
   nsWeakPtr mDocumentLoadGroup;
 
-  nsWeakPtr mDocumentContainer;
+  mozilla::WeakPtr<nsDocShell> mDocumentContainer;
 
   nsCString mCharacterSet;
   int32_t mCharacterSetSource;
@@ -2390,6 +2394,14 @@ protected:
   // caches.
   bool mDidDocumentOpen;
 
+#ifdef DEBUG
+  /**
+   * This is true while FlushPendingLinkUpdates executes.  Calls to
+   * [Un]RegisterPendingLinkUpdate will assert when this is true.
+   */
+  bool mIsLinkUpdateRegistrationsForbidden;
+#endif
+
   // The document's script global object, the object from which the
   // document can get its script context and scope. This is the
   // *inner* window object.
diff --git a/content/base/public/nsIXMLHttpRequest.idl b/content/base/public/nsIXMLHttpRequest.idl
index 5ea99210820e..9cab424bc3c7 100644
--- a/content/base/public/nsIXMLHttpRequest.idl
+++ b/content/base/public/nsIXMLHttpRequest.idl
@@ -16,7 +16,7 @@ interface nsIGlobalObject;
 interface nsIInputStream;
 interface nsIDOMBlob;
 
-[scriptable, builtinclass, uuid(ac97e161-9f1d-4163-adc9-e9a59e18682c)]
+[scriptable, builtinclass, uuid(5ced7e7a-e2c3-4563-a57d-31b97ce64dc5)]
 interface nsIXMLHttpRequestEventTarget : nsIDOMEventTarget {
   // event handler attributes
 };
diff --git a/content/base/src/FragmentOrElement.cpp b/content/base/src/FragmentOrElement.cpp
index 5530891fa00b..702f62232600 100644
--- a/content/base/src/FragmentOrElement.cpp
+++ b/content/base/src/FragmentOrElement.cpp
@@ -838,6 +838,33 @@ nsIContent::AttrValueIs(int32_t aNameSpaceID,
     AsElement()->AttrValueIs(aNameSpaceID, aName, aValue, aCaseSensitive);
 }
 
+bool
+nsIContent::IsFocusable(int32_t* aTabIndex, bool aWithMouse)
+{
+  bool focusable = IsFocusableInternal(aTabIndex, aWithMouse);
+  // Ensure that the return value and aTabIndex are consistent in the case
+  // we're in userfocusignored context.
+  if (focusable || (aTabIndex && *aTabIndex != -1)) {
+    if (nsContentUtils::IsUserFocusIgnored(this)) {
+      if (aTabIndex) {
+        *aTabIndex = -1;
+      }
+      return false;
+    }
+    return focusable;
+  }
+  return false;
+}
+
+bool
+nsIContent::IsFocusableInternal(int32_t* aTabIndex, bool aWithMouse)
+{
+  if (aTabIndex) {
+    *aTabIndex = -1; // Default, not tabbable
+  }
+  return false;
+}
+
 const nsAttrValue*
 FragmentOrElement::DoGetClasses() const
 {
diff --git a/content/base/src/moz.build b/content/base/src/moz.build
index 1de7ffd911ec..d17d7e434edf 100644
--- a/content/base/src/moz.build
+++ b/content/base/src/moz.build
@@ -201,6 +201,7 @@ LOCAL_INCLUDES += [
     '/content/xslt/src/xpath',
     '/content/xul/content/src',
     '/content/xul/document/src',
+    '/docshell/base',
     '/dom/base',
     '/dom/ipc',
     '/dom/workers',
diff --git a/content/base/src/nsContentUtils.cpp b/content/base/src/nsContentUtils.cpp
index 787a1d5fd2c7..34f3a9d8fc35 100644
--- a/content/base/src/nsContentUtils.cpp
+++ b/content/base/src/nsContentUtils.cpp
@@ -74,6 +74,7 @@
 #include "nsEventStateManager.h"
 #include "nsFocusManager.h"
 #include "nsGenericHTMLElement.h"
+#include "nsGenericHTMLFrameElement.h"
 #include "nsGkAtoms.h"
 #include "nsHostObjectProtocolHandler.h"
 #include "nsHtml5Module.h"
@@ -378,6 +379,9 @@ nsContentUtils::Init()
     return NS_ERROR_FAILURE;
   NS_ADDREF(sSecurityManager);
 
+  // Getting the first context can trigger GC, so do this non-lazily.
+  sXPConnect->InitSafeJSContext();
+
   rv = CallGetService(NS_IOSERVICE_CONTRACTID, &sIOService);
   if (NS_FAILED(rv)) {
     // This makes life easier, but we can live without it.
@@ -387,7 +391,7 @@ nsContentUtils::Init()
 
   rv = CallGetService(NS_LBRK_CONTRACTID, &sLineBreaker);
   NS_ENSURE_SUCCESS(rv, rv);
-  
+
   rv = CallGetService(NS_WBRK_CONTRACTID, &sWordBreaker);
   NS_ENSURE_SUCCESS(rv, rv);
 
@@ -2622,10 +2626,7 @@ nsContentUtils::CanLoadImage(nsIURI* aURI, nsISupports* aContext,
   uint32_t appType = nsIDocShell::APP_TYPE_UNKNOWN;
 
   {
-    nsCOMPtr<nsISupports> container = aLoadingDocument->GetContainer();
-    nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem =
-      do_QueryInterface(container);
-
+    nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem = aLoadingDocument->GetDocShell();
     if (docShellTreeItem) {
       nsCOMPtr<nsIDocShellTreeItem> root;
       docShellTreeItem->GetRootTreeItem(getter_AddRefs(root));
@@ -3153,8 +3154,7 @@ nsContentUtils::IsChromeDoc(nsIDocument *aDocument)
 bool
 nsContentUtils::IsChildOfSameType(nsIDocument* aDoc)
 {
-  nsCOMPtr<nsISupports> container = aDoc->GetContainer();
-  nsCOMPtr<nsIDocShellTreeItem> docShellAsItem(do_QueryInterface(container));
+  nsCOMPtr<nsIDocShellTreeItem> docShellAsItem(aDoc->GetDocShell());
   nsCOMPtr<nsIDocShellTreeItem> sameTypeParent;
   if (docShellAsItem) {
     docShellAsItem->GetSameTypeParent(getter_AddRefs(sameTypeParent));
@@ -3235,8 +3235,7 @@ nsContentUtils::IsInChromeDocshell(nsIDocument *aDocument)
     return IsInChromeDocshell(aDocument->GetDisplayDocument());
   }
 
-  nsCOMPtr<nsISupports> docContainer = aDocument->GetContainer();
-  nsCOMPtr<nsIDocShellTreeItem> docShell(do_QueryInterface(docContainer));
+  nsCOMPtr<nsIDocShellTreeItem> docShell(aDocument->GetDocShell());
   int32_t itemType = nsIDocShellTreeItem::typeContent;
   if (docShell) {
     docShell->GetItemType(&itemType);
@@ -4976,8 +4975,7 @@ nsContentUtils::HidePopupsInDocument(nsIDocument* aDocument)
 #ifdef MOZ_XUL
   nsXULPopupManager* pm = nsXULPopupManager::GetInstance();
   if (pm && aDocument) {
-    nsCOMPtr<nsISupports> container = aDocument->GetContainer();
-    nsCOMPtr<nsIDocShellTreeItem> docShellToHide = do_QueryInterface(container);
+    nsCOMPtr<nsIDocShellTreeItem> docShellToHide = aDocument->GetDocShell();
     if (docShellToHide)
       pm->HidePopupsInDocShell(docShellToHide);
   }
@@ -5877,8 +5875,7 @@ nsContentUtils::IsSubDocumentTabbable(nsIContent* aContent)
     return false;
   }
 
-  nsCOMPtr<nsISupports> container = subDoc->GetContainer();
-  nsCOMPtr<nsIDocShell> docShell = do_QueryInterface(container);
+  nsCOMPtr<nsIDocShell> docShell = subDoc->GetDocShell();
   if (!docShell) {
     return false;
   }
@@ -5898,6 +5895,30 @@ nsContentUtils::IsSubDocumentTabbable(nsIContent* aContent)
   return !zombieViewer;
 }
 
+bool
+nsContentUtils::IsUserFocusIgnored(nsINode* aNode)
+{
+  if (!nsGenericHTMLFrameElement::BrowserFramesEnabled()) {
+    return false;
+  }
+
+  // Check if our mozbrowser iframe ancestors has ignoreuserfocus attribute.
+  while (aNode) {
+    nsCOMPtr<nsIMozBrowserFrame> browserFrame = do_QueryInterface(aNode);
+    if (browserFrame &&
+        aNode->AsElement()->HasAttr(kNameSpaceID_None, nsGkAtoms::ignoreuserfocus) &&
+        browserFrame->GetReallyIsBrowserOrApp()) {
+      return true;
+    }
+    nsPIDOMWindow* win = aNode->OwnerDoc()->GetWindow();
+    if (win) {
+      aNode = win->GetFrameElementInternal();
+    }
+  }
+
+  return false;
+}
+
 void
 nsContentUtils::FlushLayoutForTree(nsIDOMWindow* aWindow)
 {
@@ -5988,8 +6009,7 @@ nsContentUtils::FindPresShellForDocument(const nsIDocument* aDoc)
     return shell;
   }
 
-  nsCOMPtr<nsISupports> container = doc->GetContainer();
-  nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem = do_QueryInterface(container);
+  nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem = doc->GetDocShell();
   while (docShellTreeItem) {
     // We may be in a display:none subdocument, or we may not have a presshell
     // created yet.
diff --git a/content/base/src/nsDocument.cpp b/content/base/src/nsDocument.cpp
index 89fbdb9c40c5..8a44a60dbe16 100644
--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@@ -10,6 +10,7 @@
 
 #include "nsDocument.h"
 
+#include "mozilla/AutoRestore.h"
 #include "mozilla/DebugOnly.h"
 #include "mozilla/MemoryReporting.h"
 #include "mozilla/Util.h"
@@ -33,7 +34,7 @@
 #include "nsIBaseWindow.h"
 #include "mozilla/css/Loader.h"
 #include "mozilla/css/ImageLoader.h"
-#include "nsIDocShell.h"
+#include "nsDocShell.h"
 #include "nsIDocShellTreeItem.h"
 #include "nsCOMArray.h"
 #include "nsDOMClassInfo.h"
@@ -2203,7 +2204,7 @@ nsDocument::ResetToURI(nsIURI *aURI, nsILoadGroup *aLoadGroup,
     nsIScriptSecurityManager *securityManager =
       nsContentUtils::GetSecurityManager();
     if (securityManager) {
-      nsCOMPtr<nsIDocShell> docShell = do_QueryReferent(mDocumentContainer);
+      nsCOMPtr<nsIDocShell> docShell(mDocumentContainer);
 
       if (!docShell && aLoadGroup) {
         nsCOMPtr<nsIInterfaceRequestor> cbs;
@@ -2699,7 +2700,7 @@ nsDocument::InitCSP(nsIChannel* aChannel)
   }
 
   // ----- Enforce frame-ancestor policy on any applied policies
-  nsCOMPtr<nsIDocShell> docShell = do_QueryReferent(mDocumentContainer);
+  nsCOMPtr<nsIDocShell> docShell(mDocumentContainer);
   if (docShell) {
     bool safeAncestry = false;
 
@@ -2930,7 +2931,7 @@ nsresult
 nsDocument::GetAllowPlugins(bool * aAllowPlugins)
 {
   // First, we ask our docshell if it allows plugins.
-  nsCOMPtr<nsIDocShell> docShell = do_QueryReferent(mDocumentContainer);
+  nsCOMPtr<nsIDocShell> docShell(mDocumentContainer);
 
   if (docShell) {
     docShell->GetAllowPlugins(aAllowPlugins);
@@ -3398,7 +3399,7 @@ nsDocument::SetHeaderData(nsIAtom* aHeaderField, const nsAString& aData)
   if (aHeaderField == nsGkAtoms::refresh) {
     // We get into this code before we have a script global yet, so get to
     // our container via mDocumentContainer.
-    nsCOMPtr<nsIRefreshURI> refresher = do_QueryReferent(mDocumentContainer);
+    nsCOMPtr<nsIRefreshURI> refresher(mDocumentContainer);
     if (refresher) {
       // Note: using mDocumentURI instead of mBaseURI here, for consistency
       // (used to just use the current URI of our webnavigation, but that
@@ -3479,7 +3480,7 @@ nsDocument::doCreateShell(nsPresContext* aContext,
   mPresShell = shell;
 
   // Make sure to never paint if we belong to an invisible DocShell.
-  nsCOMPtr<nsIDocShell> docShell = do_QueryReferent(mDocumentContainer);
+  nsCOMPtr<nsIDocShell> docShell(mDocumentContainer);
   if (docShell && docShell->IsInvisible())
     shell->SetNeverPainting(true);
 
@@ -4212,29 +4213,41 @@ NotifyActivityChanged(nsIContent *aContent, void *aUnused)
 }
 
 void
-nsIDocument::SetContainer(nsISupports* aContainer)
+nsIDocument::SetContainer(nsDocShell* aContainer)
 {
-  mDocumentContainer = do_GetWeakReference(aContainer);
-  EnumerateFreezableElements(NotifyActivityChanged, nullptr);
-  // Get the Docshell
-  nsCOMPtr<nsIDocShell> docShell = do_QueryInterface(aContainer);
-  if (docShell) {
-    int32_t itemType;
-    docShell->GetItemType(&itemType);
-    // check itemtype
-    if (itemType == nsIDocShellTreeItem::typeContent) {
-      // check if same type root
-      nsCOMPtr<nsIDocShellTreeItem> sameTypeRoot;
-      docShell->GetSameTypeRootTreeItem(getter_AddRefs(sameTypeRoot));
-      NS_ASSERTION(sameTypeRoot, "No document shell root tree item from document shell tree item!");
+  if (aContainer) {
+    mDocumentContainer = aContainer->asWeakPtr();
+  } else {
+    mDocumentContainer = WeakPtr<nsDocShell>();
+  }
 
-      if (sameTypeRoot == docShell) {
-        static_cast<nsDocument*>(this)->SetIsTopLevelContentDocument(true);
-      }
+  EnumerateFreezableElements(NotifyActivityChanged, nullptr);
+  if (!aContainer) {
+    return;
+  }
+
+  // Get the Docshell
+  int32_t itemType;
+  aContainer->GetItemType(&itemType);
+  // check itemtype
+  if (itemType == nsIDocShellTreeItem::typeContent) {
+    // check if same type root
+    nsCOMPtr<nsIDocShellTreeItem> sameTypeRoot;
+    aContainer->GetSameTypeRootTreeItem(getter_AddRefs(sameTypeRoot));
+    NS_ASSERTION(sameTypeRoot, "No document shell root tree item from document shell tree item!");
+
+    if (sameTypeRoot == aContainer) {
+      static_cast<nsDocument*>(this)->SetIsTopLevelContentDocument(true);
     }
   }
 }
 
+nsISupports*
+nsIDocument::GetContainer() const
+{
+  return static_cast<nsIDocShell*>(mDocumentContainer);
+}
+
 void
 nsDocument::SetScriptGlobalObject(nsIScriptGlobalObject *aScriptGlobalObject)
 {
@@ -4292,7 +4305,7 @@ nsDocument::SetScriptGlobalObject(nsIScriptGlobalObject *aScriptGlobalObject)
 #endif
 
     if (mAllowDNSPrefetch) {
-      nsCOMPtr<nsIDocShell> docShell = do_QueryReferent(mDocumentContainer);
+      nsCOMPtr<nsIDocShell> docShell(mDocumentContainer);
       if (docShell) {
 #ifdef DEBUG
         nsCOMPtr<nsIWebNavigation> webNav =
@@ -4391,8 +4404,7 @@ nsDocument::GetWindowInternal() const
   // the docshell, the outer window might be still obtainable from the it.
   nsCOMPtr<nsPIDOMWindow> win;
   if (mRemovedFromDocShell) {
-    nsCOMPtr<nsIInterfaceRequestor> requestor =
-      do_QueryReferent(mDocumentContainer);
+    nsCOMPtr<nsIInterfaceRequestor> requestor(mDocumentContainer);
     if (requestor) {
       // The docshell returns the outer window we are done.
       win = do_GetInterface(requestor);
@@ -7819,7 +7831,7 @@ nsDocument::GetLayoutHistoryState() const
   if (!mScriptGlobalObject) {
     state = mLayoutHistoryState;
   } else {
-    nsCOMPtr<nsIDocShell> docShell(do_QueryReferent(mDocumentContainer));
+    nsCOMPtr<nsIDocShell> docShell(mDocumentContainer);
     if (docShell) {
       docShell->GetLayoutHistoryState(getter_AddRefs(state));
     }
@@ -8340,7 +8352,7 @@ nsDocument::CloneDocHelper(nsDocument* clone) const
 
     // |mDocumentContainer| is the container of the document that is being
     // created and not the original container. See CreateStaticClone function().
-    nsCOMPtr<nsIDocumentLoader> docLoader = do_QueryReferent(mDocumentContainer);
+    nsCOMPtr<nsIDocumentLoader> docLoader(mDocumentContainer);
     if (docLoader) {
       docLoader->GetLoadGroup(getter_AddRefs(loadGroup));
     }
@@ -8353,8 +8365,7 @@ nsDocument::CloneDocHelper(nsDocument* clone) const
         clone->ResetToURI(uri, loadGroup, NodePrincipal());
       }
     }
-    nsCOMPtr<nsISupports> container = GetContainer();
-    clone->SetContainer(container);
+    clone->SetContainer(mDocumentContainer);
   }
 
   // Set scripting object
@@ -8832,6 +8843,7 @@ nsIDocument::EnumerateFreezableElements(FreezableElementEnumerator aEnumerator,
 void
 nsIDocument::RegisterPendingLinkUpdate(Link* aLink)
 {
+  MOZ_ASSERT(!mIsLinkUpdateRegistrationsForbidden);
   mLinksToUpdate.PutEntry(aLink);
   mHasLinksToUpdate = true;
 }
@@ -8839,6 +8851,7 @@ nsIDocument::RegisterPendingLinkUpdate(Link* aLink)
 void
 nsIDocument::UnregisterPendingLinkUpdate(Link* aLink)
 {
+  MOZ_ASSERT(!mIsLinkUpdateRegistrationsForbidden);
   if (!mHasLinksToUpdate)
     return;
 
@@ -8855,28 +8868,32 @@ EnumeratePendingLinkUpdates(nsPtrHashKey<Link>* aEntry, void* aData)
 void
 nsIDocument::FlushPendingLinkUpdates()
 {
+  MOZ_ASSERT(!mIsLinkUpdateRegistrationsForbidden);
   if (!mHasLinksToUpdate)
     return;
 
-  nsAutoScriptBlocker scriptBlocker;
+#ifdef DEBUG
+  AutoRestore<bool> saved(mIsLinkUpdateRegistrationsForbidden);
+  mIsLinkUpdateRegistrationsForbidden = true;
+#endif
   mLinksToUpdate.EnumerateEntries(EnumeratePendingLinkUpdates, nullptr);
   mLinksToUpdate.Clear();
   mHasLinksToUpdate = false;
 }
 
 already_AddRefed<nsIDocument>
-nsIDocument::CreateStaticClone(nsISupports* aCloneContainer)
+nsIDocument::CreateStaticClone(nsIDocShell* aCloneContainer)
 {
   nsCOMPtr<nsIDOMDocument> domDoc = do_QueryInterface(this);
   NS_ENSURE_TRUE(domDoc, nullptr);
   mCreatingStaticClone = true;
 
   // Make document use different container during cloning.
-  nsCOMPtr<nsISupports> originalContainer = GetContainer();
-  SetContainer(aCloneContainer);
+  nsRefPtr<nsDocShell> originalShell = mDocumentContainer.get();
+  SetContainer(static_cast<nsDocShell*>(aCloneContainer));
   nsCOMPtr<nsIDOMNode> clonedNode;
   nsresult rv = domDoc->CloneNode(true, 1, getter_AddRefs(clonedNode));
-  SetContainer(originalContainer);
+  SetContainer(originalShell);
 
   nsCOMPtr<nsIDocument> clonedDoc;
   if (NS_SUCCEEDED(rv)) {
@@ -10182,8 +10199,7 @@ nsDocument::FullScreenStackTop()
 static bool
 IsInActiveTab(nsIDocument* aDoc)
 {
-  nsCOMPtr<nsISupports> container = aDoc->GetContainer();
-  nsCOMPtr<nsIDocShell> docshell = do_QueryInterface(container);
+  nsCOMPtr<nsIDocShell> docshell = aDoc->GetDocShell();
   if (!docshell) {
     return false;
   }
@@ -10194,12 +10210,8 @@ IsInActiveTab(nsIDocument* aDoc)
     return false;
   }
 
-  nsCOMPtr<nsIDocShellTreeItem> dsti = do_QueryInterface(container);
-  if (!dsti) {
-    return false;
-  }
   nsCOMPtr<nsIDocShellTreeItem> rootItem;
-  dsti->GetRootTreeItem(getter_AddRefs(rootItem));
+  docshell->GetRootTreeItem(getter_AddRefs(rootItem));
   if (!rootItem) {
     return false;
   }
@@ -10544,7 +10556,7 @@ nsDocument::IsFullScreenEnabled(bool aCallerIsChrome, bool aLogFailure)
 
   // Ensure that all ancestor <iframe> elements have the allowfullscreen
   // boolean attribute set.
-  nsCOMPtr<nsIDocShell> docShell = do_QueryReferent(mDocumentContainer);
+  nsCOMPtr<nsIDocShell> docShell(mDocumentContainer);
   bool allowed = false;
   if (docShell) {
     docShell->GetFullscreenAllowed(&allowed);
@@ -10858,7 +10870,7 @@ nsDocument::ShouldLockPointer(Element* aElement, Element* aCurrentLock,
 
   // Check if the element is in a document with a docshell.
   nsCOMPtr<nsIDocument> ownerDoc = aElement->OwnerDoc();
-  if (!nsCOMPtr<nsISupports>(ownerDoc->GetContainer())) {
+  if (!ownerDoc->GetContainer()) {
     return false;
   }
   nsCOMPtr<nsPIDOMWindow> ownerWindow = ownerDoc->GetWindow();
@@ -11429,12 +11441,13 @@ nsIDocument::SetContentTypeInternal(const nsACString& aType)
 nsILoadContext*
 nsIDocument::GetLoadContext() const
 {
-  nsCOMPtr<nsISupports> container = GetContainer();
-  if (container) {
-    nsCOMPtr<nsILoadContext> loadContext = do_QueryInterface(container);
-    return loadContext;
-  }
-  return nullptr;
+  return mDocumentContainer;
+}
+
+nsIDocShell*
+nsIDocument::GetDocShell() const
+{
+  return mDocumentContainer;
 }
 
 void
diff --git a/content/base/src/nsGkAtomList.h b/content/base/src/nsGkAtomList.h
index 874280cca9ff..077e93302da2 100644
--- a/content/base/src/nsGkAtomList.h
+++ b/content/base/src/nsGkAtomList.h
@@ -433,6 +433,7 @@ GK_ATOM(_if, "if")
 GK_ATOM(iframe, "iframe")
 GK_ATOM(ignorecase, "ignorecase")
 GK_ATOM(ignorekeys, "ignorekeys")
+GK_ATOM(ignoreuserfocus, "ignoreuserfocus")
 GK_ATOM(ilayer, "ilayer")
 GK_ATOM(image, "image")
 GK_ATOM(imageClickedPoint, "image-clicked-point")
@@ -719,7 +720,9 @@ GK_ATOM(onheld, "onheld")
 GK_ATOM(onhfpstatuschanged, "onhfpstatuschanged")
 GK_ATOM(onholding, "onholding")
 GK_ATOM(oniccchange, "oniccchange")
+GK_ATOM(oniccdetected, "oniccdetected")
 GK_ATOM(oniccinfochange, "oniccinfochange")
+GK_ATOM(oniccundetected, "oniccundetected")
 GK_ATOM(onincoming, "onincoming")
 GK_ATOM(oninput, "oninput")
 GK_ATOM(oninvalid, "oninvalid")
@@ -1757,6 +1760,18 @@ GK_ATOM(onMozEdgeUIStarted, "onMozEdgeUIStarted")
 GK_ATOM(onMozEdgeUICanceled, "onMozEdgeUICanceled")
 GK_ATOM(onMozEdgeUICompleted, "onMozEdgeUICompleted")
 
+// Pointer events
+GK_ATOM(onpointerdown, "onpointerdown")
+GK_ATOM(onpointermove, "onpointermove")
+GK_ATOM(onpointerup, "onpointerup")
+GK_ATOM(onpointercancel, "onpointercancel")
+GK_ATOM(onpointerover, "onpointerover")
+GK_ATOM(onpointerout, "onpointerout")
+GK_ATOM(onpointerenter, "onpointerenter")
+GK_ATOM(onpointerleave, "onpointerleave")
+GK_ATOM(ongotpointercapture, "ongotpointercapture")
+GK_ATOM(onlostpointercapture, "onlostpointercapture")
+
 // orientation support
 GK_ATOM(ondevicemotion, "ondevicemotion")
 GK_ATOM(ondeviceorientation, "ondeviceorientation")
diff --git a/content/base/src/nsINode.cpp b/content/base/src/nsINode.cpp
index 0586b02146e4..76a766869d30 100644
--- a/content/base/src/nsINode.cpp
+++ b/content/base/src/nsINode.cpp
@@ -1331,15 +1331,15 @@ AdoptNodeIntoOwnerDoc(nsINode *aParent, nsINode *aNode)
 static nsresult
 CheckForOutdatedParent(nsINode* aParent, nsINode* aNode)
 {
-  if (JSObject* existingObj = aNode->GetWrapper()) {
+  if (JSObject* existingObjUnrooted = aNode->GetWrapper()) {
+    AutoJSContext cx;
+    JS::Rooted<JSObject*> existingObj(cx, existingObjUnrooted);
     nsIGlobalObject* global = aParent->OwnerDoc()->GetScopeObject();
     MOZ_ASSERT(global);
 
     if (js::GetGlobalForObjectCrossCompartment(existingObj) !=
         global->GetGlobalJSObject()) {
-      AutoJSContext cx;
-      JS::Rooted<JSObject*> rooted(cx, existingObj);
-      nsresult rv = ReparentWrapper(cx, rooted);
+      nsresult rv = ReparentWrapper(cx, existingObj);
       NS_ENSURE_SUCCESS(rv, rv);
     }
   }
diff --git a/content/base/src/nsTreeSanitizer.cpp b/content/base/src/nsTreeSanitizer.cpp
index f43349abf0a1..fe88ae2d0ed9 100644
--- a/content/base/src/nsTreeSanitizer.cpp
+++ b/content/base/src/nsTreeSanitizer.cpp
@@ -1359,8 +1359,7 @@ nsTreeSanitizer::Sanitize(nsIDocument* aDocument)
   // here that notifies / does not notify or that fires mutation events if
   // in tree.
 #ifdef DEBUG
-  nsCOMPtr<nsISupports> container = aDocument->GetContainer();
-  NS_PRECONDITION(!container, "The document is in a shell.");
+  NS_PRECONDITION(!aDocument->GetContainer(), "The document is in a shell.");
   nsRefPtr<mozilla::dom::Element> root = aDocument->GetRootElement();
   NS_PRECONDITION(root->IsHTML(nsGkAtoms::html), "Not HTML root.");
 #endif
diff --git a/content/canvas/crashtests/934939-1.html b/content/canvas/crashtests/934939-1.html
new file mode 100644
index 000000000000..d2ffbf47554c
--- /dev/null
+++ b/content/canvas/crashtests/934939-1.html
@@ -0,0 +1,8 @@
+<script type="text/javascript">
+  function run() {
+    var cx = canvas.getContext("2d");
+    canvas.toDataURL("image/png");
+  }
+</script>
+<body onload="run()">
+<canvas width="1" height="65536" id="canvas"></canvas>
diff --git a/content/canvas/crashtests/crashtests.list b/content/canvas/crashtests/crashtests.list
index 1cfc35f1e942..51e3778ad8a2 100644
--- a/content/canvas/crashtests/crashtests.list
+++ b/content/canvas/crashtests/crashtests.list
@@ -20,3 +20,4 @@ load 802926-1.html
 load 896047-1.html
 load 896047-2.html
 load 916128-1.html
+load 934939-1.html
diff --git a/content/canvas/src/CanvasRenderingContext2D.cpp b/content/canvas/src/CanvasRenderingContext2D.cpp
index e23be2e2c231..344e4ca60a07 100644
--- a/content/canvas/src/CanvasRenderingContext2D.cpp
+++ b/content/canvas/src/CanvasRenderingContext2D.cpp
@@ -1069,12 +1069,10 @@ CanvasRenderingContext2D::GetImageBuffer(uint8_t** aImageBuffer,
   }
 
   RefPtr<DataSourceSurface> data = snapshot->GetDataSurface();
-  if (!data) {
+  if (!data || data->GetSize() != IntSize(mWidth, mHeight)) {
     return;
   }
 
-  MOZ_ASSERT(data->GetSize() == IntSize(mWidth, mHeight));
-
   *aImageBuffer = SurfaceToPackedBGRA(data);
   *aFormat = imgIEncoder::INPUT_FORMAT_HOSTARGB;
 }
diff --git a/content/events/public/nsEventDispatcher.h b/content/events/public/nsEventDispatcher.h
index 38c53393ddaf..404769da6e6a 100644
--- a/content/events/public/nsEventDispatcher.h
+++ b/content/events/public/nsEventDispatcher.h
@@ -10,6 +10,9 @@
 #include "mozilla/EventForwards.h"
 #include "nsCOMPtr.h"
 
+// Microsoft's API Name hackery sucks
+#undef CreateEvent
+
 class nsEventTargetChainItem;
 class nsIDOMEvent;
 class nsIScriptGlobalObject;
diff --git a/content/events/public/nsEventNameList.h b/content/events/public/nsEventNameList.h
index 1979a107c2e0..2624672f16cf 100644
--- a/content/events/public/nsEventNameList.h
+++ b/content/events/public/nsEventNameList.h
@@ -293,6 +293,48 @@ EVENT(mozpointerlockerror,
       NS_POINTERLOCKERROR,
       EventNameType_HTML,
       NS_EVENT)
+
+EVENT(pointerdown,
+      NS_POINTER_DOWN,
+      EventNameType_All,
+      NS_POINTER_EVENT)
+EVENT(pointermove,
+      NS_POINTER_MOVE,
+      EventNameType_All,
+      NS_POINTER_EVENT)
+EVENT(pointerup,
+      NS_POINTER_UP,
+      EventNameType_All,
+      NS_POINTER_EVENT)
+EVENT(pointercancel,
+      NS_POINTER_CANCEL,
+      EventNameType_All,
+      NS_POINTER_EVENT)
+EVENT(pointerover,
+      NS_POINTER_OVER,
+      EventNameType_All,
+      NS_POINTER_EVENT)
+EVENT(pointerout,
+      NS_POINTER_OUT,
+      EventNameType_All,
+      NS_POINTER_EVENT)
+EVENT(pointerenter,
+      NS_POINTER_ENTER,
+      EventNameType_All,
+      NS_POINTER_EVENT)
+EVENT(pointerleave,
+      NS_POINTER_LEAVE,
+      EventNameType_All,
+      NS_POINTER_EVENT)
+EVENT(gotpointercapture,
+      NS_POINTER_GOT_CAPTURE,
+      EventNameType_All,
+      NS_POINTER_EVENT)
+EVENT(lostpointercapture,
+      NS_POINTER_LOST_CAPTURE,
+      EventNameType_All,
+      NS_POINTER_EVENT)
+
 // Not supported yet; probably never because "wheel" is a better idea.
 // EVENT(mousewheel)
 EVENT(pause,
diff --git a/content/events/src/PointerEvent.cpp b/content/events/src/PointerEvent.cpp
new file mode 100644
index 000000000000..0524119a91cc
--- /dev/null
+++ b/content/events/src/PointerEvent.cpp
@@ -0,0 +1,150 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Portions Copyright 2013 Microsoft Open Technologies, Inc. */
+
+#include "PointerEvent.h"
+#include "mozilla/MouseEvents.h"
+#include "prtime.h"
+
+namespace mozilla {
+namespace dom {
+
+PointerEvent::PointerEvent(EventTarget* aOwner,
+                           nsPresContext* aPresContext,
+                           WidgetPointerEvent* aEvent)
+  : nsDOMMouseEvent(aOwner, aPresContext, aEvent ? aEvent : new WidgetPointerEvent(false, 0, nullptr))
+{
+  NS_ASSERTION(mEvent->eventStructType == NS_POINTER_EVENT, "event type mismatch NS_POINTER_EVENT");
+
+  WidgetMouseEvent* mouseEvent = mEvent->AsMouseEvent();
+  if (aEvent) {
+    mEventIsInternal = false;
+  } else {
+    mEventIsInternal = true;
+    mEvent->time = PR_Now();
+    mEvent->refPoint.x = mEvent->refPoint.y = 0;
+    mouseEvent->inputSource = nsIDOMMouseEvent::MOZ_SOURCE_UNKNOWN;
+  }
+}
+
+static uint16_t
+ConvertStringToPointerType(const nsAString& aPointerTypeArg)
+{
+  if (aPointerTypeArg.EqualsLiteral("mouse")) {
+    return nsIDOMMouseEvent::MOZ_SOURCE_MOUSE;
+  }
+  if (aPointerTypeArg.EqualsLiteral("pen")) {
+    return nsIDOMMouseEvent::MOZ_SOURCE_PEN;
+  }
+  if (aPointerTypeArg.EqualsLiteral("touch")) {
+    return nsIDOMMouseEvent::MOZ_SOURCE_TOUCH;
+  }
+
+  return nsIDOMMouseEvent::MOZ_SOURCE_UNKNOWN;
+}
+
+//static
+already_AddRefed<PointerEvent>
+PointerEvent::Constructor(const mozilla::dom::GlobalObject& aGlobal,
+                          const nsAString& aType,
+                          const mozilla::dom::PointerEventInit& aParam,
+                          mozilla::ErrorResult& aRv)
+{
+  nsCOMPtr<mozilla::dom::EventTarget> t = do_QueryInterface(aGlobal.GetAsSupports());
+  nsRefPtr<PointerEvent> e = new PointerEvent(t, nullptr, nullptr);
+  bool trusted = e->Init(t);
+
+  aRv = e->InitMouseEvent(aType, aParam.mBubbles, aParam.mCancelable,
+                          aParam.mView, aParam.mDetail, aParam.mScreenX,
+                          aParam.mScreenY, aParam.mClientX, aParam.mClientY,
+                          aParam.mCtrlKey, aParam.mAltKey, aParam.mShiftKey,
+                          aParam.mMetaKey, aParam.mButton, aParam.mRelatedTarget);
+  if (aRv.Failed()) {
+    return nullptr;
+  }
+
+  WidgetPointerEvent* widgetEvent = e->mEvent->AsPointerEvent();
+  widgetEvent->pointerId = aParam.mPointerId;
+  widgetEvent->width = aParam.mWidth;
+  widgetEvent->height = aParam.mHeight;
+  widgetEvent->pressure = aParam.mPressure;
+  widgetEvent->tiltX = aParam.mTiltX;
+  widgetEvent->tiltY = aParam.mTiltY;
+  widgetEvent->inputSource = ConvertStringToPointerType(aParam.mPointerType);
+  widgetEvent->isPrimary = aParam.mIsPrimary;
+  widgetEvent->buttons = aParam.mButtons;
+
+  e->SetTrusted(trusted);
+  return e.forget();
+}
+
+void
+PointerEvent::GetPointerType(nsAString& aPointerType)
+{
+  switch (mEvent->AsPointerEvent()->inputSource) {
+    case nsIDOMMouseEvent::MOZ_SOURCE_MOUSE:
+      aPointerType.AssignLiteral("mouse");
+      break;
+    case nsIDOMMouseEvent::MOZ_SOURCE_PEN:
+      aPointerType.AssignLiteral("pen");
+      break;
+    case nsIDOMMouseEvent::MOZ_SOURCE_TOUCH:
+      aPointerType.AssignLiteral("touch");
+      break;
+    case nsIDOMMouseEvent::MOZ_SOURCE_UNKNOWN:
+      aPointerType.AssignLiteral("");
+      break;
+  }
+}
+
+int32_t PointerEvent::PointerId()
+{
+  return mEvent->AsPointerEvent()->pointerId;
+}
+
+int32_t PointerEvent::Width()
+{
+  return mEvent->AsPointerEvent()->width;
+}
+
+int32_t PointerEvent::Height()
+{
+  return mEvent->AsPointerEvent()->height;
+}
+
+int32_t PointerEvent::Pressure()
+{
+  return mEvent->AsPointerEvent()->pressure;
+}
+
+int32_t PointerEvent::TiltX()
+{
+  return mEvent->AsPointerEvent()->tiltX;
+}
+
+int32_t PointerEvent::TiltY()
+{
+  return mEvent->AsPointerEvent()->tiltY;
+}
+
+bool PointerEvent::IsPrimary()
+{
+  return mEvent->AsPointerEvent()->isPrimary;
+}
+
+} // namespace dom
+} // namespace mozilla
+
+using namespace mozilla;
+
+nsresult NS_NewDOMPointerEvent(nsIDOMEvent** aInstancePtrResult,
+                               dom::EventTarget* aOwner,
+                               nsPresContext* aPresContext,
+                               WidgetPointerEvent *aEvent)
+{
+  dom::PointerEvent *it = new dom::PointerEvent(aOwner, aPresContext, aEvent);
+  return CallQueryInterface(it, aInstancePtrResult);
+}
diff --git a/content/events/src/PointerEvent.h b/content/events/src/PointerEvent.h
new file mode 100644
index 000000000000..c2ed636e0b1c
--- /dev/null
+++ b/content/events/src/PointerEvent.h
@@ -0,0 +1,50 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Portions Copyright 2013 Microsoft Open Technologies, Inc. */
+
+#ifndef PointerEvent_h__
+#define PointerEvent_h__
+
+#include "nsDOMMouseEvent.h"
+#include "mozilla/dom/PointerEventBinding.h"
+
+class nsPresContext;
+
+namespace mozilla {
+namespace dom {
+
+class PointerEvent : public nsDOMMouseEvent
+{
+public:
+  PointerEvent(EventTarget* aOwner,
+               nsPresContext* aPresContext,
+               WidgetPointerEvent* aEvent);
+
+  virtual JSObject* WrapObject(JSContext* aCx,
+                               JS::Handle<JSObject*> aScope) MOZ_OVERRIDE
+  {
+    return mozilla::dom::PointerEventBinding::Wrap(aCx, aScope, this);
+  }
+
+  static already_AddRefed<PointerEvent>
+  Constructor(const GlobalObject& aGlobal,
+              const nsAString& aType,
+              const PointerEventInit& aParam,
+              mozilla::ErrorResult& aRv);
+
+  int32_t PointerId();
+  int32_t Width();
+  int32_t Height();
+  int32_t Pressure();
+  int32_t TiltX();
+  int32_t TiltY();
+  bool IsPrimary();
+  void GetPointerType(nsAString& aPointerType);
+};
+
+} // namespace dom
+} // namespace mozilla
+
+#endif
diff --git a/content/events/src/moz.build b/content/events/src/moz.build
index ce5b30b5cb11..3deaa99424ed 100644
--- a/content/events/src/moz.build
+++ b/content/events/src/moz.build
@@ -14,6 +14,7 @@ EXPORTS += [
 ]
 
 EXPORTS.mozilla.dom += [
+    'PointerEvent.h',
     'Touch.h',
 ]
 
@@ -57,6 +58,7 @@ UNIFIED_SOURCES += [
     'nsIMEStateManager.cpp',
     'nsPaintRequest.cpp',
     'nsPrivateTextRange.cpp',
+    'PointerEvent.cpp',
     'TextComposition.cpp',
     'Touch.cpp',
 ]
diff --git a/content/events/src/nsDOMEvent.cpp b/content/events/src/nsDOMEvent.cpp
index 83029ad3ae8e..888f47354ec7 100644
--- a/content/events/src/nsDOMEvent.cpp
+++ b/content/events/src/nsDOMEvent.cpp
@@ -145,6 +145,7 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsDOMEvent)
       case NS_MOUSE_SCROLL_EVENT:
       case NS_WHEEL_EVENT:
       case NS_SIMPLE_GESTURE_EVENT:
+      case NS_POINTER_EVENT:
         tmp->mEvent->AsMouseEventBase()->relatedTarget = nullptr;
         break;
       case NS_DRAG_EVENT: {
@@ -182,6 +183,7 @@ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsDOMEvent)
       case NS_MOUSE_SCROLL_EVENT:
       case NS_WHEEL_EVENT:
       case NS_SIMPLE_GESTURE_EVENT:
+      case NS_POINTER_EVENT:
         NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mEvent->relatedTarget");
         cb.NoteXPCOMChild(tmp->mEvent->AsMouseEventBase()->relatedTarget);
         break;
@@ -738,6 +740,21 @@ nsDOMEvent::DuplicatePrivateData()
       newEvent = touchEvent;
       break;
     }
+    case NS_POINTER_EVENT:
+    {
+      WidgetPointerEvent* oldPointerEvent = mEvent->AsPointerEvent();
+      WidgetPointerEvent* pointerEvent =
+        new WidgetPointerEvent(false, msg, nullptr,
+                               oldPointerEvent->pointerId,
+                               oldPointerEvent->width,
+                               oldPointerEvent->height,
+                               oldPointerEvent->tiltX,
+                               oldPointerEvent->tiltY,
+                               oldPointerEvent->isPrimary);
+      pointerEvent->buttons = oldPointerEvent->buttons;
+      newEvent = pointerEvent;
+      break;
+    }
     default:
     {
       NS_WARNING("Unknown event type!!!");
@@ -1022,6 +1039,7 @@ nsDOMEvent::GetScreenCoords(nsPresContext* aPresContext,
        (aEvent->eventStructType != NS_MOUSE_EVENT &&
         aEvent->eventStructType != NS_MOUSE_SCROLL_EVENT &&
         aEvent->eventStructType != NS_WHEEL_EVENT &&
+        aEvent->eventStructType != NS_POINTER_EVENT &&
         aEvent->eventStructType != NS_TOUCH_EVENT &&
         aEvent->eventStructType != NS_DRAG_EVENT &&
         aEvent->eventStructType != NS_SIMPLE_GESTURE_EVENT)) {
@@ -1081,6 +1099,7 @@ nsDOMEvent::GetClientCoords(nsPresContext* aPresContext,
        aEvent->eventStructType != NS_WHEEL_EVENT &&
        aEvent->eventStructType != NS_TOUCH_EVENT &&
        aEvent->eventStructType != NS_DRAG_EVENT &&
+       aEvent->eventStructType != NS_POINTER_EVENT &&
        aEvent->eventStructType != NS_SIMPLE_GESTURE_EVENT) ||
       !aPresContext ||
       !aEvent->AsGUIEvent()->widget) {
diff --git a/content/events/src/nsDOMMouseEvent.cpp b/content/events/src/nsDOMMouseEvent.cpp
index afedafebd261..d7769afc2245 100644
--- a/content/events/src/nsDOMMouseEvent.cpp
+++ b/content/events/src/nsDOMMouseEvent.cpp
@@ -62,6 +62,7 @@ nsDOMMouseEvent::InitMouseEvent(const nsAString & aType, bool aCanBubble, bool a
     case NS_MOUSE_SCROLL_EVENT:
     case NS_WHEEL_EVENT:
     case NS_DRAG_EVENT:
+    case NS_POINTER_EVENT:
     case NS_SIMPLE_GESTURE_EVENT: {
       WidgetMouseEventBase* mouseEventBase = mEvent->AsMouseEventBase();
       mouseEventBase->relatedTarget = aRelatedTarget;
@@ -115,6 +116,7 @@ nsDOMMouseEvent::InitMouseEvent(const nsAString& aType,
     case NS_MOUSE_SCROLL_EVENT:
     case NS_WHEEL_EVENT:
     case NS_DRAG_EVENT:
+    case NS_POINTER_EVENT:
     case NS_SIMPLE_GESTURE_EVENT:
       mEvent->AsInputEvent()->modifiers = modifiers;
       return NS_OK;
@@ -145,6 +147,7 @@ nsDOMMouseEvent::Constructor(const mozilla::dom::GlobalObject& aGlobal,
     case NS_MOUSE_SCROLL_EVENT:
     case NS_WHEEL_EVENT:
     case NS_DRAG_EVENT:
+    case NS_POINTER_EVENT:
     case NS_SIMPLE_GESTURE_EVENT:
       e->mEvent->AsMouseEventBase()->buttons = aParam.mButtons;
       break;
@@ -192,6 +195,7 @@ nsDOMMouseEvent::Button()
     case NS_MOUSE_SCROLL_EVENT:
     case NS_WHEEL_EVENT:
     case NS_DRAG_EVENT:
+    case NS_POINTER_EVENT:
     case NS_SIMPLE_GESTURE_EVENT:
       return mEvent->AsMouseEventBase()->button;
     default:
@@ -217,6 +221,7 @@ nsDOMMouseEvent::Buttons()
     case NS_MOUSE_SCROLL_EVENT:
     case NS_WHEEL_EVENT:
     case NS_DRAG_EVENT:
+    case NS_POINTER_EVENT:
     case NS_SIMPLE_GESTURE_EVENT:
       return mEvent->AsMouseEventBase()->buttons;
     default:
@@ -242,6 +247,7 @@ nsDOMMouseEvent::GetRelatedTarget()
     case NS_MOUSE_SCROLL_EVENT:
     case NS_WHEEL_EVENT:
     case NS_DRAG_EVENT:
+    case NS_POINTER_EVENT:
     case NS_SIMPLE_GESTURE_EVENT:
       relatedTarget =
         do_QueryInterface(mEvent->AsMouseEventBase()->relatedTarget);
diff --git a/content/events/src/nsDOMUIEvent.cpp b/content/events/src/nsDOMUIEvent.cpp
index 4a63aaba5e58..5c46b0698db0 100644
--- a/content/events/src/nsDOMUIEvent.cpp
+++ b/content/events/src/nsDOMUIEvent.cpp
@@ -119,6 +119,7 @@ nsDOMUIEvent::GetMovementPoint()
        mEvent->eventStructType != NS_MOUSE_SCROLL_EVENT &&
        mEvent->eventStructType != NS_WHEEL_EVENT &&
        mEvent->eventStructType != NS_DRAG_EVENT &&
+       mEvent->eventStructType != NS_POINTER_EVENT &&
        mEvent->eventStructType != NS_SIMPLE_GESTURE_EVENT) ||
        !mEvent->AsGUIEvent()->widget) {
     return nsIntPoint(0, 0);
@@ -300,6 +301,7 @@ nsDOMUIEvent::GetLayerPoint() const
       (mEvent->eventStructType != NS_MOUSE_EVENT &&
        mEvent->eventStructType != NS_MOUSE_SCROLL_EVENT &&
        mEvent->eventStructType != NS_WHEEL_EVENT &&
+       mEvent->eventStructType != NS_POINTER_EVENT &&
        mEvent->eventStructType != NS_TOUCH_EVENT &&
        mEvent->eventStructType != NS_DRAG_EVENT &&
        mEvent->eventStructType != NS_SIMPLE_GESTURE_EVENT) ||
diff --git a/content/events/src/nsDOMUIEvent.h b/content/events/src/nsDOMUIEvent.h
index 3e127b43b020..2cb58cbcb657 100644
--- a/content/events/src/nsDOMUIEvent.h
+++ b/content/events/src/nsDOMUIEvent.h
@@ -46,6 +46,7 @@ public:
          aEvent->eventStructType != NS_MOUSE_SCROLL_EVENT &&
          aEvent->eventStructType != NS_WHEEL_EVENT &&
          aEvent->eventStructType != NS_DRAG_EVENT &&
+         aEvent->eventStructType != NS_POINTER_EVENT &&
          aEvent->eventStructType != NS_SIMPLE_GESTURE_EVENT)) {
       return nsIntPoint(0, 0);
     }
@@ -71,6 +72,7 @@ public:
          aEvent->eventStructType != NS_MOUSE_SCROLL_EVENT &&
          aEvent->eventStructType != NS_WHEEL_EVENT &&
          aEvent->eventStructType != NS_DRAG_EVENT &&
+         aEvent->eventStructType != NS_POINTER_EVENT &&
          aEvent->eventStructType != NS_SIMPLE_GESTURE_EVENT) ||
         !aPresContext ||
         !aEvent->AsGUIEvent()->widget) {
diff --git a/content/events/src/nsEventDispatcher.cpp b/content/events/src/nsEventDispatcher.cpp
index 57dc0e7fd283..1a4780104c56 100644
--- a/content/events/src/nsEventDispatcher.cpp
+++ b/content/events/src/nsEventDispatcher.cpp
@@ -739,6 +739,9 @@ nsEventDispatcher::CreateEvent(mozilla::dom::EventTarget* aOwner,
     case NS_SIMPLE_GESTURE_EVENT:
       return NS_NewDOMSimpleGestureEvent(aDOMEvent, aOwner, aPresContext,
                                          aEvent->AsSimpleGestureEvent());
+    case NS_POINTER_EVENT:
+      return NS_NewDOMPointerEvent(aDOMEvent, aOwner, aPresContext,
+                                   aEvent->AsPointerEvent());
     case NS_TOUCH_EVENT:
       return NS_NewDOMTouchEvent(aDOMEvent, aOwner, aPresContext,
                                  aEvent->AsTouchEvent());
diff --git a/content/events/src/nsEventStateManager.cpp b/content/events/src/nsEventStateManager.cpp
index 582575095ad5..ba2a5cfd5474 100644
--- a/content/events/src/nsEventStateManager.cpp
+++ b/content/events/src/nsEventStateManager.cpp
@@ -3221,6 +3221,10 @@ nsEventStateManager::PostHandleEvent(nsPresContext* aPresContext,
           }
         }
 
+        if (!suppressBlur) {
+          suppressBlur = nsContentUtils::IsUserFocusIgnored(activeContent);
+        }
+
         nsIFrame* currFrame = mCurrentTarget;
 
         // When a root content which isn't editable but has an editable HTML
diff --git a/content/events/src/nsIMEStateManager.cpp b/content/events/src/nsIMEStateManager.cpp
index 83cb06658e02..7db3a042108c 100644
--- a/content/events/src/nsIMEStateManager.cpp
+++ b/content/events/src/nsIMEStateManager.cpp
@@ -5,6 +5,8 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "nsIMEStateManager.h"
+
+#include "HTMLInputElement.h"
 #include "nsCOMPtr.h"
 #include "nsIPresShell.h"
 #include "nsISupports.h"
@@ -35,6 +37,7 @@
 #include "nsAsyncDOMEvent.h"
 
 using namespace mozilla;
+using namespace mozilla::dom;
 using namespace mozilla::widget;
 
 // nsTextStateManager notifies widget of any text and selection changes
@@ -457,8 +460,22 @@ nsIMEStateManager::SetIMEState(const IMEState &aState,
       (aContent->Tag() == nsGkAtoms::input ||
        aContent->Tag() == nsGkAtoms::textarea)) {
     if (aContent->Tag() != nsGkAtoms::textarea) {
-      aContent->GetAttr(kNameSpaceID_None, nsGkAtoms::type,
-                        context.mHTMLInputType);
+      // <input type=number> has an anonymous <input type=text> descendant
+      // that gets focus whenever anyone tries to focus the number control. We
+      // need to check if aContent is one of those anonymous text controls and,
+      // if so, use the number control instead:
+      nsIContent* content = aContent;
+      HTMLInputElement* inputElement =
+        HTMLInputElement::FromContentOrNull(aContent);
+      if (inputElement) {
+        HTMLInputElement* ownerNumberControl =
+          inputElement->GetOwnerNumberControl();
+        if (ownerNumberControl) {
+          content = ownerNumberControl; // an <input type=number>
+        }
+      }
+      content->GetAttr(kNameSpaceID_None, nsGkAtoms::type,
+                       context.mHTMLInputType);
     } else {
       context.mHTMLInputType.Assign(nsGkAtoms::textarea->GetUTF16String());
     }
diff --git a/content/events/test/test_all_synthetic_events.html b/content/events/test/test_all_synthetic_events.html
index 4655a3a3200f..0a696f1bfc0d 100644
--- a/content/events/test/test_all_synthetic_events.html
+++ b/content/events/test/test_all_synthetic_events.html
@@ -171,6 +171,10 @@ const kEventConstructors = {
                                                          return new HashChangeEvent(aName, aProps);
                                                        },
                                              },
+  IccChangeEvent:                            { create: function (aName, aProps) {
+                                                         return new IccChangeEvent(aName, aProps);
+                                                       },
+                                             },
   IDBVersionChangeEvent:                     { create: function (aName, aProps) {
                                                          return new IDBVersionChangeEvent(aName, aProps);
                                                        },
diff --git a/content/html/content/public/HTMLMediaElement.h b/content/html/content/public/HTMLMediaElement.h
index 99dfeec79fdb..cb7ce243e13f 100644
--- a/content/html/content/public/HTMLMediaElement.h
+++ b/content/html/content/public/HTMLMediaElement.h
@@ -369,6 +369,10 @@ public:
     return mNetworkState;
   }
 
+  // Called by the media decoder object, on the main thread,
+  // when the connection between Rtsp server and client gets lost.
+  void ResetConnectionState() MOZ_FINAL MOZ_OVERRIDE;
+
   // XPCOM GetPreload() is OK
   void SetPreload(const nsAString& aValue, ErrorResult& aRv)
   {
diff --git a/content/html/content/src/HTMLInputElement.cpp b/content/html/content/src/HTMLInputElement.cpp
index bed1f3f52424..59311faf6c97 100644
--- a/content/html/content/src/HTMLInputElement.cpp
+++ b/content/html/content/src/HTMLInputElement.cpp
@@ -993,9 +993,7 @@ UploadLastDir::FetchDirectoryAndDisplayPicker(nsIDocument* aDoc,
   nsIURI* docURI = aDoc->GetDocumentURI();
   NS_PRECONDITION(docURI, "docURI is null");
 
-  nsCOMPtr<nsISupports> container = aDoc->GetContainer();
-  nsCOMPtr<nsILoadContext> loadContext = do_QueryInterface(container);
-
+  nsCOMPtr<nsILoadContext> loadContext = aDoc->GetLoadContext();
   nsCOMPtr<nsIContentPrefCallback2> prefCallback = 
     new UploadLastDir::ContentPrefCallback(aFilePicker, aFpCallback);
 
@@ -1046,8 +1044,7 @@ UploadLastDir::StoreLastUsedDirectory(nsIDocument* aDoc, nsIFile* aDir)
     return NS_ERROR_OUT_OF_MEMORY;
   prefValue->SetAsAString(unicodePath);
 
-  nsCOMPtr<nsISupports> container = aDoc->GetContainer();
-  nsCOMPtr<nsILoadContext> loadContext = do_QueryInterface(container);
+  nsCOMPtr<nsILoadContext> loadContext = aDoc->GetLoadContext();
   return contentPrefService->Set(spec, CPS_PREF_NAME, prefValue, loadContext, nullptr);
 }
 
@@ -2061,7 +2058,7 @@ HTMLInputElement::ApplyStep(int32_t aStep)
 
   Decimal value = GetValueAsDecimal();
   if (value.isNaN()) {
-    return NS_OK;
+    value = 0;
   }
 
   Decimal minimum = GetMinimum();
@@ -2244,6 +2241,21 @@ HTMLInputElement::MozIsTextField(bool aExcludePassword)
   return IsSingleLineTextControl(aExcludePassword);
 }
 
+HTMLInputElement*
+HTMLInputElement::GetOwnerNumberControl()
+{
+  if (IsInNativeAnonymousSubtree() &&
+      mType == NS_FORM_INPUT_TEXT &&
+      GetParent() && GetParent()->GetParent()) {
+    HTMLInputElement* grandparent =
+      HTMLInputElement::FromContentOrNull(GetParent()->GetParent());
+    if (grandparent && grandparent->mType == NS_FORM_INPUT_NUMBER) {
+      return grandparent;
+    }
+  }
+  return nullptr;
+}
+
 NS_IMETHODIMP
 HTMLInputElement::MozIsTextField(bool aExcludePassword, bool* aResult)
 {
diff --git a/content/html/content/src/HTMLInputElement.h b/content/html/content/src/HTMLInputElement.h
index bf2241d6424e..ff6f9ce1d625 100644
--- a/content/html/content/src/HTMLInputElement.h
+++ b/content/html/content/src/HTMLInputElement.h
@@ -668,6 +668,8 @@ public:
 
   void MozSetFileNameArray(const Sequence< nsString >& aFileNames);
 
+  HTMLInputElement* GetOwnerNumberControl();
+
   bool MozIsTextField(bool aExcludePassword);
 
   nsIEditor* GetEditor();
diff --git a/content/html/content/src/HTMLMediaElement.cpp b/content/html/content/src/HTMLMediaElement.cpp
index a796d8fe1a8f..f9593cff096b 100644
--- a/content/html/content/src/HTMLMediaElement.cpp
+++ b/content/html/content/src/HTMLMediaElement.cpp
@@ -1083,12 +1083,9 @@ nsresult HTMLMediaElement::LoadResource()
   }
 
   // Check if media is allowed for the docshell.
-  nsCOMPtr<nsISupports> container = OwnerDoc()->GetContainer();
-  if (container) {
-    nsCOMPtr<nsIDocShell> docShell = do_QueryInterface(container);
-    if (docShell && !docShell->GetAllowMedia()) {
-      return NS_ERROR_FAILURE;
-    }
+  nsCOMPtr<nsIDocShell> docShell = OwnerDoc()->GetDocShell();
+  if (docShell && !docShell->GetAllowMedia()) {
+    return NS_ERROR_FAILURE;
   }
 
   int16_t shouldLoad = nsIContentPolicy::ACCEPT;
@@ -2068,6 +2065,19 @@ void HTMLMediaElement::SetPlayedOrSeeked(bool aValue)
                                                       NS_FRAME_IS_DIRTY);
 }
 
+void
+HTMLMediaElement::ResetConnectionState()
+{
+  mBegun = false;
+  SetCurrentTime(0);
+  FireTimeUpdate(false);
+  DispatchAsyncEvent(NS_LITERAL_STRING("ended"));
+  mNetworkState = nsIDOMHTMLMediaElement::NETWORK_EMPTY;
+  AddRemoveSelfReference();
+  ChangeDelayLoadStatus(false);
+  ChangeReadyState(nsIDOMHTMLMediaElement::HAVE_NOTHING);
+}
+
 void
 HTMLMediaElement::Play(ErrorResult& aRv)
 {
diff --git a/content/html/content/src/nsGenericHTMLElement.h b/content/html/content/src/nsGenericHTMLElement.h
index 5598e58fb8dc..c0a682442f96 100644
--- a/content/html/content/src/nsGenericHTMLElement.h
+++ b/content/html/content/src/nsGenericHTMLElement.h
@@ -558,7 +558,7 @@ public:
                            bool aNotify) MOZ_OVERRIDE;
   virtual nsresult UnsetAttr(int32_t aNameSpaceID, nsIAtom* aName,
                              bool aNotify) MOZ_OVERRIDE;
-  virtual bool IsFocusable(int32_t *aTabIndex = nullptr, bool aWithMouse = false) MOZ_OVERRIDE
+  virtual bool IsFocusableInternal(int32_t *aTabIndex, bool aWithMouse) MOZ_OVERRIDE
   {
     bool isFocusable = false;
     IsHTMLFocusable(aWithMouse, &isFocusable, aTabIndex);
diff --git a/content/html/content/src/nsGenericHTMLFrameElement.cpp b/content/html/content/src/nsGenericHTMLFrameElement.cpp
index dc3bacd392e3..d8aa0ac0fc90 100644
--- a/content/html/content/src/nsGenericHTMLFrameElement.cpp
+++ b/content/html/content/src/nsGenericHTMLFrameElement.cpp
@@ -323,6 +323,21 @@ nsGenericHTMLFrameElement::IsHTMLFocusable(bool aWithMouse,
   return false;
 }
 
+bool
+nsGenericHTMLFrameElement::BrowserFramesEnabled()
+{
+  static bool sMozBrowserFramesEnabled = false;
+  static bool sBoolVarCacheInitialized = false;
+
+  if (!sBoolVarCacheInitialized) {
+    sBoolVarCacheInitialized = true;
+    Preferences::AddBoolVarCache(&sMozBrowserFramesEnabled,
+                                 "dom.mozBrowserFramesEnabled");
+  }
+
+  return sMozBrowserFramesEnabled;
+}
+
 /**
  * Return true if this frame element really is a mozbrowser or mozapp.  (It
  * needs to have the right attributes, and its creator must have the right
@@ -334,7 +349,7 @@ nsGenericHTMLFrameElement::GetReallyIsBrowserOrApp(bool *aOut)
   *aOut = false;
 
   // Fail if browser frames are globally disabled.
-  if (!Preferences::GetBool("dom.mozBrowserFramesEnabled")) {
+  if (!nsGenericHTMLFrameElement::BrowserFramesEnabled()) {
     return NS_OK;
   }
 
diff --git a/content/html/content/src/nsGenericHTMLFrameElement.h b/content/html/content/src/nsGenericHTMLFrameElement.h
index df599dc417dd..e4eb6b22bd6b 100644
--- a/content/html/content/src/nsGenericHTMLFrameElement.h
+++ b/content/html/content/src/nsGenericHTMLFrameElement.h
@@ -72,6 +72,7 @@ public:
 
   void SwapFrameLoaders(nsXULElement& aOtherOwner, mozilla::ErrorResult& aError);
 
+  static bool BrowserFramesEnabled();
 protected:
   // This doesn't really ensure a frame loade in all cases, only when
   // it makes sense.
diff --git a/content/html/content/test/file_ignoreuserfocus.html b/content/html/content/test/file_ignoreuserfocus.html
new file mode 100644
index 000000000000..b9e33021249f
--- /dev/null
+++ b/content/html/content/test/file_ignoreuserfocus.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML>
+<html>
+  <body>
+    <map name=a>
+      <area shape=rect coords=0,0,100,100 href=#fail>
+    </map>
+    <img usemap=#a src=image.png>
+    <input><iframe></iframe>
+  </body>
+</html>
diff --git a/content/html/content/test/forms/test_stepup_stepdown.html b/content/html/content/test/forms/test_stepup_stepdown.html
index aa14e23a901f..055fbd5b6a29 100644
--- a/content/html/content/test/forms/test_stepup_stepdown.html
+++ b/content/html/content/test/forms/test_stepup_stepdown.html
@@ -169,7 +169,7 @@ function checkStepDown()
     [ '10', '2',    '0',   '4',   '10', '0',    false ],
     [ '10', '2',    '0',   '4',   '5',  '0',    false ],
     // value = "" (NaN).
-    [ '',   null,   null,  null,  null, '',     false ],
+    [ '',   null,   null,  null,  null, '-1',     false ],
     // With step = 'any'.
     [ '0',  'any',  null,  null,  1,    null,   true ],
     [ '0',  'ANY',  null,  null,  1,    null,   true ],
@@ -304,7 +304,7 @@ function checkStepDown()
     [ '1970-03-08',  '3',    '1970-02-01',  '1970-02-07', 15,    '1970-02-01',  false ],
     [ '1970-01-10',  '3',    '1970-01-01',  '1970-01-06', 2,     '1970-01-04',  false ],
     // value = "" (NaN).
-    [ '',   null,   null,  null,  null, '',    false ],
+    [ '',   null,   null,  null,  null, '1969-12-31',    false ],
     // With step = 'any'.
     [ '2012-01-01',  'any',  null,  null,  1,  null,  true ],
     [ '2012-01-01',  'ANY',  null,  null,  1,  null,  true ],
@@ -368,7 +368,7 @@ function checkStepDown()
     [ '17:22',  '180',  '17:00',  '17:20', 15,    '17:00',  false ],
     [ '17:22',  '180',  '17:10',  '17:20', 2,     '17:16',  false ],
     // value = "" (NaN).
-    [ '',   null,   null,  null,  null, '',    false ],
+    [ '',   null,   null,  null,  null, '23:59',    false ],
     // With step = 'any'.
     [ '17:26',  'any',  null,  null,  1,  null,  true ],
     [ '17:26',  'ANY',  null,  null,  1,  null,  true ],
@@ -484,7 +484,7 @@ function checkStepUp()
     [ '-3', '2',    '-6',  '-2',  null, '-2',  false ],
     [ '-3', '2',    '-6',  '-1',  null, '-2',  false ],
     // value = "" (NaN).
-    [ '',   null,   null,  null,  null, '',    false ],
+    [ '',   null,   null,  null,  null, '1',    false ],
     // With step = 'any'.
     [ '0',  'any',  null,  null,  1,    null,  true ],
     [ '0',  'ANY',  null,  null,  1,    null,  true ],
@@ -619,7 +619,7 @@ function checkStepUp()
     [ '1970-01-01',  '3',    '1970-02-01',  '1970-02-07', 15,    '1970-02-07',  false ],
     [ '1970-01-01',  '3',    '1970-01-01',  '1970-01-06', 2,     '1970-01-04',  false ],
     // value = "" (NaN).
-    [ '',   null,   null,  null,  null, '',    false ],
+    [ '',   null,   null,  null,  null, '1970-01-02',    false ],
     // With step = 'any'.
     [ '2012-01-01',  'any',  null,  null,  1,  null,  true ],
     [ '2012-01-01',  'ANY',  null,  null,  1,  null,  true ],
@@ -683,7 +683,7 @@ function checkStepUp()
     [ '17:22',  '180',  '17:00',  '17:20', 15,    '17:22',  false ],
     [ '17:22',  '180',  '17:10',  '17:20', 2,     '17:22',  false ],
     // value = "" (NaN).
-    [ '',   null,   null,  null,  null, '',    false ],
+    [ '',   null,   null,  null,  null, '00:01',    false ],
     // With step = 'any'.
     [ '17:26',  'any',  null,  null,  1,  null,  true ],
     [ '17:26',  'ANY',  null,  null,  1,  null,  true ],
diff --git a/content/html/content/test/mochitest.ini b/content/html/content/test/mochitest.ini
index f4246a1ff634..fd8ffc6366fe 100644
--- a/content/html/content/test/mochitest.ini
+++ b/content/html/content/test/mochitest.ini
@@ -154,6 +154,7 @@ support-files =
   reflect.js
   wakelock.ogg
   wakelock.ogv
+  file_ignoreuserfocus.html
 
 [test_a_text.html]
 [test_anchor_href_cache_invalidation.html]
@@ -416,3 +417,4 @@ support-files =
 [test_undoManager.html]
 [test_video_wakelock.html]
 [test_input_files_not_nsIFile.html]
+[test_ignoreuserfocus.html]
diff --git a/content/html/content/test/test_ignoreuserfocus.html b/content/html/content/test/test_ignoreuserfocus.html
new file mode 100644
index 000000000000..64ce2c0c1466
--- /dev/null
+++ b/content/html/content/test/test_ignoreuserfocus.html
@@ -0,0 +1,146 @@
+<!DOCTYPE HTML>
+<html>
+  <head>
+    <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+    <script type="application/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
+    <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+  </head>
+  <body>
+    <script type="application/javascript;version=1.7">
+      "use strict";
+
+      SimpleTest.waitForExplicitFinish();
+
+      // Copied from EventUtils.js, but we want *ToWindow methods.
+      function synthesizeMouseAtPoint(left, top, aEvent, aWindow) {
+        var utils = _getDOMWindowUtils(aWindow);
+        var defaultPrevented = false;
+        if (utils) {
+          var button = aEvent.button || 0;
+          var clickCount = aEvent.clickCount || 1;
+          var modifiers = _parseModifiers(aEvent);
+          var pressure = ("pressure" in aEvent) ? aEvent.pressure : 0;
+          var inputSource = ("inputSource" in aEvent) ? aEvent.inputSource : 0;
+
+          if (("type" in aEvent) && aEvent.type) {
+            defaultPrevented = utils.sendMouseEventToWindow(aEvent.type, left, top, button, clickCount, modifiers, false, pressure, inputSource);
+          }
+          else {
+            utils.sendMouseEventToWindow("mousedown", left, top, button, clickCount, modifiers, false, pressure, inputSource);
+            utils.sendMouseEventToWindow("mouseup", left, top, button, clickCount, modifiers, false, pressure, inputSource);
+          }
+        }
+      }
+
+      function runTest() {
+        var witness = document.createElement("input");
+        witness.setAttribute("type", "text");
+        var witness2 = document.createElement("input");
+        witness2.setAttribute("type", "text");
+
+        var iframe = document.createElement("iframe");
+        iframe.setAttribute("mozbrowser", "true");
+        iframe.setAttribute("ignoreuserfocus", "true");
+        iframe.setAttribute("height", "500px");
+        iframe.setAttribute("src", "file_ignoreuserfocus.html");
+
+        iframe.addEventListener('load', function (e) {
+          // Get privileged iframe because mozbrowser iframe is not same origin
+          // with the parent. We need to access its content through the wrapper.
+          var privilegedIframe = SpecialPowers.wrap(iframe);
+          privilegedIframe.contentWindow.addEventListener("MozAfterPaint", function afterPaint(e) {
+            privilegedIframe.contentWindow.removeEventListener("MozAfterPaint", afterPaint);
+            
+            privilegedIframe.contentWindow.addEventListener("focus",
+              function(e) {
+                ok(!iframe.hasAttribute("ignoreuserfocus"), "Shouldn't get a focus event in ignoreuserfocus iframe!");
+              },
+              true);
+            privilegedIframe.contentWindow.addEventListener("blur",
+              function(e) {
+                ok(!iframe.hasAttribute("ignoreuserfocus"), "Shouldn't get a blur event in ignoreuserfocus iframe!");
+              },
+              true);
+
+            // Sanity check
+            witness.focus();
+            is(document.activeElement, witness, "witness should have the focus");
+
+            iframe.focus();
+            isnot(document.activeElement, iframe, "[explicit iframe.focus()] iframe should not get the focus");
+
+            iframe.removeAttribute("ignoreuserfocus");
+            iframe.focus();
+            is(document.activeElement, iframe, "[explicit iframe.focus()] iframe should get the focus");
+
+            iframe.setAttribute("ignoreuserfocus", "true");
+
+            // Test the case when iframe contains <input> and .focus()
+            // is called and explicit focus using mouse
+            witness.focus();
+
+            var innerInput = privilegedIframe.contentDocument.getElementsByTagName("input")[0];
+            innerInput.focus();
+            isnot(document.activeElement, iframe, "[explicit innerInput.focus()] iframe should not have the focus");
+
+            var iframeWindow = SpecialPowers.unwrap(privilegedIframe.contentWindow);
+            witness.focus();
+            synthesizeMouseAtCenter(innerInput, {}, iframeWindow);
+            is(document.activeElement, witness, "[synthesize mouse click] witness should have the focus");
+
+            // Test the case when iframe contains <iframe> and .focus()
+            // is called and explicit focus using mouse
+            witness.focus();
+
+            var innerIframe = privilegedIframe.contentDocument.getElementsByTagName("iframe")[0];
+            innerIframe.focus();
+            isnot(document.activeElement, iframe, "[explicit innerIframe.focus()] iframe should not have the focus");
+
+            witness.focus();
+            synthesizeMouseAtCenter(innerIframe, {}, iframeWindow);
+            is(document.activeElement, witness, "[synthesize mouse click inner iframe] witness should have the focus");
+
+            // Test the case when iframe contains <area> and .focus()
+            // is called and explicit focus using mouse
+            witness.focus();
+
+            // Wait for paint to setup frame for area. Currently the area frame
+            // map is reset for each paint. If we are in the middle of a paint
+            // then the area will not be focusable.
+            privilegedIframe.contentWindow.addEventListener("MozAfterPaint", function afterPaintArea(e) {
+              privilegedIframe.contentWindow.removeEventListener("MozAfterPaint", afterPaintArea);
+              var innerArea = privilegedIframe.contentDocument.getElementsByTagName("area")[0];
+              innerArea.focus();
+              isnot(document.activeElement, iframe, "[explicit innerArea.focus()] iframe should not have the focus");
+
+              witness.focus();
+              synthesizeMouseAtCenter(innerArea, {}, iframeWindow);
+              is(document.activeElement, witness, "[synthesize mouse click] witness should have the focus");
+
+              // Test tabindex
+              witness.focus();
+              is(document.activeElement, witness, "witness should have the focus");
+              synthesizeKey("VK_TAB", {});
+              isnot(document.activeElement, iframe, "[synthesize tab key] iframe should not have the focus");
+              is(document.activeElement, witness2, "witness2 should have the focus");
+
+              SimpleTest.finish();
+            });
+          });
+        });
+
+        document.body.appendChild(witness);
+        document.body.appendChild(iframe);
+        document.body.appendChild(witness2);
+      }
+      addEventListener("load", function() {
+        SpecialPowers.addPermission("browser", true, document);
+        SpecialPowers.pushPrefEnv({
+          "set": [
+            ["dom.mozBrowserFramesEnabled", true]
+          ]
+        }, runTest);
+      });
+    </script>
+  </body>
+</html>
diff --git a/content/html/document/reftests/bug917595-1-ref.html b/content/html/document/reftests/bug917595-1-ref.html
new file mode 100644
index 000000000000..6bb9e2dc92e4
--- /dev/null
+++ b/content/html/document/reftests/bug917595-1-ref.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<style>
+  iframe {
+    width:  100%;
+    height: 100%;
+    border: 0px;
+  }
+</style>
+<script>
+  document.addEventListener('MozReftestInvalidate',
+                            () => document.documentElement.removeAttribute('class'),
+                            false);
+</script>
+<body>
+  <iframe src="bug917595-unrotated.jpg" scrolling="no" marginwidth="0" marginheight="0"></iframe>
+</body>
+</html>
diff --git a/content/html/document/reftests/bug917595-exif-rotated.jpg b/content/html/document/reftests/bug917595-exif-rotated.jpg
new file mode 100644
index 000000000000..e7b0c22f3510
Binary files /dev/null and b/content/html/document/reftests/bug917595-exif-rotated.jpg differ
diff --git a/content/html/document/reftests/bug917595-iframe-1.html b/content/html/document/reftests/bug917595-iframe-1.html
new file mode 100644
index 000000000000..032c4f4ff58c
--- /dev/null
+++ b/content/html/document/reftests/bug917595-iframe-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<style>
+  iframe {
+    width:  100%;
+    height: 100%;
+    border: 0px;
+  }
+</style>
+<script>
+  document.addEventListener('MozReftestInvalidate',
+                            () => document.documentElement.removeAttribute('class'),
+                            false);
+</script>
+<body>
+  <iframe src="bug917595-exif-rotated.jpg" scrolling="no" marginwidth="0" marginheight="0"></iframe>
+</body>
+</html>
diff --git a/content/html/document/reftests/bug917595-pixel-rotated.jpg b/content/html/document/reftests/bug917595-pixel-rotated.jpg
new file mode 100644
index 000000000000..ac39faadadd9
Binary files /dev/null and b/content/html/document/reftests/bug917595-pixel-rotated.jpg differ
diff --git a/content/html/document/reftests/bug917595-unrotated.jpg b/content/html/document/reftests/bug917595-unrotated.jpg
new file mode 100644
index 000000000000..a787797c5e78
Binary files /dev/null and b/content/html/document/reftests/bug917595-unrotated.jpg differ
diff --git a/content/html/document/reftests/reftests.list b/content/html/document/reftests/reftests.list
index 50ee465ffe0f..530d55867fda 100644
--- a/content/html/document/reftests/reftests.list
+++ b/content/html/document/reftests/reftests.list
@@ -3,3 +3,10 @@
 
 == bug448564-4a.html          bug448564-4b.html
 == bug502168-1_malformed.html bug502168-1_well-formed.html
+
+# Test that image documents taken into account CSS properties like
+# image-orientation when determining the size of the image.
+# (Fuzzy necessary due to pixel-wise comparison of different JPEGs.
+# The vast majority of the fuzziness comes from Linux and WinXP.)
+fuzzy(1,149) == bug917595-iframe-1.html    bug917595-1-ref.html
+fuzzy(2,446) == bug917595-exif-rotated.jpg bug917595-pixel-rotated.jpg
diff --git a/content/html/document/src/ImageDocument.cpp b/content/html/document/src/ImageDocument.cpp
index ebe217d0ccc6..bd242f2df174 100644
--- a/content/html/document/src/ImageDocument.cpp
+++ b/content/html/document/src/ImageDocument.cpp
@@ -8,6 +8,7 @@
 #include "nsRect.h"
 #include "nsIImageLoadingContent.h"
 #include "nsGenericHTMLElement.h"
+#include "nsDocShell.h"
 #include "nsIDocumentInlines.h"
 #include "nsDOMTokenList.h"
 #include "nsIDOMHTMLImageElement.h"
@@ -15,6 +16,7 @@
 #include "nsIDOMKeyEvent.h"
 #include "nsIDOMMouseEvent.h"
 #include "nsIDOMEventListener.h"
+#include "nsIFrame.h"
 #include "nsGkAtoms.h"
 #include "imgIRequest.h"
 #include "imgILoader.h"
@@ -209,6 +211,7 @@ ImageDocument::Destroy()
   if (mImageContent) {
     // Remove our event listener from the image content.
     nsCOMPtr<EventTarget> target = do_QueryInterface(mImageContent);
+    target->RemoveEventListener(NS_LITERAL_STRING("load"), this, false);
     target->RemoveEventListener(NS_LITERAL_STRING("click"), this, false);
 
     // Break reference cycle with mImageContent, if we have one
@@ -253,6 +256,7 @@ ImageDocument::SetScriptGlobalObject(nsIScriptGlobalObject* aScriptGlobalObject)
       NS_ASSERTION(NS_SUCCEEDED(rv), "failed to create synthetic document");
 
       target = do_QueryInterface(mImageContent);
+      target->AddEventListener(NS_LITERAL_STRING("load"), this, false);
       target->AddEventListener(NS_LITERAL_STRING("click"), this, false);
     }
 
@@ -509,8 +513,11 @@ ImageDocument::SetModeClass(eModeClasses mode)
 nsresult
 ImageDocument::OnStartContainer(imgIRequest* aRequest, imgIContainer* aImage)
 {
+  // Styles have not yet been applied, so we don't know the final size. For now,
+  // default to the image's intrinsic size.
   aImage->GetWidth(&mImageWidth);
   aImage->GetHeight(&mImageHeight);
+
   nsCOMPtr<nsIRunnable> runnable =
     NS_NewRunnableMethod(this, &ImageDocument::DefaultCheckOverflowing);
   nsContentUtils::AddScriptRunner(runnable);
@@ -573,11 +580,44 @@ ImageDocument::HandleEvent(nsIDOMEvent* aEvent)
     else if (mImageIsOverflowing) {
       ShrinkToFit();
     }
+  } else if (eventType.EqualsLiteral("load")) {
+    UpdateSizeFromLayout();
   }
 
   return NS_OK;
 }
 
+void
+ImageDocument::UpdateSizeFromLayout()
+{
+  // Pull an updated size from the content frame to account for any size
+  // change due to CSS properties like |image-orientation|.
+  Element* contentElement = mImageContent->AsElement();
+  if (!contentElement) {
+    return;
+  }
+
+  nsIFrame* contentFrame = contentElement->GetPrimaryFrame(Flush_Frames);
+  if (!contentFrame) {
+    return;
+  }
+
+  nsIntSize oldSize(mImageWidth, mImageHeight);
+  IntrinsicSize newSize = contentFrame->GetIntrinsicSize();
+
+  if (newSize.width.GetUnit() == eStyleUnit_Coord) {
+    mImageWidth = nsPresContext::AppUnitsToFloatCSSPixels(newSize.width.GetCoordValue());
+  }
+  if (newSize.height.GetUnit() == eStyleUnit_Coord) {
+    mImageHeight = nsPresContext::AppUnitsToFloatCSSPixels(newSize.height.GetCoordValue());
+  }
+
+  // Ensure that our information about overflow is up-to-date if needed.
+  if (mImageWidth != oldSize.width || mImageHeight != oldSize.height) {
+    CheckOverflowing(false);
+  }
+}
+
 nsresult
 ImageDocument::CreateSyntheticDocument()
 {
@@ -724,7 +764,7 @@ ImageDocument::UpdateTitleAndCharset()
 void
 ImageDocument::ResetZoomLevel()
 {
-  nsCOMPtr<nsIDocShell> docShell = do_QueryReferent(mDocumentContainer);
+  nsCOMPtr<nsIDocShell> docShell(mDocumentContainer);
   if (docShell) {
     if (nsContentUtils::IsChildOfSameType(this)) {
       return;
@@ -743,7 +783,7 @@ float
 ImageDocument::GetZoomLevel()
 {
   float zoomLevel = mOriginalZoomLevel;
-  nsCOMPtr<nsIDocShell> docShell = do_QueryReferent(mDocumentContainer);
+  nsCOMPtr<nsIDocShell> docShell(mDocumentContainer);
   if (docShell) {
     nsCOMPtr<nsIContentViewer> cv;
     docShell->GetContentViewer(getter_AddRefs(cv));
diff --git a/content/html/document/src/ImageDocument.h b/content/html/document/src/ImageDocument.h
index d431b29a4ff9..45de6062deb2 100644
--- a/content/html/document/src/ImageDocument.h
+++ b/content/html/document/src/ImageDocument.h
@@ -94,6 +94,8 @@ protected:
   void ResetZoomLevel();
   float GetZoomLevel();
 
+  void UpdateSizeFromLayout();
+
   enum eModeClasses {
     eNone,
     eShrinkToFit,
diff --git a/content/html/document/src/moz.build b/content/html/document/src/moz.build
index 07692ca68e24..d11996ce4c48 100644
--- a/content/html/document/src/moz.build
+++ b/content/html/document/src/moz.build
@@ -32,6 +32,7 @@ LOCAL_INCLUDES += [
     '/caps/include',
     '/content/base/src',
     '/content/events/src',
+    '/docshell/base',
     '/dom/base',
     '/layout/style',
     '/xpcom/ds',
diff --git a/content/html/document/src/nsHTMLDocument.cpp b/content/html/document/src/nsHTMLDocument.cpp
index f68682f53e45..1e46d56a322f 100644
--- a/content/html/document/src/nsHTMLDocument.cpp
+++ b/content/html/document/src/nsHTMLDocument.cpp
@@ -32,7 +32,7 @@
 #include "nsIContentViewerContainer.h"
 #include "nsIContentViewer.h"
 #include "nsIMarkupDocumentViewer.h"
-#include "nsIDocShell.h"
+#include "nsDocShell.h"
 #include "nsDocShellLoadTypes.h"
 #include "nsIWebNavigation.h"
 #include "nsIBaseWindow.h"
@@ -1362,7 +1362,7 @@ nsHTMLDocument::Open(JSContext* cx,
   }
 
   // check whether we're in the middle of unload.  If so, ignore this call.
-  nsCOMPtr<nsIDocShell> shell = do_QueryReferent(mDocumentContainer);
+  nsCOMPtr<nsIDocShell> shell(mDocumentContainer);
   if (!shell) {
     // We won't be able to create a parser anyway.
     nsCOMPtr<nsIDocument> ret = this;
diff --git a/content/mathml/content/src/nsMathMLElement.cpp b/content/mathml/content/src/nsMathMLElement.cpp
index d7408a18fbae..7ec1c5e14a36 100644
--- a/content/mathml/content/src/nsMathMLElement.cpp
+++ b/content/mathml/content/src/nsMathMLElement.cpp
@@ -815,7 +815,7 @@ nsMathMLElement::SetIncrementScriptLevel(bool aIncrementScriptLevel,
 }
 
 bool
-nsMathMLElement::IsFocusable(int32_t *aTabIndex, bool aWithMouse)
+nsMathMLElement::IsFocusableInternal(int32_t* aTabIndex, bool aWithMouse)
 {
   nsCOMPtr<nsIURI> uri;
   if (IsLink(getter_AddRefs(uri))) {
diff --git a/content/mathml/content/src/nsMathMLElement.h b/content/mathml/content/src/nsMathMLElement.h
index ffeffc2fa813..81240042979b 100644
--- a/content/mathml/content/src/nsMathMLElement.h
+++ b/content/mathml/content/src/nsMathMLElement.h
@@ -80,8 +80,7 @@ public:
     return mIncrementScriptLevel;
   }
 
-  virtual bool IsFocusable(int32_t *aTabIndex = nullptr,
-                             bool aWithMouse = false) MOZ_OVERRIDE;
+  virtual bool IsFocusableInternal(int32_t* aTabIndex, bool aWithMouse) MOZ_OVERRIDE;
   virtual bool IsLink(nsIURI** aURI) const MOZ_OVERRIDE;
   virtual void GetLinkTarget(nsAString& aTarget) MOZ_OVERRIDE;
   virtual already_AddRefed<nsIURI> GetHrefURI() const MOZ_OVERRIDE;
diff --git a/content/media/AudioNodeExternalInputStream.h b/content/media/AudioNodeExternalInputStream.h
index fe574da0d65b..072587ba2912 100644
--- a/content/media/AudioNodeExternalInputStream.h
+++ b/content/media/AudioNodeExternalInputStream.h
@@ -9,12 +9,6 @@
 #include "MediaStreamGraph.h"
 #include "AudioNodeStream.h"
 
-#ifdef PR_LOGGING
-#define LOG(type, msg) PR_LOG(gMediaStreamGraphLog, type, msg)
-#else
-#define LOG(type, msg)
-#endif
-
 // Forward declaration for mResamplerMap
 typedef struct SpeexResamplerState_ SpeexResamplerState;
 
diff --git a/content/media/AudioNodeStream.h b/content/media/AudioNodeStream.h
index 7b6439815484..e9b81bd50058 100644
--- a/content/media/AudioNodeStream.h
+++ b/content/media/AudioNodeStream.h
@@ -10,12 +10,6 @@
 #include "mozilla/dom/AudioNodeBinding.h"
 #include "AudioSegment.h"
 
-#ifdef PR_LOGGING
-#define LOG(type, msg) PR_LOG(gMediaStreamGraphLog, type, msg)
-#else
-#define LOG(type, msg)
-#endif
-
 namespace mozilla {
 
 namespace dom {
diff --git a/content/media/DecoderTraits.cpp b/content/media/DecoderTraits.cpp
index ec1622f31f7b..44fe3ff6bee0 100644
--- a/content/media/DecoderTraits.cpp
+++ b/content/media/DecoderTraits.cpp
@@ -61,6 +61,10 @@
 #include "AppleDecoder.h"
 #include "AppleMP3Reader.h"
 #endif
+#ifdef MOZ_FMP4
+#include "MP4Reader.h"
+#include "MP4Decoder.h"
+#endif
 
 namespace mozilla
 {
@@ -298,6 +302,15 @@ IsDirectShowSupportedType(const nsACString& aType)
 }
 #endif
 
+#ifdef MOZ_FMP4
+static bool
+IsMP4SupportedType(const nsACString& aType)
+{
+  return Preferences::GetBool("media.fragmented-mp4.exposed", false) &&
+         MP4Decoder::GetSupportedCodecs(aType, nullptr);
+}
+#endif
+
 #ifdef MOZ_APPLEMEDIA
 static const char * const gAppleMP3Types[] = {
   "audio/mp3",
@@ -445,30 +458,35 @@ DecoderTraits::CanHandleMediaType(const char* aMIMEType,
   return CANPLAY_YES;
 }
 
-/* static */
+// Instantiates but does not initialize decoder.
+static
 already_AddRefed<MediaDecoder>
-DecoderTraits::CreateDecoder(const nsACString& aType, MediaDecoderOwner* aOwner)
+InstantiateDecoder(const nsACString& aType, MediaDecoderOwner* aOwner)
 {
   nsRefPtr<MediaDecoder> decoder;
 
 #ifdef MOZ_GSTREAMER
   if (IsGStreamerSupportedType(aType)) {
     decoder = new GStreamerDecoder();
+    return decoder.forget();
   }
 #endif
 #ifdef MOZ_RAW
   if (IsRawType(aType)) {
     decoder = new RawDecoder();
+    return decoder.forget();
   }
 #endif
 #ifdef MOZ_OGG
   if (IsOggType(aType)) {
     decoder = new OggDecoder();
+    return decoder.forget();
   }
 #endif
 #ifdef MOZ_WAVE
   if (IsWaveType(aType)) {
     decoder = new WaveDecoder();
+    return decoder.forget();
   }
 #endif
 #ifdef MOZ_OMX_DECODER
@@ -489,22 +507,26 @@ DecoderTraits::CreateDecoder(const nsACString& aType, MediaDecoderOwner* aOwner)
       }
     }
     decoder = new MediaOmxDecoder();
+    return decoder.forget();
   }
 #endif
 #ifdef NECKO_PROTOCOL_rtsp
   if (IsRtspSupportedType(aType)) {
     decoder = new RtspOmxDecoder();
+    return decoder.forget();
   }
 #endif
 #ifdef MOZ_MEDIA_PLUGINS
   if (MediaDecoder::IsMediaPluginsEnabled() &&
       GetMediaPluginHost()->FindDecoder(aType, nullptr)) {
     decoder = new MediaPluginDecoder(aType);
+    return decoder.forget();
   }
 #endif
 #ifdef MOZ_WEBM
   if (IsWebMType(aType)) {
     decoder = new WebMDecoder();
+    return decoder.forget();
   }
 #endif
 #ifdef MOZ_DIRECTSHOW
@@ -512,21 +534,40 @@ DecoderTraits::CreateDecoder(const nsACString& aType, MediaDecoderOwner* aOwner)
   // "media.directshow.preferred" won't be honored.
   if (IsDirectShowSupportedType(aType)) {
     decoder = new DirectShowDecoder();
+    return decoder.forget();
+  }
+#endif
+#ifdef MOZ_FMP4
+  if (IsMP4SupportedType(aType)) {
+    decoder = new MP4Decoder();
+    return decoder.forget();
   }
 #endif
 #ifdef MOZ_WMF
   if (IsWMFSupportedType(aType)) {
     decoder = new WMFDecoder();
+    return decoder.forget();
   }
 #endif
 #ifdef MOZ_APPLEMEDIA
   if (IsAppleMediaSupportedType(aType)) {
     decoder = new AppleDecoder();
+    return decoder.forget();
   }
 #endif
 
   NS_ENSURE_TRUE(decoder != nullptr, nullptr);
   NS_ENSURE_TRUE(decoder->Init(aOwner), nullptr);
+  return nullptr;
+}
+
+/* static */
+already_AddRefed<MediaDecoder>
+DecoderTraits::CreateDecoder(const nsACString& aType, MediaDecoderOwner* aOwner)
+{
+  nsRefPtr<MediaDecoder> decoder(InstantiateDecoder(aType, aOwner));
+  NS_ENSURE_TRUE(decoder != nullptr, nullptr);
+  NS_ENSURE_TRUE(decoder->Init(aOwner), nullptr);
 
   return decoder.forget();
 }
@@ -579,6 +620,11 @@ MediaDecoderReader* DecoderTraits::CreateReader(const nsACString& aType, Abstrac
     decoderReader = new DirectShowReader(aDecoder);
   } else
 #endif
+#ifdef MOZ_FMP4
+  if (IsMP4SupportedType(aType)) {
+    decoderReader = new MP4Reader(aDecoder);
+  } else
+#endif
 #ifdef MOZ_WMF
   if (IsWMFSupportedType(aType)) {
     decoderReader = new WMFReader(aDecoder);
@@ -615,6 +661,9 @@ bool DecoderTraits::IsSupportedInVideoDocument(const nsACString& aType)
 #ifdef MOZ_MEDIA_PLUGINS
     (MediaDecoder::IsMediaPluginsEnabled() && IsMediaPluginsType(aType)) ||
 #endif
+#ifdef MOZ_FMP4
+    IsMP4SupportedType(aType) ||
+#endif
 #ifdef MOZ_WMF
     (IsWMFSupportedType(aType) &&
      Preferences::GetBool("media.windows-media-foundation.play-stand-alone", true)) ||
diff --git a/content/media/MediaCache.cpp b/content/media/MediaCache.cpp
index 98f877a13d13..005d88cc7841 100644
--- a/content/media/MediaCache.cpp
+++ b/content/media/MediaCache.cpp
@@ -26,9 +26,9 @@ namespace mozilla {
 
 #ifdef PR_LOGGING
 PRLogModuleInfo* gMediaCacheLog;
-#define LOG(type, msg) PR_LOG(gMediaCacheLog, type, msg)
+#define CACHE_LOG(type, msg) PR_LOG(gMediaCacheLog, type, msg)
 #else
-#define LOG(type, msg)
+#define CACHE_LOG(type, msg)
 #endif
 
 // Readahead blocks for non-seekable streams will be limited to this
@@ -935,7 +935,7 @@ MediaCache::FreeBlock(int32_t aBlock)
     return;
   }
 
-  LOG(PR_LOG_DEBUG, ("Released block %d", aBlock));
+  CACHE_LOG(PR_LOG_DEBUG, ("Released block %d", aBlock));
 
   for (uint32_t i = 0; i < block->mOwners.Length(); ++i) {
     BlockOwner* bo = &block->mOwners[i];
@@ -1101,20 +1101,20 @@ MediaCache::Update()
 
         if (NS_SUCCEEDED(rv)) {
           // We successfully copied the file data.
-          LOG(PR_LOG_DEBUG, ("Swapping blocks %d and %d (trimming cache)",
-              blockIndex, destinationBlockIndex));
+          CACHE_LOG(PR_LOG_DEBUG, ("Swapping blocks %d and %d (trimming cache)",
+                    blockIndex, destinationBlockIndex));
           // Swapping the block metadata here lets us maintain the
           // correct positions in the linked lists
           SwapBlocks(blockIndex, destinationBlockIndex);
           //Free the overflowing block even if the copy failed.
-          LOG(PR_LOG_DEBUG, ("Released block %d (trimming cache)", blockIndex));
+          CACHE_LOG(PR_LOG_DEBUG, ("Released block %d (trimming cache)", blockIndex));
           FreeBlock(blockIndex);
         }
       } else {
-        LOG(PR_LOG_DEBUG, ("Could not trim cache block %d (destination %d, predicted next use %f, latest predicted use for overflow %f",
-                           blockIndex, destinationBlockIndex,
-                           PredictNextUse(now, destinationBlockIndex).ToSeconds(),
-                           latestPredictedUseForOverflow.ToSeconds()));
+        CACHE_LOG(PR_LOG_DEBUG, ("Could not trim cache block %d (destination %d, predicted next use %f, latest predicted use for overflow %f",
+                                 blockIndex, destinationBlockIndex,
+                                 PredictNextUse(now, destinationBlockIndex).ToSeconds(),
+                                 latestPredictedUseForOverflow.ToSeconds()));
       }
     }
     // Try chopping back the array of cache entries and the cache file.
@@ -1194,29 +1194,29 @@ MediaCache::Update()
         // advertised with Content-Length, and we may as well keep reading.
         // But we don't want to seek to the end of the stream if we're not
         // already there.
-        LOG(PR_LOG_DEBUG, ("Stream %p at end of stream", stream));
+        CACHE_LOG(PR_LOG_DEBUG, ("Stream %p at end of stream", stream));
         enableReading = !stream->mCacheSuspended &&
           stream->mStreamLength == stream->mChannelOffset;
       } else if (desiredOffset < stream->mStreamOffset) {
         // We're reading to try to catch up to where the current stream
         // reader wants to be. Better not stop.
-        LOG(PR_LOG_DEBUG, ("Stream %p catching up", stream));
+        CACHE_LOG(PR_LOG_DEBUG, ("Stream %p catching up", stream));
         enableReading = true;
       } else if (desiredOffset < stream->mStreamOffset + BLOCK_SIZE) {
         // The stream reader is waiting for us, or nearly so. Better feed it.
-        LOG(PR_LOG_DEBUG, ("Stream %p feeding reader", stream));
+        CACHE_LOG(PR_LOG_DEBUG, ("Stream %p feeding reader", stream));
         enableReading = true;
       } else if (!stream->mIsTransportSeekable &&
                  nonSeekableReadaheadBlockCount >= maxBlocks*NONSEEKABLE_READAHEAD_MAX) {
         // This stream is not seekable and there are already too many blocks
         // being cached for readahead for nonseekable streams (which we can't
         // free). So stop reading ahead now.
-        LOG(PR_LOG_DEBUG, ("Stream %p throttling non-seekable readahead", stream));
+        CACHE_LOG(PR_LOG_DEBUG, ("Stream %p throttling non-seekable readahead", stream));
         enableReading = false;
       } else if (mIndex.Length() > uint32_t(maxBlocks)) {
         // We're in the process of bringing the cache size back to the
         // desired limit, so don't bring in more data yet
-        LOG(PR_LOG_DEBUG, ("Stream %p throttling to reduce cache size", stream));
+        CACHE_LOG(PR_LOG_DEBUG, ("Stream %p throttling to reduce cache size", stream));
         enableReading = false;
       } else {
         TimeDuration predictedNewDataUse = PredictNextUseForIncomingData(stream);
@@ -1224,21 +1224,21 @@ MediaCache::Update()
         if (stream->mCacheSuspended &&
             predictedNewDataUse.ToMilliseconds() > CACHE_POWERSAVE_WAKEUP_LOW_THRESHOLD_MS) {
           // Don't need data for a while, so don't bother waking up the stream
-          LOG(PR_LOG_DEBUG, ("Stream %p avoiding wakeup since more data is not needed", stream));
+          CACHE_LOG(PR_LOG_DEBUG, ("Stream %p avoiding wakeup since more data is not needed", stream));
           enableReading = false;
         } else if (freeBlockCount > 0) {
           // Free blocks in the cache, so keep reading
-          LOG(PR_LOG_DEBUG, ("Stream %p reading since there are free blocks", stream));
+          CACHE_LOG(PR_LOG_DEBUG, ("Stream %p reading since there are free blocks", stream));
           enableReading = true;
         } else if (latestNextUse <= TimeDuration(0)) {
           // No reusable blocks, so can't read anything
-          LOG(PR_LOG_DEBUG, ("Stream %p throttling due to no reusable blocks", stream));
+          CACHE_LOG(PR_LOG_DEBUG, ("Stream %p throttling due to no reusable blocks", stream));
           enableReading = false;
         } else {
           // Read ahead if the data we expect to read is more valuable than
           // the least valuable block in the main part of the cache
-          LOG(PR_LOG_DEBUG, ("Stream %p predict next data in %f, current worst block is %f",
-              stream, predictedNewDataUse.ToSeconds(), latestNextUse.ToSeconds()));
+          CACHE_LOG(PR_LOG_DEBUG, ("Stream %p predict next data in %f, current worst block is %f",
+                    stream, predictedNewDataUse.ToSeconds(), latestNextUse.ToSeconds()));
           enableReading = predictedNewDataUse < latestNextUse;
         }
       }
@@ -1252,8 +1252,8 @@ MediaCache::Update()
             // This block is already going to be read by the other stream.
             // So don't try to read it from this stream as well.
             enableReading = false;
-            LOG(PR_LOG_DEBUG, ("Stream %p waiting on same block (%lld) from stream %p",
-                               stream, desiredOffset/BLOCK_SIZE, other));
+            CACHE_LOG(PR_LOG_DEBUG, ("Stream %p waiting on same block (%lld) from stream %p",
+                                     stream, desiredOffset/BLOCK_SIZE, other));
             break;
           }
         }
@@ -1316,17 +1316,17 @@ MediaCache::Update()
     switch (actions[i]) {
     case SEEK:
 	case SEEK_AND_RESUME:
-      LOG(PR_LOG_DEBUG, ("Stream %p CacheSeek to %lld (resume=%d)", stream,
-           (long long)stream->mChannelOffset, actions[i] == SEEK_AND_RESUME));
+      CACHE_LOG(PR_LOG_DEBUG, ("Stream %p CacheSeek to %lld (resume=%d)", stream,
+                (long long)stream->mChannelOffset, actions[i] == SEEK_AND_RESUME));
       rv = stream->mClient->CacheClientSeek(stream->mChannelOffset,
                                             actions[i] == SEEK_AND_RESUME);
       break;
     case RESUME:
-      LOG(PR_LOG_DEBUG, ("Stream %p Resumed", stream));
+      CACHE_LOG(PR_LOG_DEBUG, ("Stream %p Resumed", stream));
       rv = stream->mClient->CacheClientResume();
       break;
     case SUSPEND:
-      LOG(PR_LOG_DEBUG, ("Stream %p Suspended", stream));
+      CACHE_LOG(PR_LOG_DEBUG, ("Stream %p Suspended", stream));
       rv = stream->mClient->CacheClientSuspend();
       break;
     default:
@@ -1447,8 +1447,8 @@ MediaCache::AllocateAndWriteBlock(MediaCacheStream* aStream, const void* aData,
     if (stream->mBlocks[streamBlockIndex] >= 0) {
       // We no longer want to own this block
       int32_t globalBlockIndex = stream->mBlocks[streamBlockIndex];
-      LOG(PR_LOG_DEBUG, ("Released block %d from stream %p block %d(%lld)",
-          globalBlockIndex, stream, streamBlockIndex, (long long)streamBlockIndex*BLOCK_SIZE));
+      CACHE_LOG(PR_LOG_DEBUG, ("Released block %d from stream %p block %d(%lld)",
+                globalBlockIndex, stream, streamBlockIndex, (long long)streamBlockIndex*BLOCK_SIZE));
       RemoveBlockOwner(globalBlockIndex, stream);
     }
   }
@@ -1461,8 +1461,8 @@ MediaCache::AllocateAndWriteBlock(MediaCacheStream* aStream, const void* aData,
     FreeBlock(blockIndex);
 
     Block* block = &mIndex[blockIndex];
-    LOG(PR_LOG_DEBUG, ("Allocated block %d to stream %p block %d(%lld)",
-        blockIndex, aStream, streamBlockIndex, (long long)streamBlockIndex*BLOCK_SIZE));
+    CACHE_LOG(PR_LOG_DEBUG, ("Allocated block %d to stream %p block %d(%lld)",
+              blockIndex, aStream, streamBlockIndex, (long long)streamBlockIndex*BLOCK_SIZE));
 
     mFreeBlocks.RemoveBlock(blockIndex);
 
@@ -1496,8 +1496,8 @@ MediaCache::AllocateAndWriteBlock(MediaCacheStream* aStream, const void* aData,
 
     nsresult rv = mFileCache->WriteBlock(blockIndex, reinterpret_cast<const uint8_t*>(aData));
     if (NS_FAILED(rv)) {
-      LOG(PR_LOG_DEBUG, ("Released block %d from stream %p block %d(%lld)",
-          blockIndex, aStream, streamBlockIndex, (long long)streamBlockIndex*BLOCK_SIZE));
+      CACHE_LOG(PR_LOG_DEBUG, ("Released block %d from stream %p block %d(%lld)",
+                blockIndex, aStream, streamBlockIndex, (long long)streamBlockIndex*BLOCK_SIZE));
       FreeBlock(blockIndex);
     }
   }
@@ -1513,7 +1513,7 @@ MediaCache::OpenStream(MediaCacheStream* aStream)
   NS_ASSERTION(NS_IsMainThread(), "Only call on main thread");
 
   ReentrantMonitorAutoEnter mon(mReentrantMonitor);
-  LOG(PR_LOG_DEBUG, ("Stream %p opened", aStream));
+  CACHE_LOG(PR_LOG_DEBUG, ("Stream %p opened", aStream));
   mStreams.AppendElement(aStream);
   aStream->mResourceID = AllocateResourceID();
 
@@ -1527,7 +1527,7 @@ MediaCache::ReleaseStream(MediaCacheStream* aStream)
   NS_ASSERTION(NS_IsMainThread(), "Only call on main thread");
 
   ReentrantMonitorAutoEnter mon(mReentrantMonitor);
-  LOG(PR_LOG_DEBUG, ("Stream %p closed", aStream));
+  CACHE_LOG(PR_LOG_DEBUG, ("Stream %p closed", aStream));
   mStreams.RemoveElement(aStream);
 }
 
@@ -1543,8 +1543,8 @@ MediaCache::ReleaseStreamBlocks(MediaCacheStream* aStream)
   for (uint32_t i = 0; i < length; ++i) {
     int32_t blockIndex = aStream->mBlocks[i];
     if (blockIndex >= 0) {
-      LOG(PR_LOG_DEBUG, ("Released block %d from stream %p block %d(%lld)",
-          blockIndex, aStream, i, (long long)i*BLOCK_SIZE));
+      CACHE_LOG(PR_LOG_DEBUG, ("Released block %d from stream %p block %d(%lld)",
+                blockIndex, aStream, i, (long long)i*BLOCK_SIZE));
       RemoveBlockOwner(blockIndex, aStream);
     }
   }
@@ -1712,8 +1712,8 @@ MediaCacheStream::NotifyDataReceived(int64_t aSize, const char* aData,
   int64_t size = aSize;
   const char* data = aData;
 
-  LOG(PR_LOG_DEBUG, ("Stream %p DataReceived at %lld count=%lld",
-      this, (long long)mChannelOffset, (long long)aSize));
+  CACHE_LOG(PR_LOG_DEBUG, ("Stream %p DataReceived at %lld count=%lld",
+            this, (long long)mChannelOffset, (long long)aSize));
 
   // We process the data one block (or part of a block) at a time
   while (size > 0) {
@@ -1780,12 +1780,12 @@ MediaCacheStream::FlushPartialBlockInternal(bool aNotifyAll)
 
   int32_t blockOffset = int32_t(mChannelOffset%BLOCK_SIZE);
   if (blockOffset > 0) {
-    LOG(PR_LOG_DEBUG,
-        ("Stream %p writing partial block: [%d] bytes; "
-         "mStreamOffset [%lld] mChannelOffset[%lld] mStreamLength [%lld] "
-         "notifying: [%s]",
-         this, blockOffset, mStreamOffset, mChannelOffset, mStreamLength,
-         aNotifyAll ? "yes" : "no"));
+    CACHE_LOG(PR_LOG_DEBUG,
+              ("Stream %p writing partial block: [%d] bytes; "
+               "mStreamOffset [%lld] mChannelOffset[%lld] mStreamLength [%lld] "
+               "notifying: [%s]",
+               this, blockOffset, mStreamOffset, mChannelOffset, mStreamLength,
+               aNotifyAll ? "yes" : "no"));
 
     // Write back the partial block
     memset(reinterpret_cast<char*>(mPartialBlockBuffer) + blockOffset, 0,
@@ -2107,7 +2107,7 @@ MediaCacheStream::Seek(int32_t aWhence, int64_t aOffset)
     return NS_ERROR_FAILURE;
   }
 
-  LOG(PR_LOG_DEBUG, ("Stream %p Seek to %lld", this, (long long)mStreamOffset));
+  CACHE_LOG(PR_LOG_DEBUG, ("Stream %p Seek to %lld", this, (long long)mStreamOffset));
   gMediaCache->NoteSeek(this, oldOffset);
 
   gMediaCache->QueueUpdate();
@@ -2221,8 +2221,8 @@ MediaCacheStream::Read(char* aBuffer, uint32_t aCount, uint32_t* aBytes)
     // have changed
     gMediaCache->QueueUpdate();
   }
-  LOG(PR_LOG_DEBUG,
-      ("Stream %p Read at %lld count=%d", this, (long long)(mStreamOffset-count), count));
+  CACHE_LOG(PR_LOG_DEBUG,
+            ("Stream %p Read at %lld count=%d", this, (long long)(mStreamOffset-count), count));
   *aBytes = count;
   return NS_OK;
 }
diff --git a/content/media/MediaDecoder.cpp b/content/media/MediaDecoder.cpp
index 81dc7cdf0b02..f63f499750c5 100644
--- a/content/media/MediaDecoder.cpp
+++ b/content/media/MediaDecoder.cpp
@@ -48,9 +48,9 @@ static const int64_t CAN_PLAY_THROUGH_MARGIN = 1;
 
 #ifdef PR_LOGGING
 PRLogModuleInfo* gMediaDecoderLog;
-#define LOG(type, msg) PR_LOG(gMediaDecoderLog, type, msg)
+#define DECODER_LOG(type, msg) PR_LOG(gMediaDecoderLog, type, msg)
 #else
-#define LOG(type, msg)
+#define DECODER_LOG(type, msg)
 #endif
 
 class MediaMemoryTracker
@@ -251,8 +251,8 @@ void MediaDecoder::RecreateDecodedStream(int64_t aStartTimeUSecs)
 {
   MOZ_ASSERT(NS_IsMainThread());
   GetReentrantMonitor().AssertCurrentThreadIn();
-  LOG(PR_LOG_DEBUG, ("MediaDecoder::RecreateDecodedStream this=%p aStartTimeUSecs=%lld!",
-                     this, (long long)aStartTimeUSecs));
+  DECODER_LOG(PR_LOG_DEBUG, ("MediaDecoder::RecreateDecodedStream this=%p aStartTimeUSecs=%lld!",
+                             this, (long long)aStartTimeUSecs));
 
   DestroyDecodedStream();
 
@@ -296,8 +296,8 @@ void MediaDecoder::AddOutputStream(ProcessedMediaStream* aStream,
                                    bool aFinishWhenEnded)
 {
   MOZ_ASSERT(NS_IsMainThread());
-  LOG(PR_LOG_DEBUG, ("MediaDecoder::AddOutputStream this=%p aStream=%p!",
-                     this, aStream));
+  DECODER_LOG(PR_LOG_DEBUG, ("MediaDecoder::AddOutputStream this=%p aStream=%p!",
+                             this, aStream));
 
   {
     ReentrantMonitorAutoEnter mon(GetReentrantMonitor());
@@ -459,7 +459,7 @@ nsresult MediaDecoder::OpenResource(nsIStreamListener** aStreamListener)
 
     nsresult rv = mResource->Open(aStreamListener);
     if (NS_FAILED(rv)) {
-      LOG(PR_LOG_DEBUG, ("%p Failed to open stream!", this));
+      DECODER_LOG(PR_LOG_DEBUG, ("%p Failed to open stream!", this));
       return rv;
     }
   }
@@ -476,7 +476,7 @@ nsresult MediaDecoder::Load(nsIStreamListener** aStreamListener,
 
   mDecoderStateMachine = CreateStateMachine();
   if (!mDecoderStateMachine) {
-    LOG(PR_LOG_DEBUG, ("%p Failed to create state machine!", this));
+    DECODER_LOG(PR_LOG_DEBUG, ("%p Failed to create state machine!", this));
     return NS_ERROR_FAILURE;
   }
 
@@ -491,7 +491,7 @@ nsresult MediaDecoder::InitializeStateMachine(MediaDecoder* aCloneDonor)
   MediaDecoder* cloneDonor = static_cast<MediaDecoder*>(aCloneDonor);
   if (NS_FAILED(mDecoderStateMachine->Init(cloneDonor ?
                                            cloneDonor->mDecoderStateMachine : nullptr))) {
-    LOG(PR_LOG_DEBUG, ("%p Failed to init state machine!", this));
+    DECODER_LOG(PR_LOG_DEBUG, ("%p Failed to init state machine!", this));
     return NS_ERROR_FAILURE;
   }
   {
@@ -814,6 +814,23 @@ void MediaDecoder::ResourceLoaded()
   }
 }
 
+void MediaDecoder::ResetConnectionState()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  if (mShuttingDown)
+    return;
+
+  if (mOwner) {
+    // Notify the media element that connection gets lost.
+    mOwner->ResetConnectionState();
+  }
+
+  // Since we have notified the media element the connection
+  // lost event, the decoder will be reloaded when user tries
+  // to play the Rtsp streaming next time.
+  Shutdown();
+}
+
 void MediaDecoder::NetworkError()
 {
   MOZ_ASSERT(NS_IsMainThread());
@@ -1252,7 +1269,7 @@ void MediaDecoder::DurationChanged()
   UpdatePlaybackRate();
 
   if (mOwner && oldDuration != mDuration && !IsInfinite()) {
-    LOG(PR_LOG_DEBUG, ("%p duration changed to %lld", this, mDuration));
+    DECODER_LOG(PR_LOG_DEBUG, ("%p duration changed to %lld", this, mDuration));
     mOwner->DispatchEvent(NS_LITERAL_STRING("durationchange"));
   }
 }
diff --git a/content/media/MediaDecoder.h b/content/media/MediaDecoder.h
index 27a66180f142..651be6c73ec9 100644
--- a/content/media/MediaDecoder.h
+++ b/content/media/MediaDecoder.h
@@ -247,6 +247,9 @@ public:
   MediaDecoder();
   virtual ~MediaDecoder();
 
+  // Reset the decoder and notify the media element that
+  // server connection is closed.
+  virtual void ResetConnectionState();
   // Create a new decoder of the same type as this one.
   // Subclasses must implement this.
   virtual MediaDecoder* Clone() = 0;
diff --git a/content/media/MediaDecoderOwner.h b/content/media/MediaDecoderOwner.h
index a12f3ff0fb0d..b075ef309351 100644
--- a/content/media/MediaDecoderOwner.h
+++ b/content/media/MediaDecoderOwner.h
@@ -139,6 +139,10 @@ public:
   // Called by the media decoder and the video frame to get the
   // ImageContainer containing the video data.
   virtual VideoFrameContainer* GetVideoFrameContainer() = 0;
+
+  // Called by the media decoder object, on the main thread,
+  // when the connection between Rtsp server and client gets lost.
+  virtual void ResetConnectionState() = 0;
 };
 
 }
diff --git a/content/media/MediaDecoderReader.cpp b/content/media/MediaDecoderReader.cpp
index e5f92b886ad2..8baeefd4587e 100644
--- a/content/media/MediaDecoderReader.cpp
+++ b/content/media/MediaDecoderReader.cpp
@@ -36,14 +36,14 @@ static_assert(PlanarYCbCrImage::MAX_DIMENSION < UINT32_MAX / PlanarYCbCrImage::M
 
 #ifdef PR_LOGGING
 extern PRLogModuleInfo* gMediaDecoderLog;
-#define LOG(type, msg) PR_LOG(gMediaDecoderLog, type, msg)
+#define DECODER_LOG(type, msg) PR_LOG(gMediaDecoderLog, type, msg)
 #ifdef SEEK_LOGGING
 #define SEEK_LOG(type, msg) PR_LOG(gMediaDecoderLog, type, msg)
 #else
 #define SEEK_LOG(type, msg)
 #endif
 #else
-#define LOG(type, msg)
+#define DECODER_LOG(type, msg)
 #define SEEK_LOG(type, msg)
 #endif
 
@@ -466,12 +466,14 @@ VideoData* MediaDecoderReader::FindStartTime(int64_t& aOutStartTime)
     videoData = DecodeToFirstVideoData();
     if (videoData) {
       videoStartTime = videoData->mTime;
+      DECODER_LOG(PR_LOG_DEBUG, ("MediaDecoderReader::FindStartTime() video=%lld", videoStartTime));
     }
   }
   if (HasAudio()) {
     AudioData* audioData = DecodeToFirstAudioData();
     if (audioData) {
       audioStartTime = audioData->mTime;
+      DECODER_LOG(PR_LOG_DEBUG, ("MediaDecoderReader::FindStartTime() audio=%lld", audioStartTime));
     }
   }
 
@@ -485,7 +487,7 @@ VideoData* MediaDecoderReader::FindStartTime(int64_t& aOutStartTime)
 
 nsresult MediaDecoderReader::DecodeToTarget(int64_t aTarget)
 {
-  LOG(PR_LOG_DEBUG, ("MediaDecoderReader::DecodeToTarget(%lld) Begin", aTarget));
+  DECODER_LOG(PR_LOG_DEBUG, ("MediaDecoderReader::DecodeToTarget(%lld) Begin", aTarget));
 
   // Decode forward to the target frame. Start with video, if we have it.
   if (HasVideo()) {
@@ -529,7 +531,7 @@ nsresult MediaDecoderReader::DecodeToTarget(int64_t aTarget)
         return NS_ERROR_FAILURE;
       }
     }
-    LOG(PR_LOG_DEBUG, ("First video frame after decode is %lld", startTime));
+    DECODER_LOG(PR_LOG_DEBUG, ("First video frame after decode is %lld", startTime));
   }
 
   if (HasAudio()) {
@@ -609,7 +611,7 @@ nsresult MediaDecoderReader::DecodeToTarget(int64_t aTarget)
     }
   }
 
-  LOG(PR_LOG_DEBUG, ("MediaDecoderReader::DecodeToTarget(%lld) End", aTarget));
+  DECODER_LOG(PR_LOG_DEBUG, ("MediaDecoderReader::DecodeToTarget(%lld) End", aTarget));
 
   return NS_OK;
 }
diff --git a/content/media/MediaDecoderStateMachine.cpp b/content/media/MediaDecoderStateMachine.cpp
index 086649722581..dca55817d62e 100644
--- a/content/media/MediaDecoderStateMachine.cpp
+++ b/content/media/MediaDecoderStateMachine.cpp
@@ -38,9 +38,9 @@ using namespace mozilla::dom;
 
 #ifdef PR_LOGGING
 extern PRLogModuleInfo* gMediaDecoderLog;
-#define LOG(type, msg) PR_LOG(gMediaDecoderLog, type, msg)
+#define DECODER_LOG(type, msg) PR_LOG(gMediaDecoderLog, type, msg)
 #else
-#define LOG(type, msg)
+#define DECODER_LOG(type, msg)
 #endif
 
 // Wait this number of seconds when buffering, then leave and play
@@ -287,7 +287,7 @@ void StateMachineTracker::CleanupGlobalStateMachine()
     "State machine ref count must be > 0");
   mStateMachineCount--;
   if (mStateMachineCount == 0) {
-    LOG(PR_LOG_DEBUG, ("Destroying media state machine thread"));
+    DECODER_LOG(PR_LOG_DEBUG, ("Destroying media state machine thread"));
     NS_ASSERTION(mPending.GetSize() == 0, "Shouldn't all requests be handled by now?");
     {
       ReentrantMonitorAutoEnter mon(mMonitor);
@@ -506,7 +506,7 @@ void MediaDecoderStateMachine::DecodeThreadRun()
         NS_FAILED(DecodeMetadata())) {
       NS_ASSERTION(mState == DECODER_STATE_SHUTDOWN,
                    "Should be in shutdown state if metadata loading fails.");
-      LOG(PR_LOG_DEBUG, ("Decode metadata failed, shutting down decode thread"));
+      DECODER_LOG(PR_LOG_DEBUG, ("Decode metadata failed, shutting down decode thread"));
     }
 
     while (mState != DECODER_STATE_SHUTDOWN &&
@@ -522,7 +522,7 @@ void MediaDecoderStateMachine::DecodeThreadRun()
         if (NS_FAILED(DecodeMetadata())) {
           NS_ASSERTION(mState == DECODER_STATE_SHUTDOWN,
                        "Should be in shutdown state if metadata loading fails.");
-          LOG(PR_LOG_DEBUG, ("Decode metadata failed, shutting down decode thread"));
+          DECODER_LOG(PR_LOG_DEBUG, ("Decode metadata failed, shutting down decode thread"));
         }
       } else if (mState == DECODER_STATE_WAIT_FOR_RESOURCES) {
         mDecoder->GetReentrantMonitor().Wait();
@@ -537,7 +537,7 @@ void MediaDecoderStateMachine::DecodeThreadRun()
     }
 
     mDecodeThreadIdle = true;
-    LOG(PR_LOG_DEBUG, ("%p Decode thread finished", mDecoder.get()));
+    DECODER_LOG(PR_LOG_DEBUG, ("%p Decode thread finished", mDecoder.get()));
   }
 
   mReader->OnDecodeThreadFinish();
@@ -567,8 +567,8 @@ void MediaDecoderStateMachine::SendStreamAudio(AudioData* aAudio,
     return;
   if (audioWrittenOffset.value() < frameOffset.value()) {
     // Write silence to catch up
-    LOG(PR_LOG_DEBUG, ("%p Decoder writing %d frames of silence to MediaStream",
-                       mDecoder.get(), int32_t(frameOffset.value() - audioWrittenOffset.value())));
+    DECODER_LOG(PR_LOG_DEBUG, ("%p Decoder writing %d frames of silence to MediaStream",
+                               mDecoder.get(), int32_t(frameOffset.value() - audioWrittenOffset.value())));
     AudioSegment silence;
     silence.InsertNullDataAtStart(frameOffset.value() - audioWrittenOffset.value());
     aStream->mAudioFramesWritten += silence.GetDuration();
@@ -597,8 +597,8 @@ void MediaDecoderStateMachine::SendStreamAudio(AudioData* aAudio,
     channels.AppendElement(bufferData + i*aAudio->mFrames + offset);
   }
   aOutput->AppendFrames(buffer.forget(), channels, aAudio->mFrames);
-  LOG(PR_LOG_DEBUG, ("%p Decoder writing %d frames of data to MediaStream for AudioData at %lld",
-                     mDecoder.get(), aAudio->mFrames - int32_t(offset), aAudio->mTime));
+  DECODER_LOG(PR_LOG_DEBUG, ("%p Decoder writing %d frames of data to MediaStream for AudioData at %lld",
+                             mDecoder.get(), aAudio->mFrames - int32_t(offset), aAudio->mTime));
   aStream->mAudioFramesWritten += aAudio->mFrames - int32_t(offset);
 }
 
@@ -684,9 +684,9 @@ void MediaDecoderStateMachine::SendStreamData()
     for (uint32_t i = 0; i < video.Length(); ++i) {
       VideoData* v = video[i];
       if (stream->mNextVideoTime + mStartTime < v->mTime) {
-        LOG(PR_LOG_DEBUG, ("%p Decoder writing last video to MediaStream %p for %lld ms",
-                           mDecoder.get(), mediaStream,
-                           v->mTime - (stream->mNextVideoTime + mStartTime)));
+        DECODER_LOG(PR_LOG_DEBUG, ("%p Decoder writing last video to MediaStream %p for %lld ms",
+                                   mDecoder.get(), mediaStream,
+                                   v->mTime - (stream->mNextVideoTime + mStartTime)));
         // Write last video frame to catch up. mLastVideoImage can be null here
         // which is fine, it just means there's no video.
         WriteVideoToMediaStream(stream->mLastVideoImage,
@@ -695,9 +695,9 @@ void MediaDecoderStateMachine::SendStreamData()
         stream->mNextVideoTime = v->mTime - mStartTime;
       }
       if (stream->mNextVideoTime + mStartTime < v->GetEndTime()) {
-        LOG(PR_LOG_DEBUG, ("%p Decoder writing video frame %lld to MediaStream %p for %lld ms",
-                           mDecoder.get(), v->mTime, mediaStream,
-                           v->GetEndTime() - (stream->mNextVideoTime + mStartTime)));
+        DECODER_LOG(PR_LOG_DEBUG, ("%p Decoder writing video frame %lld to MediaStream %p for %lld ms",
+                                   mDecoder.get(), v->mTime, mediaStream,
+                                   v->GetEndTime() - (stream->mNextVideoTime + mStartTime)));
         WriteVideoToMediaStream(v->mImage,
             v->GetEndTime() - (stream->mNextVideoTime + mStartTime), v->mDisplay,
             &output);
@@ -705,8 +705,8 @@ void MediaDecoderStateMachine::SendStreamData()
         stream->mLastVideoImage = v->mImage;
         stream->mLastVideoImageDisplaySize = v->mDisplay;
       } else {
-        LOG(PR_LOG_DEBUG, ("%p Decoder skipping writing video frame %lld to MediaStream",
-                           mDecoder.get(), v->mTime));
+        DECODER_LOG(PR_LOG_DEBUG, ("%p Decoder skipping writing video frame %lld to MediaStream",
+                                   mDecoder.get(), v->mTime));
       }
     }
     if (output.GetDuration() > 0) {
@@ -814,7 +814,7 @@ bool MediaDecoderStateMachine::HaveEnoughDecodedVideo()
 
 void MediaDecoderStateMachine::DecodeLoop()
 {
-  LOG(PR_LOG_DEBUG, ("%p Start DecodeLoop()", mDecoder.get()));
+  DECODER_LOG(PR_LOG_DEBUG, ("%p Start DecodeLoop()", mDecoder.get()));
 
   AssertCurrentThreadInMonitor();
   NS_ASSERTION(OnDecodeThread(), "Should be on decode thread.");
@@ -889,7 +889,7 @@ void MediaDecoderStateMachine::DecodeLoop()
         !HasLowUndecodedData())
     {
       skipToNextKeyframe = true;
-      LOG(PR_LOG_DEBUG, ("%p Skipping video decode to the next keyframe", mDecoder.get()));
+      DECODER_LOG(PR_LOG_DEBUG, ("%p Skipping video decode to the next keyframe", mDecoder.get()));
     }
 
     // Video decode.
@@ -922,9 +922,9 @@ void MediaDecoderStateMachine::DecodeLoop()
           std::min(THRESHOLD_FACTOR * DurationToUsecs(decodeTime), AMPLE_AUDIO_USECS);
         ampleAudioThreshold = std::max(THRESHOLD_FACTOR * lowAudioThreshold,
                                      ampleAudioThreshold);
-        LOG(PR_LOG_DEBUG,
-            ("Slow video decode, set lowAudioThreshold=%lld ampleAudioThreshold=%lld",
-             lowAudioThreshold, ampleAudioThreshold));
+        DECODER_LOG(PR_LOG_DEBUG,
+                    ("Slow video decode, set lowAudioThreshold=%lld ampleAudioThreshold=%lld",
+                    lowAudioThreshold, ampleAudioThreshold));
       }
     }
 
@@ -990,7 +990,7 @@ void MediaDecoderStateMachine::DecodeLoop()
     ScheduleStateMachine();
   }
 
-  LOG(PR_LOG_DEBUG, ("%p Exiting DecodeLoop", mDecoder.get()));
+  DECODER_LOG(PR_LOG_DEBUG, ("%p Exiting DecodeLoop", mDecoder.get()));
 }
 
 bool MediaDecoderStateMachine::IsPlaying()
@@ -1026,7 +1026,7 @@ static void WriteSilence(AudioStream* aStream, uint32_t aFrames)
 void MediaDecoderStateMachine::AudioLoop()
 {
   NS_ASSERTION(OnAudioThread(), "Should be on audio thread.");
-  LOG(PR_LOG_DEBUG, ("%p Begun audio thread/loop", mDecoder.get()));
+  DECODER_LOG(PR_LOG_DEBUG, ("%p Begun audio thread/loop", mDecoder.get()));
   int64_t audioDuration = 0;
   int64_t audioStartTime = -1;
   uint32_t channels, rate;
@@ -1164,8 +1164,8 @@ void MediaDecoderStateMachine::AudioLoop()
       // hardware so that the next audio chunk begins playback at the correct
       // time.
       missingFrames = std::min<int64_t>(UINT32_MAX, missingFrames.value());
-      LOG(PR_LOG_DEBUG, ("%p Decoder playing %d frames of silence",
-                         mDecoder.get(), int32_t(missingFrames.value())));
+      DECODER_LOG(PR_LOG_DEBUG, ("%p Decoder playing %d frames of silence",
+                                 mDecoder.get(), int32_t(missingFrames.value())));
       framesWritten = PlaySilence(static_cast<uint32_t>(missingFrames.value()),
                                   channels, playedFrames.value());
     } else {
@@ -1220,7 +1220,7 @@ void MediaDecoderStateMachine::AudioLoop()
       }
     }
   }
-  LOG(PR_LOG_DEBUG, ("%p Reached audio stream end.", mDecoder.get()));
+  DECODER_LOG(PR_LOG_DEBUG, ("%p Reached audio stream end.", mDecoder.get()));
   {
     // Must hold lock while shutting down and anulling the audio stream to prevent
     // state machine thread trying to use it while we're destroying it.
@@ -1236,7 +1236,7 @@ void MediaDecoderStateMachine::AudioLoop()
     }
   }
 
-  LOG(PR_LOG_DEBUG, ("%p Audio stream finished playing, audio thread exit", mDecoder.get()));
+  DECODER_LOG(PR_LOG_DEBUG, ("%p Audio stream finished playing, audio thread exit", mDecoder.get()));
 }
 
 uint32_t MediaDecoderStateMachine::PlaySilence(uint32_t aFrames,
@@ -1271,8 +1271,8 @@ uint32_t MediaDecoderStateMachine::PlayFromAudioQueue(uint64_t aFrameOffset,
   int64_t offset = -1;
   uint32_t frames = 0;
   if (!PR_GetEnv("MOZ_QUIET")) {
-    LOG(PR_LOG_DEBUG, ("%p Decoder playing %d frames of data to stream for AudioData at %lld",
-                       mDecoder.get(), audio->mFrames, audio->mTime));
+    DECODER_LOG(PR_LOG_DEBUG, ("%p Decoder playing %d frames of data to stream for AudioData at %lld",
+                               mDecoder.get(), audio->mFrames, audio->mTime));
   }
   mAudioStream->Write(audio->mAudioData,
                       audio->mFrames);
@@ -1303,7 +1303,7 @@ nsresult MediaDecoderStateMachine::Init(MediaDecoderStateMachine* aCloneDonor)
 
 void MediaDecoderStateMachine::StopPlayback()
 {
-  LOG(PR_LOG_DEBUG, ("%p StopPlayback()", mDecoder.get()));
+  DECODER_LOG(PR_LOG_DEBUG, ("%p StopPlayback()", mDecoder.get()));
 
   AssertCurrentThreadInMonitor();
 
@@ -1321,7 +1321,7 @@ void MediaDecoderStateMachine::StopPlayback()
 
 void MediaDecoderStateMachine::StartPlayback()
 {
-  LOG(PR_LOG_DEBUG, ("%p StartPlayback()", mDecoder.get()));
+  DECODER_LOG(PR_LOG_DEBUG, ("%p StartPlayback()", mDecoder.get()));
 
   NS_ASSERTION(!IsPlaying(), "Shouldn't be playing when StartPlayback() is called");
   AssertCurrentThreadInMonitor();
@@ -1535,7 +1535,7 @@ void MediaDecoderStateMachine::Shutdown()
 
   // Change state before issuing shutdown request to threads so those
   // threads can start exiting cleanly during the Shutdown call.
-  LOG(PR_LOG_DEBUG, ("%p Changed state to SHUTDOWN", mDecoder.get()));
+  DECODER_LOG(PR_LOG_DEBUG, ("%p Changed state to SHUTDOWN", mDecoder.get()));
   ScheduleStateMachine();
   mState = DECODER_STATE_SHUTDOWN;
   mDecoder->GetReentrantMonitor().NotifyAll();
@@ -1577,7 +1577,7 @@ void MediaDecoderStateMachine::Play()
   // when the state machine notices the decoder's state change to PLAYING.
   ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());
   if (mState == DECODER_STATE_BUFFERING) {
-    LOG(PR_LOG_DEBUG, ("%p Changed state from BUFFERING to DECODING", mDecoder.get()));
+    DECODER_LOG(PR_LOG_DEBUG, ("%p Changed state from BUFFERING to DECODING", mDecoder.get()));
     mState = DECODER_STATE_DECODING;
     mDecodeStartTime = TimeStamp::Now();
   }
@@ -1652,7 +1652,7 @@ void MediaDecoderStateMachine::Seek(double aTime)
   mSeekTime = std::min(mSeekTime, mEndTime);
   mSeekTime = std::max(mStartTime, mSeekTime);
   mBasePosition = mSeekTime - mStartTime;
-  LOG(PR_LOG_DEBUG, ("%p Changed state to SEEKING (to %f)", mDecoder.get(), aTime));
+  DECODER_LOG(PR_LOG_DEBUG, ("%p Changed state to SEEKING (to %f)", mDecoder.get(), aTime));
   mState = DECODER_STATE_SEEKING;
   if (mDecoder->GetDecodedStream()) {
     mDecoder->RecreateDecodedStream(mSeekTime - mStartTime);
@@ -1675,7 +1675,7 @@ void MediaDecoderStateMachine::StopDecodeThread()
   mStopDecodeThread = true;
   mDecoder->GetReentrantMonitor().NotifyAll();
   if (mDecodeThread) {
-    LOG(PR_LOG_DEBUG, ("%p Shutdown decode thread", mDecoder.get()));
+    DECODER_LOG(PR_LOG_DEBUG, ("%p Shutdown decode thread", mDecoder.get()));
     {
       ReentrantMonitorAutoExit exitMon(mDecoder->GetReentrantMonitor());
       mDecodeThread->Shutdown();
@@ -1704,7 +1704,7 @@ void MediaDecoderStateMachine::StopAudioThread()
   mStopAudioThread = true;
   mDecoder->GetReentrantMonitor().NotifyAll();
   if (mAudioThread) {
-    LOG(PR_LOG_DEBUG, ("%p Shutdown audio thread", mDecoder.get()));
+    DECODER_LOG(PR_LOG_DEBUG, ("%p Shutdown audio thread", mDecoder.get()));
     {
       ReentrantMonitorAutoExit exitMon(mDecoder->GetReentrantMonitor());
       mAudioThread->Shutdown();
@@ -1801,7 +1801,7 @@ MediaDecoderStateMachine::StartAudioThread()
                                     nullptr,
                                     MEDIA_THREAD_STACK_SIZE);
     if (NS_FAILED(rv)) {
-      LOG(PR_LOG_DEBUG, ("%p Changed state to SHUTDOWN because failed to create audio thread", mDecoder.get()));
+      DECODER_LOG(PR_LOG_DEBUG, ("%p Changed state to SHUTDOWN because failed to create audio thread", mDecoder.get()));
       mState = DECODER_STATE_SHUTDOWN;
       return rv;
     }
@@ -1884,7 +1884,7 @@ nsresult MediaDecoderStateMachine::DecodeMetadata()
   NS_ASSERTION(mState == DECODER_STATE_DECODING_METADATA,
                "Only call when in metadata decoding state");
 
-  LOG(PR_LOG_DEBUG, ("%p Decoding Media Headers", mDecoder.get()));
+  DECODER_LOG(PR_LOG_DEBUG, ("%p Decoding Media Headers", mDecoder.get()));
   nsresult res;
   MediaInfo info;
   MetadataTags* tags;
@@ -1935,10 +1935,10 @@ nsresult MediaDecoderStateMachine::DecodeMetadata()
               "Active seekable media should have end time");
   MOZ_ASSERT(!(mMediaSeekable && mTransportSeekable) ||
              GetDuration() != -1, "Seekable media should have duration");
-  LOG(PR_LOG_DEBUG, ("%p Media goes from %lld to %lld (duration %lld)"
-                     " transportSeekable=%d, mediaSeekable=%d",
-                     mDecoder.get(), mStartTime, mEndTime, GetDuration(),
-                     mTransportSeekable, mMediaSeekable));
+  DECODER_LOG(PR_LOG_DEBUG, ("%p Media goes from %lld to %lld (duration %lld)"
+                             " transportSeekable=%d, mediaSeekable=%d",
+                             mDecoder.get(), mStartTime, mEndTime, GetDuration(),
+                             mTransportSeekable, mMediaSeekable));
 
   // Inform the element that we've loaded the metadata and the first frame,
   // setting the default framebuffer size for audioavailable events.  Also,
@@ -1963,7 +1963,7 @@ nsresult MediaDecoderStateMachine::DecodeMetadata()
   NS_DispatchToMainThread(metadataLoadedEvent, NS_DISPATCH_NORMAL);
 
   if (mState == DECODER_STATE_DECODING_METADATA) {
-    LOG(PR_LOG_DEBUG, ("%p Changed state from DECODING_METADATA to DECODING", mDecoder.get()));
+    DECODER_LOG(PR_LOG_DEBUG, ("%p Changed state from DECODING_METADATA to DECODING", mDecoder.get()));
     StartDecoding();
   }
 
@@ -2068,8 +2068,8 @@ void MediaDecoderStateMachine::DecodeSeek()
   }
 
   // Try to decode another frame to detect if we're at the end...
-  LOG(PR_LOG_DEBUG, ("%p Seek completed, mCurrentFrameTime=%lld\n",
-      mDecoder.get(), mCurrentFrameTime));
+  DECODER_LOG(PR_LOG_DEBUG, ("%p Seek completed, mCurrentFrameTime=%lld\n",
+              mDecoder.get(), mCurrentFrameTime));
 
   // Change state to DECODING or COMPLETED now. SeekingStopped will
   // call MediaDecoderStateMachine::Seek to reset our state to SEEKING
@@ -2081,13 +2081,13 @@ void MediaDecoderStateMachine::DecodeSeek()
     // Seeked to end of media, move to COMPLETED state. Note we don't do
     // this if we're playing a live stream, since the end of media will advance
     // once we download more data!
-    LOG(PR_LOG_DEBUG, ("%p Changed state from SEEKING (to %lld) to COMPLETED",
-                        mDecoder.get(), seekTime));
+    DECODER_LOG(PR_LOG_DEBUG, ("%p Changed state from SEEKING (to %lld) to COMPLETED",
+                               mDecoder.get(), seekTime));
     stopEvent = NS_NewRunnableMethod(mDecoder, &MediaDecoder::SeekingStoppedAtEnd);
     mState = DECODER_STATE_COMPLETED;
   } else {
-    LOG(PR_LOG_DEBUG, ("%p Changed state from SEEKING (to %lld) to DECODING",
-                        mDecoder.get(), seekTime));
+    DECODER_LOG(PR_LOG_DEBUG, ("%p Changed state from SEEKING (to %lld) to DECODING",
+                               mDecoder.get(), seekTime));
     stopEvent = NS_NewRunnableMethod(mDecoder, &MediaDecoder::SeekingStopped);
     StartDecoding();
   }
@@ -2278,19 +2278,19 @@ nsresult MediaDecoderStateMachine::RunStateMachine()
             !mDecoder->IsDataCachedToEndOfResource() &&
             !resource->IsSuspended())
       {
-        LOG(PR_LOG_DEBUG,
-            ("%p Buffering: wait %ds, timeout in %.3lfs %s",
-              mDecoder.get(),
-              mBufferingWait,
-              mBufferingWait - elapsed.ToSeconds(),
-              (mQuickBuffering ? "(quick exit)" : "")));
+        DECODER_LOG(PR_LOG_DEBUG,
+                    ("%p Buffering: wait %ds, timeout in %.3lfs %s",
+                      mDecoder.get(),
+                      mBufferingWait,
+                      mBufferingWait - elapsed.ToSeconds(),
+                      (mQuickBuffering ? "(quick exit)" : "")));
         ScheduleStateMachine(USECS_PER_S);
         return NS_OK;
       } else {
-        LOG(PR_LOG_DEBUG, ("%p Changed state from BUFFERING to DECODING", mDecoder.get()));
-        LOG(PR_LOG_DEBUG, ("%p Buffered for %.3lfs",
-                            mDecoder.get(),
-                            (now - mBufferingStart).ToSeconds()));
+        DECODER_LOG(PR_LOG_DEBUG, ("%p Changed state from BUFFERING to DECODING", mDecoder.get()));
+        DECODER_LOG(PR_LOG_DEBUG, ("%p Buffered for %.3lfs",
+                                   mDecoder.get(),
+                                   (now - mBufferingStart).ToSeconds()));
         StartDecoding();
       }
 
@@ -2377,8 +2377,8 @@ void MediaDecoderStateMachine::RenderVideoFrame(VideoData* aData,
   }
 
   if (!PR_GetEnv("MOZ_QUIET")) {
-    LOG(PR_LOG_DEBUG, ("%p Decoder playing video frame %lld",
-                       mDecoder.get(), aData->mTime));
+    DECODER_LOG(PR_LOG_DEBUG, ("%p Decoder playing video frame %lld",
+                               mDecoder.get(), aData->mTime));
   }
 
   VideoFrameContainer* container = mDecoder->GetVideoFrameContainer();
@@ -2487,10 +2487,10 @@ void MediaDecoderStateMachine::AdvanceFrame()
       currentFrame = frame;
 #ifdef PR_LOGGING
       if (!PR_GetEnv("MOZ_QUIET")) {
-        LOG(PR_LOG_DEBUG, ("%p Decoder discarding video frame %lld", mDecoder.get(), frame->mTime));
+        DECODER_LOG(PR_LOG_DEBUG, ("%p Decoder discarding video frame %lld", mDecoder.get(), frame->mTime));
         if (droppedFrames++) {
-          LOG(PR_LOG_DEBUG, ("%p Decoder discarding video frame %lld (%d so far)",
-            mDecoder.get(), frame->mTime, droppedFrames - 1));
+          DECODER_LOG(PR_LOG_DEBUG, ("%p Decoder discarding video frame %lld (%d so far)",
+                      mDecoder.get(), frame->mTime, droppedFrames - 1));
         }
       }
 #endif
@@ -2632,7 +2632,7 @@ VideoData* MediaDecoderStateMachine::FindStartTime()
   // first actual audio frame we have, we'll inject silence during playback
   // to ensure the audio starts at the correct time.
   mAudioStartTime = mStartTime;
-  LOG(PR_LOG_DEBUG, ("%p Media start time is %lld", mDecoder.get(), mStartTime));
+  DECODER_LOG(PR_LOG_DEBUG, ("%p Media start time is %lld", mDecoder.get(), mStartTime));
   return v;
 }
 
@@ -2693,15 +2693,15 @@ void MediaDecoderStateMachine::StartBuffering()
   // the element we're buffering or not.
   UpdateReadyState();
   mState = DECODER_STATE_BUFFERING;
-  LOG(PR_LOG_DEBUG, ("%p Changed state from DECODING to BUFFERING, decoded for %.3lfs",
-                     mDecoder.get(), decodeDuration.ToSeconds()));
+  DECODER_LOG(PR_LOG_DEBUG, ("%p Changed state from DECODING to BUFFERING, decoded for %.3lfs",
+                             mDecoder.get(), decodeDuration.ToSeconds()));
 #ifdef PR_LOGGING
   MediaDecoder::Statistics stats = mDecoder->GetStatistics();
 #endif
-  LOG(PR_LOG_DEBUG, ("%p Playback rate: %.1lfKB/s%s download rate: %.1lfKB/s%s",
-    mDecoder.get(),
-    stats.mPlaybackRate/1024, stats.mPlaybackRateReliable ? "" : " (unreliable)",
-    stats.mDownloadRate/1024, stats.mDownloadRateReliable ? "" : " (unreliable)"));
+  DECODER_LOG(PR_LOG_DEBUG, ("%p Playback rate: %.1lfKB/s%s download rate: %.1lfKB/s%s",
+              mDecoder.get(),
+              stats.mPlaybackRate/1024, stats.mPlaybackRateReliable ? "" : " (unreliable)",
+              stats.mDownloadRate/1024, stats.mDownloadRateReliable ? "" : " (unreliable)"));
 }
 
 nsresult MediaDecoderStateMachine::GetBuffered(dom::TimeRanges* aBuffered) {
diff --git a/content/media/MediaResource.cpp b/content/media/MediaResource.cpp
index f5806b659e73..8e150cb16ffb 100644
--- a/content/media/MediaResource.cpp
+++ b/content/media/MediaResource.cpp
@@ -33,13 +33,13 @@
 
 #ifdef PR_LOGGING
 PRLogModuleInfo* gMediaResourceLog;
-#define LOG(msg, ...) PR_LOG(gMediaResourceLog, PR_LOG_DEBUG, \
-                             (msg, ##__VA_ARGS__))
+#define RESOURCE_LOG(msg, ...) PR_LOG(gMediaResourceLog, PR_LOG_DEBUG, \
+                                      (msg, ##__VA_ARGS__))
 // Debug logging macro with object pointer and class name.
 #define CMLOG(msg, ...) \
-        LOG("%p [ChannelMediaResource]: " msg, this, ##__VA_ARGS__)
+        RESOURCE_LOG("%p [ChannelMediaResource]: " msg, this, ##__VA_ARGS__)
 #else
-#define LOG(msg, ...)
+#define RESOURCE_LOG(msg, ...)
 #define CMLOG(msg, ...)
 #endif
 
@@ -475,10 +475,10 @@ ChannelMediaResource::CopySegmentToCache(nsIInputStream *aInStream,
   closure->mResource->mDecoder->NotifyDataArrived(aFromSegment, aCount, closure->mResource->mOffset);
 
   // Keep track of where we're up to.
-  LOG("%p [ChannelMediaResource]: CopySegmentToCache at mOffset [%lld] add "
-      "[%d] bytes for decoder[%p]",
-      closure->mResource, closure->mResource->mOffset, aCount,
-      closure->mResource->mDecoder);
+  RESOURCE_LOG("%p [ChannelMediaResource]: CopySegmentToCache at mOffset [%lld] add "
+               "[%d] bytes for decoder[%p]",
+               closure->mResource, closure->mResource->mOffset, aCount,
+               closure->mResource->mDecoder);
   closure->mResource->mOffset += aCount;
 
   closure->mResource->mCacheStream.NotifyDataReceived(aCount, aFromSegment,
diff --git a/content/media/MediaStreamGraph.cpp b/content/media/MediaStreamGraph.cpp
index 7b3c7aa4627d..ec4c21ad30e8 100644
--- a/content/media/MediaStreamGraph.cpp
+++ b/content/media/MediaStreamGraph.cpp
@@ -32,6 +32,9 @@ namespace mozilla {
 
 #ifdef PR_LOGGING
 PRLogModuleInfo* gMediaStreamGraphLog;
+#define STREAM_LOG(type, msg) PR_LOG(gMediaStreamGraphLog, type, msg)
+#else
+#define STREAM_LOG(type, msg)
 #endif
 
 /**
@@ -39,6 +42,14 @@ PRLogModuleInfo* gMediaStreamGraphLog;
  */
 static MediaStreamGraphImpl* gGraph;
 
+MediaStreamGraphImpl::~MediaStreamGraphImpl()
+{
+  NS_ASSERTION(IsEmpty(),
+               "All streams should have been destroyed by messages from the main thread");
+  STREAM_LOG(PR_LOG_DEBUG, ("MediaStreamGraph %p destroyed", this));
+}
+
+
 StreamTime
 MediaStreamGraphImpl::GetDesiredBufferEnd(MediaStream* aStream)
 {
@@ -52,7 +63,7 @@ MediaStreamGraphImpl::FinishStream(MediaStream* aStream)
 {
   if (aStream->mFinished)
     return;
-  LOG(PR_LOG_DEBUG, ("MediaStream %p will finish", aStream));
+  STREAM_LOG(PR_LOG_DEBUG, ("MediaStream %p will finish", aStream));
   aStream->mFinished = true;
   // Force at least one more iteration of the control loop, since we rely
   // on UpdateCurrentTime to notify our listeners once the stream end
@@ -65,7 +76,7 @@ MediaStreamGraphImpl::AddStream(MediaStream* aStream)
 {
   aStream->mBufferStartTime = mCurrentTime;
   *mStreams.AppendElement() = already_AddRefed<MediaStream>(aStream);
-  LOG(PR_LOG_DEBUG, ("Adding media stream %p to the graph", aStream));
+  STREAM_LOG(PR_LOG_DEBUG, ("Adding media stream %p to the graph", aStream));
 }
 
 void
@@ -86,7 +97,7 @@ MediaStreamGraphImpl::RemoveStream(MediaStream* aStream)
   // This unrefs the stream, probably destroying it
   mStreams.RemoveElement(aStream);
 
-  LOG(PR_LOG_DEBUG, ("Removing media stream %p from the graph", aStream));
+  STREAM_LOG(PR_LOG_DEBUG, ("Removing media stream %p from the graph", aStream));
 }
 
 void
@@ -120,16 +131,16 @@ MediaStreamGraphImpl::ExtractPendingInput(SourceMediaStream* aStream,
       StreamTime t =
         GraphTimeToStreamTime(aStream, mStateComputedTime) +
         (aDesiredUpToTime - mStateComputedTime);
-      LOG(PR_LOG_DEBUG+1, ("Calling NotifyPull aStream=%p t=%f current end=%f", aStream,
-                           MediaTimeToSeconds(t),
-                           MediaTimeToSeconds(aStream->mBuffer.GetEnd())));
+      STREAM_LOG(PR_LOG_DEBUG+1, ("Calling NotifyPull aStream=%p t=%f current end=%f", aStream,
+                                  MediaTimeToSeconds(t),
+                                  MediaTimeToSeconds(aStream->mBuffer.GetEnd())));
       if (t > aStream->mBuffer.GetEnd()) {
         *aEnsureNextIteration = true;
 #ifdef DEBUG
         if (aStream->mListeners.Length() == 0) {
-          LOG(PR_LOG_ERROR, ("No listeners in NotifyPull aStream=%p desired=%f current end=%f",
-                             aStream, MediaTimeToSeconds(t),
-                             MediaTimeToSeconds(aStream->mBuffer.GetEnd())));
+          STREAM_LOG(PR_LOG_ERROR, ("No listeners in NotifyPull aStream=%p desired=%f current end=%f",
+                                    aStream, MediaTimeToSeconds(t),
+                                    MediaTimeToSeconds(aStream->mBuffer.GetEnd())));
           aStream->DumpTrackInfo();
         }
 #endif
@@ -155,9 +166,9 @@ MediaStreamGraphImpl::ExtractPendingInput(SourceMediaStream* aStream,
       }
       if (data->mCommands & SourceMediaStream::TRACK_CREATE) {
         MediaSegment* segment = data->mData.forget();
-        LOG(PR_LOG_DEBUG, ("SourceMediaStream %p creating track %d, rate %d, start %lld, initial end %lld",
-                           aStream, data->mID, data->mRate, int64_t(data->mStart),
-                           int64_t(segment->GetDuration())));
+        STREAM_LOG(PR_LOG_DEBUG, ("SourceMediaStream %p creating track %d, rate %d, start %lld, initial end %lld",
+                                  aStream, data->mID, data->mRate, int64_t(data->mStart),
+                                  int64_t(segment->GetDuration())));
         aStream->mBuffer.AddTrack(data->mID, data->mRate, data->mStart, segment);
         // The track has taken ownership of data->mData, so let's replace
         // data->mData with an empty clone.
@@ -165,10 +176,10 @@ MediaStreamGraphImpl::ExtractPendingInput(SourceMediaStream* aStream,
         data->mCommands &= ~SourceMediaStream::TRACK_CREATE;
       } else if (data->mData->GetDuration() > 0) {
         MediaSegment* dest = aStream->mBuffer.FindTrack(data->mID)->GetSegment();
-        LOG(PR_LOG_DEBUG+1, ("SourceMediaStream %p track %d, advancing end from %lld to %lld",
-                             aStream, data->mID,
-                             int64_t(dest->GetDuration()),
-                             int64_t(dest->GetDuration() + data->mData->GetDuration())));
+        STREAM_LOG(PR_LOG_DEBUG+1, ("SourceMediaStream %p track %d, advancing end from %lld to %lld",
+                                    aStream, data->mID,
+                                    int64_t(dest->GetDuration()),
+                                    int64_t(dest->GetDuration() + data->mData->GetDuration())));
         dest->AppendFrom(data->mData);
       }
       if (data->mCommands & SourceMediaStream::TRACK_END) {
@@ -322,27 +333,27 @@ MediaStreamGraphImpl::UpdateCurrentTime()
       SecondsToMediaTime((now - mCurrentTimeStamp).ToSeconds()) + mCurrentTime;
 
     mCurrentTimeStamp = now;
-    LOG(PR_LOG_DEBUG+1, ("Updating current time to %f (real %f, mStateComputedTime %f)",
-          MediaTimeToSeconds(nextCurrentTime),
-          (now - mInitialTimeStamp).ToSeconds(),
-          MediaTimeToSeconds(mStateComputedTime)));
+    STREAM_LOG(PR_LOG_DEBUG+1, ("Updating current time to %f (real %f, mStateComputedTime %f)",
+               MediaTimeToSeconds(nextCurrentTime),
+               (now - mInitialTimeStamp).ToSeconds(),
+               MediaTimeToSeconds(mStateComputedTime)));
   } else {
     prevCurrentTime = mCurrentTime;
     nextCurrentTime = mCurrentTime + MEDIA_GRAPH_TARGET_PERIOD_MS;
-    LOG(PR_LOG_DEBUG+1, ("Updating offline current time to %f (mStateComputedTime %f)",
-          MediaTimeToSeconds(nextCurrentTime),
-          MediaTimeToSeconds(mStateComputedTime)));
+    STREAM_LOG(PR_LOG_DEBUG+1, ("Updating offline current time to %f (mStateComputedTime %f)",
+               MediaTimeToSeconds(nextCurrentTime),
+               MediaTimeToSeconds(mStateComputedTime)));
   }
 
   if (mStateComputedTime < nextCurrentTime) {
-    LOG(PR_LOG_WARNING, ("Media graph global underrun detected"));
+    STREAM_LOG(PR_LOG_WARNING, ("Media graph global underrun detected"));
     nextCurrentTime = mStateComputedTime;
   }
 
   if (prevCurrentTime >= nextCurrentTime) {
     NS_ASSERTION(prevCurrentTime == nextCurrentTime, "Time can't go backwards!");
     // This could happen due to low clock resolution, maybe?
-    LOG(PR_LOG_DEBUG, ("Time did not advance"));
+    STREAM_LOG(PR_LOG_DEBUG, ("Time did not advance"));
     // There's not much left to do here, but the code below that notifies
     // listeners that streams have ended still needs to run.
   }
@@ -386,9 +397,9 @@ MediaStreamGraphImpl::UpdateCurrentTime()
     if (stream->mFinished && !stream->mNotifiedFinished) {
       streamsReadyToFinish.AppendElement(stream);
     }
-    LOG(PR_LOG_DEBUG+1, ("MediaStream %p bufferStartTime=%f blockedTime=%f",
-                         stream, MediaTimeToSeconds(stream->mBufferStartTime),
-                         MediaTimeToSeconds(blockedTime)));
+    STREAM_LOG(PR_LOG_DEBUG+1, ("MediaStream %p bufferStartTime=%f blockedTime=%f",
+                                stream, MediaTimeToSeconds(stream->mBufferStartTime),
+                                MediaTimeToSeconds(blockedTime)));
   }
 
   mCurrentTime = nextCurrentTime;
@@ -422,19 +433,19 @@ MediaStreamGraphImpl::WillUnderrun(MediaStream* aStream, GraphTime aTime,
                           INCLUDE_TRAILING_BLOCKED_INTERVAL);
 #ifdef DEBUG
   if (bufferEnd < mCurrentTime) {
-    LOG(PR_LOG_ERROR, ("MediaStream %p underrun, "
-                       "bufferEnd %f < mCurrentTime %f (%lld < %lld), Streamtime %lld",
-                       aStream, MediaTimeToSeconds(bufferEnd), MediaTimeToSeconds(mCurrentTime),
-                       bufferEnd, mCurrentTime, aStream->GetBufferEnd()));
+    STREAM_LOG(PR_LOG_ERROR, ("MediaStream %p underrun, "
+                              "bufferEnd %f < mCurrentTime %f (%lld < %lld), Streamtime %lld",
+                              aStream, MediaTimeToSeconds(bufferEnd), MediaTimeToSeconds(mCurrentTime),
+                              bufferEnd, mCurrentTime, aStream->GetBufferEnd()));
     aStream->DumpTrackInfo();
     NS_ASSERTION(bufferEnd >= mCurrentTime, "Buffer underran");
   }
 #endif
   // We should block after bufferEnd.
   if (bufferEnd <= aTime) {
-    LOG(PR_LOG_DEBUG+1, ("MediaStream %p will block due to data underrun, "
-                         "bufferEnd %f",
-                         aStream, MediaTimeToSeconds(bufferEnd)));
+    STREAM_LOG(PR_LOG_DEBUG+1, ("MediaStream %p will block due to data underrun, "
+                                "bufferEnd %f",
+                                aStream, MediaTimeToSeconds(bufferEnd)));
     return true;
   }
   // We should keep blocking if we're currently blocked and we don't have
@@ -443,9 +454,9 @@ MediaStreamGraphImpl::WillUnderrun(MediaStream* aStream, GraphTime aTime,
   // but we might as well remain unblocked and play the data we've got while
   // we can.
   if (bufferEnd <= aEndBlockingDecisions && aStream->mBlocked.GetBefore(aTime)) {
-    LOG(PR_LOG_DEBUG+1, ("MediaStream %p will block due to speculative data underrun, "
-                         "bufferEnd %f",
-                         aStream, MediaTimeToSeconds(bufferEnd)));
+    STREAM_LOG(PR_LOG_DEBUG+1, ("MediaStream %p will block due to speculative data underrun, "
+                                "bufferEnd %f",
+                                aStream, MediaTimeToSeconds(bufferEnd)));
     return true;
   }
   // Reconsider decisions at bufferEnd
@@ -573,8 +584,8 @@ MediaStreamGraphImpl::RecomputeBlocking(GraphTime aEndBlockingDecisions)
 {
   bool blockingDecisionsWillChange = false;
 
-  LOG(PR_LOG_DEBUG+1, ("Media graph %p computing blocking for time %f",
-                       this, MediaTimeToSeconds(mStateComputedTime)));
+  STREAM_LOG(PR_LOG_DEBUG+1, ("Media graph %p computing blocking for time %f",
+                              this, MediaTimeToSeconds(mStateComputedTime)));
   for (uint32_t i = 0; i < mStreams.Length(); ++i) {
     MediaStream* stream = mStreams[i];
     if (!stream->mInBlockingSet) {
@@ -600,9 +611,9 @@ MediaStreamGraphImpl::RecomputeBlocking(GraphTime aEndBlockingDecisions)
       blockingDecisionsWillChange = true;
     }
   }
-  LOG(PR_LOG_DEBUG+1, ("Media graph %p computed blocking for interval %f to %f",
-                       this, MediaTimeToSeconds(mStateComputedTime),
-                       MediaTimeToSeconds(aEndBlockingDecisions)));
+  STREAM_LOG(PR_LOG_DEBUG+1, ("Media graph %p computed blocking for interval %f to %f",
+                              this, MediaTimeToSeconds(mStateComputedTime),
+                              MediaTimeToSeconds(aEndBlockingDecisions)));
   mStateComputedTime = aEndBlockingDecisions;
  
   if (blockingDecisionsWillChange) {
@@ -676,15 +687,15 @@ MediaStreamGraphImpl::RecomputeBlockingAt(const nsTArray<MediaStream*>& aStreams
     if (stream->mFinished) {
       GraphTime endTime = StreamTimeToGraphTime(stream, stream->GetBufferEnd());
       if (endTime <= aTime) {
-        LOG(PR_LOG_DEBUG+1, ("MediaStream %p is blocked due to being finished", stream));
+        STREAM_LOG(PR_LOG_DEBUG+1, ("MediaStream %p is blocked due to being finished", stream));
         // We'll block indefinitely
         MarkStreamBlocking(stream);
         *aEnd = aEndBlockingDecisions;
         continue;
       } else {
-        LOG(PR_LOG_DEBUG+1, ("MediaStream %p is finished, but not blocked yet (end at %f, with blocking at %f)",
-                             stream, MediaTimeToSeconds(stream->GetBufferEnd()),
-                             MediaTimeToSeconds(endTime)));
+        STREAM_LOG(PR_LOG_DEBUG+1, ("MediaStream %p is finished, but not blocked yet (end at %f, with blocking at %f)",
+                                    stream, MediaTimeToSeconds(stream->GetBufferEnd()),
+                                    MediaTimeToSeconds(endTime)));
         *aEnd = std::min(*aEnd, endTime);
       }
     }
@@ -693,7 +704,7 @@ MediaStreamGraphImpl::RecomputeBlockingAt(const nsTArray<MediaStream*>& aStreams
     bool explicitBlock = stream->mExplicitBlockerCount.GetAt(aTime, &end) > 0;
     *aEnd = std::min(*aEnd, end);
     if (explicitBlock) {
-      LOG(PR_LOG_DEBUG+1, ("MediaStream %p is blocked due to explicit blocker", stream));
+      STREAM_LOG(PR_LOG_DEBUG+1, ("MediaStream %p is blocked due to explicit blocker", stream));
       MarkStreamBlocking(stream);
       continue;
     }
@@ -833,8 +844,8 @@ MediaStreamGraphImpl::PlayAudio(MediaStream* aStream,
             TimeToTicksRoundDown(track->GetRate(), audioOutput.mBlockedAudioTime);
 
         output.InsertNullDataAtStart(endTicks - startTicks);
-        LOG(PR_LOG_DEBUG+1, ("MediaStream %p writing blocking-silence samples for %f to %f",
-                             aStream, MediaTimeToSeconds(t), MediaTimeToSeconds(end)));
+        STREAM_LOG(PR_LOG_DEBUG+1, ("MediaStream %p writing blocking-silence samples for %f to %f",
+                                    aStream, MediaTimeToSeconds(t), MediaTimeToSeconds(end)));
       } else {
         TrackTicks startTicks =
             track->TimeToTicksRoundDown(GraphTimeToStreamTime(aStream, t));
@@ -854,9 +865,9 @@ MediaStreamGraphImpl::PlayAudio(MediaStream* aStream,
         NS_ASSERTION(endTicks == sliceEnd || track->IsEnded(),
                      "Ran out of data but track not ended?");
         output.ApplyVolume(volume);
-        LOG(PR_LOG_DEBUG+1, ("MediaStream %p writing samples for %f to %f (samples %lld to %lld)",
-                             aStream, MediaTimeToSeconds(t), MediaTimeToSeconds(end),
-                             startTicks, endTicks));
+        STREAM_LOG(PR_LOG_DEBUG+1, ("MediaStream %p writing samples for %f to %f (samples %lld to %lld)",
+                                    aStream, MediaTimeToSeconds(t), MediaTimeToSeconds(end),
+                                    startTicks, endTicks));
       }
       // Need unique id for stream & track - and we want it to match the inserter
       output.WriteTo(LATENCY_STREAM_ID(aStream, track->GetID()),
@@ -912,9 +923,9 @@ MediaStreamGraphImpl::PlayVideo(MediaStream* aStream)
   if (!frame || *frame == aStream->mLastPlayedVideoFrame)
     return;
 
-  LOG(PR_LOG_DEBUG+1, ("MediaStream %p writing video frame %p (%dx%d)",
-                       aStream, frame->GetImage(), frame->GetIntrinsicSize().width,
-                       frame->GetIntrinsicSize().height));
+  STREAM_LOG(PR_LOG_DEBUG+1, ("MediaStream %p writing video frame %p (%dx%d)",
+                              aStream, frame->GetImage(), frame->GetIntrinsicSize().width,
+                              frame->GetIntrinsicSize().height));
   GraphTime startTime = StreamTimeToGraphTime(aStream,
       track->TicksToTimeRoundDown(start), INCLUDE_TRAILING_BLOCKED_INTERVAL);
   TimeStamp targetTime = mCurrentTimeStamp +
@@ -1220,7 +1231,7 @@ MediaStreamGraphImpl::RunThread()
       if (finalUpdate) {
         // Enter shutdown mode. The stable-state handler will detect this
         // and complete shutdown. Destroy any streams immediately.
-        LOG(PR_LOG_DEBUG, ("MediaStreamGraph %p waiting for main thread cleanup", this));
+        STREAM_LOG(PR_LOG_DEBUG, ("MediaStreamGraph %p waiting for main thread cleanup", this));
         // Commit to shutting down this graph object.
         mLifecycleState = LIFECYCLE_WAITING_FOR_MAIN_THREAD_CLEANUP;
         // No need to Destroy streams here. The main-thread owner of each
@@ -1240,17 +1251,17 @@ MediaStreamGraphImpl::RunThread()
           // least once a minute, if we need to wake up at all
           timeoutMS = std::max<int64_t>(0, std::min<int64_t>(timeoutMS, 60*1000));
           timeout = PR_MillisecondsToInterval(uint32_t(timeoutMS));
-          LOG(PR_LOG_DEBUG+1, ("Waiting for next iteration; at %f, timeout=%f",
-                               (now - mInitialTimeStamp).ToSeconds(), timeoutMS/1000.0));
+          STREAM_LOG(PR_LOG_DEBUG+1, ("Waiting for next iteration; at %f, timeout=%f",
+                                     (now - mInitialTimeStamp).ToSeconds(), timeoutMS/1000.0));
           mWaitState = WAITSTATE_WAITING_FOR_NEXT_ITERATION;
         } else {
           mWaitState = WAITSTATE_WAITING_INDEFINITELY;
         }
         if (timeout > 0) {
           mMonitor.Wait(timeout);
-          LOG(PR_LOG_DEBUG+1, ("Resuming after timeout; at %f, elapsed=%f",
-                               (TimeStamp::Now() - mInitialTimeStamp).ToSeconds(),
-                               (TimeStamp::Now() - now).ToSeconds()));
+          STREAM_LOG(PR_LOG_DEBUG+1, ("Resuming after timeout; at %f, elapsed=%f",
+                                     (TimeStamp::Now() - mInitialTimeStamp).ToSeconds(),
+                                     (TimeStamp::Now() - now).ToSeconds()));
         }
       }
       mWaitState = WAITSTATE_RUNNING;
@@ -1289,7 +1300,7 @@ MediaStreamGraphImpl::ShutdownThreads()
 {
   NS_ASSERTION(NS_IsMainThread(), "Must be called on main thread");
   // mGraph's thread is not running so it's OK to do whatever here
-  LOG(PR_LOG_DEBUG, ("Stopping threads for MediaStreamGraph %p", this));
+  STREAM_LOG(PR_LOG_DEBUG, ("Stopping threads for MediaStreamGraph %p", this));
 
   if (mThread) {
     mThread->Shutdown();
@@ -1301,7 +1312,7 @@ void
 MediaStreamGraphImpl::ForceShutDown()
 {
   NS_ASSERTION(NS_IsMainThread(), "Must be called on main thread");
-  LOG(PR_LOG_DEBUG, ("MediaStreamGraph %p ForceShutdown", this));
+  STREAM_LOG(PR_LOG_DEBUG, ("MediaStreamGraph %p ForceShutdown", this));
   {
     MonitorAutoLock lock(mMonitor);
     mForceShutDown = true;
@@ -1475,7 +1486,7 @@ MediaStreamGraphImpl::RunInStableState()
       if (mLifecycleState == LIFECYCLE_WAITING_FOR_MAIN_THREAD_CLEANUP && IsEmpty()) {
         // Complete shutdown. First, ensure that this graph is no longer used.
         // A new graph graph will be created if one is needed.
-        LOG(PR_LOG_DEBUG, ("Disconnecting MediaStreamGraph %p", this));
+        STREAM_LOG(PR_LOG_DEBUG, ("Disconnecting MediaStreamGraph %p", this));
         if (this == gGraph) {
           // null out gGraph if that's the graph being shut down
           gGraph = nullptr;
@@ -2196,8 +2207,8 @@ SourceMediaStream::GetBufferedTicks(TrackID aID)
 void
 MediaInputPort::Init()
 {
-  LOG(PR_LOG_DEBUG, ("Adding MediaInputPort %p (from %p to %p) to the graph",
-      this, mSource, mDest));
+  STREAM_LOG(PR_LOG_DEBUG, ("Adding MediaInputPort %p (from %p to %p) to the graph",
+             this, mSource, mDest));
   mSource->AddConsumer(this);
   mDest->AddInput(this);
   // mPortCount decremented via MediaInputPort::Destroy's message
@@ -2415,7 +2426,7 @@ MediaStreamGraph::GetInstance()
     }
 
     gGraph = new MediaStreamGraphImpl(true);
-    LOG(PR_LOG_DEBUG, ("Starting up MediaStreamGraph %p", gGraph));
+    STREAM_LOG(PR_LOG_DEBUG, ("Starting up MediaStreamGraph %p", gGraph));
   }
 
   return gGraph;
diff --git a/content/media/MediaStreamGraph.h b/content/media/MediaStreamGraph.h
index cf1e4a5d6f43..7a35db6cb52c 100644
--- a/content/media/MediaStreamGraph.h
+++ b/content/media/MediaStreamGraph.h
@@ -1057,7 +1057,7 @@ protected:
   {
     MOZ_COUNT_CTOR(MediaStreamGraph);
   }
-  ~MediaStreamGraph()
+  virtual ~MediaStreamGraph()
   {
     MOZ_COUNT_DTOR(MediaStreamGraph);
   }
diff --git a/content/media/MediaStreamGraphImpl.h b/content/media/MediaStreamGraphImpl.h
index c7d2e8721b21..c8cd27a8b1be 100644
--- a/content/media/MediaStreamGraphImpl.h
+++ b/content/media/MediaStreamGraphImpl.h
@@ -19,13 +19,6 @@ namespace mozilla {
 template <typename T>
 class LinkedList;
 
-#ifdef PR_LOGGING
-extern PRLogModuleInfo* gMediaStreamGraphLog;
-#define LOG(type, msg) PR_LOG(gMediaStreamGraphLog, type, msg)
-#else
-#define LOG(type, msg)
-#endif
-
 /**
  * Assume we can run an iteration of the MediaStreamGraph loop in this much time
  * or less.
@@ -120,12 +113,7 @@ public:
    * implement OfflineAudioContext.  They do not support MediaStream inputs.
    */
   explicit MediaStreamGraphImpl(bool aRealtime);
-  ~MediaStreamGraphImpl()
-  {
-    NS_ASSERTION(IsEmpty(),
-                 "All streams should have been destroyed by messages from the main thread");
-    LOG(PR_LOG_DEBUG, ("MediaStreamGraph %p destroyed", this));
-  }
+  virtual ~MediaStreamGraphImpl();
 
   // Main thread only.
   /**
diff --git a/content/media/RtspMediaResource.cpp b/content/media/RtspMediaResource.cpp
index 20f78594e002..d1a143cd7fc7 100644
--- a/content/media/RtspMediaResource.cpp
+++ b/content/media/RtspMediaResource.cpp
@@ -18,13 +18,13 @@
 
 #ifdef PR_LOGGING
 PRLogModuleInfo* gRtspMediaResourceLog;
-#define LOG(msg, ...) PR_LOG(gRtspMediaResourceLog, PR_LOG_DEBUG, \
-                             (msg, ##__VA_ARGS__))
+#define RTSP_LOG(msg, ...) PR_LOG(gRtspMediaResourceLog, PR_LOG_DEBUG, \
+                                  (msg, ##__VA_ARGS__))
 // Debug logging macro with object pointer and class name.
 #define RTSPMLOG(msg, ...) \
-        LOG("%p [RtspMediaResource]: " msg, this, ##__VA_ARGS__)
+        RTSP_LOG("%p [RtspMediaResource]: " msg, this, ##__VA_ARGS__)
 #else
-#define LOG(msg, ...)
+#define RTSP_LOG(msg, ...)
 #define RTSPMLOG(msg, ...)
 #endif
 
@@ -72,6 +72,7 @@ public:
   void Start() {
     MonitorAutoLock monitor(mMonitor);
     mIsStarted = true;
+    mFrameType = 0;
   }
   void Stop() {
     MonitorAutoLock monitor(mMonitor);
@@ -444,6 +445,9 @@ RtspMediaResource::OnConnected(uint8_t aTrackIdx,
                                nsIStreamingProtocolMetaData *meta)
 {
   if (mIsConnected) {
+    for (uint32_t i = 0 ; i < mTrackBuffer.Length(); ++i) {
+      mTrackBuffer[i]->Start();
+    }
     return NS_OK;
   }
 
@@ -523,9 +527,19 @@ RtspMediaResource::OnDisconnected(uint8_t aTrackIdx, nsresult aReason)
     mTrackBuffer[i]->Reset();
   }
 
-  if (aReason == NS_ERROR_CONNECTION_REFUSED) {
+  if (aReason == NS_ERROR_NOT_INITIALIZED ||
+      aReason == NS_ERROR_CONNECTION_REFUSED ||
+      aReason == NS_ERROR_NOT_CONNECTED) {
+
+    RTSPMLOG("Error in OnDisconnected 0x%x", aReason);
+
     mDecoder->NetworkError();
+    return NS_OK;
   }
+
+  // Resetting the decoder and media element when the connection
+  // between Rtsp client and server goes down.
+  mDecoder->ResetConnectionState();
   return NS_OK;
 }
 
diff --git a/content/media/StreamBuffer.cpp b/content/media/StreamBuffer.cpp
index 21f250c6deac..51d5f0d2ffd4 100644
--- a/content/media/StreamBuffer.cpp
+++ b/content/media/StreamBuffer.cpp
@@ -11,23 +11,23 @@ namespace mozilla {
 
 #ifdef PR_LOGGING
 extern PRLogModuleInfo* gMediaStreamGraphLog;
-#define LOG(type, msg) PR_LOG(gMediaStreamGraphLog, type, msg)
+#define STREAM_LOG(type, msg) PR_LOG(gMediaStreamGraphLog, type, msg)
 #else
-#define LOG(type, msg)
+#define STREAM_LOG(type, msg)
 #endif
 
 #ifdef DEBUG
 void
 StreamBuffer::DumpTrackInfo() const
 {
-  LOG(PR_LOG_ALWAYS, ("DumpTracks: mTracksKnownTime %lld", mTracksKnownTime));
+  STREAM_LOG(PR_LOG_ALWAYS, ("DumpTracks: mTracksKnownTime %lld", mTracksKnownTime));
   for (uint32_t i = 0; i < mTracks.Length(); ++i) {
     Track* track = mTracks[i];
     if (track->IsEnded()) {
-      LOG(PR_LOG_ALWAYS, ("Track[%d] %d: ended", i, track->GetID()));
+      STREAM_LOG(PR_LOG_ALWAYS, ("Track[%d] %d: ended", i, track->GetID()));
     } else {
-      LOG(PR_LOG_ALWAYS, ("Track[%d] %d: %lld", i, track->GetID(),
-                          track->GetEndTimeRoundDown()));
+      STREAM_LOG(PR_LOG_ALWAYS, ("Track[%d] %d: %lld", i, track->GetID(),
+                                 track->GetEndTimeRoundDown()));
     }
   }
 }
diff --git a/content/media/TrackUnionStream.h b/content/media/TrackUnionStream.h
index ff0881fc3ecb..800480d84483 100644
--- a/content/media/TrackUnionStream.h
+++ b/content/media/TrackUnionStream.h
@@ -12,9 +12,9 @@
 namespace mozilla {
 
 #ifdef PR_LOGGING
-#define LOG(type, msg) PR_LOG(gMediaStreamGraphLog, type, msg)
+#define STREAM_LOG(type, msg) PR_LOG(gMediaStreamGraphLog, type, msg)
 #else
-#define LOG(type, msg)
+#define STREAM_LOG(type, msg)
 #endif
 
 /**
@@ -178,9 +178,9 @@ protected:
     segment->AppendNullData(outputStart);
     StreamBuffer::Track* track =
       &mBuffer.AddTrack(id, rate, outputStart, segment.forget());
-    LOG(PR_LOG_DEBUG, ("TrackUnionStream %p adding track %d for input stream %p track %d, start ticks %lld",
-                       this, id, aPort->GetSource(), aTrack->GetID(),
-                       (long long)outputStart));
+    STREAM_LOG(PR_LOG_DEBUG, ("TrackUnionStream %p adding track %d for input stream %p track %d, start ticks %lld",
+                              this, id, aPort->GetSource(), aTrack->GetID(),
+                              (long long)outputStart));
 
     TrackMapEntry* map = mTrackMap.AppendElement();
     map->mEndOfConsumedInputTicks = 0;
@@ -253,8 +253,8 @@ protected:
       if (interval.mInputIsBlocked) {
         // Maybe the input track ended?
         segment->AppendNullData(ticks);
-        LOG(PR_LOG_DEBUG+1, ("TrackUnionStream %p appending %lld ticks of null data to track %d",
-            this, (long long)ticks, outputTrack->GetID()));
+        STREAM_LOG(PR_LOG_DEBUG+1, ("TrackUnionStream %p appending %lld ticks of null data to track %d",
+                   this, (long long)ticks, outputTrack->GetID()));
       } else {
         // Figuring out which samples to use from the input stream is tricky
         // because its start time and our start time may differ by a fraction
@@ -322,9 +322,9 @@ protected:
                                std::min(inputTrackEndPoint, inputStartTicks),
                                std::min(inputTrackEndPoint, inputEndTicks));
         }
-        LOG(PR_LOG_DEBUG+1, ("TrackUnionStream %p appending %lld ticks of input data to track %d",
-            this, (long long)(std::min(inputTrackEndPoint, inputEndTicks) - std::min(inputTrackEndPoint, inputStartTicks)),
-            outputTrack->GetID()));
+        STREAM_LOG(PR_LOG_DEBUG+1, ("TrackUnionStream %p appending %lld ticks of input data to track %d",
+                   this, (long long)(std::min(inputTrackEndPoint, inputEndTicks) - std::min(inputTrackEndPoint, inputStartTicks)),
+                   outputTrack->GetID()));
       }
       ApplyTrackDisabling(outputTrack->GetID(), segment);
       for (uint32_t j = 0; j < mListeners.Length(); ++j) {
diff --git a/content/media/WebVTTListener.cpp b/content/media/WebVTTListener.cpp
index 28c933527894..6cff168ea803 100644
--- a/content/media/WebVTTListener.cpp
+++ b/content/media/WebVTTListener.cpp
@@ -30,9 +30,9 @@ NS_IMPL_CYCLE_COLLECTING_RELEASE(WebVTTListener)
 
 #ifdef PR_LOGGING
 PRLogModuleInfo* gTextTrackLog;
-# define LOG(...) PR_LOG(gTextTrackLog, PR_LOG_DEBUG, (__VA_ARGS__))
+# define VTT_LOG(...) PR_LOG(gTextTrackLog, PR_LOG_DEBUG, (__VA_ARGS__))
 #else
-# define LOG(msg)
+# define VTT_LOG(msg)
 #endif
 
 WebVTTListener::WebVTTListener(HTMLTrackElement* aElement)
@@ -44,12 +44,12 @@ WebVTTListener::WebVTTListener(HTMLTrackElement* aElement)
     gTextTrackLog = PR_NewLogModule("TextTrack");
   }
 #endif
-  LOG("WebVTTListener created.");
+  VTT_LOG("WebVTTListener created.");
 }
 
 WebVTTListener::~WebVTTListener()
 {
-  LOG("WebVTTListener destroyed.");
+  VTT_LOG("WebVTTListener destroyed.");
 }
 
 NS_IMETHODIMP
@@ -124,7 +124,7 @@ WebVTTListener::ParseChunk(nsIInputStream* aInStream, void* aClosure,
   WebVTTListener* listener = static_cast<WebVTTListener*>(aClosure);
 
   if (NS_FAILED(listener->mParserWrapper->Parse(buffer))) {
-    LOG("Unable to parse chunk of WEBVTT text. Aborting.");
+    VTT_LOG("Unable to parse chunk of WEBVTT text. Aborting.");
     *aWriteCount = 0;
     return NS_ERROR_FAILURE;
   }
diff --git a/content/media/encoder/OpusTrackEncoder.cpp b/content/media/encoder/OpusTrackEncoder.cpp
index d89b15e9ed24..735dc22d9520 100644
--- a/content/media/encoder/OpusTrackEncoder.cpp
+++ b/content/media/encoder/OpusTrackEncoder.cpp
@@ -127,6 +127,10 @@ OpusTrackEncoder::~OpusTrackEncoder()
   if (mEncoder) {
     opus_encoder_destroy(mEncoder);
   }
+  if (mResampler) {
+    speex_resampler_destroy(mResampler);
+  }
+
 }
 
 nsresult
@@ -324,6 +328,7 @@ OpusTrackEncoder::GetEncodedTrack(EncodedFrameContainer& aData)
     mDoneEncoding = true;
     if (mResampler) {
       speex_resampler_destroy(mResampler);
+      mResampler = nullptr;
     }
     LOG("[Opus] Done encoding.");
   }
diff --git a/content/media/fmp4/BlankDecoderModule.cpp b/content/media/fmp4/BlankDecoderModule.cpp
new file mode 100644
index 000000000000..bef6244072be
--- /dev/null
+++ b/content/media/fmp4/BlankDecoderModule.cpp
@@ -0,0 +1,225 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "MediaDecoderReader.h"
+#include "PlatformDecoderModule.h"
+#include "nsRect.h"
+#include "mozilla/RefPtr.h"
+#include "mozilla/CheckedInt.h"
+#include "VideoUtils.h"
+#include "ImageContainer.h"
+
+namespace mozilla {
+
+// Decoder that uses a passed in object's Create function to create blank
+// MediaData objects.
+template<class BlankMediaDataCreator>
+class BlankMediaDataDecoder : public MediaDataDecoder {
+public:
+
+  BlankMediaDataDecoder(BlankMediaDataCreator* aCreator)
+    : mCreator(aCreator),
+      mNextDTS(-1),
+      mNextOffset(-1)
+  {
+  }
+
+  virtual nsresult Shutdown() MOZ_OVERRIDE {
+    return NS_OK;
+  }
+
+  virtual DecoderStatus Input(const uint8_t* aData,
+                              uint32_t aLength,
+                              Microseconds aDTS,
+                              Microseconds aPTS,
+                              int64_t aOffsetInStream) MOZ_OVERRIDE
+  {
+    // Accepts input, and outputs on the second input, using the difference
+    // in DTS as the duration.
+    if (mOutput) {
+      return DECODE_STATUS_NOT_ACCEPTING;
+    }
+    if (mNextDTS != -1 && mNextOffset != -1) {
+      Microseconds duration = aDTS - mNextDTS;
+      mOutput = mCreator->Create(mNextDTS, duration, mNextOffset);
+    }
+
+    mNextDTS = aDTS;
+    mNextOffset = aOffsetInStream;
+    return DECODE_STATUS_OK;
+  }
+
+  virtual DecoderStatus Output(nsAutoPtr<MediaData>& aOutData) MOZ_OVERRIDE
+  {
+    if (!mOutput) {
+      return DECODE_STATUS_NEED_MORE_INPUT;
+    }
+    aOutData = mOutput.forget();
+    return DECODE_STATUS_OK;
+  }
+
+  virtual DecoderStatus Flush()  MOZ_OVERRIDE {
+    return DECODE_STATUS_OK;
+  }
+private:
+  nsAutoPtr<BlankMediaDataCreator> mCreator;
+  Microseconds mNextDTS;
+  int64_t mNextOffset;
+  nsAutoPtr<MediaData> mOutput;
+  bool mHasInput;
+};
+
+static const uint32_t sFrameWidth = 320;
+static const uint32_t sFrameHeight = 240;
+
+class BlankVideoDataCreator {
+public:
+  BlankVideoDataCreator(layers::ImageContainer* aImageContainer)
+    : mImageContainer(aImageContainer)
+  {
+    mInfo.mDisplay = nsIntSize(sFrameWidth, sFrameHeight);
+    mPicture = nsIntRect(0, 0, sFrameWidth, sFrameHeight);
+  }
+
+  MediaData* Create(Microseconds aDTS,
+                    Microseconds aDuration,
+                    int64_t aOffsetInStream)
+  {
+    // Create a fake YUV buffer in a 420 format. That is, an 8bpp Y plane,
+    // with a U and V plane that are half the size of the Y plane, i.e 8 bit,
+    // 2x2 subsampled. Have the data pointers of each frame point to the
+    // first plane, they'll always be zero'd memory anyway.
+    uint8_t* frame = new uint8_t[sFrameWidth * sFrameHeight];
+    memset(frame, 0, sFrameWidth * sFrameHeight);
+    VideoData::YCbCrBuffer buffer;
+
+    // Y plane.
+    buffer.mPlanes[0].mData = frame;
+    buffer.mPlanes[0].mStride = sFrameWidth;
+    buffer.mPlanes[0].mHeight = sFrameHeight;
+    buffer.mPlanes[0].mWidth = sFrameWidth;
+    buffer.mPlanes[0].mOffset = 0;
+    buffer.mPlanes[0].mSkip = 0;
+
+    // Cb plane.
+    buffer.mPlanes[1].mData = frame;
+    buffer.mPlanes[1].mStride = sFrameWidth / 2;
+    buffer.mPlanes[1].mHeight = sFrameHeight / 2;
+    buffer.mPlanes[1].mWidth = sFrameWidth / 2;
+    buffer.mPlanes[1].mOffset = 0;
+    buffer.mPlanes[1].mSkip = 0;
+
+    // Cr plane.
+    buffer.mPlanes[2].mData = frame;
+    buffer.mPlanes[2].mStride = sFrameWidth / 2;
+    buffer.mPlanes[2].mHeight = sFrameHeight / 2;
+    buffer.mPlanes[2].mWidth = sFrameWidth / 2;
+    buffer.mPlanes[2].mOffset = 0;
+    buffer.mPlanes[2].mSkip = 0;
+
+    return VideoData::Create(mInfo,
+                             mImageContainer,
+                             nullptr,
+                             aOffsetInStream,
+                             aDTS,
+                             aDuration,
+                             buffer,
+                             true,
+                             aDTS,
+                             mPicture);
+  }
+private:
+  VideoInfo mInfo;
+  nsIntRect mPicture;
+  RefPtr<layers::ImageContainer> mImageContainer;
+};
+
+
+class BlankAudioDataCreator {
+public:
+  BlankAudioDataCreator(uint32_t aChannelCount,
+                        uint32_t aSampleRate,
+                        uint16_t aBitsPerSample)
+    : mFrameSum(0),
+      mChannelCount(aChannelCount),
+      mSampleRate(aSampleRate),
+      mBitsPerSample(aBitsPerSample)
+  {
+  }
+
+  MediaData* Create(Microseconds aDTS,
+                    Microseconds aDuration,
+                    int64_t aOffsetInStream)
+  {
+    // Convert duration to frames. We add 1 to duration to account for
+    // rounding errors, so we get a consistent tone.
+    CheckedInt64 frames = UsecsToFrames(aDuration+1, mSampleRate);
+    if (!frames.isValid() ||
+        !mChannelCount ||
+        !mSampleRate ||
+        frames.value() > (UINT32_MAX / mChannelCount)) {
+      return nullptr;
+    }
+    AudioDataValue* samples = new AudioDataValue[frames.value() * mChannelCount];
+    // Fill the sound buffer with an A4 tone.
+    static const float pi = 3.14159265f;
+    static const float noteHz = 440.0f;
+    for (int i = 0; i < frames.value(); i++) {
+      float f = sin(2 * pi * noteHz * mFrameSum / mSampleRate);
+      for (unsigned c = 0; c < mChannelCount; c++) {
+        samples[i * mChannelCount + c] = AudioDataValue(f);
+      }
+      mFrameSum++;
+    }
+    return new AudioData(aOffsetInStream,
+                         aDTS,
+                         aDuration,
+                         uint32_t(frames.value()),
+                         samples,
+                         mChannelCount);
+  }
+
+private:
+  int64_t mFrameSum;
+  uint32_t mChannelCount;
+  uint32_t mSampleRate;
+  uint16_t mBitsPerSample;
+};
+
+class BlankDecoderModule : public PlatformDecoderModule {
+public:
+
+  // Called when the decoders have shutdown. Main thread only.
+  virtual nsresult Shutdown() MOZ_OVERRIDE {
+    return NS_OK;
+  }
+
+  // Decode thread.
+  virtual MediaDataDecoder* CreateVideoDecoder(layers::LayersBackend aLayersBackend,
+                                               layers::ImageContainer* aImageContainer) MOZ_OVERRIDE {
+    BlankVideoDataCreator* decoder = new BlankVideoDataCreator(aImageContainer);
+    return new BlankMediaDataDecoder<BlankVideoDataCreator>(decoder);
+  }
+
+  // Decode thread.
+  virtual MediaDataDecoder* CreateAudioDecoder(uint32_t aChannelCount,
+                                               uint32_t aSampleRate,
+                                               uint16_t aBitsPerSample,
+                                               const uint8_t* aUserData,
+                                               uint32_t aUserDataLength) MOZ_OVERRIDE {
+    BlankAudioDataCreator* decoder = new BlankAudioDataCreator(aChannelCount,
+                                                               aSampleRate,
+                                                               aBitsPerSample);
+    return new BlankMediaDataDecoder<BlankAudioDataCreator>(decoder);
+  }
+};
+
+PlatformDecoderModule* CreateBlankDecoderModule()
+{
+  return new BlankDecoderModule();
+}
+
+} // namespace mozilla
diff --git a/content/media/fmp4/MP4Decoder.cpp b/content/media/fmp4/MP4Decoder.cpp
new file mode 100644
index 000000000000..1d912f0f1d3d
--- /dev/null
+++ b/content/media/fmp4/MP4Decoder.cpp
@@ -0,0 +1,90 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "MP4Decoder.h"
+#include "MP4Reader.h"
+#include "MediaDecoderStateMachine.h"
+#include "mozilla/Preferences.h"
+
+#ifdef XP_WIN
+#include "WinUtils.h"
+using namespace mozilla::widget;
+#endif
+
+namespace mozilla {
+
+MediaDecoderStateMachine* MP4Decoder::CreateStateMachine()
+{
+  return new MediaDecoderStateMachine(this, new MP4Reader(this));
+}
+
+bool
+MP4Decoder::GetSupportedCodecs(const nsACString& aType,
+                               char const *const ** aCodecList)
+{
+  if (!IsEnabled()) {
+    return false;
+  }
+
+  // AAC in M4A.
+  static char const *const aacAudioCodecs[] = {
+    "mp4a.40.2",    // AAC-LC
+    // TODO: AAC-HE ?
+    nullptr
+  };
+  if (aType.EqualsASCII("audio/mp4") ||
+      aType.EqualsASCII("audio/x-m4a")) {
+    if (aCodecList) {
+      *aCodecList = aacAudioCodecs;
+    }
+    return true;
+  }
+
+  // H.264 + AAC in MP4.
+  static char const *const h264Codecs[] = {
+    "avc1.42E01E",  // H.264 Constrained Baseline Profile Level 3.0
+    "avc1.42001E",  // H.264 Baseline Profile Level 3.0
+    "avc1.58A01E",  // H.264 Extended Profile Level 3.0
+    "avc1.4D401E",  // H.264 Main Profile Level 3.0
+    "avc1.64001E",  // H.264 High Profile Level 3.0
+    "avc1.64001F",  // H.264 High Profile Level 3.1
+    "mp4a.40.2",    // AAC-LC
+    // TODO: There must be more profiles here?
+    nullptr
+  };
+  if (aType.EqualsASCII("video/mp4")) {
+    if (aCodecList) {
+      *aCodecList = h264Codecs;
+    }
+    return true;
+  }
+
+  return false;
+}
+
+static bool
+HavePlatformMPEGDecoders()
+{
+  return
+    Preferences::GetBool("media.fragmented-mp4.use-blank-decoder") ||
+#ifdef XP_WIN
+    // We have H.264/AAC platform decoders on Windows Vista and up.
+    WinUtils::GetWindowsVersion() >= WinUtils::VISTA_VERSION ||
+#endif
+    // TODO: Other platforms...
+    false;
+}
+
+/* static */
+bool
+MP4Decoder::IsEnabled()
+{
+  return HavePlatformMPEGDecoders() &&
+         Preferences::GetBool("media.fragmented-mp4.enabled");
+}
+
+} // namespace mozilla
+
diff --git a/content/media/fmp4/MP4Decoder.h b/content/media/fmp4/MP4Decoder.h
new file mode 100644
index 000000000000..323381f0b50b
--- /dev/null
+++ b/content/media/fmp4/MP4Decoder.h
@@ -0,0 +1,41 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+#if !defined(MP4Decoder_h_)
+#define MP4Decoder_h_
+
+#include "MediaDecoder.h"
+
+namespace mozilla {
+
+// Decoder that uses a bundled MP4 demuxer and platform decoders to play MP4.
+class MP4Decoder : public MediaDecoder
+{
+public:
+
+  virtual MediaDecoder* Clone() {
+    if (!IsEnabled()) {
+      return nullptr;
+    }
+    return new MP4Decoder();
+  }
+
+  virtual MediaDecoderStateMachine* CreateStateMachine();
+
+  // Returns true if aType is a MIME type that we can render with the
+  // a MP4 platform decoder backend. If aCodecList is non null,
+  // it is filled with a (static const) null-terminated list of strings
+  // denoting the codecs we'll playback.
+  static bool GetSupportedCodecs(const nsACString& aType,
+                                 char const *const ** aCodecList);
+
+  // Returns true if the MP4 backend is preffed on, and we're running on a
+  // platform that is likely to have decoders for the contained formats.
+  static bool IsEnabled();
+};
+
+} // namespace mozilla
+
+#endif
diff --git a/content/media/fmp4/MP4Reader.cpp b/content/media/fmp4/MP4Reader.cpp
new file mode 100644
index 000000000000..0a3bf7948ed3
--- /dev/null
+++ b/content/media/fmp4/MP4Reader.cpp
@@ -0,0 +1,393 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "MP4Reader.h"
+#include "MediaResource.h"
+#include "mp4_demuxer/mp4_demuxer.h"
+#include "mp4_demuxer/Streams.h"
+#include "nsSize.h"
+#include "VideoUtils.h"
+#include "mozilla/dom/HTMLMediaElement.h"
+#include "ImageContainer.h"
+#include "Layers.h"
+
+using mozilla::layers::Image;
+using mozilla::layers::LayerManager;
+using mozilla::layers::LayersBackend;
+
+#ifdef PR_LOGGING
+PRLogModuleInfo* GetDemuxerLog() {
+  static PRLogModuleInfo* log = nullptr;
+  if (!log) {
+    log = PR_NewLogModule("MP4Demuxer");
+  }
+  return log;
+}
+#define LOG(...) PR_LOG(GetDemuxerLog(), PR_LOG_DEBUG, (__VA_ARGS__))
+#else
+#define LOG(...)
+#endif
+
+using namespace mp4_demuxer;
+
+namespace mozilla {
+
+// Uncomment to enable verbose per-sample logging.
+//#define LOG_SAMPLE_DECODE 1
+
+class MP4Stream : public mp4_demuxer::Stream {
+public:
+
+  MP4Stream(MediaResource* aResource)
+    : mResource(aResource)
+  {
+    MOZ_COUNT_CTOR(MP4Stream);
+    MOZ_ASSERT(aResource);
+  }
+  ~MP4Stream() {
+    MOZ_COUNT_DTOR(MP4Stream);
+  }
+
+  virtual bool ReadAt(int64_t aOffset,
+                      uint8_t* aBuffer,
+                      uint32_t aCount,
+                      uint32_t* aBytesRead) MOZ_OVERRIDE {
+    uint32_t sum = 0;
+    do {
+      uint32_t offset = aOffset + sum;
+      char* buffer = reinterpret_cast<char*>(aBuffer + sum);
+      uint32_t toRead = aCount - sum;
+      uint32_t bytesRead = 0;
+      nsresult rv = mResource->ReadAt(offset, buffer, toRead, &bytesRead);
+      if (NS_FAILED(rv)) {
+        return false;
+      }
+      sum += bytesRead;
+    } while (sum < aCount);
+    *aBytesRead = sum;
+    return true;
+  }
+
+  virtual int64_t Length() const MOZ_OVERRIDE {
+    return mResource->GetLength();
+  }
+
+private:
+  RefPtr<MediaResource> mResource;
+};
+
+MP4Reader::MP4Reader(AbstractMediaDecoder* aDecoder)
+  : MediaDecoderReader(aDecoder),
+    mLayersBackendType(layers::LAYERS_NONE),
+    mHasAudio(false),
+    mHasVideo(false)
+{
+  MOZ_COUNT_CTOR(MP4Reader);
+}
+
+MP4Reader::~MP4Reader()
+{
+  MOZ_COUNT_DTOR(MP4Reader);
+}
+
+nsresult
+MP4Reader::Init(MediaDecoderReader* aCloneDonor)
+{
+  MOZ_ASSERT(NS_IsMainThread(), "Must be on main thread.");
+  mMP4Stream = new MP4Stream(mDecoder->GetResource());
+  mDemuxer = new MP4Demuxer(mMP4Stream);
+
+  mPlatform = PlatformDecoderModule::Create();
+  NS_ENSURE_TRUE(mPlatform, NS_ERROR_FAILURE);
+
+  if (IsVideoContentType(mDecoder->GetResource()->GetContentType())) {
+    // Extract the layer manager backend type so that platform decoders
+    // can determine whether it's worthwhile using hardware accelerated
+    // video decoding.
+    MediaDecoderOwner* owner = mDecoder->GetOwner();
+    NS_ENSURE_TRUE(owner, NS_ERROR_FAILURE);
+
+    dom::HTMLMediaElement* element = owner->GetMediaElement();
+    NS_ENSURE_TRUE(element, NS_ERROR_FAILURE);
+
+    nsRefPtr<LayerManager> layerManager =
+      nsContentUtils::LayerManagerForDocument(element->OwnerDoc());
+    NS_ENSURE_TRUE(layerManager, NS_ERROR_FAILURE);
+
+    mLayersBackendType = layerManager->GetBackendType();
+  }
+
+  return NS_OK;
+}
+
+nsresult
+MP4Reader::ReadMetadata(MediaInfo* aInfo,
+                        MetadataTags** aTags)
+{
+  bool ok = mDemuxer->Init();
+  NS_ENSURE_TRUE(ok, NS_ERROR_FAILURE);
+
+  mInfo.mAudio.mHasAudio = mHasAudio = mDemuxer->HasAudio();
+  if (mHasAudio) {
+    const AudioDecoderConfig& config = mDemuxer->AudioConfig();
+    mInfo.mAudio.mRate = config.samples_per_second();
+    mInfo.mAudio.mChannels = ChannelLayoutToChannelCount(config.channel_layout());
+    mAudioDecoder = mPlatform->CreateAudioDecoder(mInfo.mAudio.mChannels,
+                                                  mInfo.mAudio.mRate,
+                                                  config.bits_per_channel(),
+                                                  config.extra_data(),
+                                                  config.extra_data_size());
+    NS_ENSURE_TRUE(mAudioDecoder != nullptr, NS_ERROR_FAILURE);
+  }
+
+  mInfo.mVideo.mHasVideo = mHasVideo = mDemuxer->HasVideo();
+  if (mHasVideo) {
+    const VideoDecoderConfig& config = mDemuxer->VideoConfig();
+    IntSize sz = config.natural_size();
+    mInfo.mVideo.mDisplay = nsIntSize(sz.width(), sz.height());
+
+    mVideoDecoder = mPlatform->CreateVideoDecoder(mLayersBackendType,
+                                                  mDecoder->GetImageContainer());
+    NS_ENSURE_TRUE(mVideoDecoder != nullptr, NS_ERROR_FAILURE);
+  }
+
+  // Get the duration, and report it to the decoder if we have it.
+  Microseconds duration = mDemuxer->Duration();
+  if (duration != -1) {
+    ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());
+    mDecoder->SetMediaDuration(duration);
+  }
+  // We can seek if we get a duration *and* the reader reports that it's
+  // seekable.
+  if (!mDemuxer->CanSeek()) {
+    mDecoder->SetMediaSeekable(false);
+  }
+
+  *aInfo = mInfo;
+  *aTags = nullptr;
+
+  return NS_OK;
+}
+
+bool
+MP4Reader::HasAudio()
+{
+  return mHasAudio;
+}
+
+bool
+MP4Reader::HasVideo()
+{
+  return mHasVideo;
+}
+
+MP4SampleQueue&
+MP4Reader::SampleQueue(TrackType aTrack)
+{
+  MOZ_ASSERT(aTrack == kAudio || aTrack == kVideo);
+  return (aTrack == kAudio) ? mCompressedAudioQueue
+                            : mCompressedVideoQueue;
+}
+
+MediaDataDecoder*
+MP4Reader::Decoder(mp4_demuxer::TrackType aTrack)
+{
+  MOZ_ASSERT(aTrack == kAudio || aTrack == kVideo);
+  return (aTrack == kAudio) ? mAudioDecoder
+                            : mVideoDecoder;
+}
+
+MP4Sample*
+MP4Reader::PopSample(TrackType aTrack)
+{
+  // Unfortunately the demuxer outputs in the order samples appear in the
+  // media, not on a per stream basis. We cache the samples we get from
+  // streams other than the one we want.
+  MP4SampleQueue& sampleQueue = SampleQueue(aTrack);
+  while (sampleQueue.empty()) {
+    nsAutoPtr<MP4Sample> sample;
+    bool eos = false;
+    bool ok = mDemuxer->Demux(&sample, &eos);
+    if (!ok || eos) {
+      MOZ_ASSERT(!sample);
+      return nullptr;
+    }
+    MOZ_ASSERT(sample);
+    MP4Sample* s = sample.forget();
+    SampleQueue(s->type).push_back(s);
+  }
+  MOZ_ASSERT(!sampleQueue.empty());
+  MP4Sample* sample = sampleQueue.front();
+  sampleQueue.pop_front();
+  return sample;
+}
+
+bool
+MP4Reader::Decode(TrackType aTrack, nsAutoPtr<MediaData>& aOutData)
+{
+  MP4SampleQueue& sampleQueue = SampleQueue(aTrack);
+  MediaDataDecoder* decoder = Decoder(aTrack);
+
+  MOZ_ASSERT(decoder);
+
+  // Loop until we hit a return condition; we produce samples, or hit an error.
+  while (true) {
+    DecoderStatus status = decoder->Output(aOutData);
+    if (status == DECODE_STATUS_OK) {
+      MOZ_ASSERT(aOutData);
+      return true;
+    }
+    // |aOutData| should only be non-null in success case.
+    MOZ_ASSERT(!aOutData);
+
+    if (status == DECODE_STATUS_ERROR) {
+      return false;
+    }
+
+    if (status == DECODE_STATUS_NEED_MORE_INPUT) {
+      // We need to push more data from the demuxer into the decoder.
+      // Now loop back and try to extract output again.
+      nsAutoPtr<MP4Sample> compressed;
+      do {
+        compressed = PopSample(aTrack);
+        if (!compressed) {
+          // EOS, or error. Let the state machine know there are no more
+          // frames coming.
+          return false;
+        }
+        const std::vector<uint8_t>* data = compressed->data;
+        status = decoder->Input(&data->front(),
+                                data->size(),
+                                compressed->decode_timestamp,
+                                compressed->composition_timestamp,
+                                compressed->byte_offset);
+      } while (status == DECODE_STATUS_OK);
+      if (status == DECODE_STATUS_NOT_ACCEPTING) {
+        // Decoder should now be able to produce an output.
+        SampleQueue(aTrack).push_front(compressed.forget());
+        continue;
+      }
+      LOG("MP4Reader decode failure. track=%d status=%d\n", aTrack, status);
+      return false;
+    } else {
+      LOG("MP4Reader unexpected error. track=%d status=%d\n", aTrack, status);
+      return false;
+    }
+  }
+}
+
+bool
+MP4Reader::DecodeAudioData()
+{
+  MOZ_ASSERT(mHasAudio && mPlatform && mAudioDecoder);
+  nsAutoPtr<MediaData> audio;
+  bool ok = Decode(kAudio, audio);
+  if (ok && audio && audio->mType == MediaData::AUDIO_SAMPLES) {
+#ifdef LOG_SAMPLE_DECODE
+    LOG("DecodeAudioData time=%lld dur=%lld", audio->mTime, audio->mDuration);
+#endif
+    mAudioQueue.Push(static_cast<AudioData*>(audio.forget()));
+  }
+  return ok;
+}
+
+bool
+MP4Reader::SkipVideoDemuxToNextKeyFrame(int64_t aTimeThreshold, uint32_t& parsed)
+{
+  MOZ_ASSERT(mVideoDecoder);
+
+  // Purge the current decoder's state.
+  mVideoDecoder->Flush();
+
+  // Loop until we reach the next keyframe after the threshold.
+  while (true) {
+    nsAutoPtr<MP4Sample> compressed(PopSample(kVideo));
+    if (!compressed) {
+      // EOS, or error. Let the state machine know.
+      return false;
+    }
+    parsed++;
+    if (!compressed->is_sync_point ||
+        compressed->composition_timestamp < aTimeThreshold) {
+      continue;
+    }
+    mCompressedVideoQueue.push_front(compressed.forget());
+    break;
+  }
+
+  return true;
+}
+
+bool
+MP4Reader::DecodeVideoFrame(bool &aKeyframeSkip,
+                            int64_t aTimeThreshold)
+{
+  // Record number of frames decoded and parsed. Automatically update the
+  // stats counters using the AutoNotifyDecoded stack-based class.
+  uint32_t parsed = 0, decoded = 0;
+  AbstractMediaDecoder::AutoNotifyDecoded autoNotify(mDecoder, parsed, decoded);
+
+  MOZ_ASSERT(mHasVideo && mPlatform && mVideoDecoder);
+
+  if (aKeyframeSkip) {
+    bool ok = SkipVideoDemuxToNextKeyFrame(aTimeThreshold, parsed);
+    if (!ok) {
+      NS_WARNING("Failed to skip demux up to next keyframe");
+      return false;
+    }
+    aKeyframeSkip = false;
+  }
+
+  nsAutoPtr<MediaData> data;
+  bool ok = Decode(kVideo, data);
+  MOZ_ASSERT(!data || data->mType == MediaData::VIDEO_FRAME);
+  if (ok && data) {
+    parsed++;
+    if (data->mTime < aTimeThreshold) {
+      // Skip frame, it's too late to be displayed.
+      return true;
+    }
+    decoded++;
+    VideoData* video = static_cast<VideoData*>(data.forget());
+#ifdef LOG_SAMPLE_DECODE
+    LOG("DecodeVideoData time=%lld dur=%lld", video->mTime, video->mDuration);
+#endif
+    mVideoQueue.Push(video);
+  }
+  return ok;
+}
+
+nsresult
+MP4Reader::Seek(int64_t aTime,
+                int64_t aStartTime,
+                int64_t aEndTime,
+                int64_t aCurrentTime)
+{
+  if (!mDemuxer->CanSeek()) {
+    return NS_ERROR_FAILURE;
+  }
+  return NS_ERROR_NOT_IMPLEMENTED;
+}
+
+void
+MP4Reader::OnDecodeThreadStart()
+{
+  MOZ_ASSERT(!NS_IsMainThread(), "Must not be on main thread.");
+  MOZ_ASSERT(mDecoder->OnDecodeThread(), "Should be on decode thread.");
+  MOZ_ASSERT(mPlatform);
+  mPlatform->OnDecodeThreadStart();
+}
+
+void
+MP4Reader::OnDecodeThreadFinish()
+{
+  MOZ_ASSERT(!NS_IsMainThread(), "Must not be on main thread.");
+  MOZ_ASSERT(mDecoder->OnDecodeThread(), "Should be on decode thread.");
+  MOZ_ASSERT(mPlatform);
+  mPlatform->OnDecodeThreadFinish();
+}
+
+} // namespace mozilla
diff --git a/content/media/fmp4/MP4Reader.h b/content/media/fmp4/MP4Reader.h
new file mode 100644
index 000000000000..d7d1e23597c8
--- /dev/null
+++ b/content/media/fmp4/MP4Reader.h
@@ -0,0 +1,88 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#if !defined(MP4Reader_h_)
+#define MP4Reader_h_
+
+#include "MediaDecoderReader.h"
+#include "nsAutoPtr.h"
+#include "PlatformDecoderModule.h"
+#include "mp4_demuxer/mp4_demuxer.h"
+#include "mp4_demuxer/box_definitions.h"
+
+#include <deque>
+
+namespace mozilla {
+
+namespace dom {
+class TimeRanges;
+}
+
+typedef std::deque<mp4_demuxer::MP4Sample*> MP4SampleQueue;
+
+class MP4Stream;
+
+class MP4Reader : public MediaDecoderReader
+{
+public:
+  MP4Reader(AbstractMediaDecoder* aDecoder);
+
+  virtual ~MP4Reader();
+
+  virtual nsresult Init(MediaDecoderReader* aCloneDonor) MOZ_OVERRIDE;
+
+  virtual bool DecodeAudioData() MOZ_OVERRIDE;
+  virtual bool DecodeVideoFrame(bool &aKeyframeSkip,
+                                int64_t aTimeThreshold) MOZ_OVERRIDE;
+
+  virtual bool HasAudio() MOZ_OVERRIDE;
+  virtual bool HasVideo() MOZ_OVERRIDE;
+
+  virtual nsresult ReadMetadata(MediaInfo* aInfo,
+                                MetadataTags** aTags) MOZ_OVERRIDE;
+
+  virtual nsresult Seek(int64_t aTime,
+                        int64_t aStartTime,
+                        int64_t aEndTime,
+                        int64_t aCurrentTime) MOZ_OVERRIDE;
+
+  virtual void OnDecodeThreadStart() MOZ_OVERRIDE;
+  virtual void OnDecodeThreadFinish() MOZ_OVERRIDE;
+
+private:
+
+  MP4SampleQueue& SampleQueue(mp4_demuxer::TrackType aTrack);
+
+  // Blocks until the demuxer produces an sample of specified type.
+  // Returns nullptr on error on EOS. Caller must delete sample.
+  mp4_demuxer::MP4Sample* PopSample(mp4_demuxer::TrackType aTrack);
+
+  bool Decode(mp4_demuxer::TrackType aTrack,
+              nsAutoPtr<MediaData>& aOutData);
+
+  MediaDataDecoder* Decoder(mp4_demuxer::TrackType aTrack);
+
+  bool SkipVideoDemuxToNextKeyFrame(int64_t aTimeThreshold, uint32_t& parsed);
+
+  nsAutoPtr<mp4_demuxer::MP4Demuxer> mDemuxer;
+  nsAutoPtr<MP4Stream> mMP4Stream;
+  nsAutoPtr<PlatformDecoderModule> mPlatform;
+  nsAutoPtr<MediaDataDecoder> mVideoDecoder;
+  nsAutoPtr<MediaDataDecoder> mAudioDecoder;
+
+  MP4SampleQueue mCompressedAudioQueue;
+  MP4SampleQueue mCompressedVideoQueue;
+
+  layers::LayersBackend mLayersBackendType;
+
+  bool mHasAudio;
+  bool mHasVideo;
+
+};
+
+} // namespace mozilla
+
+#endif
diff --git a/content/media/fmp4/Makefile.in b/content/media/fmp4/Makefile.in
new file mode 100644
index 000000000000..642256452251
--- /dev/null
+++ b/content/media/fmp4/Makefile.in
@@ -0,0 +1,7 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+ifeq ($(OS_ARCH),WINNT)
+OS_CXXFLAGS += -DNOMINMAX
+endif
diff --git a/content/media/fmp4/PlatformDecoderModule.cpp b/content/media/fmp4/PlatformDecoderModule.cpp
new file mode 100644
index 000000000000..fdb37aedb0dd
--- /dev/null
+++ b/content/media/fmp4/PlatformDecoderModule.cpp
@@ -0,0 +1,43 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "PlatformDecoderModule.h"
+#ifdef XP_WIN
+#include "WMFDecoderModule.h"
+#endif
+#include "mozilla/Preferences.h"
+
+namespace mozilla {
+
+extern PlatformDecoderModule* CreateBlankDecoderModule();
+
+/* static */
+PlatformDecoderModule*
+PlatformDecoderModule::Create()
+{
+  if (Preferences::GetBool("media.fragmented-mp4.use-blank-decoder")) {
+    return CreateBlankDecoderModule();
+  }
+#ifdef XP_WIN
+  nsAutoPtr<WMFDecoderModule> m(new WMFDecoderModule());
+  if (NS_SUCCEEDED(m->Init())) {
+    return m.forget();
+  }
+#endif
+  return nullptr;
+}
+
+void
+PlatformDecoderModule::OnDecodeThreadStart()
+{
+}
+
+void
+PlatformDecoderModule::OnDecodeThreadFinish()
+{
+}
+
+} // namespace mozilla
diff --git a/content/media/fmp4/PlatformDecoderModule.h b/content/media/fmp4/PlatformDecoderModule.h
new file mode 100644
index 000000000000..182c3ce3ebb0
--- /dev/null
+++ b/content/media/fmp4/PlatformDecoderModule.h
@@ -0,0 +1,84 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#if !defined(PlatformDecoderModule_h_)
+#define PlatformDecoderModule_h_
+
+#include "MediaDecoderReader.h"
+#include "mozilla/layers/LayersTypes.h"
+
+namespace mozilla {
+
+namespace layers {
+class ImageContainer;
+}
+
+typedef int64_t Microseconds;
+
+enum DecoderStatus {
+  DECODE_STATUS_NOT_ACCEPTING, // Can't accept input at this time.
+  DECODE_STATUS_NEED_MORE_INPUT, // Nothing in pipeline to produce output with at this time.
+  DECODE_STATUS_OK,
+  DECODE_STATUS_ERROR
+};
+
+class MediaDataDecoder {
+public:
+  virtual ~MediaDataDecoder() {};
+
+  virtual nsresult Shutdown() = 0;
+
+  // Returns true if future decodes may produce output, or false
+  // on end of segment.
+  // Inserts data into the decoder's pipeline.
+  virtual DecoderStatus Input(const uint8_t* aData,
+                              uint32_t aLength,
+                              Microseconds aDTS,
+                              Microseconds aPTS,
+                              int64_t aOffsetInStream) = 0;
+
+  // Blocks until decoded sample is produced by the deoder.
+  virtual DecoderStatus Output(nsAutoPtr<MediaData>& aOutData) = 0;
+
+  virtual DecoderStatus Flush() = 0;
+};
+
+class PlatformDecoderModule {
+public:
+
+  // Creates the appropriate PlatformDecoderModule for this platform.
+  // Caller is responsible for deleting this instance. It's safe to have
+  // multiple PlatformDecoderModules alive at the same time.
+  // There is one PlatformDecoderModule's created per media decoder.
+  static PlatformDecoderModule* Create();
+
+  // Called when the decoders have shutdown. Main thread only.
+  virtual nsresult Shutdown() = 0;
+
+  // TODO: Parameters for codec type.
+  // Decode thread.
+  virtual MediaDataDecoder* CreateVideoDecoder(layers::LayersBackend aLayersBackend,
+                                               layers::ImageContainer* aImageContainer) = 0;
+
+  // Decode thread.
+  virtual MediaDataDecoder* CreateAudioDecoder(uint32_t aChannelCount,
+                                               uint32_t aSampleRate,
+                                               uint16_t aBitsPerSample,
+                                               const uint8_t* aUserData,
+                                               uint32_t aUserDataLength) = 0;
+
+  // Platform decoders can override these. Base implementation does nothing.
+  virtual void OnDecodeThreadStart();
+  virtual void OnDecodeThreadFinish();
+
+  virtual ~PlatformDecoderModule() {}
+protected:
+  PlatformDecoderModule() {}
+};
+
+} // namespace mozilla
+
+#endif
diff --git a/content/media/fmp4/demuxer/LICENSE b/content/media/fmp4/demuxer/LICENSE
new file mode 100644
index 000000000000..3d0f7d3edfd8
--- /dev/null
+++ b/content/media/fmp4/demuxer/LICENSE
@@ -0,0 +1,27 @@
+// Copyright (c) 2013 The Chromium Authors. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//    * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//    * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//    * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/content/media/fmp4/demuxer/Streams.h b/content/media/fmp4/demuxer/Streams.h
new file mode 100644
index 000000000000..0274433cc09e
--- /dev/null
+++ b/content/media/fmp4/demuxer/Streams.h
@@ -0,0 +1,21 @@
+#pragma once
+
+#include <stdint.h>
+
+namespace mp4_demuxer {
+
+class Stream {
+public:
+
+  // Returns true on success, false on failure.
+  // Writes number of bytes read into out_bytes_read, or 0 on EOS.
+  // Returns true on EOS.
+  virtual bool ReadAt(int64_t offset,
+                      uint8_t* buffer,
+                      uint32_t count,
+                      uint32_t* out_bytes_read) = 0;
+
+  virtual int64_t Length() const = 0;
+};
+
+} // namespace mp4_demuxer
\ No newline at end of file
diff --git a/content/media/fmp4/demuxer/aac.cc b/content/media/fmp4/demuxer/aac.cc
new file mode 100644
index 000000000000..f0b6203ca739
--- /dev/null
+++ b/content/media/fmp4/demuxer/aac.cc
@@ -0,0 +1,273 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "mp4_demuxer/aac.h"
+
+#include <algorithm>
+
+#include "mp4_demuxer/bit_reader.h"
+
+namespace mp4_demuxer {
+
+// The following conversion table is extracted from ISO 14496 Part 3 -
+// Table 1.16 - Sampling Frequency Index.
+static const int kFrequencyMap[] = {
+  96000, 88200, 64000, 48000, 44100, 32000, 24000,
+  22050, 16000, 12000, 11025, 8000, 7350
+};
+
+static ChannelLayout ConvertChannelConfigToLayout(uint8_t channel_config) {
+  switch (channel_config) {
+    case 1:
+      return CHANNEL_LAYOUT_MONO;
+    case 2:
+      return CHANNEL_LAYOUT_STEREO;
+    case 3:
+      return CHANNEL_LAYOUT_SURROUND;
+    case 4:
+      return CHANNEL_LAYOUT_4_0;
+    case 5:
+      return CHANNEL_LAYOUT_5_0;
+    case 6:
+      return CHANNEL_LAYOUT_5_1;
+    case 8:
+      return CHANNEL_LAYOUT_7_1;
+    default:
+      break;
+  }
+
+  return CHANNEL_LAYOUT_UNSUPPORTED;
+}
+
+AAC::AAC()
+    : profile_(0), frequency_index_(0), channel_config_(0), frequency_(0),
+      extension_frequency_(0), channel_layout_(CHANNEL_LAYOUT_UNSUPPORTED) {
+}
+
+AAC::~AAC() {
+}
+
+bool AAC::Parse(const std::vector<uint8_t>& data) {
+  if (data.empty())
+    return false;
+
+  BitReader reader(&data[0], data.size());
+  uint8_t extension_type = 0;
+  bool ps_present = false;
+  uint8_t extension_frequency_index = 0xff;
+
+  frequency_ = 0;
+  extension_frequency_ = 0;
+
+  // The following code is written according to ISO 14496 Part 3 Table 1.13 -
+  // Syntax of AudioSpecificConfig.
+
+  // Read base configuration
+  RCHECK(reader.ReadBits(5, &profile_));
+  RCHECK(reader.ReadBits(4, &frequency_index_));
+  if (frequency_index_ == 0xf)
+    RCHECK(reader.ReadBits(24, &frequency_));
+  RCHECK(reader.ReadBits(4, &channel_config_));
+
+  // Read extension configuration.
+  if (profile_ == 5 || profile_ == 29) {
+    ps_present = (profile_ == 29);
+    extension_type = 5;
+    RCHECK(reader.ReadBits(4, &extension_frequency_index));
+    if (extension_frequency_index == 0xf)
+      RCHECK(reader.ReadBits(24, &extension_frequency_));
+    RCHECK(reader.ReadBits(5, &profile_));
+  }
+
+  RCHECK(SkipDecoderGASpecificConfig(&reader));
+  RCHECK(SkipErrorSpecificConfig());
+
+  // Read extension configuration again
+  // Note: The check for 16 available bits comes from the AAC spec.
+  if (extension_type != 5 && reader.bits_available() >= 16) {
+    uint16_t sync_extension_type;
+    uint8_t sbr_present_flag;
+    uint8_t ps_present_flag;
+
+    if (reader.ReadBits(11, &sync_extension_type) &&
+        sync_extension_type == 0x2b7) {
+      if (reader.ReadBits(5, &extension_type) && extension_type == 5) {
+        RCHECK(reader.ReadBits(1, &sbr_present_flag));
+
+        if (sbr_present_flag) {
+          RCHECK(reader.ReadBits(4, &extension_frequency_index));
+
+          if (extension_frequency_index == 0xf)
+            RCHECK(reader.ReadBits(24, &extension_frequency_));
+
+          // Note: The check for 12 available bits comes from the AAC spec.
+          if (reader.bits_available() >= 12) {
+            RCHECK(reader.ReadBits(11, &sync_extension_type));
+            if (sync_extension_type == 0x548) {
+              RCHECK(reader.ReadBits(1, &ps_present_flag));
+              ps_present = ps_present_flag != 0;
+            }
+          }
+        }
+      }
+    }
+  }
+
+  if (frequency_ == 0) {
+    RCHECK(frequency_index_ < arraysize(kFrequencyMap));
+    frequency_ = kFrequencyMap[frequency_index_];
+  }
+
+  if (extension_frequency_ == 0 && extension_frequency_index != 0xff) {
+    RCHECK(extension_frequency_index < arraysize(kFrequencyMap));
+    extension_frequency_ = kFrequencyMap[extension_frequency_index];
+  }
+
+  // When Parametric Stereo is on, mono will be played as stereo.
+  if (ps_present && channel_config_ == 1)
+    channel_layout_ = CHANNEL_LAYOUT_STEREO;
+  else
+    channel_layout_ = ConvertChannelConfigToLayout(channel_config_);
+
+  audio_specific_config_.insert(audio_specific_config_.begin(), data.begin(), data.end());
+
+  return frequency_ != 0 && channel_layout_ != CHANNEL_LAYOUT_UNSUPPORTED &&
+      profile_ >= 1 && profile_ <= 4 && frequency_index_ != 0xf &&
+      channel_config_ <= 7;
+}
+
+const std::vector<uint8_t>& AAC::AudioSpecificConfig() const
+{
+  return audio_specific_config_;
+}
+
+int AAC::GetOutputSamplesPerSecond(bool sbr_in_mimetype) const {
+  if (extension_frequency_ > 0)
+    return extension_frequency_;
+
+  if (!sbr_in_mimetype)
+    return frequency_;
+
+  // The following code is written according to ISO 14496 Part 3 Table 1.11 and
+  // Table 1.22. (Table 1.11 refers to the capping to 48000, Table 1.22 refers
+  // to SBR doubling the AAC sample rate.)
+  // TODO(acolwell) : Extend sample rate cap to 96kHz for Level 5 content.
+  DCHECK_GT(frequency_, 0);
+  return std::min(2 * frequency_, 48000);
+}
+
+ChannelLayout AAC::GetChannelLayout(bool sbr_in_mimetype) const {
+  // Check for implicit signalling of HE-AAC and indicate stereo output
+  // if the mono channel configuration is signalled.
+  // See ISO-14496-3 Section 1.6.6.1.2 for details about this special casing.
+  if (sbr_in_mimetype && channel_config_ == 1)
+    return CHANNEL_LAYOUT_STEREO;
+
+  return channel_layout_;
+}
+
+bool AAC::ConvertEsdsToADTS(std::vector<uint8_t>* buffer) const {
+  size_t size = buffer->size() + kADTSHeaderSize;
+
+  DCHECK(profile_ >= 1 && profile_ <= 4 && frequency_index_ != 0xf &&
+         channel_config_ <= 7);
+
+  // ADTS header uses 13 bits for packet size.
+  if (size >= (1 << 13))
+    return false;
+
+  std::vector<uint8_t>& adts = *buffer;
+
+  adts.insert(buffer->begin(), kADTSHeaderSize, 0);
+  adts[0] = 0xff;
+  adts[1] = 0xf1;
+  adts[2] = ((profile_ - 1) << 6) + (frequency_index_ << 2) +
+      (channel_config_ >> 2);
+  adts[3] = ((channel_config_ & 0x3) << 6) + (size >> 11);
+  adts[4] = (size & 0x7ff) >> 3;
+  adts[5] = ((size & 7) << 5) + 0x1f;
+  adts[6] = 0xfc;
+
+  return true;
+}
+
+// Currently this function only support GASpecificConfig defined in
+// ISO 14496 Part 3 Table 4.1 - Syntax of GASpecificConfig()
+bool AAC::SkipDecoderGASpecificConfig(BitReader* bit_reader) const {
+  switch (profile_) {
+    case 1:
+    case 2:
+    case 3:
+    case 4:
+    case 6:
+    case 7:
+    case 17:
+    case 19:
+    case 20:
+    case 21:
+    case 22:
+    case 23:
+      return SkipGASpecificConfig(bit_reader);
+    default:
+      break;
+  }
+
+  return false;
+}
+
+bool AAC::SkipErrorSpecificConfig() const {
+  switch (profile_) {
+    case 17:
+    case 19:
+    case 20:
+    case 21:
+    case 22:
+    case 23:
+    case 24:
+    case 25:
+    case 26:
+    case 27:
+      return false;
+    default:
+      break;
+  }
+
+  return true;
+}
+
+// The following code is written according to ISO 14496 part 3 Table 4.1 -
+// GASpecificConfig.
+bool AAC::SkipGASpecificConfig(BitReader* bit_reader) const {
+  uint8_t extension_flag = 0;
+  uint8_t depends_on_core_coder;
+  uint16_t dummy;
+
+  RCHECK(bit_reader->ReadBits(1, &dummy));  // frameLengthFlag
+  RCHECK(bit_reader->ReadBits(1, &depends_on_core_coder));
+  if (depends_on_core_coder == 1)
+    RCHECK(bit_reader->ReadBits(14, &dummy));  // coreCoderDelay
+
+  RCHECK(bit_reader->ReadBits(1, &extension_flag));
+  RCHECK(channel_config_ != 0);
+
+  if (profile_ == 6 || profile_ == 20)
+    RCHECK(bit_reader->ReadBits(3, &dummy));  // layerNr
+
+  if (extension_flag) {
+    if (profile_ == 22) {
+      RCHECK(bit_reader->ReadBits(5, &dummy));  // numOfSubFrame
+      RCHECK(bit_reader->ReadBits(11, &dummy));  // layer_length
+    }
+
+    if (profile_ == 17 || profile_ == 19 || profile_ == 20 || profile_ == 23) {
+      RCHECK(bit_reader->ReadBits(3, &dummy));  // resilience flags
+    }
+
+    RCHECK(bit_reader->ReadBits(1, &dummy));  // extensionFlag3
+  }
+
+  return true;
+}
+
+}  // namespace mp4_demuxer
diff --git a/content/media/fmp4/demuxer/aac.h b/content/media/fmp4/demuxer/aac.h
new file mode 100644
index 000000000000..e3f4b92f74e8
--- /dev/null
+++ b/content/media/fmp4/demuxer/aac.h
@@ -0,0 +1,81 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef MEDIA_MP4_AAC_H_
+#define MEDIA_MP4_AAC_H_
+
+#include <vector>
+
+#include "mp4_demuxer/basictypes.h"
+#include "mp4_demuxer/channel_layout.h"
+
+namespace mp4_demuxer {
+
+class BitReader;
+
+// This class parses the AAC information from decoder specific information
+// embedded in the esds box in an ISO BMFF file.
+// Please refer to ISO 14496 Part 3 Table 1.13 - Syntax of AudioSpecificConfig
+// for more details.
+class AAC {
+ public:
+  AAC();
+  ~AAC();
+
+  // Parse the AAC config from the raw binary data embedded in esds box.
+  // The function will parse the data and get the ElementaryStreamDescriptor,
+  // then it will parse the ElementaryStreamDescriptor to get audio stream
+  // configurations.
+  bool Parse(const std::vector<uint8_t>& data);
+
+  // Gets the output sample rate for the AAC stream.
+  // |sbr_in_mimetype| should be set to true if the SBR mode is
+  // signalled in the mimetype. (ie mp4a.40.5 in the codecs parameter).
+  // Returns the samples_per_second value that should used in an
+  // AudioDecoderConfig.
+  int GetOutputSamplesPerSecond(bool sbr_in_mimetype) const;
+
+  // Gets the channel layout for the AAC stream.
+  // |sbr_in_mimetype| should be set to true if the SBR mode is
+  // signalled in the mimetype. (ie mp4a.40.5 in the codecs parameter).
+  // Returns the channel_layout value that should used in an
+  // AudioDecoderConfig.
+  ChannelLayout GetChannelLayout(bool sbr_in_mimetype) const;
+
+  // This function converts a raw AAC frame into an AAC frame with an ADTS
+  // header. On success, the function returns true and stores the converted data
+  // in the buffer. The function returns false on failure and leaves the buffer
+  // unchanged.
+  bool ConvertEsdsToADTS(std::vector<uint8_t>* buffer) const;
+
+  // Size in bytes of the ADTS header added by ConvertEsdsToADTS().
+  static const size_t kADTSHeaderSize = 7;
+
+  const std::vector<uint8_t>& AudioSpecificConfig() const;
+
+ private:
+  bool SkipDecoderGASpecificConfig(BitReader* bit_reader) const;
+  bool SkipErrorSpecificConfig() const;
+  bool SkipGASpecificConfig(BitReader* bit_reader) const;
+
+  // The following variables store the AAC specific configuration information
+  // that are used to generate the ADTS header.
+  uint8_t profile_;
+  uint8_t frequency_index_;
+  uint8_t channel_config_;
+
+  // The following variables store audio configuration information that
+  // can be used by Chromium. They are based on the AAC specific
+  // configuration but can be overridden by extensions in elementary
+  // stream descriptor.
+  int frequency_;
+  int extension_frequency_;
+  ChannelLayout channel_layout_;
+
+  std::vector<uint8_t> audio_specific_config_;
+};
+
+}  // namespace mp4_demuxer
+
+#endif  // MEDIA_MP4_AAC_H_
diff --git a/content/media/fmp4/demuxer/audio_decoder_config.cc b/content/media/fmp4/demuxer/audio_decoder_config.cc
new file mode 100644
index 000000000000..f73b23e8bedc
--- /dev/null
+++ b/content/media/fmp4/demuxer/audio_decoder_config.cc
@@ -0,0 +1,108 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "mp4_demuxer/audio_decoder_config.h"
+
+#include <sstream>
+
+namespace mp4_demuxer {
+
+static int SampleFormatToBitsPerChannel(SampleFormat sample_format) {
+  switch (sample_format) {
+    case kUnknownSampleFormat:
+      return 0;
+    case kSampleFormatU8:
+      return 8;
+    case kSampleFormatS16:
+    case kSampleFormatPlanarS16:
+      return 16;
+    case kSampleFormatS32:
+    case kSampleFormatF32:
+    case kSampleFormatPlanarF32:
+      return 32;
+    case kSampleFormatMax:
+      break;
+  }
+
+  //NOTREACHED() << "Invalid sample format provided: " << sample_format;
+  return 0;
+}
+
+AudioDecoderConfig::AudioDecoderConfig()
+    : codec_(kUnknownAudioCodec),
+      sample_format_(kUnknownSampleFormat),
+      bits_per_channel_(0),
+      channel_layout_(CHANNEL_LAYOUT_UNSUPPORTED),
+      samples_per_second_(0),
+      bytes_per_frame_(0),
+      is_encrypted_(false) {
+}
+
+AudioDecoderConfig::AudioDecoderConfig(AudioCodec codec,
+                                       SampleFormat sample_format,
+                                       ChannelLayout channel_layout,
+                                       int samples_per_second,
+                                       const uint8_t* extra_data,
+                                       size_t extra_data_size,
+                                       bool is_encrypted) {
+  Initialize(codec, sample_format, channel_layout, samples_per_second,
+             extra_data, extra_data_size, is_encrypted);
+}
+
+void AudioDecoderConfig::Initialize(AudioCodec codec,
+                                    SampleFormat sample_format,
+                                    ChannelLayout channel_layout,
+                                    int samples_per_second,
+                                    const uint8_t* extra_data,
+                                    size_t extra_data_size,
+                                    bool is_encrypted) {
+  CHECK((extra_data_size != 0) == (extra_data != NULL));
+
+  codec_ = codec;
+  channel_layout_ = channel_layout;
+  samples_per_second_ = samples_per_second;
+  sample_format_ = sample_format;
+  bits_per_channel_ = SampleFormatToBitsPerChannel(sample_format);
+  extra_data_.assign(extra_data, extra_data + extra_data_size);
+  is_encrypted_ = is_encrypted;
+
+  int channels = ChannelLayoutToChannelCount(channel_layout_);
+  bytes_per_frame_ = channels * bits_per_channel_ / 8;
+}
+
+AudioDecoderConfig::~AudioDecoderConfig() {}
+
+bool AudioDecoderConfig::IsValidConfig() const {
+  return codec_ != kUnknownAudioCodec &&
+         channel_layout_ != CHANNEL_LAYOUT_UNSUPPORTED &&
+         bits_per_channel_ > 0 &&
+         bits_per_channel_ <= kMaxBitsPerSample &&
+         samples_per_second_ > 0 &&
+         samples_per_second_ <= kMaxSampleRate &&
+         sample_format_ != kUnknownSampleFormat;
+}
+
+bool AudioDecoderConfig::Matches(const AudioDecoderConfig& config) const {
+  return ((codec() == config.codec()) &&
+          (bits_per_channel() == config.bits_per_channel()) &&
+          (channel_layout() == config.channel_layout()) &&
+          (samples_per_second() == config.samples_per_second()) &&
+          (extra_data_size() == config.extra_data_size()) &&
+          (!extra_data() || !memcmp(extra_data(), config.extra_data(),
+                                    extra_data_size())) &&
+          (is_encrypted() == config.is_encrypted()) &&
+          (sample_format() == config.sample_format()));
+}
+
+std::string AudioDecoderConfig::AsHumanReadableString() const {
+  std::ostringstream s;
+  s << "codec: " << codec()
+    << " bits/channel: " << bits_per_channel()
+    << " samples/s: " << samples_per_second()
+    << " has extra data? " << (extra_data() ? "true" : "false")
+    << " encrypted? " << (is_encrypted() ? "true" : "false");
+  return s.str();
+}
+
+}  // namespace mp4_demuxer
diff --git a/content/media/fmp4/demuxer/audio_decoder_config.h b/content/media/fmp4/demuxer/audio_decoder_config.h
new file mode 100644
index 000000000000..8318ecf899a3
--- /dev/null
+++ b/content/media/fmp4/demuxer/audio_decoder_config.h
@@ -0,0 +1,127 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef MEDIA_BASE_AUDIO_DECODER_CONFIG_H_
+#define MEDIA_BASE_AUDIO_DECODER_CONFIG_H_
+
+#include <vector>
+
+#include "mp4_demuxer/basictypes.h"
+#include "mp4_demuxer/channel_layout.h"
+
+namespace mp4_demuxer {
+
+enum AudioCodec {
+  // These values are histogrammed over time; do not change their ordinal
+  // values.  When deleting a codec replace it with a dummy value; when adding a
+  // codec, do so at the bottom before kAudioCodecMax.
+  kUnknownAudioCodec = 0,
+  kCodecAAC,
+  kCodecMP3,
+  kCodecPCM,
+  kCodecVorbis,
+  kCodecFLAC,
+  kCodecAMR_NB,
+  kCodecAMR_WB,
+  kCodecPCM_MULAW,
+  kCodecGSM_MS,
+  kCodecPCM_S16BE,
+  kCodecPCM_S24BE,
+  kCodecOpus,
+  // DO NOT ADD RANDOM AUDIO CODECS!
+  //
+  // The only acceptable time to add a new codec is if there is production code
+  // that uses said codec in the same CL.
+
+  // Must always be last!
+  kAudioCodecMax
+};
+
+enum SampleFormat {
+  // These values are histogrammed over time; do not change their ordinal
+  // values.  When deleting a sample format replace it with a dummy value; when
+  // adding a sample format, do so at the bottom before kSampleFormatMax.
+  kUnknownSampleFormat = 0,
+  kSampleFormatU8,         // Unsigned 8-bit w/ bias of 128.
+  kSampleFormatS16,        // Signed 16-bit.
+  kSampleFormatS32,        // Signed 32-bit.
+  kSampleFormatF32,        // Float 32-bit.
+  kSampleFormatPlanarS16,  // Signed 16-bit planar.
+  kSampleFormatPlanarF32,  // Float 32-bit planar.
+
+  // Must always be last!
+  kSampleFormatMax
+};
+
+// TODO(dalecurtis): FFmpeg API uses |bytes_per_channel| instead of
+// |bits_per_channel|, we should switch over since bits are generally confusing
+// to work with.
+class AudioDecoderConfig {
+ public:
+  // Constructs an uninitialized object. Clients should call Initialize() with
+  // appropriate values before using.
+  AudioDecoderConfig();
+
+  // Constructs an initialized object. It is acceptable to pass in NULL for
+  // |extra_data|, otherwise the memory is copied.
+  AudioDecoderConfig(AudioCodec codec, SampleFormat sample_format,
+                     ChannelLayout channel_layout, int samples_per_second,
+                     const uint8_t* extra_data, size_t extra_data_size,
+                     bool is_encrypted);
+
+  ~AudioDecoderConfig();
+
+  // Resets the internal state of this object.
+  void Initialize(AudioCodec codec, SampleFormat sample_format,
+                  ChannelLayout channel_layout, int samples_per_second,
+                  const uint8_t* extra_data, size_t extra_data_size,
+                  bool is_encrypted);
+
+  // Returns true if this object has appropriate configuration values, false
+  // otherwise.
+  bool IsValidConfig() const;
+
+  // Returns true if all fields in |config| match this config.
+  // Note: The contents of |extra_data_| are compared not the raw pointers.
+  bool Matches(const AudioDecoderConfig& config) const;
+
+  AudioCodec codec() const { return codec_; }
+  int bits_per_channel() const { return bits_per_channel_; }
+  ChannelLayout channel_layout() const { return channel_layout_; }
+  int samples_per_second() const { return samples_per_second_; }
+  SampleFormat sample_format() const { return sample_format_; }
+  int bytes_per_frame() const { return bytes_per_frame_; }
+
+  // Optional byte data required to initialize audio decoders such as Vorbis
+  // codebooks.
+  const uint8_t* extra_data() const {
+    return extra_data_.empty() ? NULL : &extra_data_[0];
+  }
+  size_t extra_data_size() const { return extra_data_.size(); }
+
+  // Whether the audio stream is potentially encrypted.
+  // Note that in a potentially encrypted audio stream, individual buffers
+  // can be encrypted or not encrypted.
+  bool is_encrypted() const { return is_encrypted_; }
+
+  std::string AsHumanReadableString() const;
+
+ private:
+  AudioCodec codec_;
+  SampleFormat sample_format_;
+  int bits_per_channel_;
+  ChannelLayout channel_layout_;
+  int samples_per_second_;
+  int bytes_per_frame_;
+  std::vector<uint8_t> extra_data_;
+  bool is_encrypted_;
+
+  // Not using DISALLOW_COPY_AND_ASSIGN here intentionally to allow the compiler
+  // generated copy constructor and assignment operator. Since the extra data is
+  // typically small, the performance impact is minimal.
+};
+
+}  // namespace mp4_demuxer
+
+#endif  // MEDIA_BASE_AUDIO_DECODER_CONFIG_H_
diff --git a/content/media/fmp4/demuxer/avc.cc b/content/media/fmp4/demuxer/avc.cc
new file mode 100644
index 000000000000..d03790860860
--- /dev/null
+++ b/content/media/fmp4/demuxer/avc.cc
@@ -0,0 +1,89 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "mp4_demuxer/avc.h"
+
+#include <algorithm>
+#include <vector>
+
+#include "mp4_demuxer/box_definitions.h"
+#include "mp4_demuxer/box_reader.h"
+
+namespace mp4_demuxer {
+
+static const uint8_t kAnnexBStartCode[] = {0, 0, 0, 1};
+static const int kAnnexBStartCodeSize = 4;
+
+static bool ConvertAVCToAnnexBInPlaceForLengthSize4(std::vector<uint8_t>* buf) {
+  const int kLengthSize = 4;
+  size_t pos = 0;
+  while (pos + kLengthSize < buf->size()) {
+    int nal_size = (*buf)[pos];
+    nal_size = (nal_size << 8) + (*buf)[pos+1];
+    nal_size = (nal_size << 8) + (*buf)[pos+2];
+    nal_size = (nal_size << 8) + (*buf)[pos+3];
+    std::copy(kAnnexBStartCode, kAnnexBStartCode + kAnnexBStartCodeSize,
+              buf->begin() + pos);
+    pos += kLengthSize + nal_size;
+  }
+  return pos == buf->size();
+}
+
+// static
+bool AVC::ConvertFrameToAnnexB(int length_size, std::vector<uint8_t>* buffer) {
+  RCHECK(length_size == 1 || length_size == 2 || length_size == 4);
+
+  if (length_size == 4)
+    return ConvertAVCToAnnexBInPlaceForLengthSize4(buffer);
+
+  std::vector<uint8_t> temp;
+  temp.swap(*buffer);
+  buffer->reserve(temp.size() + 32);
+
+  size_t pos = 0;
+  while (pos + length_size < temp.size()) {
+    int nal_size = temp[pos];
+    if (length_size == 2) nal_size = (nal_size << 8) + temp[pos+1];
+    pos += length_size;
+
+    RCHECK(pos + nal_size <= temp.size());
+    buffer->insert(buffer->end(), kAnnexBStartCode,
+                   kAnnexBStartCode + kAnnexBStartCodeSize);
+    buffer->insert(buffer->end(), temp.begin() + pos,
+                   temp.begin() + pos + nal_size);
+    pos += nal_size;
+  }
+  return pos == temp.size();
+}
+
+// static
+bool AVC::ConvertConfigToAnnexB(
+    const AVCDecoderConfigurationRecord& avc_config,
+    std::vector<uint8_t>* buffer) {
+  DCHECK(buffer->empty());
+  buffer->clear();
+  int total_size = 0;
+  for (size_t i = 0; i < avc_config.sps_list.size(); i++)
+    total_size += avc_config.sps_list[i].size() + kAnnexBStartCodeSize;
+  for (size_t i = 0; i < avc_config.pps_list.size(); i++)
+    total_size += avc_config.pps_list[i].size() + kAnnexBStartCodeSize;
+  buffer->reserve(total_size);
+
+  for (size_t i = 0; i < avc_config.sps_list.size(); i++) {
+    buffer->insert(buffer->end(), kAnnexBStartCode,
+                kAnnexBStartCode + kAnnexBStartCodeSize);
+    buffer->insert(buffer->end(), avc_config.sps_list[i].begin(),
+                avc_config.sps_list[i].end());
+  }
+
+  for (size_t i = 0; i < avc_config.pps_list.size(); i++) {
+    buffer->insert(buffer->end(), kAnnexBStartCode,
+                   kAnnexBStartCode + kAnnexBStartCodeSize);
+    buffer->insert(buffer->end(), avc_config.pps_list[i].begin(),
+                   avc_config.pps_list[i].end());
+  }
+  return true;
+}
+
+}  // namespace mp4_demuxer
diff --git a/content/media/fmp4/demuxer/avc.h b/content/media/fmp4/demuxer/avc.h
new file mode 100644
index 000000000000..150a4e10975d
--- /dev/null
+++ b/content/media/fmp4/demuxer/avc.h
@@ -0,0 +1,27 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef MEDIA_MP4_AVC_H_
+#define MEDIA_MP4_AVC_H_
+
+#include <vector>
+
+#include "mp4_demuxer/basictypes.h"
+
+namespace mp4_demuxer {
+
+struct AVCDecoderConfigurationRecord;
+
+class AVC {
+ public:
+  static bool ConvertFrameToAnnexB(int length_size, std::vector<uint8_t>* buffer);
+
+  static bool ConvertConfigToAnnexB(
+      const AVCDecoderConfigurationRecord& avc_config,
+      std::vector<uint8_t>* buffer);
+};
+
+}  // namespace mp4_demuxer
+
+#endif  // MEDIA_MP4_AVC_H_
diff --git a/content/media/fmp4/demuxer/basictypes.h b/content/media/fmp4/demuxer/basictypes.h
new file mode 100644
index 000000000000..00b463507bc4
--- /dev/null
+++ b/content/media/fmp4/demuxer/basictypes.h
@@ -0,0 +1,175 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef MEDIA_MP4_BASIC_TYPES_H_
+#define MEDIA_MP4_BASIC_TYPES_H_
+
+#include <iostream>
+#include <stdint.h>
+#include "prlog.h"
+
+#ifdef PR_LOGGING
+PRLogModuleInfo* GetDemuxerLog();
+#endif
+
+namespace mp4_demuxer {
+
+// Define to enable logging.
+//#define LOG_DEMUXER
+
+#define kint32max std::numeric_limits<int32_t>::max()
+#define kuint64max std::numeric_limits<uint64_t>::max()
+#define kint64max std::numeric_limits<int64_t>::max()
+
+
+
+#define OVERRIDE override
+#define WARN_UNUSED_RESULT
+
+#define DCHECK(condition) \
+{ \
+  if (!(condition)) {\
+    DMX_LOG("DCHECK Failed (%s) %s:%d\n", #condition, __FILE__, __LINE__); \
+  } \
+}
+
+#define CHECK(condition) { \
+  if (!(condition)) {\
+    DMX_LOG("CHECK Failed %s %s:%d\n", #condition, __FILE__, __LINE__); \
+  } \
+}
+
+#define DCHECK_LE(variable, value) DCHECK(variable <= value)
+#define DCHECK_LT(variable, value) DCHECK(variable < value)
+#define DCHECK_EQ(variable, value) DCHECK(variable == value)
+#define DCHECK_GT(variable, value) DCHECK(variable > value)
+#define DCHECK_GE(variable, value) DCHECK(variable >= value)
+
+#define RCHECK(x) \
+    do { \
+      if (!(x)) { \
+        DMX_LOG("Failure while parsing MP4: %s %s:%d\n", #x, __FILE__, __LINE__); \
+        return false; \
+      } \
+    } while (0)
+
+#define arraysize(f) (sizeof(f) / sizeof(*f))
+
+#ifdef LOG_DEMUXER
+#ifdef PR_LOGGING
+#define DMX_LOG(...) PR_LOG(GetDemuxerLog(), PR_LOG_DEBUG, (__VA_ARGS__))
+#else
+#define DMX_LOG(...) 0
+#endif
+#else
+// define DMX_LOG as 0, so that if(condition){DMX_LOG(...)} branches don't elicit
+// a warning-as-error.
+#define DMX_LOG(...) 0
+#endif
+
+// A macro to disallow the evil copy constructor and operator= functions
+// This should be used in the private: declarations for a class
+#define DISALLOW_COPY_AND_ASSIGN(TypeName)  \
+  TypeName(const TypeName&);      \
+  void operator=(const TypeName&)
+
+typedef int64_t Microseconds;
+typedef int64_t Milliseconds;
+
+#define MicrosecondsPerSecond (int64_t(1000000))
+#define InfiniteMicroseconds (int64_t(-1))
+#define InfiniteMilliseconds (int64_t(-1))
+
+inline Microseconds MicrosecondsFromRational(int64_t numer, int64_t denom) {
+  DCHECK_LT((numer > 0 ? numer : -numer),
+            kint64max / MicrosecondsPerSecond);
+  return MicrosecondsPerSecond * numer / denom;
+}
+
+inline Milliseconds ToMilliseconds(Microseconds us) {
+  return (us == InfiniteMicroseconds) ? InfiniteMilliseconds : us / 1000;
+}
+
+class IntSize {
+public:
+  IntSize() : w_(0), h_(0) {}
+  IntSize(const IntSize& i) : w_(i.w_), h_(i.h_) {}
+  IntSize(int32_t w, int32_t h) : w_(w), h_(h) {}
+  ~IntSize() {};
+  int32_t width() const { return w_; }
+  int32_t height() const { return h_; }
+  int32_t GetArea() const { return w_ * h_; }
+  bool IsEmpty() const { return (w_ == 0) || (h_ == 0); }
+private:
+  int32_t w_;
+  int32_t h_;
+};
+
+inline bool operator==(const IntSize& lhs, const IntSize& rhs) {
+  return lhs.width() == rhs.width() &&
+         lhs.height() == rhs.height();
+}
+
+class IntRect {
+public:
+  IntRect() : x_(0), y_(0), w_(0), h_(0) {}
+  IntRect(const IntRect& i) : x_(i.x_), y_(i.y_), w_(i.w_), h_(i.h_) {}
+  IntRect(int32_t x, int32_t y, int32_t w, int32_t h) : x_(x), y_(y), w_(w), h_(h) {}
+  ~IntRect() {};
+  IntSize size() const { return IntSize(w_, h_); }
+  int32_t x() const { return x_; }
+  int32_t y() const { return y_; }
+  int32_t width() const { return w_; }
+  int32_t height() const { return h_; }
+  int32_t GetArea() const { return w_ * h_; }
+  bool IsEmpty() const { return (w_ == 0) || (h_ == 0); }
+  int32_t right() const { return x() + width(); }
+  int32_t bottom() const { return y() + height(); }
+private:
+  int32_t x_;
+  int32_t y_;
+  int32_t w_;
+  int32_t h_;
+};
+
+inline bool operator==(const IntRect& lhs, const IntRect& rhs) {
+  return lhs.x() == rhs.x() &&
+         lhs.y() == rhs.y() &&
+         lhs.width() == rhs.width() &&
+         lhs.height() == rhs.height();
+}
+
+enum {
+  // Maximum possible dimension (width or height) for any video.
+  kMaxDimension = (1 << 15) - 1,  // 32767
+
+  // Maximum possible canvas size (width multiplied by height) for any video.
+  kMaxCanvas = (1 << (14 * 2)),  // 16384 x 16384
+
+  // Total number of video frames which are populating in the pipeline.
+  kMaxVideoFrames = 4,
+
+  // The following limits are used by AudioParameters::IsValid().
+  //
+  // A few notes on sample rates of common formats:
+  //   - AAC files are limited to 96 kHz.
+  //   - MP3 files are limited to 48 kHz.
+  //   - Vorbis used to be limited to 96 KHz, but no longer has that
+  //     restriction.
+  //   - Most PC audio hardware is limited to 192 KHz.
+  kMaxSampleRate = 192000,
+  kMinSampleRate = 3000,
+  kMaxChannels = 32,
+  kMaxBitsPerSample = 32,
+  kMaxSamplesPerPacket = kMaxSampleRate,
+  kMaxPacketSizeInBytes =
+      (kMaxBitsPerSample / 8) * kMaxChannels * kMaxSamplesPerPacket,
+
+  // This limit is used by ParamTraits<VideoCaptureParams>.
+  kMaxFramesPerSecond = 1000,
+};
+
+}  // namespace mp4_demuxer
+
+#endif // MEDIA_MP4_BASIC_TYPES_H_
diff --git a/content/media/fmp4/demuxer/bit_reader.cc b/content/media/fmp4/demuxer/bit_reader.cc
new file mode 100644
index 000000000000..3677021a589e
--- /dev/null
+++ b/content/media/fmp4/demuxer/bit_reader.cc
@@ -0,0 +1,56 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "mp4_demuxer/bit_reader.h"
+
+namespace mp4_demuxer {
+
+BitReader::BitReader(const uint8_t* data, off_t size)
+    : data_(data), bytes_left_(size), num_remaining_bits_in_curr_byte_(0) {
+  DCHECK(data_ != nullptr && bytes_left_ > 0);
+
+  UpdateCurrByte();
+}
+
+BitReader::~BitReader() {}
+
+int BitReader::bits_available() const {
+  return 8 * bytes_left_ + num_remaining_bits_in_curr_byte_;
+}
+
+bool BitReader::ReadBitsInternal(int num_bits, uint64_t* out) {
+  DCHECK_LE(num_bits, 64);
+
+  *out = 0;
+
+  while (num_remaining_bits_in_curr_byte_ != 0 && num_bits != 0) {
+    int bits_to_take = std::min(num_remaining_bits_in_curr_byte_, num_bits);
+
+    *out <<= bits_to_take;
+    *out += curr_byte_ >> (num_remaining_bits_in_curr_byte_ - bits_to_take);
+    num_bits -= bits_to_take;
+    num_remaining_bits_in_curr_byte_ -= bits_to_take;
+    curr_byte_ &= (1 << num_remaining_bits_in_curr_byte_) - 1;
+
+    if (num_remaining_bits_in_curr_byte_ == 0)
+      UpdateCurrByte();
+  }
+
+  return num_bits == 0;
+}
+
+void BitReader::UpdateCurrByte() {
+  DCHECK_EQ(num_remaining_bits_in_curr_byte_, 0);
+
+  if (bytes_left_ == 0)
+    return;
+
+  // Load a new byte and advance pointers.
+  curr_byte_ = *data_;
+  ++data_;
+  --bytes_left_;
+  num_remaining_bits_in_curr_byte_ = 8;
+}
+
+}  // namespace mp4_demuxer
diff --git a/content/media/fmp4/demuxer/bit_reader.h b/content/media/fmp4/demuxer/bit_reader.h
new file mode 100644
index 000000000000..0657c25397df
--- /dev/null
+++ b/content/media/fmp4/demuxer/bit_reader.h
@@ -0,0 +1,69 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef MEDIA_BASE_BIT_READER_H_
+#define MEDIA_BASE_BIT_READER_H_
+
+#include <sys/types.h>
+
+#include "mp4_demuxer/basictypes.h"
+
+namespace mp4_demuxer {
+
+// A class to read bit streams.
+class BitReader {
+ public:
+  // Initialize the reader to start reading at |data|, |size| being size
+  // of |data| in bytes.
+  BitReader(const uint8_t* data, off_t size);
+  ~BitReader();
+
+  // Read |num_bits| next bits from stream and return in |*out|, first bit
+  // from the stream starting at |num_bits| position in |*out|.
+  // |num_bits| cannot be larger than the bits the type can hold.
+  // Return false if the given number of bits cannot be read (not enough
+  // bits in the stream), true otherwise. When return false, the stream will
+  // enter a state where further ReadBits/SkipBits operations will always
+  // return false unless |num_bits| is 0. The type |T| has to be a primitive
+  // integer type.
+  template<typename T> bool ReadBits(int num_bits, T *out) {
+    DCHECK_LE(num_bits, static_cast<int>(sizeof(T) * 8));
+    uint64_t temp;
+    bool ret = ReadBitsInternal(num_bits, &temp);
+    *out = static_cast<T>(temp);
+    return ret;
+  }
+
+  // Returns the number of bits available for reading.
+  int bits_available() const;
+
+ private:
+  // Help function used by ReadBits to avoid inlining the bit reading logic.
+  bool ReadBitsInternal(int num_bits, uint64_t* out);
+
+  // Advance to the next byte, loading it into curr_byte_.
+  // If the num_remaining_bits_in_curr_byte_ is 0 after this function returns,
+  // the stream has reached the end.
+  void UpdateCurrByte();
+
+  // Pointer to the next unread (not in curr_byte_) byte in the stream.
+  const uint8_t* data_;
+
+  // Bytes left in the stream (without the curr_byte_).
+  off_t bytes_left_;
+
+  // Contents of the current byte; first unread bit starting at position
+  // 8 - num_remaining_bits_in_curr_byte_ from MSB.
+  uint8_t curr_byte_;
+
+  // Number of bits remaining in curr_byte_
+  int num_remaining_bits_in_curr_byte_;
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(BitReader);
+};
+
+}  // namespace mp4_demuxer
+
+#endif  // MEDIA_BASE_BIT_READER_H_
diff --git a/content/media/fmp4/demuxer/box_definitions.cc b/content/media/fmp4/demuxer/box_definitions.cc
new file mode 100644
index 000000000000..7dfb53fced65
--- /dev/null
+++ b/content/media/fmp4/demuxer/box_definitions.cc
@@ -0,0 +1,754 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "mp4_demuxer/box_definitions.h"
+#include "mp4_demuxer/es_descriptor.h"
+
+#include <iostream>
+
+namespace mp4_demuxer {
+
+FileType::FileType() {}
+FileType::~FileType() {}
+FourCC FileType::BoxType() const { return FOURCC_FTYP; }
+
+bool FileType::Parse(BoxReader* reader) {
+  RCHECK(reader->ReadFourCC(&major_brand) && reader->Read4(&minor_version));
+  size_t num_brands = (reader->size() - reader->pos()) / sizeof(FourCC);
+  return reader->SkipBytes(sizeof(FourCC) * num_brands);  // compatible_brands
+}
+
+ProtectionSystemSpecificHeader::ProtectionSystemSpecificHeader() {}
+ProtectionSystemSpecificHeader::~ProtectionSystemSpecificHeader() {}
+FourCC ProtectionSystemSpecificHeader::BoxType() const { return FOURCC_PSSH; }
+
+bool ProtectionSystemSpecificHeader::Parse(BoxReader* reader) {
+  // Validate the box's contents and hang on to the system ID.
+  uint32_t size;
+  RCHECK(reader->ReadFullBoxHeader() &&
+         reader->ReadVec(&system_id, 16) &&
+         reader->Read4(&size) &&
+         reader->HasBytes(size));
+
+  // Copy the entire box, including the header, for passing to EME as initData.
+  DCHECK(raw_box.empty());
+  reader->ReadVec(&raw_box, size);
+  //raw_box.assign(reader->data(), reader->data() + size);
+  return true;
+}
+
+SampleAuxiliaryInformationOffset::SampleAuxiliaryInformationOffset() {}
+SampleAuxiliaryInformationOffset::~SampleAuxiliaryInformationOffset() {}
+FourCC SampleAuxiliaryInformationOffset::BoxType() const { return FOURCC_SAIO; }
+
+bool SampleAuxiliaryInformationOffset::Parse(BoxReader* reader) {
+  RCHECK(reader->ReadFullBoxHeader());
+  if (reader->flags() & 1)
+    RCHECK(reader->SkipBytes(8));
+
+  uint32_t count;
+  RCHECK(reader->Read4(&count) &&
+         reader->HasBytes(count * (reader->version() == 1 ? 8 : 4)));
+  offsets.resize(count);
+
+  for (uint32_t i = 0; i < count; i++) {
+    if (reader->version() == 1) {
+      RCHECK(reader->Read8(&offsets[i]));
+    } else {
+      RCHECK(reader->Read4Into8(&offsets[i]));
+    }
+  }
+  return true;
+}
+
+SampleAuxiliaryInformationSize::SampleAuxiliaryInformationSize()
+  : default_sample_info_size(0), sample_count(0) {
+}
+SampleAuxiliaryInformationSize::~SampleAuxiliaryInformationSize() {}
+FourCC SampleAuxiliaryInformationSize::BoxType() const { return FOURCC_SAIZ; }
+
+bool SampleAuxiliaryInformationSize::Parse(BoxReader* reader) {
+  RCHECK(reader->ReadFullBoxHeader());
+  if (reader->flags() & 1)
+    RCHECK(reader->SkipBytes(8));
+
+  RCHECK(reader->Read1(&default_sample_info_size) &&
+         reader->Read4(&sample_count));
+  if (default_sample_info_size == 0)
+    return reader->ReadVec(&sample_info_sizes, sample_count);
+  return true;
+}
+
+OriginalFormat::OriginalFormat() : format(FOURCC_NULL) {}
+OriginalFormat::~OriginalFormat() {}
+FourCC OriginalFormat::BoxType() const { return FOURCC_FRMA; }
+
+bool OriginalFormat::Parse(BoxReader* reader) {
+  return reader->ReadFourCC(&format);
+}
+
+SchemeType::SchemeType() : type(FOURCC_NULL), version(0) {}
+SchemeType::~SchemeType() {}
+FourCC SchemeType::BoxType() const { return FOURCC_SCHM; }
+
+bool SchemeType::Parse(BoxReader* reader) {
+  RCHECK(reader->ReadFullBoxHeader() &&
+         reader->ReadFourCC(&type) &&
+         reader->Read4(&version));
+  return true;
+}
+
+TrackEncryption::TrackEncryption()
+  : is_encrypted(false), default_iv_size(0) {
+}
+TrackEncryption::~TrackEncryption() {}
+FourCC TrackEncryption::BoxType() const { return FOURCC_TENC; }
+
+bool TrackEncryption::Parse(BoxReader* reader) {
+  uint8_t flag;
+  RCHECK(reader->ReadFullBoxHeader() &&
+         reader->SkipBytes(2) &&
+         reader->Read1(&flag) &&
+         reader->Read1(&default_iv_size) &&
+         reader->ReadVec(&default_kid, 16));
+  is_encrypted = (flag != 0);
+  if (is_encrypted) {
+    RCHECK(default_iv_size == 8 || default_iv_size == 16);
+  } else {
+    RCHECK(default_iv_size == 0);
+  }
+  return true;
+}
+
+SchemeInfo::SchemeInfo() {}
+SchemeInfo::~SchemeInfo() {}
+FourCC SchemeInfo::BoxType() const { return FOURCC_SCHI; }
+
+bool SchemeInfo::Parse(BoxReader* reader) {
+  return reader->ScanChildren() && reader->ReadChild(&track_encryption);
+}
+
+ProtectionSchemeInfo::ProtectionSchemeInfo() {}
+ProtectionSchemeInfo::~ProtectionSchemeInfo() {}
+FourCC ProtectionSchemeInfo::BoxType() const { return FOURCC_SINF; }
+
+bool ProtectionSchemeInfo::Parse(BoxReader* reader) {
+  RCHECK(reader->ScanChildren() &&
+         reader->ReadChild(&format) &&
+         reader->ReadChild(&type));
+  if (type.type == FOURCC_CENC)
+    RCHECK(reader->ReadChild(&info));
+  // Other protection schemes are silently ignored. Since the protection scheme
+  // type can't be determined until this box is opened, we return 'true' for
+  // non-CENC protection scheme types. It is the parent box's responsibility to
+  // ensure that this scheme type is a supported one.
+  return true;
+}
+
+MovieHeader::MovieHeader()
+    : creation_time(0),
+      modification_time(0),
+      timescale(0),
+      duration(0),
+      rate(-1),
+      volume(-1),
+      next_track_id(0) {}
+MovieHeader::~MovieHeader() {}
+FourCC MovieHeader::BoxType() const { return FOURCC_MVHD; }
+
+bool MovieHeader::Parse(BoxReader* reader) {
+  RCHECK(reader->ReadFullBoxHeader());
+
+  if (reader->version() == 1) {
+    RCHECK(reader->Read8(&creation_time) &&
+           reader->Read8(&modification_time) &&
+           reader->Read4(&timescale) &&
+           reader->Read8(&duration));
+  } else {
+    RCHECK(reader->Read4Into8(&creation_time) &&
+           reader->Read4Into8(&modification_time) &&
+           reader->Read4(&timescale) &&
+           reader->Read4Into8(&duration));
+  }
+
+  RCHECK(reader->Read4s(&rate) &&
+         reader->Read2s(&volume) &&
+         reader->SkipBytes(10) &&  // reserved
+         reader->SkipBytes(36) &&  // matrix
+         reader->SkipBytes(24) &&  // predefined zero
+         reader->Read4(&next_track_id));
+  return true;
+}
+
+TrackHeader::TrackHeader()
+    : creation_time(0),
+      modification_time(0),
+      track_id(0),
+      duration(0),
+      layer(-1),
+      alternate_group(-1),
+      volume(-1),
+      width(0),
+      height(0) {}
+TrackHeader::~TrackHeader() {}
+FourCC TrackHeader::BoxType() const { return FOURCC_TKHD; }
+
+bool TrackHeader::Parse(BoxReader* reader) {
+  RCHECK(reader->ReadFullBoxHeader());
+  if (reader->version() == 1) {
+    RCHECK(reader->Read8(&creation_time) &&
+           reader->Read8(&modification_time) &&
+           reader->Read4(&track_id) &&
+           reader->SkipBytes(4) &&    // reserved
+           reader->Read8(&duration));
+  } else {
+    RCHECK(reader->Read4Into8(&creation_time) &&
+           reader->Read4Into8(&modification_time) &&
+           reader->Read4(&track_id) &&
+           reader->SkipBytes(4) &&   // reserved
+           reader->Read4Into8(&duration));
+  }
+
+  RCHECK(reader->SkipBytes(8) &&  // reserved
+         reader->Read2s(&layer) &&
+         reader->Read2s(&alternate_group) &&
+         reader->Read2s(&volume) &&
+         reader->SkipBytes(2) &&  // reserved
+         reader->SkipBytes(36) &&  // matrix
+         reader->Read4(&width) &&
+         reader->Read4(&height));
+  width >>= 16;
+  height >>= 16;
+  return true;
+}
+
+SampleDescription::SampleDescription() : type(kInvalid) {}
+SampleDescription::~SampleDescription() {}
+FourCC SampleDescription::BoxType() const { return FOURCC_STSD; }
+
+bool SampleDescription::Parse(BoxReader* reader) {
+  uint32_t count;
+  RCHECK(reader->SkipBytes(4) &&
+         reader->Read4(&count));
+  video_entries.clear();
+  audio_entries.clear();
+
+  // Note: this value is preset before scanning begins. See comments in the
+  // Parse(Media*) function.
+  if (type == kVideo) {
+    RCHECK(reader->ReadAllChildren(&video_entries));
+  } else if (type == kAudio) {
+    RCHECK(reader->ReadAllChildren(&audio_entries));
+  }
+  return true;
+}
+
+SampleTable::SampleTable() {}
+SampleTable::~SampleTable() {}
+FourCC SampleTable::BoxType() const { return FOURCC_STBL; }
+
+bool SampleTable::Parse(BoxReader* reader) {
+  return reader->ScanChildren() &&
+         reader->ReadChild(&description);
+}
+
+EditList::EditList() {}
+EditList::~EditList() {}
+FourCC EditList::BoxType() const { return FOURCC_ELST; }
+
+bool EditList::Parse(BoxReader* reader) {
+  uint32_t count;
+  RCHECK(reader->ReadFullBoxHeader() && reader->Read4(&count));
+
+  if (reader->version() == 1) {
+    RCHECK(reader->HasBytes(count * 20));
+  } else {
+    RCHECK(reader->HasBytes(count * 12));
+  }
+  edits.resize(count);
+
+  for (std::vector<EditListEntry>::iterator edit = edits.begin();
+       edit != edits.end(); ++edit) {
+    if (reader->version() == 1) {
+      RCHECK(reader->Read8(&edit->segment_duration) &&
+             reader->Read8s(&edit->media_time));
+    } else {
+      RCHECK(reader->Read4Into8(&edit->segment_duration) &&
+             reader->Read4sInto8s(&edit->media_time));
+    }
+    RCHECK(reader->Read2s(&edit->media_rate_integer) &&
+           reader->Read2s(&edit->media_rate_fraction));
+  }
+  return true;
+}
+
+Edit::Edit() {}
+Edit::~Edit() {}
+FourCC Edit::BoxType() const { return FOURCC_EDTS; }
+
+bool Edit::Parse(BoxReader* reader) {
+  return reader->ScanChildren() && reader->ReadChild(&list);
+}
+
+HandlerReference::HandlerReference() : type(kInvalid) {}
+HandlerReference::~HandlerReference() {}
+FourCC HandlerReference::BoxType() const { return FOURCC_HDLR; }
+
+bool HandlerReference::Parse(BoxReader* reader) {
+  FourCC hdlr_type;
+  RCHECK(reader->SkipBytes(8) && reader->ReadFourCC(&hdlr_type));
+  // Note: remaining fields in box ignored
+  if (hdlr_type == FOURCC_VIDE) {
+    type = kVideo;
+  } else if (hdlr_type == FOURCC_SOUN) {
+    type = kAudio;
+  } else {
+    type = kInvalid;
+  }
+  return true;
+}
+
+AVCDecoderConfigurationRecord::AVCDecoderConfigurationRecord()
+    : version(0),
+      profile_indication(0),
+      profile_compatibility(0),
+      avc_level(0),
+      length_size(0) {}
+
+AVCDecoderConfigurationRecord::~AVCDecoderConfigurationRecord() {}
+FourCC AVCDecoderConfigurationRecord::BoxType() const { return FOURCC_AVCC; }
+
+bool AVCDecoderConfigurationRecord::Parse(BoxReader* reader) {
+  RCHECK(reader->Read1(&version) && version == 1 &&
+         reader->Read1(&profile_indication) &&
+         reader->Read1(&profile_compatibility) &&
+         reader->Read1(&avc_level));
+
+  uint8_t length_size_minus_one;
+  RCHECK(reader->Read1(&length_size_minus_one) &&
+         (length_size_minus_one & 0xfc) == 0xfc);
+  length_size = (length_size_minus_one & 0x3) + 1;
+
+  uint8_t num_sps;
+  RCHECK(reader->Read1(&num_sps) && (num_sps & 0xe0) == 0xe0);
+  num_sps &= 0x1f;
+
+  sps_list.resize(num_sps);
+  for (int i = 0; i < num_sps; i++) {
+    uint16_t sps_length;
+    RCHECK(reader->Read2(&sps_length) &&
+           reader->ReadVec(&sps_list[i], sps_length));
+  }
+
+  uint8_t num_pps;
+  RCHECK(reader->Read1(&num_pps));
+
+  pps_list.resize(num_pps);
+  for (int i = 0; i < num_pps; i++) {
+    uint16_t pps_length;
+    RCHECK(reader->Read2(&pps_length) &&
+           reader->ReadVec(&pps_list[i], pps_length));
+  }
+
+  return true;
+}
+
+PixelAspectRatioBox::PixelAspectRatioBox() : h_spacing(1), v_spacing(1) {}
+PixelAspectRatioBox::~PixelAspectRatioBox() {}
+FourCC PixelAspectRatioBox::BoxType() const { return FOURCC_PASP; }
+
+bool PixelAspectRatioBox::Parse(BoxReader* reader) {
+  RCHECK(reader->Read4(&h_spacing) &&
+         reader->Read4(&v_spacing));
+  return true;
+}
+
+VideoSampleEntry::VideoSampleEntry()
+    : format(FOURCC_NULL),
+      data_reference_index(0),
+      width(0),
+      height(0) {}
+
+VideoSampleEntry::~VideoSampleEntry() {}
+FourCC VideoSampleEntry::BoxType() const {
+  DMX_LOG("VideoSampleEntry should be parsed according to the "
+      "handler type recovered in its Media ancestor.\n");
+  return FOURCC_NULL;
+}
+
+bool VideoSampleEntry::Parse(BoxReader* reader) {
+  format = reader->type();
+  RCHECK(reader->SkipBytes(6) &&
+         reader->Read2(&data_reference_index) &&
+         reader->SkipBytes(16) &&
+         reader->Read2(&width) &&
+         reader->Read2(&height) &&
+         reader->SkipBytes(50));
+
+  RCHECK(reader->ScanChildren() &&
+         reader->MaybeReadChild(&pixel_aspect));
+
+  if (format == FOURCC_ENCV) {
+    // Continue scanning until a recognized protection scheme is found, or until
+    // we run out of protection schemes.
+    while (sinf.type.type != FOURCC_CENC) {
+      if (!reader->ReadChild(&sinf))
+        return false;
+    }
+  }
+
+  if (format == FOURCC_AVC1 ||
+      (format == FOURCC_ENCV && sinf.format.format == FOURCC_AVC1)) {
+    RCHECK(reader->ReadChild(&avcc));
+  }
+  return true;
+}
+
+ElementaryStreamDescriptor::ElementaryStreamDescriptor()
+    : object_type(kForbidden) {}
+
+ElementaryStreamDescriptor::~ElementaryStreamDescriptor() {}
+
+FourCC ElementaryStreamDescriptor::BoxType() const {
+  return FOURCC_ESDS;
+}
+
+bool ElementaryStreamDescriptor::Parse(BoxReader* reader) {
+  std::vector<uint8_t> data;
+  ESDescriptor es_desc;
+
+  RCHECK(reader->ReadFullBoxHeader());
+  RCHECK(reader->ReadVec(&data, reader->size() - reader->pos()));
+  RCHECK(es_desc.Parse(data));
+
+  object_type = es_desc.object_type();
+
+  RCHECK(aac.Parse(es_desc.decoder_specific_info()));
+
+  return true;
+}
+
+AudioSampleEntry::AudioSampleEntry()
+    : format(FOURCC_NULL),
+      data_reference_index(0),
+      channelcount(0),
+      samplesize(0),
+      samplerate(0) {}
+
+AudioSampleEntry::~AudioSampleEntry() {}
+
+FourCC AudioSampleEntry::BoxType() const {
+  DMX_LOG("AudioSampleEntry should be parsed according to the "
+      "handler type recovered in its Media ancestor.\n");
+  return FOURCC_NULL;
+}
+
+bool AudioSampleEntry::Parse(BoxReader* reader) {
+  format = reader->type();
+  RCHECK(reader->SkipBytes(6) &&
+         reader->Read2(&data_reference_index) &&
+         reader->SkipBytes(8) &&
+         reader->Read2(&channelcount) &&
+         reader->Read2(&samplesize) &&
+         reader->SkipBytes(4) &&
+         reader->Read4(&samplerate));
+  // Convert from 16.16 fixed point to integer
+  samplerate >>= 16;
+
+  RCHECK(reader->ScanChildren());
+  if (format == FOURCC_ENCA) {
+    // Continue scanning until a recognized protection scheme is found, or until
+    // we run out of protection schemes.
+    while (sinf.type.type != FOURCC_CENC) {
+      if (!reader->ReadChild(&sinf))
+        return false;
+    }
+  }
+
+  RCHECK(reader->ReadChild(&esds));
+  return true;
+}
+
+MediaHeader::MediaHeader()
+    : creation_time(0),
+      modification_time(0),
+      timescale(0),
+      duration(0) {}
+MediaHeader::~MediaHeader() {}
+FourCC MediaHeader::BoxType() const { return FOURCC_MDHD; }
+
+bool MediaHeader::Parse(BoxReader* reader) {
+  RCHECK(reader->ReadFullBoxHeader());
+
+  if (reader->version() == 1) {
+    RCHECK(reader->Read8(&creation_time) &&
+           reader->Read8(&modification_time) &&
+           reader->Read4(&timescale) &&
+           reader->Read8(&duration));
+  } else {
+    RCHECK(reader->Read4Into8(&creation_time) &&
+           reader->Read4Into8(&modification_time) &&
+           reader->Read4(&timescale) &&
+           reader->Read4Into8(&duration));
+  }
+  // Skip language information
+  return reader->SkipBytes(4);
+}
+
+MediaInformation::MediaInformation() {}
+MediaInformation::~MediaInformation() {}
+FourCC MediaInformation::BoxType() const { return FOURCC_MINF; }
+
+bool MediaInformation::Parse(BoxReader* reader) {
+  return reader->ScanChildren() &&
+         reader->ReadChild(&sample_table);
+}
+
+Media::Media() {}
+Media::~Media() {}
+FourCC Media::BoxType() const { return FOURCC_MDIA; }
+
+bool Media::Parse(BoxReader* reader) {
+  RCHECK(reader->ScanChildren() &&
+         reader->ReadChild(&header) &&
+         reader->ReadChild(&handler));
+
+  // Maddeningly, the HandlerReference box specifies how to parse the
+  // SampleDescription box, making the latter the only box (of those that we
+  // support) which cannot be parsed correctly on its own (or even with
+  // information from its strict ancestor tree). We thus copy the handler type
+  // to the sample description box *before* parsing it to provide this
+  // information while parsing.
+  information.sample_table.description.type = handler.type;
+  RCHECK(reader->ReadChild(&information));
+  return true;
+}
+
+Track::Track() {}
+Track::~Track() {}
+FourCC Track::BoxType() const { return FOURCC_TRAK; }
+
+bool Track::Parse(BoxReader* reader) {
+  RCHECK(reader->ScanChildren() &&
+         reader->ReadChild(&header) &&
+         reader->ReadChild(&media) &&
+         reader->MaybeReadChild(&edit));
+  return true;
+}
+
+MovieExtendsHeader::MovieExtendsHeader() : fragment_duration(0) {}
+MovieExtendsHeader::~MovieExtendsHeader() {}
+FourCC MovieExtendsHeader::BoxType() const { return FOURCC_MEHD; }
+
+bool MovieExtendsHeader::Parse(BoxReader* reader) {
+  RCHECK(reader->ReadFullBoxHeader());
+  if (reader->version() == 1) {
+    RCHECK(reader->Read8(&fragment_duration));
+  } else {
+    RCHECK(reader->Read4Into8(&fragment_duration));
+  }
+  return true;
+}
+
+TrackExtends::TrackExtends()
+    : track_id(0),
+      default_sample_description_index(0),
+      default_sample_duration(0),
+      default_sample_size(0),
+      default_sample_flags(0) {}
+TrackExtends::~TrackExtends() {}
+FourCC TrackExtends::BoxType() const { return FOURCC_TREX; }
+
+bool TrackExtends::Parse(BoxReader* reader) {
+  RCHECK(reader->ReadFullBoxHeader() &&
+         reader->Read4(&track_id) &&
+         reader->Read4(&default_sample_description_index) &&
+         reader->Read4(&default_sample_duration) &&
+         reader->Read4(&default_sample_size) &&
+         reader->Read4(&default_sample_flags));
+  return true;
+}
+
+MovieExtends::MovieExtends() {}
+MovieExtends::~MovieExtends() {}
+FourCC MovieExtends::BoxType() const { return FOURCC_MVEX; }
+
+bool MovieExtends::Parse(BoxReader* reader) {
+  header.fragment_duration = 0;
+  return reader->ScanChildren() &&
+         reader->MaybeReadChild(&header) &&
+         reader->ReadChildren(&tracks);
+}
+
+Movie::Movie() : fragmented(false) {}
+Movie::~Movie() {}
+FourCC Movie::BoxType() const { return FOURCC_MOOV; }
+
+bool Movie::Parse(BoxReader* reader) {
+  return reader->ScanChildren() &&
+         reader->ReadChild(&header) &&
+         reader->ReadChildren(&tracks) &&
+         // Media Source specific: 'mvex' required
+         reader->ReadChild(&extends) &&
+         reader->MaybeReadChildren(&pssh);
+}
+
+TrackFragmentDecodeTime::TrackFragmentDecodeTime() : decode_time(0) {}
+TrackFragmentDecodeTime::~TrackFragmentDecodeTime() {}
+FourCC TrackFragmentDecodeTime::BoxType() const { return FOURCC_TFDT; }
+
+bool TrackFragmentDecodeTime::Parse(BoxReader* reader) {
+  RCHECK(reader->ReadFullBoxHeader());
+  if (reader->version() == 1)
+    return reader->Read8(&decode_time);
+  else
+    return reader->Read4Into8(&decode_time);
+}
+
+MovieFragmentHeader::MovieFragmentHeader() : sequence_number(0) {}
+MovieFragmentHeader::~MovieFragmentHeader() {}
+FourCC MovieFragmentHeader::BoxType() const { return FOURCC_MFHD; }
+
+bool MovieFragmentHeader::Parse(BoxReader* reader) {
+  return reader->SkipBytes(4) && reader->Read4(&sequence_number);
+}
+
+TrackFragmentHeader::TrackFragmentHeader()
+    : track_id(0),
+      sample_description_index(0),
+      default_sample_duration(0),
+      default_sample_size(0),
+      default_sample_flags(0),
+      has_default_sample_flags(false) {}
+
+TrackFragmentHeader::~TrackFragmentHeader() {}
+FourCC TrackFragmentHeader::BoxType() const { return FOURCC_TFHD; }
+
+bool TrackFragmentHeader::Parse(BoxReader* reader) {
+  RCHECK(reader->ReadFullBoxHeader() && reader->Read4(&track_id));
+
+  // Media Source specific: reject tracks that set 'base-data-offset-present'.
+  // Although the Media Source requires that 'default-base-is-moof' (14496-12
+  // Amendment 2) be set, we omit this check as many otherwise-valid files in
+  // the wild don't set it.
+  //
+  //  RCHECK((flags & 0x020000) && !(flags & 0x1));
+  RCHECK(!(reader->flags() & 0x1));
+
+  if (reader->flags() & 0x2) {
+    RCHECK(reader->Read4(&sample_description_index));
+  } else {
+    sample_description_index = 0;
+  }
+
+  if (reader->flags() & 0x8) {
+    RCHECK(reader->Read4(&default_sample_duration));
+  } else {
+    default_sample_duration = 0;
+  }
+
+  if (reader->flags() & 0x10) {
+    RCHECK(reader->Read4(&default_sample_size));
+  } else {
+    default_sample_size = 0;
+  }
+
+  if (reader->flags() & 0x20) {
+    RCHECK(reader->Read4(&default_sample_flags));
+    has_default_sample_flags = true;
+  } else {
+    has_default_sample_flags = false;
+  }
+
+  return true;
+}
+
+TrackFragmentRun::TrackFragmentRun()
+    : sample_count(0), data_offset(0) {}
+TrackFragmentRun::~TrackFragmentRun() {}
+FourCC TrackFragmentRun::BoxType() const { return FOURCC_TRUN; }
+
+bool TrackFragmentRun::Parse(BoxReader* reader) {
+  RCHECK(reader->ReadFullBoxHeader() &&
+         reader->Read4(&sample_count));
+  const uint32_t flags = reader->flags();
+
+  bool data_offset_present = (flags & 0x1) != 0;
+  bool first_sample_flags_present = (flags & 0x4) != 0;
+  bool sample_duration_present = (flags & 0x100) != 0;
+  bool sample_size_present = (flags & 0x200) != 0;
+  bool sample_flags_present = (flags & 0x400) != 0;
+  bool sample_composition_time_offsets_present = (flags & 0x800) != 0;
+
+  if (data_offset_present) {
+    RCHECK(reader->Read4(&data_offset));
+  } else {
+    data_offset = 0;
+  }
+
+  uint32_t first_sample_flags;
+  if (first_sample_flags_present)
+    RCHECK(reader->Read4(&first_sample_flags));
+
+  int fields = sample_duration_present + sample_size_present +
+      sample_flags_present + sample_composition_time_offsets_present;
+  RCHECK(reader->HasBytes(fields * sample_count));
+
+  if (sample_duration_present)
+    sample_durations.resize(sample_count);
+  if (sample_size_present)
+    sample_sizes.resize(sample_count);
+  if (sample_flags_present)
+    sample_flags.resize(sample_count);
+  if (sample_composition_time_offsets_present)
+    sample_composition_time_offsets.resize(sample_count);
+
+  for (uint32_t i = 0; i < sample_count; ++i) {
+    if (sample_duration_present)
+      RCHECK(reader->Read4(&sample_durations[i]));
+    if (sample_size_present)
+      RCHECK(reader->Read4(&sample_sizes[i]));
+    if (sample_flags_present)
+      RCHECK(reader->Read4(&sample_flags[i]));
+    if (sample_composition_time_offsets_present)
+      RCHECK(reader->Read4s(&sample_composition_time_offsets[i]));
+  }
+
+  if (first_sample_flags_present) {
+    if (sample_flags.size() == 0) {
+      sample_flags.push_back(first_sample_flags);
+    } else {
+      sample_flags[0] = first_sample_flags;
+    }
+  }
+  return true;
+}
+
+TrackFragment::TrackFragment() {}
+TrackFragment::~TrackFragment() {}
+FourCC TrackFragment::BoxType() const { return FOURCC_TRAF; }
+
+bool TrackFragment::Parse(BoxReader* reader) {
+  return reader->ScanChildren() &&
+         reader->ReadChild(&header) &&
+         // Media Source specific: 'tfdt' required
+         reader->ReadChild(&decode_time) &&
+         reader->MaybeReadChildren(&runs) &&
+         reader->MaybeReadChild(&auxiliary_offset) &&
+         reader->MaybeReadChild(&auxiliary_size);
+}
+
+MovieFragment::MovieFragment() {}
+MovieFragment::~MovieFragment() {}
+FourCC MovieFragment::BoxType() const { return FOURCC_MOOF; }
+
+bool MovieFragment::Parse(BoxReader* reader) {
+  RCHECK(reader->ScanChildren() &&
+         reader->ReadChild(&header) &&
+         reader->ReadChildren(&tracks) &&
+         reader->MaybeReadChildren(&pssh));
+  return true;
+}
+
+}  // namespace mp4_demuxer
diff --git a/content/media/fmp4/demuxer/box_definitions.h b/content/media/fmp4/demuxer/box_definitions.h
new file mode 100644
index 000000000000..d82c7269fbda
--- /dev/null
+++ b/content/media/fmp4/demuxer/box_definitions.h
@@ -0,0 +1,349 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef MEDIA_MP4_BOX_DEFINITIONS_H_
+#define MEDIA_MP4_BOX_DEFINITIONS_H_
+
+#include <string>
+#include <vector>
+
+#include "mp4_demuxer/box_reader.h"
+
+#include "mp4_demuxer/basictypes.h"
+#include "mp4_demuxer/aac.h"
+#include "mp4_demuxer/avc.h"
+#include "mp4_demuxer/box_reader.h"
+#include "mp4_demuxer/fourccs.h"
+
+namespace mp4_demuxer {
+
+enum TrackType {
+  kInvalid = 0,
+  kVideo,
+  kAudio,
+  kHint
+};
+
+#define DECLARE_BOX_METHODS(T) \
+  T(); \
+  virtual ~T(); \
+  virtual bool Parse(BoxReader* reader) OVERRIDE; \
+  virtual FourCC BoxType() const OVERRIDE; \
+
+struct FileType : Box {
+  DECLARE_BOX_METHODS(FileType);
+
+  FourCC major_brand;
+  uint32_t minor_version;
+};
+
+struct ProtectionSystemSpecificHeader : Box {
+  DECLARE_BOX_METHODS(ProtectionSystemSpecificHeader);
+
+  std::vector<uint8_t> system_id;
+  std::vector<uint8_t> raw_box;
+};
+
+struct SampleAuxiliaryInformationOffset : Box {
+  DECLARE_BOX_METHODS(SampleAuxiliaryInformationOffset);
+
+  std::vector<uint64_t> offsets;
+};
+
+struct SampleAuxiliaryInformationSize : Box {
+  DECLARE_BOX_METHODS(SampleAuxiliaryInformationSize);
+
+  uint8_t default_sample_info_size;
+  uint32_t sample_count;
+  std::vector<uint8_t> sample_info_sizes;
+};
+
+struct OriginalFormat : Box {
+  DECLARE_BOX_METHODS(OriginalFormat);
+
+  FourCC format;
+};
+
+struct SchemeType : Box {
+  DECLARE_BOX_METHODS(SchemeType);
+
+  FourCC type;
+  uint32_t version;
+};
+
+struct TrackEncryption : Box {
+  DECLARE_BOX_METHODS(TrackEncryption);
+
+  // Note: this definition is specific to the CENC protection type.
+  bool is_encrypted;
+  uint8_t default_iv_size;
+  std::vector<uint8_t> default_kid;
+};
+
+struct SchemeInfo : Box {
+  DECLARE_BOX_METHODS(SchemeInfo);
+
+  TrackEncryption track_encryption;
+};
+
+struct ProtectionSchemeInfo : Box {
+  DECLARE_BOX_METHODS(ProtectionSchemeInfo);
+
+  OriginalFormat format;
+  SchemeType type;
+  SchemeInfo info;
+};
+
+struct MovieHeader : Box {
+  DECLARE_BOX_METHODS(MovieHeader);
+
+  uint64_t creation_time;
+  uint64_t modification_time;
+  uint32_t timescale;
+  uint64_t duration;
+  int32_t rate;
+  int16_t volume;
+  uint32_t next_track_id;
+};
+
+struct TrackHeader : Box {
+  DECLARE_BOX_METHODS(TrackHeader);
+
+  uint64_t creation_time;
+  uint64_t modification_time;
+  uint32_t track_id;
+  uint64_t duration;
+  int16_t layer;
+  int16_t alternate_group;
+  int16_t volume;
+  uint32_t width;
+  uint32_t height;
+};
+
+struct EditListEntry {
+  uint64_t segment_duration;
+  int64_t media_time;
+  int16_t media_rate_integer;
+  int16_t media_rate_fraction;
+};
+
+struct EditList : Box {
+  DECLARE_BOX_METHODS(EditList);
+
+  std::vector<EditListEntry> edits;
+};
+
+struct Edit : Box {
+  DECLARE_BOX_METHODS(Edit);
+
+  EditList list;
+};
+
+struct HandlerReference : Box {
+  DECLARE_BOX_METHODS(HandlerReference);
+
+  TrackType type;
+};
+
+struct AVCDecoderConfigurationRecord : Box {
+  DECLARE_BOX_METHODS(AVCDecoderConfigurationRecord);
+
+  uint8_t version;
+  uint8_t profile_indication;
+  uint8_t profile_compatibility;
+  uint8_t avc_level;
+  uint8_t length_size;
+
+  typedef std::vector<uint8_t> SPS;
+  typedef std::vector<uint8_t> PPS;
+
+  std::vector<SPS> sps_list;
+  std::vector<PPS> pps_list;
+};
+
+struct PixelAspectRatioBox : Box {
+  DECLARE_BOX_METHODS(PixelAspectRatioBox);
+
+  uint32_t h_spacing;
+  uint32_t v_spacing;
+};
+
+struct VideoSampleEntry : Box {
+  DECLARE_BOX_METHODS(VideoSampleEntry);
+
+  FourCC format;
+  uint16_t data_reference_index;
+  uint16_t width;
+  uint16_t height;
+
+  PixelAspectRatioBox pixel_aspect;
+  ProtectionSchemeInfo sinf;
+
+  // Currently expected to be present regardless of format.
+  AVCDecoderConfigurationRecord avcc;
+};
+
+struct ElementaryStreamDescriptor : Box {
+  DECLARE_BOX_METHODS(ElementaryStreamDescriptor);
+
+  uint8_t object_type;
+  AAC aac;
+};
+
+struct AudioSampleEntry : Box {
+  DECLARE_BOX_METHODS(AudioSampleEntry);
+
+  FourCC format;
+  uint16_t data_reference_index;
+  uint16_t channelcount;
+  uint16_t samplesize;
+  uint32_t samplerate;
+
+  ProtectionSchemeInfo sinf;
+  ElementaryStreamDescriptor esds;
+};
+
+struct SampleDescription : Box {
+  DECLARE_BOX_METHODS(SampleDescription);
+
+  TrackType type;
+  std::vector<VideoSampleEntry> video_entries;
+  std::vector<AudioSampleEntry> audio_entries;
+};
+
+struct SampleTable : Box {
+  DECLARE_BOX_METHODS(SampleTable);
+
+  // Media Source specific: we ignore many of the sub-boxes in this box,
+  // including some that are required to be present in the BMFF spec. This
+  // includes the 'stts', 'stsc', and 'stco' boxes, which must contain no
+  // samples in order to be compliant files.
+  SampleDescription description;
+};
+
+struct MediaHeader : Box {
+  DECLARE_BOX_METHODS(MediaHeader);
+
+  uint64_t creation_time;
+  uint64_t modification_time;
+  uint32_t timescale;
+  uint64_t duration;
+};
+
+struct MediaInformation : Box {
+  DECLARE_BOX_METHODS(MediaInformation);
+
+  SampleTable sample_table;
+};
+
+struct Media : Box {
+  DECLARE_BOX_METHODS(Media);
+
+  MediaHeader header;
+  HandlerReference handler;
+  MediaInformation information;
+};
+
+struct Track : Box {
+  DECLARE_BOX_METHODS(Track);
+
+  TrackHeader header;
+  Media media;
+  Edit edit;
+};
+
+struct MovieExtendsHeader : Box {
+  DECLARE_BOX_METHODS(MovieExtendsHeader);
+
+  uint64_t fragment_duration;
+};
+
+struct TrackExtends : Box {
+  DECLARE_BOX_METHODS(TrackExtends);
+
+  uint32_t track_id;
+  uint32_t default_sample_description_index;
+  uint32_t default_sample_duration;
+  uint32_t default_sample_size;
+  uint32_t default_sample_flags;
+};
+
+struct MovieExtends : Box {
+  DECLARE_BOX_METHODS(MovieExtends);
+
+  MovieExtendsHeader header;
+  std::vector<TrackExtends> tracks;
+};
+
+struct Movie : Box {
+  DECLARE_BOX_METHODS(Movie);
+
+  bool fragmented;
+  MovieHeader header;
+  MovieExtends extends;
+  std::vector<Track> tracks;
+  std::vector<ProtectionSystemSpecificHeader> pssh;
+};
+
+struct TrackFragmentDecodeTime : Box {
+  DECLARE_BOX_METHODS(TrackFragmentDecodeTime);
+
+  uint64_t decode_time;
+};
+
+struct MovieFragmentHeader : Box {
+  DECLARE_BOX_METHODS(MovieFragmentHeader);
+
+  uint32_t sequence_number;
+};
+
+struct TrackFragmentHeader : Box {
+  DECLARE_BOX_METHODS(TrackFragmentHeader);
+
+  uint32_t track_id;
+
+  uint32_t sample_description_index;
+  uint32_t default_sample_duration;
+  uint32_t default_sample_size;
+  uint32_t default_sample_flags;
+
+  // As 'flags' might be all zero, we cannot use zeroness alone to identify
+  // when default_sample_flags wasn't specified, unlike the other values.
+  bool has_default_sample_flags;
+};
+
+struct TrackFragmentRun : Box {
+  DECLARE_BOX_METHODS(TrackFragmentRun);
+
+  uint32_t sample_count;
+  uint32_t data_offset;
+  std::vector<uint32_t> sample_flags;
+  std::vector<uint32_t> sample_sizes;
+  std::vector<uint32_t> sample_durations;
+  std::vector<int32_t> sample_composition_time_offsets;
+};
+
+struct TrackFragment : Box {
+  DECLARE_BOX_METHODS(TrackFragment);
+
+  TrackFragmentHeader header;
+  std::vector<TrackFragmentRun> runs;
+  TrackFragmentDecodeTime decode_time;
+  SampleAuxiliaryInformationOffset auxiliary_offset;
+  SampleAuxiliaryInformationSize auxiliary_size;
+};
+
+struct MovieFragment : Box {
+  DECLARE_BOX_METHODS(MovieFragment);
+
+  MovieFragmentHeader header;
+  std::vector<TrackFragment> tracks;
+  std::vector<ProtectionSystemSpecificHeader> pssh;
+};
+
+#undef DECLARE_BOX
+
+}  // namespace mp4_demuxer
+
+#endif  // MEDIA_MP4_BOX_DEFINITIONS_H_
diff --git a/content/media/fmp4/demuxer/box_reader.cc b/content/media/fmp4/demuxer/box_reader.cc
new file mode 100644
index 000000000000..8b72e01e0eb9
--- /dev/null
+++ b/content/media/fmp4/demuxer/box_reader.cc
@@ -0,0 +1,263 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "mp4_demuxer/box_reader.h"
+
+#include <string.h>
+#include <algorithm>
+#include <map>
+#include <set>
+#include <memory>
+#include <iostream>
+#include <assert.h>
+
+#include "mp4_demuxer/box_definitions.h"
+
+#include "mp4_demuxer/Streams.h"
+
+using namespace std;
+
+namespace mp4_demuxer {
+
+Box::~Box() {}
+
+bool StreamReader::Read1(uint8_t* v) {
+  RCHECK(HasBytes(1));
+  assert(start_ + pos_ <= stream_->Length());
+  uint32_t bytesRead = 0;
+  if (!stream_->ReadAt(start_ + pos_, v, 1, &bytesRead) || bytesRead != 1) {
+    return false;
+  }
+  pos_ += bytesRead;
+  return true;
+}
+
+// Internal implementation of multi-byte reads
+template<typename T> bool StreamReader::Read(T* v) {
+  RCHECK(HasBytes(sizeof(T)));
+
+  T tmp = 0;
+  for (size_t i = 0; i < sizeof(T); i++) {
+    tmp <<= 8;
+    uint8_t byte;
+    Read1(&byte);
+    tmp += byte;
+  }
+  *v = tmp;
+  return true;
+}
+
+bool StreamReader::Read2(uint16_t* v) { return Read(v); }
+bool StreamReader::Read2s(int16_t* v) { return Read(v); }
+bool StreamReader::Read4(uint32_t* v) { return Read(v); }
+bool StreamReader::Read4s(int32_t* v) { return Read(v); }
+bool StreamReader::Read8(uint64_t* v) { return Read(v); }
+bool StreamReader::Read8s(int64_t* v) { return Read(v); }
+
+bool StreamReader::ReadFourCC(FourCC* v) {
+  return Read4(reinterpret_cast<uint32_t*>(v));
+}
+
+bool StreamReader::ReadVec(std::vector<uint8_t>* vec, int count) {
+  RCHECK(HasBytes(count));
+  vec->resize(count);
+  assert(start_ + pos_ <= stream_->Length());
+  uint32_t bytesRead = 0;
+  if (!stream_->ReadAt(start_ + pos_, vec->data(), count, &bytesRead)) {
+    return false;
+  }
+  pos_ += bytesRead;
+  return true;
+}
+
+bool StreamReader::SkipBytes(int bytes) {
+  RCHECK(HasBytes(bytes));
+  pos_ += bytes;
+  return true;
+}
+
+bool StreamReader::Read4Into8(uint64_t* v) {
+  uint32_t tmp;
+  RCHECK(Read4(&tmp));
+  *v = tmp;
+  return true;
+}
+
+bool StreamReader::Read4sInto8s(int64_t* v) {
+  // Beware of the need for sign extension.
+  int32_t tmp;
+  RCHECK(Read4s(&tmp));
+  *v = tmp;
+  return true;
+}
+
+int64_t StreamReader::size() const {
+  return size_;
+}
+
+int64_t StreamReader::pos() const {
+  return pos_;
+}
+
+BoxReader::BoxReader(Stream* stream, int64_t offset, int64_t size)
+    : StreamReader(stream, offset, size),
+      type_(FOURCC_NULL),
+      version_(0),
+      flags_(0),
+      scanned_(false) {
+}
+
+BoxReader::~BoxReader() {
+  if (scanned_ && !children_.empty()) {
+    for (ChildMap::iterator itr = children_.begin();
+         itr != children_.end(); ++itr) {
+      auto reader = itr->second;
+      DMX_LOG("Skipping unknown box: '%s' reader type'%s'\n",
+          FourCCToString(itr->first).c_str(),
+          FourCCToString(reader.type()).c_str());
+    }
+  }
+}
+
+// static
+BoxReader* BoxReader::ReadTopLevelBox(Stream* stream,
+                                      int64_t offset,
+                                      bool* err) {
+  nsAutoPtr<BoxReader> reader(new BoxReader(stream, offset, stream->Length()));
+  if (!reader->ReadHeader(err))
+    return NULL;
+
+  if (!IsValidTopLevelBox(reader->type())) {
+    *err = true;
+    return NULL;
+  }
+
+  if (reader->size() <= stream->Length())
+    return reader.forget();
+
+  return NULL;
+}
+
+// static
+bool BoxReader::StartTopLevelBox(Stream* stream,
+                                 int64_t offset,
+                                 FourCC* type,
+                                 int* box_size) {
+  assert(stream->Length() > offset);
+  BoxReader reader(stream, offset, stream->Length() - offset);
+  bool err = false;
+  if (!reader.ReadHeader(&err)) return false;
+  if (!IsValidTopLevelBox(reader.type()) || err) {
+    return false;
+  }
+  *type = reader.type();
+  *box_size = reader.size();
+  return true;
+}
+
+// static
+bool BoxReader::IsValidTopLevelBox(const FourCC& type) {
+  switch (type) {
+    case FOURCC_FTYP:
+    case FOURCC_PDIN:
+    case FOURCC_BLOC:
+    case FOURCC_MOOV:
+    case FOURCC_MOOF:
+    case FOURCC_MFRA:
+    case FOURCC_MDAT:
+    case FOURCC_FREE:
+    case FOURCC_SKIP:
+    case FOURCC_META:
+    case FOURCC_MECO:
+    case FOURCC_STYP:
+    case FOURCC_SIDX:
+    case FOURCC_SSIX:
+    case FOURCC_PRFT:
+      return true;
+    default:
+      // Hex is used to show nonprintable characters and aid in debugging
+      DMX_LOG("Unrecognized top-level box type 0x%x\n", type);
+      return false;
+  }
+}
+
+bool BoxReader::ScanChildren() {
+  DCHECK(!scanned_);
+  scanned_ = true;
+
+  bool err = false;
+  while (pos() < size()) {
+    BoxReader child(stream_, start_ + pos_, size_ - pos_);
+    if (!child.ReadHeader(&err)) break;
+    assert(child.size() < size());
+    children_.insert(std::pair<FourCC, BoxReader>(child.type(), child));
+    pos_ += child.size();
+  }
+
+  DCHECK(!err);
+  return !err && pos() == size();
+}
+
+bool BoxReader::ReadChild(Box* child) {
+  DCHECK(scanned_);
+  FourCC child_type = child->BoxType();
+
+  ChildMap::iterator itr = children_.find(child_type);
+  if (itr == children_.end()) {
+    DMX_LOG("No child of type %s\n", FourCCToString(child_type).c_str());
+  }
+  RCHECK(itr != children_.end());
+  DMX_LOG("Found a %s box\n", FourCCToString(child_type).c_str());
+  RCHECK(child->Parse(&itr->second));
+  children_.erase(itr);
+  return true;
+}
+
+bool BoxReader::MaybeReadChild(Box* child) {
+  if (!children_.count(child->BoxType())) return true;
+  return ReadChild(child);
+}
+
+bool BoxReader::ReadFullBoxHeader() {
+  uint32_t vflags;
+  RCHECK(Read4(&vflags));
+  version_ = vflags >> 24;
+  flags_ = vflags & 0xffffff;
+  return true;
+}
+
+bool BoxReader::ReadHeader(bool* err) {
+  uint64_t size = 0;
+  *err = false;
+
+  if (!HasBytes(8)) return false;
+  CHECK(Read4Into8(&size) && ReadFourCC(&type_));
+
+  DMX_LOG("BoxReader::ReadHeader() read %s size=%d\n", FourCCToString(type_).c_str(), size);
+
+  if (size == 0) {
+    // Media Source specific: we do not support boxes that run to EOS.
+    *err = true;
+    return false;
+  } else if (size == 1) {
+    if (!HasBytes(8)) return false;
+    CHECK(Read8(&size));
+  }
+
+  // Implementation-specific: support for boxes larger than 2^31 has been
+  // removed.
+  if (size < static_cast<uint64_t>(pos_) ||
+      size > static_cast<uint64_t>(kint32max)) {
+    *err = true;
+    return false;
+  }
+
+  // Note that the pos_ head has advanced to the byte immediately after the
+  // header, which is where we want it.
+  size_ = size;
+
+  return true;
+}
+
+}  // namespace mp4_demuxer
diff --git a/content/media/fmp4/demuxer/box_reader.h b/content/media/fmp4/demuxer/box_reader.h
new file mode 100644
index 000000000000..9c891328092d
--- /dev/null
+++ b/content/media/fmp4/demuxer/box_reader.h
@@ -0,0 +1,216 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef MEDIA_MP4_BOX_READER_H_
+#define MEDIA_MP4_BOX_READER_H_
+
+#include <map>
+#include <vector>
+
+#include "mp4_demuxer/basictypes.h"
+#include "mp4_demuxer/fourccs.h"
+
+#include "nsAutoPtr.h"
+
+namespace mp4_demuxer {
+
+class BoxReader;
+class Stream;
+
+struct Box {
+  virtual ~Box();
+  virtual bool Parse(BoxReader* reader) = 0;
+  virtual FourCC BoxType() const = 0;
+};
+
+class StreamReader {
+ public:
+  StreamReader(Stream* stream, int64_t offset, int64_t size)
+    : stream_(stream), start_(offset), pos_(0), size_(size) {}
+
+  bool HasBytes(int count) { return (pos() + count <= size()); }
+
+  // Read a value from the stream, perfoming endian correction, and advance the
+  // stream pointer.
+  bool Read1(uint8_t* v)  WARN_UNUSED_RESULT;
+  bool Read2(uint16_t* v) WARN_UNUSED_RESULT;
+  bool Read2s(int16_t* v) WARN_UNUSED_RESULT;
+  bool Read4(uint32_t* v) WARN_UNUSED_RESULT;
+  bool Read4s(int32_t* v) WARN_UNUSED_RESULT;
+  bool Read8(uint64_t* v) WARN_UNUSED_RESULT;
+  bool Read8s(int64_t* v) WARN_UNUSED_RESULT;
+
+  bool ReadFourCC(FourCC* v) WARN_UNUSED_RESULT;
+
+  bool ReadVec(std::vector<uint8_t>* t, int count) WARN_UNUSED_RESULT;
+
+  // These variants read a 4-byte integer of the corresponding signedness and
+  // store it in the 8-byte return type.
+  bool Read4Into8(uint64_t* v) WARN_UNUSED_RESULT;
+  bool Read4sInto8s(int64_t* v) WARN_UNUSED_RESULT;
+
+  // Advance the stream by this many bytes.
+  bool SkipBytes(int nbytes) WARN_UNUSED_RESULT;
+
+  //const uint8_t* data() const { return buf_; }
+  int64_t size() const;
+  int64_t pos() const;
+
+protected:
+
+  // The start offset of the box in the stream.
+  const int64_t start_;
+
+  // The size of the box in the stream.
+  int64_t size_;
+
+  // The offset from start_ at which the read cursor is.
+  // 0 initially.
+  int64_t pos_;
+
+  // The stream that we read from.
+  Stream* stream_;
+
+  template<typename T> bool Read(T* t) WARN_UNUSED_RESULT;
+};
+
+class BoxReader : public StreamReader {
+ public:
+  ~BoxReader();
+
+  // Create a BoxReader from a buffer. Note that this function may return NULL
+  // if an intact, complete box was not available in the buffer. If |*err| is
+  // set, there was a stream-level error when creating the box; otherwise, NULL
+  // values are only expected when insufficient data is available.
+  //
+  // |buf| is retained but not owned, and must outlive the BoxReader instance.
+  static BoxReader* ReadTopLevelBox(Stream* stream,
+                                    int64_t offset,
+                                    bool* err);
+
+  // Read the box header from the current buffer. This function returns true if
+  // the header is sane; that is, it does not check to ensure the entire box is
+  // in the buffer before returning true.
+  static bool StartTopLevelBox(Stream* stream,
+                               int64_t offset,
+                               FourCC* type,
+                               int* box_size);
+
+  // Returns true if |type| is recognized to be a top-level box, false
+  // otherwise. This returns true for some boxes which we do not parse.
+  // Helpful in debugging misaligned appends.
+  static bool IsValidTopLevelBox(const FourCC& type);
+
+  // Scan through all boxes within the current box, starting at the current
+  // buffer position. Must be called before any of the *Child functions work.
+  bool ScanChildren() WARN_UNUSED_RESULT;
+
+  // Read exactly one child box from the set of children. The type of the child
+  // will be determined by the BoxType() method of |child|.
+  bool ReadChild(Box* child) WARN_UNUSED_RESULT;
+
+  // Read one child if available. Returns false on error, true on successful
+  // read or on child absent.
+  bool MaybeReadChild(Box* child) WARN_UNUSED_RESULT;
+
+  // Read at least one child. False means error or no such child present.
+  template<typename T> bool ReadChildren(
+      std::vector<T>* children) WARN_UNUSED_RESULT;
+
+  // Read any number of children. False means error.
+  template<typename T> bool MaybeReadChildren(
+      std::vector<T>* children) WARN_UNUSED_RESULT;
+
+  // Read all children, regardless of FourCC. This is used from exactly one box,
+  // corresponding to a rather significant inconsistency in the BMFF spec.
+  // Note that this method is mutually exclusive with ScanChildren().
+  template<typename T> bool ReadAllChildren(
+      std::vector<T>* children) WARN_UNUSED_RESULT;
+
+  // Populate the values of 'version()' and 'flags()' from a full box header.
+  // Many boxes, but not all, use these values. This call should happen after
+  // the box has been initialized, and does not re-read the main box header.
+  bool ReadFullBoxHeader() WARN_UNUSED_RESULT;
+
+  FourCC type() const   { return type_; }
+  uint8_t version() const { return version_; }
+  uint32_t flags() const  { return flags_; }
+
+private:
+
+  BoxReader(Stream* stream, int64_t offset, int64_t size);
+
+  // Must be called immediately after init. If the return is false, this
+  // indicates that the box header and its contents were not available in the
+  // stream or were nonsensical, and that the box must not be used further. In
+  // this case, if |*err| is false, the problem was simply a lack of data, and
+  // should only be an error condition if some higher-level component knows that
+  // no more data is coming (i.e. EOS or end of containing box). If |*err| is
+  // true, the error is unrecoverable and the stream should be aborted.
+  bool ReadHeader(bool* err);
+
+  FourCC type_;
+  uint8_t version_;
+  uint32_t flags_;
+
+  typedef std::multimap<FourCC, BoxReader> ChildMap;
+
+  // The set of child box FourCCs and their corresponding buffer readers. Only
+  // valid if scanned_ is true.
+  ChildMap children_;
+  bool scanned_;
+};
+
+// Template definitions
+template<typename T> bool BoxReader::ReadChildren(std::vector<T>* children) {
+  RCHECK(MaybeReadChildren(children) && !children->empty());
+  return true;
+}
+
+template<typename T>
+bool BoxReader::MaybeReadChildren(std::vector<T>* children) {
+  DCHECK(scanned_);
+  DCHECK(children->empty());
+
+  children->resize(1);
+  FourCC child_type = (*children)[0].BoxType();
+
+  ChildMap::iterator start_itr = children_.lower_bound(child_type);
+  ChildMap::iterator end_itr = children_.upper_bound(child_type);
+  children->resize(std::distance(start_itr, end_itr));
+  typename std::vector<T>::iterator child_itr = children->begin();
+  for (ChildMap::iterator itr = start_itr; itr != end_itr; ++itr) {
+    RCHECK(child_itr->Parse(&itr->second));
+    ++child_itr;
+  }
+  children_.erase(start_itr, end_itr);
+
+  DMX_LOG("Found %d %s boxes\n",
+      children->size(),
+      FourCCToString(child_type).c_str());
+
+  return true;
+}
+
+template<typename T>
+bool BoxReader::ReadAllChildren(std::vector<T>* children) {
+  DCHECK(!scanned_);
+  scanned_ = true;
+
+  bool err = false;
+  while (pos() < size()) {
+    BoxReader child_reader(stream_, start_ + pos_, size_ - pos_);
+    if (!child_reader.ReadHeader(&err)) break;
+    T child;
+    RCHECK(child.Parse(&child_reader));
+    children->push_back(child);
+    pos_ += child_reader.size();
+  }
+
+  return !err;
+}
+
+}  // namespace mp4_demuxer
+
+#endif  // MEDIA_MP4_BOX_READER_H_
diff --git a/content/media/fmp4/demuxer/cenc.cc b/content/media/fmp4/demuxer/cenc.cc
new file mode 100644
index 000000000000..533cbe1f8333
--- /dev/null
+++ b/content/media/fmp4/demuxer/cenc.cc
@@ -0,0 +1,51 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "mp4_demuxer/cenc.h"
+
+#include <cstring>
+
+#include "mp4_demuxer/box_reader.h"
+
+namespace mp4_demuxer {
+
+FrameCENCInfo::FrameCENCInfo() {}
+FrameCENCInfo::~FrameCENCInfo() {}
+
+bool FrameCENCInfo::Parse(int iv_size, StreamReader* reader) {
+  const int kEntrySize = 6;
+  // Mandated by CENC spec
+  RCHECK(iv_size == 8 || iv_size == 16);
+
+  memset(iv, 0, sizeof(iv));
+  for (int i = 0; i < iv_size; i++)
+    RCHECK(reader->Read1(&iv[i]));
+
+  if (!reader->HasBytes(1)) return true;
+
+  uint16_t subsample_count;
+  RCHECK(reader->Read2(&subsample_count) &&
+         reader->HasBytes(subsample_count * kEntrySize));
+
+  subsamples.resize(subsample_count);
+  for (int i = 0; i < subsample_count; i++) {
+    uint16_t clear_bytes;
+    uint32_t cypher_bytes;
+    RCHECK(reader->Read2(&clear_bytes) &&
+           reader->Read4(&cypher_bytes));
+    subsamples[i].clear_bytes = clear_bytes;
+    subsamples[i].cypher_bytes = cypher_bytes;
+  }
+  return true;
+}
+
+size_t FrameCENCInfo::GetTotalSizeOfSubsamples() const {
+  size_t size = 0;
+  for (size_t i = 0; i < subsamples.size(); i++) {
+    size += subsamples[i].clear_bytes + subsamples[i].cypher_bytes;
+  }
+  return size;
+}
+
+}  // namespace mp4_demuxer
diff --git a/content/media/fmp4/demuxer/cenc.h b/content/media/fmp4/demuxer/cenc.h
new file mode 100644
index 000000000000..6a3d62ff5151
--- /dev/null
+++ b/content/media/fmp4/demuxer/cenc.h
@@ -0,0 +1,29 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef MEDIA_MP4_CENC_H_
+#define MEDIA_MP4_CENC_H_
+
+#include <vector>
+
+#include "mp4_demuxer/basictypes.h"
+#include "mp4_demuxer/decrypt_config.h"
+
+namespace mp4_demuxer {
+
+class StreamReader;
+
+struct FrameCENCInfo {
+  uint8_t iv[16];
+  std::vector<SubsampleEntry> subsamples;
+
+  FrameCENCInfo();
+  ~FrameCENCInfo();
+  bool Parse(int iv_size, StreamReader* r);
+  size_t GetTotalSizeOfSubsamples() const;
+};
+
+}  // namespace mp4_demuxer
+
+#endif  // MEDIA_MP4_CENC_H_
diff --git a/content/media/fmp4/demuxer/channel_layout.cc b/content/media/fmp4/demuxer/channel_layout.cc
new file mode 100644
index 000000000000..ba7d275d346c
--- /dev/null
+++ b/content/media/fmp4/demuxer/channel_layout.cc
@@ -0,0 +1,186 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "mp4_demuxer/channel_layout.h"
+
+#include "mp4_demuxer/basictypes.h"
+
+namespace mp4_demuxer {
+
+static const int kLayoutToChannels[] = {
+    0,   // CHANNEL_LAYOUT_NONE
+    0,   // CHANNEL_LAYOUT_UNSUPPORTED
+    1,   // CHANNEL_LAYOUT_MONO
+    2,   // CHANNEL_LAYOUT_STEREO
+    3,   // CHANNEL_LAYOUT_2_1
+    3,   // CHANNEL_LAYOUT_SURROUND
+    4,   // CHANNEL_LAYOUT_4_0
+    4,   // CHANNEL_LAYOUT_2_2
+    4,   // CHANNEL_LAYOUT_QUAD
+    5,   // CHANNEL_LAYOUT_5_0
+    6,   // CHANNEL_LAYOUT_5_1
+    5,   // CHANNEL_LAYOUT_5_0_BACK
+    6,   // CHANNEL_LAYOUT_5_1_BACK
+    7,   // CHANNEL_LAYOUT_7_0
+    8,   // CHANNEL_LAYOUT_7_1
+    8,   // CHANNEL_LAYOUT_7_1_WIDE
+    2,   // CHANNEL_LAYOUT_STEREO_DOWNMIX
+    3,   // CHANNEL_LAYOUT_2POINT1
+    4,   // CHANNEL_LAYOUT_3_1
+    5,   // CHANNEL_LAYOUT_4_1
+    6,   // CHANNEL_LAYOUT_6_0
+    6,   // CHANNEL_LAYOUT_6_0_FRONT
+    6,   // CHANNEL_LAYOUT_HEXAGONAL
+    7,   // CHANNEL_LAYOUT_6_1
+    7,   // CHANNEL_LAYOUT_6_1_BACK
+    7,   // CHANNEL_LAYOUT_6_1_FRONT
+    7,   // CHANNEL_LAYOUT_7_0_FRONT
+    8,   // CHANNEL_LAYOUT_7_1_WIDE_BACK
+    8,   // CHANNEL_LAYOUT_OCTAGONAL
+    0,   // CHANNEL_LAYOUT_DISCRETE
+};
+
+// The channel orderings for each layout as specified by FFmpeg.  Each value
+// represents the index of each channel in each layout.  Values of -1 mean the
+// channel at that index is not used for that layout.For example, the left side
+// surround sound channel in FFmpeg's 5.1 layout is in the 5th position (because
+// the order is L, R, C, LFE, LS, RS), so
+// kChannelOrderings[CHANNEL_LAYOUT_5POINT1][SIDE_LEFT] = 4;
+static const int kChannelOrderings[CHANNEL_LAYOUT_MAX][CHANNELS_MAX] = {
+    // FL | FR | FC | LFE | BL | BR | FLofC | FRofC | BC | SL | SR
+
+    // CHANNEL_LAYOUT_NONE
+    {  -1 , -1 , -1 , -1  , -1 , -1 , -1    , -1    , -1 , -1 , -1 },
+
+    // CHANNEL_LAYOUT_UNSUPPORTED
+    {  -1 , -1 , -1 , -1  , -1 , -1 , -1    , -1    , -1 , -1 , -1 },
+
+    // CHANNEL_LAYOUT_MONO
+    {  -1 , -1 , 0  , -1  , -1 , -1 , -1    , -1    , -1 , -1 , -1 },
+
+    // CHANNEL_LAYOUT_STEREO
+    {  0  , 1  , -1 , -1  , -1 , -1 , -1    , -1    , -1 , -1 , -1 },
+
+    // CHANNEL_LAYOUT_2_1
+    {  0  , 1  , -1 , -1  , -1 , -1 , -1    , -1    , 2  , -1 , -1 },
+
+    // CHANNEL_LAYOUT_SURROUND
+    {  0  , 1  , 2  , -1  , -1 , -1 , -1    , -1    , -1 , -1 , -1 },
+
+    // CHANNEL_LAYOUT_4_0
+    {  0  , 1  , 2  , -1  , -1 , -1 , -1    , -1    , 3  , -1 , -1 },
+
+    // CHANNEL_LAYOUT_2_2
+    {  0  , 1  , -1 , -1  , -1 , -1 , -1    , -1    , -1 , 2  ,  3 },
+
+    // CHANNEL_LAYOUT_QUAD
+    {  0  , 1  , -1 , -1  , 2  , 3  , -1    , -1    , -1 , -1 , -1 },
+
+    // CHANNEL_LAYOUT_5_0
+    {  0  , 1  , 2  , -1  , -1 , -1 , -1    , -1    , -1 , 3  ,  4 },
+
+    // CHANNEL_LAYOUT_5_1
+    {  0  , 1  , 2  , 3   , -1 , -1 , -1    , -1    , -1 , 4  ,  5 },
+
+    // FL | FR | FC | LFE | BL | BR | FLofC | FRofC | BC | SL | SR
+
+    // CHANNEL_LAYOUT_5_0_BACK
+    {  0  , 1  , 2  , -1  , 3  , 4  , -1    , -1    , -1 , -1 , -1 },
+
+    // CHANNEL_LAYOUT_5_1_BACK
+    {  0  , 1  , 2  , 3   , 4  , 5  , -1    , -1    , -1 , -1 , -1 },
+
+    // CHANNEL_LAYOUT_7_0
+    {  0  , 1  , 2  , -1  , 5  , 6  , -1    , -1    , -1 , 3  ,  4 },
+
+    // CHANNEL_LAYOUT_7_1
+    {  0  , 1  , 2  , 3   , 6  , 7  , -1    , -1    , -1 , 4  ,  5 },
+
+    // CHANNEL_LAYOUT_7_1_WIDE
+    {  0  , 1  , 2  , 3   , -1 , -1 , 6     , 7     , -1 , 4  ,  5 },
+
+    // CHANNEL_LAYOUT_STEREO_DOWNMIX
+    {  0  , 1  , -1 , -1  , -1 , -1 , -1    , -1    , -1 , -1 , -1 },
+
+    // CHANNEL_LAYOUT_2POINT1
+    {  0  , 1  , -1 ,  2  , -1 , -1 , -1    , -1    , -1 , -1 , -1 },
+
+    // CHANNEL_LAYOUT_3_1
+    {  0  , 1  ,  2 ,  3  , -1 , -1 , -1    , -1    , -1 , -1 , -1 },
+
+    // CHANNEL_LAYOUT_4_1
+    {  0  , 1  ,  2 ,  4  , -1 , -1 , -1    , -1    ,  3 , -1 , -1 },
+
+    // CHANNEL_LAYOUT_6_0
+    {  0  , 1  , 2  , -1  , -1 , -1 , -1    , -1    ,  5 , 3  ,  4 },
+
+    // CHANNEL_LAYOUT_6_0_FRONT
+    {  0  , 1  , -1 , -1  , -1 , -1 ,  4    ,  5    , -1 , 2  ,  3 },
+
+    // FL | FR | FC | LFE | BL | BR | FLofC | FRofC | BC | SL | SR
+
+    // CHANNEL_LAYOUT_HEXAGONAL
+    {  0  , 1  , 2  , -1  , 3  , 4  , -1    , -1    ,  5 , -1 , -1 },
+
+    // CHANNEL_LAYOUT_6_1
+    {  0  , 1  , 2  , 3   , -1 , -1 , -1    , -1    ,  6 , 4  ,  5 },
+
+    // CHANNEL_LAYOUT_6_1_BACK
+    {  0  , 1  , 2  , 3   , 4  , 5  , -1    , -1    ,  6 , -1 , -1 },
+
+    // CHANNEL_LAYOUT_6_1_FRONT
+    {  0  , 1  , -1 , 6   , -1 , -1 , 4     , 5     , -1 , 2  ,  3 },
+
+    // CHANNEL_LAYOUT_7_0_FRONT
+    {  0  , 1  , 2  , -1  , -1 , -1 , 5     , 6     , -1 , 3  ,  4 },
+
+    // CHANNEL_LAYOUT_7_1_WIDE_BACK
+    {  0  , 1  , 2  , 3   , 4  , 5  , 6     , 7     , -1 , -1 , -1 },
+
+    // CHANNEL_LAYOUT_OCTAGONAL
+    {  0  , 1  , 2  , -1  , 5  , 6  , -1    , -1    ,  7 , 3  ,  4 },
+
+    // CHANNEL_LAYOUT_DISCRETE
+    {  -1 , -1 , -1 , -1  , -1 , -1 , -1    , -1    , -1 , -1 , -1 },
+
+    // FL | FR | FC | LFE | BL | BR | FLofC | FRofC | BC | SL | SR
+};
+
+int ChannelLayoutToChannelCount(ChannelLayout layout) {
+  DCHECK_LT(static_cast<size_t>(layout), arraysize(kLayoutToChannels));
+  return kLayoutToChannels[layout];
+}
+
+// Converts a channel count into a channel layout.
+ChannelLayout GuessChannelLayout(int channels) {
+  switch (channels) {
+    case 1:
+      return CHANNEL_LAYOUT_MONO;
+    case 2:
+      return CHANNEL_LAYOUT_STEREO;
+    case 3:
+      return CHANNEL_LAYOUT_SURROUND;
+    case 4:
+      return CHANNEL_LAYOUT_QUAD;
+    case 5:
+      return CHANNEL_LAYOUT_5_0;
+    case 6:
+      return CHANNEL_LAYOUT_5_1;
+    case 7:
+      return CHANNEL_LAYOUT_6_1;
+    case 8:
+      return CHANNEL_LAYOUT_7_1;
+    default:
+      DMX_LOG("Unsupported channel count: %d\n", channels);
+  }
+  return CHANNEL_LAYOUT_UNSUPPORTED;
+}
+
+int ChannelOrder(ChannelLayout layout, Channels channel) {
+  DCHECK_LT(static_cast<size_t>(layout), arraysize(kChannelOrderings));
+  DCHECK_LT(static_cast<size_t>(channel), arraysize(kChannelOrderings[0]));
+  return kChannelOrderings[layout][channel];
+}
+
+}  // namespace mp4_demuxer
diff --git a/content/media/fmp4/demuxer/channel_layout.h b/content/media/fmp4/demuxer/channel_layout.h
new file mode 100644
index 000000000000..6377b28575d1
--- /dev/null
+++ b/content/media/fmp4/demuxer/channel_layout.h
@@ -0,0 +1,134 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef MEDIA_BASE_CHANNEL_LAYOUT_H_
+#define MEDIA_BASE_CHANNEL_LAYOUT_H_
+
+
+namespace mp4_demuxer {
+
+// Enumerates the various representations of the ordering of audio channels.
+// Logged to UMA, so never reuse a value, always add new/greater ones!
+enum ChannelLayout {
+  CHANNEL_LAYOUT_NONE = 0,
+  CHANNEL_LAYOUT_UNSUPPORTED = 1,
+
+  // Front C
+  CHANNEL_LAYOUT_MONO = 2,
+
+  // Front L, Front R
+  CHANNEL_LAYOUT_STEREO = 3,
+
+  // Front L, Front R, Back C
+  CHANNEL_LAYOUT_2_1 = 4,
+
+  // Front L, Front R, Front C
+  CHANNEL_LAYOUT_SURROUND = 5,
+
+  // Front L, Front R, Front C, Back C
+  CHANNEL_LAYOUT_4_0 = 6,
+
+  // Front L, Front R, Side L, Side R
+  CHANNEL_LAYOUT_2_2 = 7,
+
+  // Front L, Front R, Back L, Back R
+  CHANNEL_LAYOUT_QUAD = 8,
+
+  // Front L, Front R, Front C, Side L, Side R
+  CHANNEL_LAYOUT_5_0 = 9,
+
+  // Front L, Front R, Front C, Side L, Side R, LFE
+  CHANNEL_LAYOUT_5_1 = 10,
+
+  // Front L, Front R, Front C, Back L, Back R
+  CHANNEL_LAYOUT_5_0_BACK = 11,
+
+  // Front L, Front R, Front C, Back L, Back R, LFE
+  CHANNEL_LAYOUT_5_1_BACK = 12,
+
+  // Front L, Front R, Front C, Side L, Side R, Back L, Back R
+  CHANNEL_LAYOUT_7_0 = 13,
+
+  // Front L, Front R, Front C, Side L, Side R, LFE, Back L, Back R
+  CHANNEL_LAYOUT_7_1 = 14,
+
+  // Front L, Front R, Front C, Side L, Side R, LFE, Front LofC, Front RofC
+  CHANNEL_LAYOUT_7_1_WIDE = 15,
+
+  // Stereo L, Stereo R
+  CHANNEL_LAYOUT_STEREO_DOWNMIX = 16,
+
+  // Stereo L, Stereo R, LFE
+  CHANNEL_LAYOUT_2POINT1 = 17,
+
+  // Stereo L, Stereo R, Front C, LFE
+  CHANNEL_LAYOUT_3_1 = 18,
+
+  // Stereo L, Stereo R, Front C, Rear C, LFE
+  CHANNEL_LAYOUT_4_1 = 19,
+
+  // Stereo L, Stereo R, Front C, Side L, Side R, Back C
+  CHANNEL_LAYOUT_6_0 = 20,
+
+  // Stereo L, Stereo R, Side L, Side R, Front LofC, Front RofC
+  CHANNEL_LAYOUT_6_0_FRONT = 21,
+
+  // Stereo L, Stereo R, Side L, Side R, Front C, Rear C.
+  CHANNEL_LAYOUT_HEXAGONAL = 22,
+
+  // Stereo L, Stereo R, Side L, Side R, Front C, Rear Center, LFE
+  CHANNEL_LAYOUT_6_1 = 23,
+
+  // Stereo L, Stereo R, Back L, Back R, Front C, Rear Center, LFE
+  CHANNEL_LAYOUT_6_1_BACK = 24,
+
+  // Stereo L, Stereo R, Side L, Side R, Front LofC, Front RofC, LFE
+  CHANNEL_LAYOUT_6_1_FRONT = 25,
+
+  // Front L, Front R, Front C, Side L, Side R, Front LofC, Front RofC
+  CHANNEL_LAYOUT_7_0_FRONT = 26,
+
+  // Front L, Front R, Front C, Back L, Back R, LFE, Front LofC, Front RofC
+  CHANNEL_LAYOUT_7_1_WIDE_BACK = 27,
+
+  // Front L, Front R, Front C, Side L, Side R, Rear C, Back L, Back R.
+  CHANNEL_LAYOUT_OCTAGONAL = 28,
+
+  // Channels are not explicitly mapped to speakers.
+  CHANNEL_LAYOUT_DISCRETE = 29,
+
+  // Total number of layouts.
+  CHANNEL_LAYOUT_MAX  // Must always be last!
+};
+
+enum Channels {
+  LEFT = 0,
+  RIGHT,
+  CENTER,
+  LFE,
+  BACK_LEFT,
+  BACK_RIGHT,
+  LEFT_OF_CENTER,
+  RIGHT_OF_CENTER,
+  BACK_CENTER,
+  SIDE_LEFT,
+  SIDE_RIGHT,
+  CHANNELS_MAX
+};
+
+// Returns the expected channel position in an interleaved stream.  Values of -1
+// mean the channel at that index is not used for that layout.  Values range
+// from 0 to CHANNELS_MAX - 1.
+int ChannelOrder(ChannelLayout layout, Channels channel);
+
+// Returns the number of channels in a given ChannelLayout.
+int ChannelLayoutToChannelCount(ChannelLayout layout);
+
+// Given the number of channels, return the best layout,
+// or return CHANNEL_LAYOUT_UNSUPPORTED if there is no good match.
+ChannelLayout GuessChannelLayout(int channels);
+
+}  // namespace mp4_demuxer
+
+#endif  // MEDIA_BASE_CHANNEL_LAYOUT_H_
diff --git a/content/media/fmp4/demuxer/decrypt_config.cc b/content/media/fmp4/demuxer/decrypt_config.cc
new file mode 100644
index 000000000000..809725db1d58
--- /dev/null
+++ b/content/media/fmp4/demuxer/decrypt_config.cc
@@ -0,0 +1,25 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "mp4_demuxer/decrypt_config.h"
+
+namespace mp4_demuxer {
+
+DecryptConfig::DecryptConfig(const std::string& key_id,
+                             const std::string& iv,
+                             const int data_offset,
+                             const std::vector<SubsampleEntry>& subsamples)
+    : key_id_(key_id),
+      iv_(iv),
+      data_offset_(data_offset),
+      subsamples_(subsamples) {
+  DCHECK_GT(key_id.size(), 0u);
+  DCHECK(iv.size() == static_cast<size_t>(DecryptConfig::kDecryptionKeySize) ||
+        iv.empty());
+  DCHECK_GE(data_offset, 0);
+}
+
+DecryptConfig::~DecryptConfig() {}
+
+}  // namespace mp4_demuxer
diff --git a/content/media/fmp4/demuxer/decrypt_config.h b/content/media/fmp4/demuxer/decrypt_config.h
new file mode 100644
index 000000000000..3c56eb1f4a0b
--- /dev/null
+++ b/content/media/fmp4/demuxer/decrypt_config.h
@@ -0,0 +1,78 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef MEDIA_BASE_DECRYPT_CONFIG_H_
+#define MEDIA_BASE_DECRYPT_CONFIG_H_
+
+#include <string>
+#include <vector>
+
+#include "mp4_demuxer/basictypes.h"
+
+namespace mp4_demuxer {
+
+// The Common Encryption spec provides for subsample encryption, where portions
+// of a sample are set in cleartext. A SubsampleEntry specifies the number of
+// clear and encrypted bytes in each subsample. For decryption, all of the
+// encrypted bytes in a sample should be considered a single logical stream,
+// regardless of how they are divided into subsamples, and the clear bytes
+// should not be considered as part of decryption. This is logically equivalent
+// to concatenating all 'cypher_bytes' portions of subsamples, decrypting that
+// result, and then copying each byte from the decrypted block over the
+// position of the corresponding encrypted byte.
+struct SubsampleEntry {
+  uint32_t clear_bytes;
+  uint32_t cypher_bytes;
+};
+
+// Contains all information that a decryptor needs to decrypt a media sample.
+class DecryptConfig {
+ public:
+  // Keys are always 128 bits.
+  static const int kDecryptionKeySize = 16;
+
+  // |key_id| is the ID that references the decryption key for this sample.
+  // |iv| is the initialization vector defined by the encrypted format.
+  //   Currently |iv| must be 16 bytes as defined by WebM and ISO. Or must be
+  //   empty which signals an unencrypted frame.
+  // |data_offset| is the amount of data that should be discarded from the
+  //   head of the sample buffer before applying subsample information. A
+  //   decrypted buffer will be shorter than an encrypted buffer by this amount.
+  // |subsamples| defines the clear and encrypted portions of the sample as
+  //   described above. A decrypted buffer will be equal in size to the sum
+  //   of the subsample sizes.
+  //
+  // |data_offset| is applied before |subsamples|.
+  DecryptConfig(const std::string& key_id,
+                const std::string& iv,
+                const int data_offset,
+                const std::vector<SubsampleEntry>& subsamples);
+  ~DecryptConfig();
+
+  const std::string& key_id() const { return key_id_; }
+  const std::string& iv() const { return iv_; }
+  int data_offset() const { return data_offset_; }
+  const std::vector<SubsampleEntry>& subsamples() const { return subsamples_; }
+
+ private:
+  const std::string key_id_;
+
+  // Initialization vector.
+  const std::string iv_;
+
+  // TODO(fgalligan): Remove |data_offset_| if there is no plan to use it in
+  // the future.
+  // Amount of data to be discarded before applying subsample information.
+  const int data_offset_;
+
+  // Subsample information. May be empty for some formats, meaning entire frame
+  // (less data ignored by data_offset_) is encrypted.
+  const std::vector<SubsampleEntry> subsamples_;
+
+  DISALLOW_COPY_AND_ASSIGN(DecryptConfig);
+};
+
+}  // namespace mp4_demuxer
+
+#endif  // MEDIA_BASE_DECRYPT_CONFIG_H_
diff --git a/content/media/fmp4/demuxer/es_descriptor.cc b/content/media/fmp4/demuxer/es_descriptor.cc
new file mode 100644
index 000000000000..fb7c5f20fc9f
--- /dev/null
+++ b/content/media/fmp4/demuxer/es_descriptor.cc
@@ -0,0 +1,106 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "mp4_demuxer/es_descriptor.h"
+#include "mp4_demuxer/bit_reader.h"
+
+namespace mp4_demuxer {
+
+// The elementary stream size is specific by up to 4 bytes.
+// The MSB of a byte indicates if there are more bytes for the size.
+static bool ReadESSize(BitReader* reader, uint32_t* size) {
+  uint8_t msb;
+  uint8_t byte;
+
+  *size = 0;
+
+  for (size_t i = 0; i < 4; ++i) {
+    RCHECK(reader->ReadBits(1, &msb));
+    RCHECK(reader->ReadBits(7, &byte));
+    *size = (*size << 7) + byte;
+
+    if (msb == 0)
+      break;
+  }
+
+  return true;
+}
+
+ESDescriptor::ESDescriptor()
+    : object_type_(kForbidden) {
+}
+
+ESDescriptor::~ESDescriptor() {}
+
+bool ESDescriptor::Parse(const std::vector<uint8_t>& data) {
+  BitReader reader(&data[0], data.size());
+  uint8_t tag;
+  uint32_t size;
+  uint8_t stream_dependency_flag;
+  uint8_t url_flag;
+  uint8_t ocr_stream_flag;
+  uint16_t dummy;
+
+  RCHECK(reader.ReadBits(8, &tag));
+  RCHECK(tag == kESDescrTag);
+  RCHECK(ReadESSize(&reader, &size));
+
+  RCHECK(reader.ReadBits(16, &dummy));  // ES_ID
+  RCHECK(reader.ReadBits(1, &stream_dependency_flag));
+  RCHECK(reader.ReadBits(1, &url_flag));
+  RCHECK(!url_flag);  // We don't support url flag
+  RCHECK(reader.ReadBits(1, &ocr_stream_flag));
+  RCHECK(reader.ReadBits(5, &dummy));  // streamPriority
+
+  if (stream_dependency_flag)
+    RCHECK(reader.ReadBits(16, &dummy));  // dependsOn_ES_ID
+  if (ocr_stream_flag)
+    RCHECK(reader.ReadBits(16, &dummy));  // OCR_ES_Id
+
+  RCHECK(ParseDecoderConfigDescriptor(&reader));
+
+  return true;
+}
+
+uint8_t ESDescriptor::object_type() const {
+  return object_type_;
+}
+
+const std::vector<uint8_t>& ESDescriptor::decoder_specific_info() const {
+  return decoder_specific_info_;
+}
+
+bool ESDescriptor::ParseDecoderConfigDescriptor(BitReader* reader) {
+  uint8_t tag;
+  uint32_t size;
+  uint64_t dummy;
+
+  RCHECK(reader->ReadBits(8, &tag));
+  RCHECK(tag == kDecoderConfigDescrTag);
+  RCHECK(ReadESSize(reader, &size));
+
+  RCHECK(reader->ReadBits(8, &object_type_));
+  RCHECK(reader->ReadBits(64, &dummy));
+  RCHECK(reader->ReadBits(32, &dummy));
+  RCHECK(ParseDecoderSpecificInfo(reader));
+
+  return true;
+}
+
+bool ESDescriptor::ParseDecoderSpecificInfo(BitReader* reader) {
+  uint8_t tag;
+  uint32_t size;
+
+  RCHECK(reader->ReadBits(8, &tag));
+  RCHECK(tag == kDecoderSpecificInfoTag);
+  RCHECK(ReadESSize(reader, &size));
+
+  decoder_specific_info_.resize(size);
+  for (uint32_t i = 0; i < size; ++i)
+    RCHECK(reader->ReadBits(8, &decoder_specific_info_[i]));
+
+  return true;
+}
+
+}  // namespace mp4_demuxer
diff --git a/content/media/fmp4/demuxer/es_descriptor.h b/content/media/fmp4/demuxer/es_descriptor.h
new file mode 100644
index 000000000000..b213eba274ec
--- /dev/null
+++ b/content/media/fmp4/demuxer/es_descriptor.h
@@ -0,0 +1,53 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef MEDIA_MP4_ES_DESCRIPTOR_H_
+#define MEDIA_MP4_ES_DESCRIPTOR_H_
+
+#include <vector>
+
+#include "mp4_demuxer/basictypes.h"
+
+namespace mp4_demuxer {
+
+class BitReader;
+
+// The following values are extracted from ISO 14496 Part 1 Table 5 -
+// objectTypeIndication Values. Only values currently in use are included.
+enum ObjectType {
+  kForbidden = 0,
+  kISO_14496_3 = 0x40,  // MPEG4 AAC
+  kISO_13818_7_AAC_LC = 0x67  // MPEG2 AAC-LC
+};
+
+// This class parse object type and decoder specific information from an
+// elementary stream descriptor, which is usually contained in an esds box.
+// Please refer to ISO 14496 Part 1 7.2.6.5 for more details.
+class ESDescriptor {
+ public:
+  ESDescriptor();
+  ~ESDescriptor();
+
+  bool Parse(const std::vector<uint8_t>& data);
+
+  uint8_t object_type() const;
+  const std::vector<uint8_t>& decoder_specific_info() const;
+
+ private:
+  enum Tag {
+    kESDescrTag = 0x03,
+    kDecoderConfigDescrTag = 0x04,
+    kDecoderSpecificInfoTag = 0x05
+  };
+
+  bool ParseDecoderConfigDescriptor(BitReader* reader);
+  bool ParseDecoderSpecificInfo(BitReader* reader);
+
+  uint8_t object_type_;
+  std::vector<uint8_t> decoder_specific_info_;
+};
+
+}  // namespace mp4_demuxer
+
+#endif  // MEDIA_MP4_ES_DESCRIPTOR_H_
diff --git a/content/media/fmp4/demuxer/fourccs.h b/content/media/fmp4/demuxer/fourccs.h
new file mode 100644
index 000000000000..3c584aa462d6
--- /dev/null
+++ b/content/media/fmp4/demuxer/fourccs.h
@@ -0,0 +1,97 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef MEDIA_MP4_FOURCCS_H_
+#define MEDIA_MP4_FOURCCS_H_
+
+#include <string>
+
+namespace mp4_demuxer {
+
+enum FourCC {
+  FOURCC_NULL = 0,
+  FOURCC_AVC1 = 0x61766331,
+  FOURCC_AVCC = 0x61766343,
+  FOURCC_BLOC = 0x626C6F63,
+  FOURCC_CENC = 0x63656e63,
+  FOURCC_CO64 = 0x636f3634,
+  FOURCC_CTTS = 0x63747473,
+  FOURCC_DINF = 0x64696e66,
+  FOURCC_EDTS = 0x65647473,
+  FOURCC_ELST = 0x656c7374,
+  FOURCC_ENCA = 0x656e6361,
+  FOURCC_ENCV = 0x656e6376,
+  FOURCC_ESDS = 0x65736473,
+  FOURCC_FREE = 0x66726565,
+  FOURCC_FRMA = 0x66726d61,
+  FOURCC_FTYP = 0x66747970,
+  FOURCC_HDLR = 0x68646c72,
+  FOURCC_HINT = 0x68696e74,
+  FOURCC_IODS = 0x696f6473,
+  FOURCC_MDAT = 0x6d646174,
+  FOURCC_MDHD = 0x6d646864,
+  FOURCC_MDIA = 0x6d646961,
+  FOURCC_MECO = 0x6d65636f,
+  FOURCC_MEHD = 0x6d656864,
+  FOURCC_META = 0x6d657461,
+  FOURCC_MFHD = 0x6d666864,
+  FOURCC_MFRA = 0x6d667261,
+  FOURCC_MINF = 0x6d696e66,
+  FOURCC_MOOF = 0x6d6f6f66,
+  FOURCC_MOOV = 0x6d6f6f76,
+  FOURCC_MP4A = 0x6d703461,
+  FOURCC_MP4V = 0x6d703476,
+  FOURCC_MVEX = 0x6d766578,
+  FOURCC_MVHD = 0x6d766864,
+  FOURCC_PASP = 0x70617370,
+  FOURCC_PDIN = 0x7064696e,
+  FOURCC_PRFT = 0x70726674,
+  FOURCC_PSSH = 0x70737368,
+  FOURCC_SAIO = 0x7361696f,
+  FOURCC_SAIZ = 0x7361697a,
+  FOURCC_SCHI = 0x73636869,
+  FOURCC_SCHM = 0x7363686d,
+  FOURCC_SDTP = 0x73647470,
+  FOURCC_SIDX = 0x73696478,
+  FOURCC_SINF = 0x73696e66,
+  FOURCC_SKIP = 0x736b6970,
+  FOURCC_SMHD = 0x736d6864,
+  FOURCC_SOUN = 0x736f756e,
+  FOURCC_SSIX = 0x73736978,
+  FOURCC_STBL = 0x7374626c,
+  FOURCC_STCO = 0x7374636f,
+  FOURCC_STSC = 0x73747363,
+  FOURCC_STSD = 0x73747364,
+  FOURCC_STSS = 0x73747373,
+  FOURCC_STSZ = 0x7374737a,
+  FOURCC_STTS = 0x73747473,
+  FOURCC_STYP = 0x73747970,
+  FOURCC_TENC = 0x74656e63,
+  FOURCC_TFDT = 0x74666474,
+  FOURCC_TFHD = 0x74666864,
+  FOURCC_TKHD = 0x746b6864,
+  FOURCC_TRAF = 0x74726166,
+  FOURCC_TRAK = 0x7472616b,
+  FOURCC_TREX = 0x74726578,
+  FOURCC_TRUN = 0x7472756e,
+  FOURCC_UDTA = 0x75647461,
+  FOURCC_UUID = 0x75756964,
+  FOURCC_VIDE = 0x76696465,
+  FOURCC_VMHD = 0x766d6864,
+  FOURCC_WIDE = 0x77696465,
+};
+
+const inline std::string FourCCToString(FourCC fourcc) {
+  char buf[5];
+  buf[0] = (fourcc >> 24) & 0xff;
+  buf[1] = (fourcc >> 16) & 0xff;
+  buf[2] = (fourcc >> 8) & 0xff;
+  buf[3] = (fourcc) & 0xff;
+  buf[4] = 0;
+  return std::string(buf);
+}
+
+}  // namespace mp4_demuxer
+
+#endif  // MEDIA_MP4_FOURCCS_H_
diff --git a/content/media/fmp4/demuxer/mp4_demuxer.cc b/content/media/fmp4/demuxer/mp4_demuxer.cc
new file mode 100644
index 000000000000..b1994644b077
--- /dev/null
+++ b/content/media/fmp4/demuxer/mp4_demuxer.cc
@@ -0,0 +1,535 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+#include "mp4_demuxer/mp4_demuxer.h"
+
+#include "mp4_demuxer/Streams.h"
+#include "mp4_demuxer/box_reader.h"
+#include "mp4_demuxer/box_definitions.h"
+#include "mp4_demuxer/basictypes.h"
+#include "mp4_demuxer/es_descriptor.h"
+#include "mp4_demuxer/video_util.h"
+#include "mp4_demuxer/track_run_iterator.h"
+#include "mp4_demuxer/audio_decoder_config.h"
+#include "mp4_demuxer/video_decoder_config.h"
+
+#include <assert.h>
+
+using namespace std;
+
+namespace mp4_demuxer {
+
+
+MP4Sample::MP4Sample(Microseconds _decode_timestamp,
+                     Microseconds _composition_timestamp,
+                     Microseconds _duration,
+                     int64_t _byte_offset,
+                     std::vector<uint8_t>* _data,
+                     TrackType _type,
+                     DecryptConfig* _decrypt_config,
+                     bool _is_sync_point)
+  : decode_timestamp(_decode_timestamp),
+    composition_timestamp(_composition_timestamp),
+    duration(_duration),
+    byte_offset(_byte_offset),
+    data(_data),
+    type(_type),
+    decrypt_config(_decrypt_config),
+    is_sync_point(_is_sync_point)
+{
+}
+
+MP4Sample::~MP4Sample()
+{
+}
+
+bool MP4Sample::is_encrypted() const {
+  return decrypt_config != nullptr;
+};
+
+
+
+
+MP4Demuxer::MP4Demuxer(Stream* stream)
+  : state_(kWaitingForInit),
+    stream_(stream),
+    stream_offset_(0),
+    duration_(InfiniteMicroseconds),
+    moof_head_(0),
+    mdat_tail_(0),
+    audio_track_id_(0),
+    video_track_id_(0),
+    audio_frameno(0),
+    video_frameno(0),
+    has_audio_(false),
+    has_sbr_(false),
+    is_audio_track_encrypted_(false),
+    has_video_(false),
+    is_video_track_encrypted_(false),
+    can_seek_(false)
+{
+}
+
+MP4Demuxer::~MP4Demuxer()
+{
+}
+
+bool MP4Demuxer::Init()
+{
+  ChangeState(kParsingBoxes);
+
+  // Read from the stream until the moov box is read. This will have the
+  // header data that we need to initialize the decoders.
+  bool ok = true;
+  const int64_t length = stream_->Length();
+  while (ok &&
+         stream_offset_ < length &&
+         !moov_ &&
+         state_ == kParsingBoxes) {
+    ok = ParseBox();
+  }
+  return state_  >= kParsingBoxes &&
+         state_ < kError;
+}
+
+void MP4Demuxer::Reset() {
+  moov_ = nullptr;
+  runs_ = nullptr;
+  stream_offset_; // TODO; Not sure if this needs to be reset?
+  DMX_LOG("Warning: resetting stream_offset_\n");
+  moof_head_ = 0;
+  mdat_tail_ = 0;
+}
+
+// TODO(xhwang): Figure out the init data type appropriately once it's spec'ed.
+static const char kMp4InitDataType[] = "video/mp4";
+
+bool MP4Demuxer::ParseMoov(BoxReader* reader) {
+  RCHECK(state_ < kError);
+  moov_ = new Movie();
+  RCHECK(moov_->Parse(reader));
+  runs_ = new TrackRunIterator(moov_.get());
+
+  has_audio_ = false;
+  has_video_ = false;
+
+  for (std::vector<Track>::const_iterator track = moov_->tracks.begin();
+       track != moov_->tracks.end(); ++track) {
+    // TODO(strobe): Only the first audio and video track present in a file are
+    // used. (Track selection is better accomplished via Source IDs, though, so
+    // adding support for track selection within a stream is low-priority.)
+    const SampleDescription& samp_descr =
+        track->media.information.sample_table.description;
+
+    // TODO(strobe): When codec reconfigurations are supported, detect and send
+    // a codec reconfiguration for fragments using a sample description index
+    // different from the previous one
+    size_t desc_idx = 0;
+    for (size_t t = 0; t < moov_->extends.tracks.size(); t++) {
+      const TrackExtends& trex = moov_->extends.tracks[t];
+      if (trex.track_id == track->header.track_id) {
+        desc_idx = trex.default_sample_description_index;
+        break;
+      }
+    }
+    RCHECK(desc_idx > 0);
+    desc_idx -= 1;  // BMFF descriptor index is one-based
+
+    if (track->media.handler.type == kAudio && !audio_config_.IsValidConfig()) {
+      RCHECK(!samp_descr.audio_entries.empty());
+
+      // It is not uncommon to find otherwise-valid files with incorrect sample
+      // description indices, so we fail gracefully in that case.
+      if (desc_idx >= samp_descr.audio_entries.size())
+        desc_idx = 0;
+      const AudioSampleEntry& entry = samp_descr.audio_entries[desc_idx];
+      const AAC& aac = entry.esds.aac;
+
+      if (!(entry.format == FOURCC_MP4A ||
+            (entry.format == FOURCC_ENCA &&
+             entry.sinf.format.format == FOURCC_MP4A))) {
+        DMX_LOG("Unsupported audio format 0x%x in stsd box\n", entry.format);
+        return false;
+      }
+
+      int audio_type = entry.esds.object_type;
+      DMX_LOG("audio_type 0x%x\n", audio_type);
+
+      const std::vector<uint8_t>& asc = aac.AudioSpecificConfig();
+      if (asc.size() > 0) {
+        DMX_LOG("audio specific config:");
+        for (unsigned i=0; i<asc.size(); ++i) {
+          DMX_LOG(" 0x%x", asc[i]);
+        }
+        DMX_LOG("\n");
+      }
+
+      // Check if it is MPEG4 AAC defined in ISO 14496 Part 3 or
+      // supported MPEG2 AAC varients.
+      if (audio_type != kISO_14496_3 && audio_type != kISO_13818_7_AAC_LC) {
+        DMX_LOG("Unsupported audio object type 0x%x  in esds.", audio_type);
+        return false;
+      }
+
+      SampleFormat sample_format;
+      if (entry.samplesize == 8) {
+        sample_format = kSampleFormatU8;
+      } else if (entry.samplesize == 16) {
+        sample_format = kSampleFormatS16;
+      } else if (entry.samplesize == 32) {
+        sample_format = kSampleFormatS32;
+      } else {
+        DMX_LOG("Unsupported sample size.\n");
+        return false;
+      }
+
+      is_audio_track_encrypted_ = entry.sinf.info.track_encryption.is_encrypted;
+      DMX_LOG("is_audio_track_encrypted_: %d\n", is_audio_track_encrypted_);
+      // TODO(cpearce): Chromium checks the MIME type specified to see if it contains
+      // the codec info that tells us it's using SBR. We should check for that
+      // here too.
+      audio_config_.Initialize(kCodecAAC, sample_format,
+                               aac.GetChannelLayout(has_sbr_),
+                               aac.GetOutputSamplesPerSecond(has_sbr_),
+                               &asc.front(),
+                               asc.size(),
+                               is_audio_track_encrypted_);
+      has_audio_ = true;
+      audio_track_id_ = track->header.track_id;
+    }
+    if (track->media.handler.type == kVideo && !video_config_.IsValidConfig()) {
+      RCHECK(!samp_descr.video_entries.empty());
+      if (desc_idx >= samp_descr.video_entries.size())
+        desc_idx = 0;
+      const VideoSampleEntry& entry = samp_descr.video_entries[desc_idx];
+
+      if (!(entry.format == FOURCC_AVC1 ||
+            (entry.format == FOURCC_ENCV &&
+             entry.sinf.format.format == FOURCC_AVC1))) {
+        DMX_LOG("Unsupported video format 0x%x in stsd box.\n", entry.format);
+        return false;
+      }
+
+      // TODO(strobe): Recover correct crop box
+      IntSize coded_size(entry.width, entry.height);
+      IntRect visible_rect(0, 0, coded_size.width(), coded_size.height());
+      IntSize natural_size = GetNaturalSize(visible_rect.size(),
+                                            entry.pixel_aspect.h_spacing,
+                                            entry.pixel_aspect.v_spacing);
+      is_video_track_encrypted_ = entry.sinf.info.track_encryption.is_encrypted;
+      DMX_LOG("is_video_track_encrypted_: %d\n", is_video_track_encrypted_);
+      video_config_.Initialize(kCodecH264, H264PROFILE_MAIN,  VideoFrameFormat::YV12,
+                              coded_size, visible_rect, natural_size,
+                              // No decoder-specific buffer needed for AVC;
+                              // SPS/PPS are embedded in the video stream
+                              NULL, 0, is_video_track_encrypted_, true);
+      has_video_ = true;
+      video_track_id_ = track->header.track_id;
+    }
+  }
+
+  //RCHECK(config_cb_.Run(audio_config, video_config));
+
+  if (moov_->extends.header.fragment_duration > 0) {
+    duration_ = MicrosecondsFromRational(moov_->extends.header.fragment_duration,
+                                     moov_->header.timescale);
+  } else if (moov_->header.duration > 0 &&
+             moov_->header.duration != kuint64max) {
+    duration_ = MicrosecondsFromRational(moov_->header.duration,
+                                     moov_->header.timescale);
+  } else {
+    duration_ = InfiniteMicroseconds;
+  }
+
+  //if (!init_cb_.is_null())
+  //  base::ResetAndReturn(&init_cb_).Run(true, duration);
+
+  return true;
+}
+
+Microseconds
+MP4Demuxer::Duration() const {
+  return duration_;
+}
+
+bool MP4Demuxer::ParseMoof(BoxReader* reader) {
+  RCHECK(state_ < kError);
+  RCHECK(moov_.get());  // Must already have initialization segment
+  MovieFragment moof;
+  RCHECK(moof.Parse(reader));
+  RCHECK(runs_->Init(moof));
+  //new_segment_cb_.Run(runs_->GetMinDecodeTimestamp());
+  ChangeState(kEmittingSamples);
+  return true;
+}
+
+bool MP4Demuxer::ParseBox() {
+  RCHECK(state_ < kError);
+  bool err = false;
+  nsAutoPtr<BoxReader> reader(BoxReader::ReadTopLevelBox(stream_,
+                                                         stream_offset_,
+                                                         &err));
+  if (!reader || err) {
+    DMX_LOG("Failed to read box at offset=%lld", stream_offset_);
+    return false;
+  }
+  string type = FourCCToString(reader->type());
+
+  DMX_LOG("offset=%lld version=0x%x flags=0x%x size=%d",
+      stream_offset_, (uint32_t)reader->version(),
+      reader->flags(), reader->size());
+
+  if (reader->type() == FOURCC_MOOV) {
+    DMX_LOG("ParseMoov\n");
+    if (!ParseMoov(reader.get())) {
+      DMX_LOG("ParseMoov failed\n");
+      return false;
+    }
+  } else if (reader->type() == FOURCC_MOOF) {
+    DMX_LOG("MOOF encountered\n.");
+    moof_head_ = stream_offset_;
+    if (!ParseMoof(reader.get())) {
+      DMX_LOG("ParseMoof failed\n");
+      return false;
+    }
+    mdat_tail_ = stream_offset_ + reader->size();
+  }
+
+  stream_offset_ += reader->size();
+
+  return true;
+}
+
+bool MP4Demuxer::EmitSample(nsAutoPtr<MP4Sample>* sample) {
+  bool ok = true;
+  if (!runs_->IsRunValid()) {
+
+    // Flush any buffers we've gotten in this chunk so that buffers don't
+    // cross NewSegment() calls
+    //ok = SendAndFlushSamples(/*audio_buffers, video_buffers*/);
+    //if (!ok)
+    //  return false;
+
+    ChangeState(kParsingBoxes);
+    //end_of_segment_cb_.Run();
+    return true;
+  }
+
+  if (!runs_->IsSampleValid()) {
+    runs_->AdvanceRun();
+    return true;
+  }
+
+  bool audio = has_audio_ && audio_track_id_ == runs_->track_id();
+  bool video = has_video_ && video_track_id_ == runs_->track_id();
+
+  // Skip this entire track if it's not one we're interested in
+  if (!audio && !video)
+    runs_->AdvanceRun();
+
+  // Attempt to cache the auxiliary information first. Aux info is usually
+  // placed in a contiguous block before the sample data, rather than being
+  // interleaved. If we didn't cache it, this would require that we retain the
+  // start of the segment buffer while reading samples. Aux info is typically
+  // quite small compared to sample data, so this pattern is useful on
+  // memory-constrained devices where the source buffer consumes a substantial
+  // portion of the total system memory.
+  if (runs_->AuxInfoNeedsToBeCached()) {
+    int64_t aux_info_offset = runs_->aux_info_offset() + moof_head_;
+    if (stream_->Length() - aux_info_offset < runs_->aux_info_size()) {
+      return false;
+    }
+
+    return runs_->CacheAuxInfo(stream_, moof_head_);
+  }
+
+  nsAutoPtr<DecryptConfig> decrypt_config;
+  std::vector<SubsampleEntry> subsamples;
+  if (runs_->is_encrypted()) {
+    runs_->GetDecryptConfig(decrypt_config);
+    subsamples = decrypt_config->subsamples();
+  }
+
+  nsAutoPtr<vector<uint8_t>> frame_buf(new vector<uint8_t>());
+  const int64_t sample_offset = runs_->sample_offset() + moof_head_;
+  StreamReader reader(stream_, sample_offset, runs_->sample_size());
+  reader.ReadVec(frame_buf, runs_->sample_size());
+
+  if (video) {
+    if (!PrepareAVCBuffer(runs_->video_description().avcc,
+                          frame_buf, &subsamples)) {
+      DMX_LOG("Failed to prepare AVC sample for decode\n");
+      return false;
+    }
+  }
+
+  if (audio) {
+    if (!PrepareAACBuffer(runs_->audio_description().esds.aac,
+                          frame_buf, &subsamples)) {
+      DMX_LOG("Failed to prepare AAC sample for decode\n");
+      return false;
+    }
+  }
+
+  const bool is_encrypted = (audio && is_audio_track_encrypted_) ||
+                            (video && is_video_track_encrypted_);
+  assert(runs_->is_encrypted() == is_encrypted);
+  if (decrypt_config) {
+    if (!subsamples.empty()) {
+      // Create a new config with the updated subsamples.
+      decrypt_config = new DecryptConfig(decrypt_config->key_id(),
+                                         decrypt_config->iv(),
+                                         decrypt_config->data_offset(),
+                                         subsamples);
+    }
+    // else, use the existing config.
+  } else if (is_encrypted) {
+    // The media pipeline requires a DecryptConfig with an empty |iv|.
+    // TODO(ddorwin): Refactor so we do not need a fake key ID ("1");
+    decrypt_config = new DecryptConfig("1", "", 0, std::vector<SubsampleEntry>());
+  }
+
+  assert(audio || video);
+  *sample = new MP4Sample(runs_->dts(),
+                          runs_->cts(),
+                          runs_->duration(),
+                          sample_offset,
+                          frame_buf.forget(),
+                          audio ? kAudio : kVideo,
+                          decrypt_config.forget(),
+                          runs_->is_keyframe());
+  runs_->AdvanceSample();
+  return true;
+}
+
+bool MP4Demuxer::PrepareAVCBuffer(
+    const AVCDecoderConfigurationRecord& avc_config,
+    std::vector<uint8_t>* frame_buf,
+    std::vector<SubsampleEntry>* subsamples) const {
+  // Convert the AVC NALU length fields to Annex B headers, as expected by
+  // decoding libraries. Since this may enlarge the size of the buffer, we also
+  // update the clear byte count for each subsample if encryption is used to
+  // account for the difference in size between the length prefix and Annex B
+  // start code.
+  RCHECK(AVC::ConvertFrameToAnnexB(avc_config.length_size, frame_buf));
+  if (!subsamples->empty()) {
+    const int nalu_size_diff = 4 - avc_config.length_size;
+    size_t expected_size = runs_->sample_size() +
+        subsamples->size() * nalu_size_diff;
+    RCHECK(frame_buf->size() == expected_size);
+    for (size_t i = 0; i < subsamples->size(); i++)
+      (*subsamples)[i].clear_bytes += nalu_size_diff;
+  }
+
+  if (runs_->is_keyframe()) {
+    // If this is a keyframe, we (re-)inject SPS and PPS headers at the start of
+    // a frame. If subsample info is present, we also update the clear byte
+    // count for that first subsample.
+    std::vector<uint8_t> param_sets;
+    RCHECK(AVC::ConvertConfigToAnnexB(avc_config, &param_sets));
+    frame_buf->insert(frame_buf->begin(),
+                      param_sets.begin(), param_sets.end());
+    if (!subsamples->empty())
+      (*subsamples)[0].clear_bytes += param_sets.size();
+  }
+  return true;
+}
+
+bool MP4Demuxer::PrepareAACBuffer(const AAC& aac_config,
+                                  std::vector<uint8_t>* frame_buf,
+                                  std::vector<SubsampleEntry>* subsamples) const {
+  // Append an ADTS header to every audio sample.
+  RCHECK(aac_config.ConvertEsdsToADTS(frame_buf));
+
+  // As above, adjust subsample information to account for the headers. AAC is
+  // not required to use subsample encryption, so we may need to add an entry.
+  if (subsamples->empty()) {
+    SubsampleEntry entry;
+    entry.clear_bytes = AAC::kADTSHeaderSize;
+    entry.cypher_bytes = frame_buf->size() - AAC::kADTSHeaderSize;
+    subsamples->push_back(entry);
+  } else {
+    (*subsamples)[0].clear_bytes += AAC::kADTSHeaderSize;
+  }
+  return true;
+}
+
+// Reads the metadata boxes.
+bool MP4Demuxer::Demux(nsAutoPtr<MP4Sample>* sample,
+                       bool* end_of_stream)
+{
+  RCHECK(state_ < kError);
+  assert(state_ > kWaitingForInit);
+  *end_of_stream = false;
+
+  const int64_t length = stream_->Length();
+  bool ok = true;
+  while (ok) {
+    if (state_ == kParsingBoxes) {
+      if (stream_offset_ < length) {
+        ok = ParseBox();
+      } else {
+        DMX_LOG("End of stream reached.\n");
+        *end_of_stream = true;
+        break;
+      }
+    } else {
+      DCHECK_EQ(kEmittingSamples, state_);
+      ok = EmitSample(sample);
+      if (ok && *sample) {
+        // Got a sample, return.
+        break;
+      }
+    }
+  }
+
+  if (!ok) {
+    DMX_LOG("Error demuxing stream\n");
+    ChangeState(kError);
+    return false;
+  }
+
+  return true;
+}
+
+void MP4Demuxer::ChangeState(State new_state) {
+  DMX_LOG("Demuxer changing state: %d\n", new_state);
+  state_ = new_state;
+  if (state_ == kError) {
+    Reset();
+  }
+}
+
+const AudioDecoderConfig&
+MP4Demuxer::AudioConfig() const
+{
+  return audio_config_;
+}
+
+const VideoDecoderConfig&
+MP4Demuxer::VideoConfig() const
+{
+  return video_config_;
+}
+
+bool
+MP4Demuxer::HasAudio() const
+{
+  return has_audio_;
+}
+
+bool
+MP4Demuxer::HasVideo() const
+{
+  return has_video_;
+}
+
+bool
+MP4Demuxer::CanSeek() const
+{
+  return can_seek_;
+}
+
+} // namespace mp4_demuxer
diff --git a/content/media/fmp4/demuxer/mp4_demuxer.h b/content/media/fmp4/demuxer/mp4_demuxer.h
new file mode 100644
index 000000000000..05d90df2b61b
--- /dev/null
+++ b/content/media/fmp4/demuxer/mp4_demuxer.h
@@ -0,0 +1,159 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef MEDIA_MP4_MP4DEMUXER_H
+#define MEDIA_MP4_MP4DEMUXER_H
+
+#include "mp4_demuxer/audio_decoder_config.h"
+#include "mp4_demuxer/video_decoder_config.h"
+#include "mp4_demuxer/decrypt_config.h"
+#include "mp4_demuxer/box_definitions.h"
+
+
+#include "nsAutoPtr.h"
+#include <memory>
+
+namespace mp4_demuxer {
+
+class Stream;
+class BoxReader;
+struct Movie;
+class TrackRunIterator;
+struct AVCDecoderConfigurationRecord;
+class AAC;
+
+// Constructs an MP4 Sample. Note this assumes ownership of the |data| vector
+// passed in.
+struct MP4Sample {
+  MP4Sample(Microseconds decode_timestamp,
+            Microseconds composition_timestamp,
+            Microseconds duration,
+            int64_t byte_offset,
+            std::vector<uint8_t>* data,
+            TrackType type,
+            DecryptConfig* decrypt_config,
+            bool is_sync_point);
+  ~MP4Sample();
+
+  const Microseconds decode_timestamp;
+
+  const Microseconds composition_timestamp;
+
+  const Microseconds duration;
+
+  // Offset of sample in byte stream.
+  const int64_t byte_offset;
+
+  // Raw demuxed data.
+  const nsAutoPtr<std::vector<uint8_t>> data;
+
+  // Is this an audio or video sample?
+  const TrackType type;
+
+  const nsAutoPtr<DecryptConfig> decrypt_config;
+
+  // Whether this is a keyframe or not.
+  const bool is_sync_point;
+
+  bool is_encrypted() const;
+};
+
+class MP4Demuxer {
+public:
+  MP4Demuxer(Stream* stream);
+  ~MP4Demuxer();
+
+  bool Init();
+
+  // Reads the metadata boxes, up to the first fragment.
+  bool Demux(nsAutoPtr<MP4Sample>* sample,
+             bool* end_of_stream);
+
+  bool HasAudio() const;
+  const AudioDecoderConfig& AudioConfig() const;
+
+  bool HasVideo() const;
+  const VideoDecoderConfig& VideoConfig() const;
+
+  Microseconds Duration() const;
+
+  bool CanSeek() const;
+
+private:
+
+  enum State {
+    kWaitingForInit,
+    kParsingBoxes,
+    kEmittingSamples,
+    kError
+  };
+
+  // Parses the bitstream. Returns false on error.
+  bool Parse(nsAutoPtr<MP4Sample>* sample,
+             bool& end_of_stream);
+
+  void ChangeState(State new_state);
+
+  // Return true on success, false on failure.
+  bool ParseBox();
+  bool ParseMoov(BoxReader* reader);
+  bool ParseMoof(BoxReader* reader);
+
+  void Reset();
+
+  bool EmitSample(nsAutoPtr<MP4Sample>* sample);
+
+  bool PrepareAACBuffer(const AAC& aac_config,
+                        std::vector<uint8_t>* frame_buf,
+                        std::vector<SubsampleEntry>* subsamples) const;
+
+  bool PrepareAVCBuffer(const AVCDecoderConfigurationRecord& avc_config,
+                        std::vector<uint8_t>* frame_buf,
+                        std::vector<SubsampleEntry>* subsamples) const;
+
+  State state_;
+  
+  // Stream abstraction that we read from. It is the responsibility of the
+  // owner of the demuxer to ensure that it stays alive for the lifetime
+  // of the demuxer.
+  Stream* stream_;
+  int64_t stream_offset_;
+
+  Microseconds duration_;
+
+  // These two parameters are only valid in the |kEmittingSegments| state.
+  //
+  // |moof_head_| is the offset of the start of the most recently parsed moof
+  // block. All byte offsets in sample information are relative to this offset,
+  // as mandated by the Media Source spec.
+  int64_t moof_head_;
+  // |mdat_tail_| is the stream offset of the end of the current 'mdat' box.
+  // Valid iff it is greater than the head of the queue.
+  int64_t mdat_tail_;
+
+  nsAutoPtr<Movie> moov_;
+  nsAutoPtr<TrackRunIterator> runs_;
+
+  uint32_t audio_track_id_;
+  uint32_t video_track_id_;
+
+  uint32_t audio_frameno;
+  uint32_t video_frameno;
+
+  AudioDecoderConfig audio_config_;
+  VideoDecoderConfig video_config_;
+
+  bool has_audio_;
+  bool has_sbr_; // NOTE: This is not initialized!
+  bool is_audio_track_encrypted_;
+
+  bool has_video_;
+  bool is_video_track_encrypted_;
+
+  bool can_seek_;
+};
+
+} // mp4_demuxer
+
+#endif // MEDIA_MP4_MP4DEMUXER_H
diff --git a/content/media/fmp4/demuxer/track_run_iterator.cc b/content/media/fmp4/demuxer/track_run_iterator.cc
new file mode 100644
index 000000000000..e0eaa523d3e6
--- /dev/null
+++ b/content/media/fmp4/demuxer/track_run_iterator.cc
@@ -0,0 +1,451 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "mp4_demuxer/track_run_iterator.h"
+#include "mp4_demuxer/basictypes.h"
+#include "mp4_demuxer/Streams.h"
+
+#include <algorithm>
+#include <memory>
+#include <assert.h>
+
+using namespace std;
+
+namespace mp4_demuxer {
+
+static const uint32_t kSampleIsDifferenceSampleFlagMask = 0x10000;
+
+struct SampleInfo {
+  int size;
+  int duration;
+  int cts_offset;
+  bool is_keyframe;
+};
+
+struct TrackRunInfo {
+  uint32_t track_id;
+  std::vector<SampleInfo> samples;
+  int64_t timescale;
+  int64_t start_dts;
+  int64_t sample_start_offset;
+
+  bool is_audio;
+  const AudioSampleEntry* audio_description;
+  const VideoSampleEntry* video_description;
+
+  int64_t aux_info_start_offset;  // Only valid if aux_info_total_size > 0.
+  int aux_info_default_size;
+  std::vector<uint8_t> aux_info_sizes;  // Populated if default_size == 0.
+  int aux_info_total_size;
+
+  TrackRunInfo();
+  ~TrackRunInfo();
+};
+
+TrackRunInfo::TrackRunInfo()
+    : track_id(0),
+      timescale(-1),
+      start_dts(-1),
+      sample_start_offset(-1),
+      is_audio(false),
+      aux_info_start_offset(-1),
+      aux_info_default_size(-1),
+      aux_info_total_size(-1) {
+}
+TrackRunInfo::~TrackRunInfo() {}
+
+Microseconds TimeDeltaFromRational(int64_t numer, int64_t denom) {
+  DCHECK_LT((numer > 0 ? numer : -numer),
+            kint64max / MicrosecondsPerSecond);
+  return MicrosecondsPerSecond * numer / denom;
+}
+
+TrackRunIterator::TrackRunIterator(const Movie* moov)
+    : moov_(moov), sample_offset_(0) {
+  CHECK(moov);
+}
+
+TrackRunIterator::~TrackRunIterator() {}
+
+static void PopulateSampleInfo(const TrackExtends& trex,
+                               const TrackFragmentHeader& tfhd,
+                               const TrackFragmentRun& trun,
+                               const int64_t edit_list_offset,
+                               const uint32_t i,
+                               SampleInfo* sample_info) {
+  if (i < trun.sample_sizes.size()) {
+    sample_info->size = trun.sample_sizes[i];
+  } else if (tfhd.default_sample_size > 0) {
+    sample_info->size = tfhd.default_sample_size;
+  } else {
+    sample_info->size = trex.default_sample_size;
+  }
+
+  if (i < trun.sample_durations.size()) {
+    sample_info->duration = trun.sample_durations[i];
+  } else if (tfhd.default_sample_duration > 0) {
+    sample_info->duration = tfhd.default_sample_duration;
+  } else {
+    sample_info->duration = trex.default_sample_duration;
+  }
+
+  if (i < trun.sample_composition_time_offsets.size()) {
+    sample_info->cts_offset = trun.sample_composition_time_offsets[i];
+  } else {
+    sample_info->cts_offset = 0;
+  }
+  sample_info->cts_offset += edit_list_offset;
+
+  uint32_t flags;
+  if (i < trun.sample_flags.size()) {
+    flags = trun.sample_flags[i];
+  } else if (tfhd.has_default_sample_flags) {
+    flags = tfhd.default_sample_flags;
+  } else {
+    flags = trex.default_sample_flags;
+  }
+  sample_info->is_keyframe = !(flags & kSampleIsDifferenceSampleFlagMask);
+}
+
+// In well-structured encrypted media, each track run will be immediately
+// preceded by its auxiliary information; this is the only optimal storage
+// pattern in terms of minimum number of bytes from a serial stream needed to
+// begin playback. It also allows us to optimize caching on memory-constrained
+// architectures, because we can cache the relatively small auxiliary
+// information for an entire run and then discard data from the input stream,
+// instead of retaining the entire 'mdat' box.
+//
+// We optimize for this situation (with no loss of generality) by sorting track
+// runs during iteration in order of their first data offset (either sample data
+// or auxiliary data).
+class CompareMinTrackRunDataOffset {
+ public:
+  bool operator()(const TrackRunInfo& a, const TrackRunInfo& b) {
+    int64_t a_aux = a.aux_info_total_size ? a.aux_info_start_offset : kint64max;
+    int64_t b_aux = b.aux_info_total_size ? b.aux_info_start_offset : kint64max;
+
+    int64_t a_lesser = std::min(a_aux, a.sample_start_offset);
+    int64_t a_greater = std::max(a_aux, a.sample_start_offset);
+    int64_t b_lesser = std::min(b_aux, b.sample_start_offset);
+    int64_t b_greater = std::max(b_aux, b.sample_start_offset);
+
+    if (a_lesser == b_lesser) return a_greater < b_greater;
+    return a_lesser < b_lesser;
+  }
+};
+
+bool TrackRunIterator::Init(const MovieFragment& moof) {
+  runs_.clear();
+
+  for (size_t i = 0; i < moof.tracks.size(); i++) {
+    const TrackFragment& traf = moof.tracks[i];
+
+    const Track* trak = NULL;
+    for (size_t t = 0; t < moov_->tracks.size(); t++) {
+      if (moov_->tracks[t].header.track_id == traf.header.track_id)
+        trak = &moov_->tracks[t];
+    }
+    RCHECK(trak);
+
+    const TrackExtends* trex = NULL;
+    for (size_t t = 0; t < moov_->extends.tracks.size(); t++) {
+      if (moov_->extends.tracks[t].track_id == traf.header.track_id)
+        trex = &moov_->extends.tracks[t];
+    }
+    RCHECK(trex);
+
+    const SampleDescription& stsd =
+        trak->media.information.sample_table.description;
+    if (stsd.type != kAudio && stsd.type != kVideo) {
+      DMX_LOG("Skipping unhandled track type\n");
+      continue;
+    }
+    size_t desc_idx = traf.header.sample_description_index;
+    if (!desc_idx) desc_idx = trex->default_sample_description_index;
+    RCHECK(desc_idx > 0);  // Descriptions are one-indexed in the file
+    desc_idx -= 1;
+
+    // Process edit list to remove CTS offset introduced in the presence of
+    // B-frames (those that contain a single edit with a nonnegative media
+    // time). Other uses of edit lists are not supported, as they are
+    // both uncommon and better served by higher-level protocols.
+    int64_t edit_list_offset = 0;
+    const std::vector<EditListEntry>& edits = trak->edit.list.edits;
+    if (!edits.empty()) {
+      if (edits.size() > 1)
+        DMX_LOG("Multi-entry edit box detected; some components ignored.\n");
+
+      if (edits[0].media_time < 0) {
+        DMX_LOG("Empty edit list entry ignored.\n");
+      } else {
+        edit_list_offset = -edits[0].media_time;
+      }
+    }
+
+    int64_t run_start_dts = traf.decode_time.decode_time;
+    int sample_count_sum = 0;
+    for (size_t j = 0; j < traf.runs.size(); j++) {
+      const TrackFragmentRun& trun = traf.runs[j];
+      TrackRunInfo tri;
+      tri.track_id = traf.header.track_id;
+      tri.timescale = trak->media.header.timescale;
+      tri.start_dts = run_start_dts;
+      tri.sample_start_offset = trun.data_offset;
+
+      tri.is_audio = (stsd.type == kAudio);
+      if (tri.is_audio) {
+        RCHECK(!stsd.audio_entries.empty());
+        if (desc_idx > stsd.audio_entries.size())
+          desc_idx = 0;
+        tri.audio_description = &stsd.audio_entries[desc_idx];
+      } else {
+        RCHECK(!stsd.video_entries.empty());
+        if (desc_idx > stsd.video_entries.size())
+          desc_idx = 0;
+        tri.video_description = &stsd.video_entries[desc_idx];
+      }
+
+      // Collect information from the auxiliary_offset entry with the same index
+      // in the 'saiz' container as the current run's index in the 'trun'
+      // container, if it is present.
+      if (traf.auxiliary_offset.offsets.size() > j) {
+        // There should be an auxiliary info entry corresponding to each sample
+        // in the auxiliary offset entry's corresponding track run.
+        RCHECK(traf.auxiliary_size.sample_count >=
+               sample_count_sum + trun.sample_count);
+        tri.aux_info_start_offset = traf.auxiliary_offset.offsets[j];
+        tri.aux_info_default_size =
+            traf.auxiliary_size.default_sample_info_size;
+        if (tri.aux_info_default_size == 0) {
+          const std::vector<uint8_t>& sizes =
+              traf.auxiliary_size.sample_info_sizes;
+          tri.aux_info_sizes.insert(tri.aux_info_sizes.begin(),
+              sizes.begin() + sample_count_sum,
+              sizes.begin() + sample_count_sum + trun.sample_count);
+        }
+
+        // If the default info size is positive, find the total size of the aux
+        // info block from it, otherwise sum over the individual sizes of each
+        // aux info entry in the aux_offset entry.
+        if (tri.aux_info_default_size) {
+          tri.aux_info_total_size =
+              tri.aux_info_default_size * trun.sample_count;
+        } else {
+          tri.aux_info_total_size = 0;
+          for (size_t k = 0; k < trun.sample_count; k++) {
+            tri.aux_info_total_size += tri.aux_info_sizes[k];
+          }
+        }
+      } else {
+        tri.aux_info_start_offset = -1;
+        tri.aux_info_total_size = 0;
+      }
+
+      tri.samples.resize(trun.sample_count);
+      for (size_t k = 0; k < trun.sample_count; k++) {
+        PopulateSampleInfo(*trex, traf.header, trun, edit_list_offset,
+                           k, &tri.samples[k]);
+        run_start_dts += tri.samples[k].duration;
+      }
+      runs_.push_back(tri);
+      sample_count_sum += trun.sample_count;
+    }
+  }
+
+  std::sort(runs_.begin(), runs_.end(), CompareMinTrackRunDataOffset());
+  run_itr_ = runs_.begin();
+  ResetRun();
+  return true;
+}
+
+void TrackRunIterator::AdvanceRun() {
+  ++run_itr_;
+  ResetRun();
+}
+
+void TrackRunIterator::ResetRun() {
+  if (!IsRunValid()) return;
+  sample_dts_ = run_itr_->start_dts;
+  sample_offset_ = run_itr_->sample_start_offset;
+  sample_itr_ = run_itr_->samples.begin();
+  cenc_info_.clear();
+}
+
+void TrackRunIterator::AdvanceSample() {
+  DCHECK(IsSampleValid());
+  sample_dts_ += sample_itr_->duration;
+  sample_offset_ += sample_itr_->size;
+  ++sample_itr_;
+}
+
+// This implementation only indicates a need for caching if CENC auxiliary
+// info is available in the stream.
+bool TrackRunIterator::AuxInfoNeedsToBeCached() {
+  DCHECK(IsRunValid());
+  return is_encrypted() && aux_info_size() > 0 && cenc_info_.size() == 0;
+}
+
+// This implementation currently only caches CENC auxiliary info.
+bool TrackRunIterator::CacheAuxInfo(Stream* stream, int64_t moof_offset) {
+  RCHECK(AuxInfoNeedsToBeCached());
+
+  int64_t offset = aux_info_offset() + moof_offset;
+  if (stream->Length() - offset < aux_info_size()) {
+    return false;
+  }
+
+  assert(run_itr_ == runs_.begin());
+  cenc_info_.resize(run_itr_->samples.size());
+  int64_t pos = 0;
+  for (size_t i = 0; i < run_itr_->samples.size(); i++) {
+    int info_size = run_itr_->aux_info_default_size;
+    if (!info_size)
+      info_size = run_itr_->aux_info_sizes[i];
+
+    StreamReader reader(stream, offset + pos, info_size);
+    RCHECK(cenc_info_[i].Parse(track_encryption().default_iv_size, &reader));
+    pos += info_size;
+  }
+
+  return true;
+}
+
+bool TrackRunIterator::IsRunValid() const {
+  return run_itr_ != runs_.end();
+}
+
+bool TrackRunIterator::IsSampleValid() const {
+  return IsRunValid() && (sample_itr_ != run_itr_->samples.end());
+}
+
+// Because tracks are in sorted order and auxiliary information is cached when
+// returning samples, it is guaranteed that no data will be required before the
+// lesser of the minimum data offset of this track and the next in sequence.
+// (The stronger condition - that no data is required before the minimum data
+// offset of this track alone - is not guaranteed, because the BMFF spec does
+// not have any inter-run ordering restrictions.)
+int64_t TrackRunIterator::GetMaxClearOffset() {
+  int64_t offset = kint64max;
+
+  if (IsSampleValid()) {
+    offset = std::min(offset, sample_offset_);
+    if (AuxInfoNeedsToBeCached())
+      offset = std::min(offset, aux_info_offset());
+  }
+  if (run_itr_ != runs_.end()) {
+    std::vector<TrackRunInfo>::const_iterator next_run = run_itr_ + 1;
+    if (next_run != runs_.end()) {
+      offset = std::min(offset, next_run->sample_start_offset);
+      if (next_run->aux_info_total_size)
+        offset = std::min(offset, next_run->aux_info_start_offset);
+    }
+  }
+  if (offset == kint64max) return 0;
+  return offset;
+}
+
+Microseconds TrackRunIterator::GetMinDecodeTimestamp() {
+  Microseconds dts = -1;
+  for (size_t i = 0; i < runs_.size(); i++) {
+    dts = std::min(dts, MicrosecondsFromRational(runs_[i].start_dts,
+                                                 runs_[i].timescale));
+  }
+  return dts;
+}
+
+uint32_t TrackRunIterator::track_id() const {
+  DCHECK(IsRunValid());
+  return run_itr_->track_id;
+}
+
+bool TrackRunIterator::is_encrypted() const {
+  DCHECK(IsRunValid());
+  return track_encryption().is_encrypted;
+}
+
+int64_t TrackRunIterator::aux_info_offset() const {
+  return run_itr_->aux_info_start_offset;
+}
+
+int TrackRunIterator::aux_info_size() const {
+  return run_itr_->aux_info_total_size;
+}
+
+bool TrackRunIterator::is_audio() const {
+  DCHECK(IsRunValid());
+  return run_itr_->is_audio;
+}
+
+const AudioSampleEntry& TrackRunIterator::audio_description() const {
+  DCHECK(is_audio());
+  DCHECK(run_itr_->audio_description);
+  return *run_itr_->audio_description;
+}
+
+const VideoSampleEntry& TrackRunIterator::video_description() const {
+  DCHECK(!is_audio());
+  DCHECK(run_itr_->video_description);
+  return *run_itr_->video_description;
+}
+
+int64_t TrackRunIterator::sample_offset() const {
+  DCHECK(IsSampleValid());
+  return sample_offset_;
+}
+
+int TrackRunIterator::sample_size() const {
+  DCHECK(IsSampleValid());
+  return sample_itr_->size;
+}
+
+Microseconds TrackRunIterator::dts() const {
+  DCHECK(IsSampleValid());
+  return MicrosecondsFromRational(sample_dts_, run_itr_->timescale);
+}
+
+Microseconds TrackRunIterator::cts() const {
+  DCHECK(IsSampleValid());
+  return MicrosecondsFromRational(sample_dts_ + sample_itr_->cts_offset,
+                               run_itr_->timescale);
+}
+
+Microseconds TrackRunIterator::duration() const {
+  DCHECK(IsSampleValid());
+  return MicrosecondsFromRational(sample_itr_->duration, run_itr_->timescale);
+}
+
+bool TrackRunIterator::is_keyframe() const {
+  DCHECK(IsSampleValid());
+  return sample_itr_->is_keyframe;
+}
+
+const TrackEncryption& TrackRunIterator::track_encryption() const {
+  if (is_audio())
+    return audio_description().sinf.info.track_encryption;
+  return video_description().sinf.info.track_encryption;
+}
+
+void TrackRunIterator::GetDecryptConfig(nsAutoPtr<DecryptConfig>& config) {
+  size_t sample_idx = sample_itr_ - run_itr_->samples.begin();
+  DCHECK(sample_idx < cenc_info_.size());
+  const FrameCENCInfo& cenc_info = cenc_info_[sample_idx];
+  DCHECK(is_encrypted() && !AuxInfoNeedsToBeCached());
+
+  if (!cenc_info.subsamples.empty() &&
+      (cenc_info.GetTotalSizeOfSubsamples() !=
+       static_cast<size_t>(sample_size()))) {
+    DMX_LOG("Incorrect CENC subsample size.\n");
+    return;
+  }
+
+  const std::vector<uint8_t>& kid = track_encryption().default_kid;
+  config = new DecryptConfig(
+      std::string(reinterpret_cast<const char*>(&kid[0]), kid.size()),
+      std::string(reinterpret_cast<const char*>(cenc_info.iv),
+                  arraysize(cenc_info.iv)),
+      0,  // No offset to start of media data in MP4 using CENC.
+      cenc_info.subsamples);
+}
+
+}  // namespace mp4_demuxer
diff --git a/content/media/fmp4/demuxer/track_run_iterator.h b/content/media/fmp4/demuxer/track_run_iterator.h
new file mode 100644
index 000000000000..2d7f0fdeca12
--- /dev/null
+++ b/content/media/fmp4/demuxer/track_run_iterator.h
@@ -0,0 +1,107 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef MEDIA_MP4_TRACK_RUN_ITERATOR_H_
+#define MEDIA_MP4_TRACK_RUN_ITERATOR_H_
+
+#include <vector>
+#include <memory>
+
+#include "mp4_demuxer/box_definitions.h"
+#include "mp4_demuxer/cenc.h"
+#include "nsAutoPtr.h"
+
+namespace mp4_demuxer {
+
+class DecryptConfig;
+
+Microseconds MicrosecondsFromRational(int64_t numer, int64_t denom);
+
+struct SampleInfo;
+struct TrackRunInfo;
+
+class TrackRunIterator {
+ public:
+  // Create a new TrackRunIterator. A reference to |moov| will be retained for
+  // the lifetime of this object.
+  TrackRunIterator(const Movie* moov);
+  ~TrackRunIterator();
+
+  void Reset();
+
+  // Sets up the iterator to handle all the runs from the current fragment.
+  bool Init(const MovieFragment& moof);
+
+  // Returns true if the properties of the current run or sample are valid.
+  bool IsRunValid() const;
+  bool IsSampleValid() const;
+
+  // Advance the properties to refer to the next run or sample. Requires that
+  // the current sample be valid.
+  void AdvanceRun();
+  void AdvanceSample();
+
+  // Returns true if this track run has auxiliary information and has not yet
+  // been cached. Only valid if IsRunValid().
+  bool AuxInfoNeedsToBeCached();
+
+  // Caches the CENC data from the given buffer. |buf| must be a buffer starting
+  // at the offset given by cenc_offset(), with a |size| of at least
+  // cenc_size(). Returns true on success, false on error.
+  //bool CacheAuxInfo(const uint8_t* buf, int size);
+  bool CacheAuxInfo(Stream* stream, int64_t moof_offset);
+
+  // Returns the maximum buffer location at which no data earlier in the stream
+  // will be required in order to read the current or any subsequent sample. You
+  // may clear all data up to this offset before reading the current sample
+  // safely. Result is in the same units as offset() (for Media Source this is
+  // in bytes past the the head of the MOOF box).
+  int64_t GetMaxClearOffset();
+
+  // Returns the minimum timestamp (or kInfiniteDuration if no runs present).
+  Microseconds GetMinDecodeTimestamp();
+
+  // Property of the current run. Only valid if IsRunValid().
+  uint32_t track_id() const;
+  int64_t aux_info_offset() const;
+  int aux_info_size() const;
+  bool is_encrypted() const;
+  bool is_audio() const;
+  // Only one is valid, based on the value of is_audio().
+  const AudioSampleEntry& audio_description() const;
+  const VideoSampleEntry& video_description() const;
+
+  // Properties of the current sample. Only valid if IsSampleValid().
+  int64_t sample_offset() const;
+  int sample_size() const;
+  Microseconds dts() const;
+  Microseconds cts() const;
+  Microseconds duration() const;
+  bool is_keyframe() const;
+
+  // Only call when is_encrypted() is true and AuxInfoNeedsToBeCached() is
+  // false. Result is owned by caller.
+  void GetDecryptConfig(nsAutoPtr<DecryptConfig>& config);
+
+ private:
+  void ResetRun();
+  const TrackEncryption& track_encryption() const;
+
+  const Movie* moov_;
+
+  std::vector<TrackRunInfo> runs_;
+  std::vector<TrackRunInfo>::const_iterator run_itr_;
+  std::vector<SampleInfo>::const_iterator sample_itr_;
+
+  std::vector<FrameCENCInfo> cenc_info_;
+
+  int64_t sample_dts_;
+  int64_t sample_offset_;
+
+  DISALLOW_COPY_AND_ASSIGN(TrackRunIterator);
+};
+
+}  // namespace mp4_demuxer
+
+#endif  // MEDIA_MP4_TRACK_RUN_ITERATOR_H_
diff --git a/content/media/fmp4/demuxer/video_decoder_config.cc b/content/media/fmp4/demuxer/video_decoder_config.cc
new file mode 100644
index 000000000000..3abf12ac1ac0
--- /dev/null
+++ b/content/media/fmp4/demuxer/video_decoder_config.cc
@@ -0,0 +1,158 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "mp4_demuxer/video_decoder_config.h"
+
+#include <sstream>
+
+namespace mp4_demuxer {
+
+VideoDecoderConfig::VideoDecoderConfig()
+    : codec_(kUnknownVideoCodec),
+      profile_(VIDEO_CODEC_PROFILE_UNKNOWN),
+      format_(VideoFrameFormat::INVALID),
+      is_encrypted_(false) {
+}
+
+VideoDecoderConfig::VideoDecoderConfig(VideoCodec codec,
+                                       VideoCodecProfile profile,
+                                       VideoFrameFormat format,
+                                       const IntSize& coded_size,
+                                       const IntRect& visible_rect,
+                                       const IntSize& natural_size,
+                                       const uint8_t* extra_data,
+                                       size_t extra_data_size,
+                                       bool is_encrypted) {
+  Initialize(codec, profile, format, coded_size, visible_rect, natural_size,
+             extra_data, extra_data_size, is_encrypted, true);
+}
+
+VideoDecoderConfig::~VideoDecoderConfig() {}
+
+// Some videos just want to watch the world burn, with a height of 0; cap the
+// "infinite" aspect ratio resulting.
+static const int kInfiniteRatio = 99999;
+
+// Common aspect ratios (multiplied by 100 and truncated) used for histogramming
+// video sizes.  These were taken on 20111103 from
+// http://wikipedia.org/wiki/Aspect_ratio_(image)#Previous_and_currently_used_aspect_ratios
+static const int kCommonAspectRatios100[] = {
+  100, 115, 133, 137, 143, 150, 155, 160, 166, 175, 177, 185, 200, 210, 220,
+  221, 235, 237, 240, 255, 259, 266, 276, 293, 400, 1200, kInfiniteRatio,
+};
+
+void VideoDecoderConfig::Initialize(VideoCodec codec,
+                                    VideoCodecProfile profile,
+                                    VideoFrameFormat format,
+                                    const IntSize& coded_size,
+                                    const IntRect& visible_rect,
+                                    const IntSize& natural_size,
+                                    const uint8_t* extra_data,
+                                    size_t extra_data_size,
+                                    bool is_encrypted,
+                                    bool record_stats) {
+  CHECK((extra_data_size != 0) == (extra_data != NULL));
+
+  codec_ = codec;
+  profile_ = profile;
+  format_ = format;
+  coded_size_ = coded_size;
+  visible_rect_ = visible_rect;
+  natural_size_ = natural_size;
+  extra_data_.assign(extra_data, extra_data + extra_data_size);
+  is_encrypted_ = is_encrypted;
+}
+
+bool VideoDecoderConfig::IsValidConfig() const {
+  return codec_ != kUnknownVideoCodec &&
+      natural_size_.width() > 0 &&
+      natural_size_.height() > 0 &&
+
+      // Copied from:
+      // VideoFrame::IsValidConfig(format_, coded_size_, visible_rect_, natural_size_)
+      format_ != VideoFrameFormat::INVALID &&
+      !coded_size_.IsEmpty() &&
+      coded_size_.GetArea() <= kMaxCanvas &&
+      coded_size_.width() <= kMaxDimension &&
+      coded_size_.height() <= kMaxDimension &&
+      !visible_rect_.IsEmpty() &&
+      visible_rect_.x() >= 0 && visible_rect_.y() >= 0 &&
+      visible_rect_.right() <= coded_size_.width() &&
+      visible_rect_.bottom() <= coded_size_.height() &&
+      !natural_size_.IsEmpty() &&
+      natural_size_.GetArea() <= kMaxCanvas &&
+      natural_size_.width() <= kMaxDimension &&
+      natural_size_.height() <= kMaxDimension;
+}
+
+bool VideoDecoderConfig::Matches(const VideoDecoderConfig& config) const {
+  return ((codec() == config.codec()) &&
+          (format() == config.format()) &&
+          (profile() == config.profile()) &&
+          (coded_size() == config.coded_size()) &&
+          (visible_rect() == config.visible_rect()) &&
+          (natural_size() == config.natural_size()) &&
+          (extra_data_size() == config.extra_data_size()) &&
+          (!extra_data() || !memcmp(extra_data(), config.extra_data(),
+                                    extra_data_size())) &&
+          (is_encrypted() == config.is_encrypted()));
+}
+
+std::string VideoDecoderConfig::AsHumanReadableString() const {
+  std::ostringstream s;
+  s << "codec: " << codec()
+    << " format: " << format()
+    << " profile: " << profile()
+    << " coded size: [" << coded_size().width()
+    << "," << coded_size().height() << "]"
+    << " visible rect: [" << visible_rect().x()
+    << "," << visible_rect().y()
+    << "," << visible_rect().width()
+    << "," << visible_rect().height() << "]"
+    << " natural size: [" << natural_size().width()
+    << "," << natural_size().height() << "]"
+    << " has extra data? " << (extra_data() ? "true" : "false")
+    << " encrypted? " << (is_encrypted() ? "true" : "false");
+  return s.str();
+}
+
+VideoCodec VideoDecoderConfig::codec() const {
+  return codec_;
+}
+
+VideoCodecProfile VideoDecoderConfig::profile() const {
+  return profile_;
+}
+
+VideoFrameFormat VideoDecoderConfig::format() const {
+  return format_;
+}
+
+IntSize VideoDecoderConfig::coded_size() const {
+  return coded_size_;
+}
+
+IntRect VideoDecoderConfig::visible_rect() const {
+  return visible_rect_;
+}
+
+IntSize VideoDecoderConfig::natural_size() const {
+  return natural_size_;
+}
+
+const uint8_t* VideoDecoderConfig::extra_data() const {
+  if (extra_data_.empty())
+    return NULL;
+  return &extra_data_[0];
+}
+
+size_t VideoDecoderConfig::extra_data_size() const {
+  return extra_data_.size();
+}
+
+bool VideoDecoderConfig::is_encrypted() const {
+  return is_encrypted_;
+}
+
+}  // namespace mp4_demuxer
diff --git a/content/media/fmp4/demuxer/video_decoder_config.h b/content/media/fmp4/demuxer/video_decoder_config.h
new file mode 100644
index 000000000000..0751f9250104
--- /dev/null
+++ b/content/media/fmp4/demuxer/video_decoder_config.h
@@ -0,0 +1,171 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef MEDIA_BASE_VIDEO_DECODER_CONFIG_H_
+#define MEDIA_BASE_VIDEO_DECODER_CONFIG_H_
+
+#include <string>
+#include <vector>
+
+#include "mp4_demuxer/basictypes.h"
+
+namespace mp4_demuxer {
+
+enum VideoCodec {
+  // These values are histogrammed over time; do not change their ordinal
+  // values.  When deleting a codec replace it with a dummy value; when adding a
+  // codec, do so at the bottom (and update kVideoCodecMax).
+  kUnknownVideoCodec = 0,
+  kCodecH264,
+  kCodecVC1,
+  kCodecMPEG2,
+  kCodecMPEG4,
+  kCodecTheora,
+  kCodecVP8,
+  kCodecVP9,
+  // DO NOT ADD RANDOM VIDEO CODECS!
+  //
+  // The only acceptable time to add a new codec is if there is production code
+  // that uses said codec in the same CL.
+
+  kVideoCodecMax = kCodecVP9  // Must equal the last "real" codec above.
+};
+
+// Video stream profile.  This *must* match PP_VideoDecoder_Profile.
+// (enforced in webkit/plugins/ppapi/ppb_video_decoder_impl.cc)
+enum VideoCodecProfile {
+  // Keep the values in this enum unique, as they imply format (h.264 vs. VP8,
+  // for example), and keep the values for a particular format grouped
+  // together for clarity.
+  VIDEO_CODEC_PROFILE_UNKNOWN = -1,
+  H264PROFILE_MIN = 0,
+  H264PROFILE_BASELINE = H264PROFILE_MIN,
+  H264PROFILE_MAIN = 1,
+  H264PROFILE_EXTENDED = 2,
+  H264PROFILE_HIGH = 3,
+  H264PROFILE_HIGH10PROFILE = 4,
+  H264PROFILE_HIGH422PROFILE = 5,
+  H264PROFILE_HIGH444PREDICTIVEPROFILE = 6,
+  H264PROFILE_SCALABLEBASELINE = 7,
+  H264PROFILE_SCALABLEHIGH = 8,
+  H264PROFILE_STEREOHIGH = 9,
+  H264PROFILE_MULTIVIEWHIGH = 10,
+  H264PROFILE_MAX = H264PROFILE_MULTIVIEWHIGH,
+  VP8PROFILE_MIN = 11,
+  VP8PROFILE_MAIN = VP8PROFILE_MIN,
+  VP8PROFILE_MAX = VP8PROFILE_MAIN,
+  VP9PROFILE_MIN = 12,
+  VP9PROFILE_MAIN = VP9PROFILE_MIN,
+  VP9PROFILE_MAX = VP9PROFILE_MAIN,
+  VIDEO_CODEC_PROFILE_MAX = VP9PROFILE_MAX,
+};
+
+// Surface formats roughly based on FOURCC labels, see:
+// http://www.fourcc.org/rgb.php
+// http://www.fourcc.org/yuv.php
+enum VideoFrameFormat { // VideoFrame::Format
+  INVALID = 0,  // Invalid format value.  Used for error reporting.
+  RGB32 = 4,  // 32bpp RGB packed with extra byte 8:8:8
+  YV12 = 6,  // 12bpp YVU planar 1x1 Y, 2x2 VU samples
+  YV16 = 7,  // 16bpp YVU planar 1x1 Y, 2x1 VU samples
+  EMPTY = 9,  // An empty frame.
+  I420 = 11,  // 12bpp YVU planar 1x1 Y, 2x2 UV samples.
+  NATIVE_TEXTURE = 12,  // Native texture.  Pixel-format agnostic.
+#if defined(GOOGLE_TV)
+  HOLE = 13,  // Hole frame.
+#endif
+  YV12A = 14,  // 20bpp YUVA planar 1x1 Y, 2x2 VU, 1x1 A samples.
+};
+
+class VideoDecoderConfig {
+ public:
+  // Constructs an uninitialized object. Clients should call Initialize() with
+  // appropriate values before using.
+  VideoDecoderConfig();
+
+  // Constructs an initialized object. It is acceptable to pass in NULL for
+  // |extra_data|, otherwise the memory is copied.
+  VideoDecoderConfig(VideoCodec codec,
+                     VideoCodecProfile profile,
+                     VideoFrameFormat format,
+                     const IntSize& coded_size,
+                     const IntRect& visible_rect,
+                     const IntSize& natural_size,
+                     const uint8_t* extra_data, size_t extra_data_size,
+                     bool is_encrypted);
+
+  ~VideoDecoderConfig();
+
+  // Resets the internal state of this object.
+  void Initialize(VideoCodec codec,
+                  VideoCodecProfile profile,
+                  VideoFrameFormat format,
+                  const IntSize& coded_size,
+                  const IntRect& visible_rect,
+                  const IntSize& natural_size,
+                  const uint8_t* extra_data, size_t extra_data_size,
+                  bool is_encrypted,
+                  bool record_stats);
+
+  // Returns true if this object has appropriate configuration values, false
+  // otherwise.
+  bool IsValidConfig() const;
+
+  // Returns true if all fields in |config| match this config.
+  // Note: The contents of |extra_data_| are compared not the raw pointers.
+  bool Matches(const VideoDecoderConfig& config) const;
+
+  // Returns a human-readable string describing |*this|.  For debugging & test
+  // output only.
+  std::string AsHumanReadableString() const;
+
+  VideoCodec codec() const;
+  VideoCodecProfile profile() const;
+
+  // Video format used to determine YUV buffer sizes.
+  VideoFrameFormat format() const;
+
+  // Width and height of video frame immediately post-decode. Not all pixels
+  // in this region are valid.
+  IntSize coded_size() const;
+
+  // Region of |coded_size_| that is visible.
+  IntRect visible_rect() const;
+
+  // Final visible width and height of a video frame with aspect ratio taken
+  // into account.
+  IntSize natural_size() const;
+
+  // Optional byte data required to initialize video decoders, such as H.264
+  // AAVC data.
+  const uint8_t* extra_data() const;
+  size_t extra_data_size() const;
+
+  // Whether the video stream is potentially encrypted.
+  // Note that in a potentially encrypted video stream, individual buffers
+  // can be encrypted or not encrypted.
+  bool is_encrypted() const;
+
+ private:
+  VideoCodec codec_;
+  VideoCodecProfile profile_;
+
+  VideoFrameFormat format_;
+
+  IntSize coded_size_;
+  IntRect visible_rect_;
+  IntSize natural_size_;
+
+  std::vector<uint8_t> extra_data_;
+
+  bool is_encrypted_;
+
+  // Not using DISALLOW_COPY_AND_ASSIGN here intentionally to allow the compiler
+  // generated copy constructor and assignment operator. Since the extra data is
+  // typically small, the performance impact is minimal.
+};
+
+}  // namespace mp4_demuxer
+
+#endif  // MEDIA_BASE_VIDEO_DECODER_CONFIG_H_
diff --git a/content/media/fmp4/demuxer/video_util.cc b/content/media/fmp4/demuxer/video_util.cc
new file mode 100644
index 000000000000..15eae7f0e72b
--- /dev/null
+++ b/content/media/fmp4/demuxer/video_util.cc
@@ -0,0 +1,299 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "mp4_demuxer/video_util.h"
+
+#include <cmath>
+
+namespace mp4_demuxer {
+
+IntSize GetNaturalSize(const IntSize& visible_size,
+                       int aspect_ratio_numerator,
+                       int aspect_ratio_denominator) {
+  if (aspect_ratio_denominator == 0 ||
+      aspect_ratio_numerator < 0 ||
+      aspect_ratio_denominator < 0)
+    return IntSize();
+
+  double aspect_ratio = aspect_ratio_numerator /
+      static_cast<double>(aspect_ratio_denominator);
+
+  int width = floor(visible_size.width() * aspect_ratio + 0.5);
+  int height = visible_size.height();
+
+  // An even width makes things easier for YV12 and appears to be the behavior
+  // expected by WebKit layout tests.
+  return IntSize(width & ~1, height);
+}
+
+/*
+void CopyPlane(size_t plane, const uint8_t* source, int stride, int rows,
+               VideoFrame* frame) {
+  uint8_t* dest = frame->data(plane);
+  int dest_stride = frame->stride(plane);
+
+  // Clamp in case source frame has smaller stride.
+  int bytes_to_copy_per_row = std::min(frame->row_bytes(plane), stride);
+
+  // Clamp in case source frame has smaller height.
+  int rows_to_copy = std::min(frame->rows(plane), rows);
+
+  // Copy!
+  for (int row = 0; row < rows_to_copy; ++row) {
+    memcpy(dest, source, bytes_to_copy_per_row);
+    source += stride;
+    dest += dest_stride;
+  }
+}
+
+void CopyYPlane(const uint8_t* source, int stride, int rows, VideoFrame* frame) {
+  CopyPlane(VideoFrame::kYPlane, source, stride, rows, frame);
+}
+
+void CopyUPlane(const uint8_t* source, int stride, int rows, VideoFrame* frame) {
+  CopyPlane(VideoFrame::kUPlane, source, stride, rows, frame);
+}
+
+void CopyVPlane(const uint8_t* source, int stride, int rows, VideoFrame* frame) {
+  CopyPlane(VideoFrame::kVPlane, source, stride, rows, frame);
+}
+
+void CopyAPlane(const uint8_t* source, int stride, int rows, VideoFrame* frame) {
+  CopyPlane(VideoFrame::kAPlane, source, stride, rows, frame);
+}
+
+void MakeOpaqueAPlane(int stride, int rows, VideoFrame* frame) {
+  int rows_to_clear = std::min(frame->rows(VideoFrame::kAPlane), rows);
+  memset(frame->data(VideoFrame::kAPlane), 255,
+         frame->stride(VideoFrame::kAPlane) * rows_to_clear);
+}
+
+void FillYUV(VideoFrame* frame, uint8_t y, uint8_t u, uint8_t v) {
+  // Fill the Y plane.
+  uint8_t* y_plane = frame->data(VideoFrame::kYPlane);
+  int y_rows = frame->rows(VideoFrame::kYPlane);
+  int y_row_bytes = frame->row_bytes(VideoFrame::kYPlane);
+  for (int i = 0; i < y_rows; ++i) {
+    memset(y_plane, y, y_row_bytes);
+    y_plane += frame->stride(VideoFrame::kYPlane);
+  }
+
+  // Fill the U and V planes.
+  uint8_t* u_plane = frame->data(VideoFrame::kUPlane);
+  uint8_t* v_plane = frame->data(VideoFrame::kVPlane);
+  int uv_rows = frame->rows(VideoFrame::kUPlane);
+  int u_row_bytes = frame->row_bytes(VideoFrame::kUPlane);
+  int v_row_bytes = frame->row_bytes(VideoFrame::kVPlane);
+  for (int i = 0; i < uv_rows; ++i) {
+    memset(u_plane, u, u_row_bytes);
+    memset(v_plane, v, v_row_bytes);
+    u_plane += frame->stride(VideoFrame::kUPlane);
+    v_plane += frame->stride(VideoFrame::kVPlane);
+  }
+}
+
+static void LetterboxPlane(VideoFrame* frame,
+                           int plane,
+                           const gfx::Rect& view_area,
+                           uint8_t fill_byte) {
+  uint8_t* ptr = frame->data(plane);
+  const int rows = frame->rows(plane);
+  const int row_bytes = frame->row_bytes(plane);
+  const int stride = frame->stride(plane);
+
+  CHECK_GE(stride, row_bytes);
+  CHECK_GE(view_area.x(), 0);
+  CHECK_GE(view_area.y(), 0);
+  CHECK_LE(view_area.right(), row_bytes);
+  CHECK_LE(view_area.bottom(), rows);
+
+  int y = 0;
+  for (; y < view_area.y(); y++) {
+    memset(ptr, fill_byte, row_bytes);
+    ptr += stride;
+  }
+  if (view_area.width() < row_bytes) {
+    for (; y < view_area.bottom(); y++) {
+      if (view_area.x() > 0) {
+        memset(ptr, fill_byte, view_area.x());
+      }
+      if (view_area.right() < row_bytes) {
+        memset(ptr + view_area.right(),
+               fill_byte,
+               row_bytes - view_area.right());
+      }
+      ptr += stride;
+    }
+  } else {
+    y += view_area.height();
+    ptr += stride * view_area.height();
+  }
+  for (; y < rows; y++) {
+    memset(ptr, fill_byte, row_bytes);
+    ptr += stride;
+  }
+}
+
+void LetterboxYUV(VideoFrame* frame, const gfx::Rect& view_area) {
+  DCHECK(!(view_area.x() & 1));
+  DCHECK(!(view_area.y() & 1));
+  DCHECK(!(view_area.width() & 1));
+  DCHECK(!(view_area.height() & 1));
+  DCHECK_EQ(frame->format(), VideoFrame::YV12);
+  LetterboxPlane(frame, VideoFrame::kYPlane, view_area, 0x00);
+  gfx::Rect half_view_area(view_area.x() / 2,
+                           view_area.y() / 2,
+                           view_area.width() / 2,
+                           view_area.height() / 2);
+  LetterboxPlane(frame, VideoFrame::kUPlane, half_view_area, 0x80);
+  LetterboxPlane(frame, VideoFrame::kVPlane, half_view_area, 0x80);
+}
+
+void RotatePlaneByPixels(
+    const uint8_t* src,
+    uint8_t* dest,
+    int width,
+    int height,
+    int rotation,  // Clockwise.
+    bool flip_vert,
+    bool flip_horiz) {
+  DCHECK((width > 0) && (height > 0) &&
+         ((width & 1) == 0) && ((height & 1) == 0) &&
+         (rotation >= 0) && (rotation < 360) && (rotation % 90 == 0));
+
+  // Consolidate cases. Only 0 and 90 are left.
+  if (rotation == 180 || rotation == 270) {
+    rotation -= 180;
+    flip_vert = !flip_vert;
+    flip_horiz = !flip_horiz;
+  }
+
+  int num_rows = height;
+  int num_cols = width;
+  int src_stride = width;
+  // During pixel copying, the corresponding incremental of dest pointer
+  // when src pointer moves to next row.
+  int dest_row_step = width;
+  // During pixel copying, the corresponding incremental of dest pointer
+  // when src pointer moves to next column.
+  int dest_col_step = 1;
+
+  if (rotation == 0) {
+    if (flip_horiz) {
+      // Use pixel copying.
+      dest_col_step = -1;
+      if (flip_vert) {
+        // Rotation 180.
+        dest_row_step = -width;
+        dest += height * width - 1;
+      } else {
+        dest += width - 1;
+      }
+    } else {
+      if (flip_vert) {
+        // Fast copy by rows.
+        dest += width * (height - 1);
+        for (int row = 0; row < height; ++row) {
+          memcpy(dest, src, width);
+          src += width;
+          dest -= width;
+        }
+      } else {
+        memcpy(dest, src, width * height);
+      }
+      return;
+    }
+  } else if (rotation == 90) {
+    int offset;
+    if (width > height) {
+      offset = (width - height) / 2;
+      src += offset;
+      num_rows = num_cols = height;
+    } else {
+      offset = (height - width) / 2;
+      src += width * offset;
+      num_rows = num_cols = width;
+    }
+
+    dest_col_step = (flip_vert ? -width : width);
+    dest_row_step = (flip_horiz ? 1 : -1);
+    if (flip_horiz) {
+      if (flip_vert) {
+        dest += (width > height ? width * (height - 1) + offset :
+                                  width * (height - offset - 1));
+      } else {
+        dest += (width > height ? offset : width * offset);
+      }
+    } else {
+      if (flip_vert) {
+        dest += (width > height ?  width * height - offset - 1 :
+                                   width * (height - offset) - 1);
+      } else {
+        dest += (width > height ? width - offset - 1 :
+                                  width * (offset + 1) - 1);
+      }
+    }
+  } else {
+    NOTREACHED();
+  }
+
+  // Copy pixels.
+  for (int row = 0; row < num_rows; ++row) {
+    const uint8_t* src_ptr = src;
+    uint8_t* dest_ptr = dest;
+    for (int col = 0; col < num_cols; ++col) {
+      *dest_ptr = *src_ptr++;
+      dest_ptr += dest_col_step;
+    }
+    src += src_stride;
+    dest += dest_row_step;
+  }
+}
+
+gfx::Rect ComputeLetterboxRegion(const gfx::Rect& bounds,
+                                 const IntSize& content) {
+  int64_t x = static_cast<int64_t>(content.width()) * bounds.height();
+  int64_t y = static_cast<int64_t>(content.height()) * bounds.width();
+
+  IntSize letterbox(bounds.width(), bounds.height());
+  if (y < x)
+    letterbox.set_height(static_cast<int>(y / content.width()));
+  else
+    letterbox.set_width(static_cast<int>(x / content.height()));
+  gfx::Rect result = bounds;
+  result.ClampToCenteredSize(letterbox);
+  return result;
+}
+
+void CopyRGBToVideoFrame(const uint8_t* source,
+                         int stride,
+                         const gfx::Rect& region_in_frame,
+                         VideoFrame* frame) {
+  const int kY = VideoFrame::kYPlane;
+  const int kU = VideoFrame::kUPlane;
+  const int kV = VideoFrame::kVPlane;
+  CHECK_EQ(frame->stride(kU), frame->stride(kV));
+  const int uv_stride = frame->stride(kU);
+
+  if (region_in_frame != gfx::Rect(frame->coded_size())) {
+    LetterboxYUV(frame, region_in_frame);
+  }
+
+  const int y_offset = region_in_frame.x()
+                     + (region_in_frame.y() * frame->stride(kY));
+  const int uv_offset = region_in_frame.x() / 2
+                      + (region_in_frame.y() / 2 * uv_stride);
+
+  ConvertRGB32ToYUV(source,
+                    frame->data(kY) + y_offset,
+                    frame->data(kU) + uv_offset,
+                    frame->data(kV) + uv_offset,
+                    region_in_frame.width(),
+                    region_in_frame.height(),
+                    stride,
+                    frame->stride(kY),
+                    uv_stride);
+}
+*/
+}  // namespace mp4_demuxer
diff --git a/content/media/fmp4/demuxer/video_util.h b/content/media/fmp4/demuxer/video_util.h
new file mode 100644
index 000000000000..2c568788ee80
--- /dev/null
+++ b/content/media/fmp4/demuxer/video_util.h
@@ -0,0 +1,86 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef MEDIA_BASE_VIDEO_UTIL_H_
+#define MEDIA_BASE_VIDEO_UTIL_H_
+
+#include "mp4_demuxer/basictypes.h"
+
+namespace mp4_demuxer {
+
+class VideoFrame;
+
+// Computes the size of |visible_size| for a given aspect ratio.
+IntSize GetNaturalSize(const IntSize& visible_size,
+                                    int aspect_ratio_numerator,
+                                    int aspect_ratio_denominator);
+/*
+// Copies a plane of YUV(A) source into a VideoFrame object, taking into account
+// source and destinations dimensions.
+//
+// NOTE: rows is *not* the same as height!
+void CopyYPlane(const uint8_t* source, int stride, int rows,
+                             VideoFrame* frame);
+void CopyUPlane(const uint8_t* source, int stride, int rows,
+                             VideoFrame* frame);
+void CopyVPlane(const uint8_t* source, int stride, int rows,
+                             VideoFrame* frame);
+void CopyAPlane(const uint8_t* source, int stride, int rows,
+                             VideoFrame* frame);
+
+// Sets alpha plane values to be completely opaque (all 255's).
+void MakeOpaqueAPlane(int stride, int rows, VideoFrame* frame);
+
+// |plane| is one of VideoFrame::kYPlane, VideoFrame::kUPlane,
+// VideoFrame::kVPlane or VideoFrame::kAPlane
+void CopyPlane(size_t plane, const uint8_t* source, int stride,
+                            int rows, VideoFrame* frame);
+
+
+// Fills |frame| containing YUV data to the given color values.
+void FillYUV(VideoFrame* frame, uint8_t y, uint8_t u, uint8_t v);
+
+// Creates a border in |frame| such that all pixels outside of
+// |view_area| are black. The size and position of |view_area|
+// must be even to align correctly with the color planes.
+// Only YV12 format video frames are currently supported.
+void LetterboxYUV(VideoFrame* frame,
+                               const gfx::Rect& view_area);
+
+// Rotates |src| plane by |rotation| degree with possible flipping vertically
+// and horizontally.
+// |rotation| is limited to {0, 90, 180, 270}.
+// |width| and |height| are expected to be even numbers.
+// Both |src| and |dest| planes are packed and have same |width| and |height|.
+// When |width| != |height| and rotated by 90/270, only the maximum square
+// portion located in the center is rotated. For example, for width=640 and
+// height=480, the rotated area is 480x480 located from row 0 through 479 and
+// from column 80 through 559. The leftmost and rightmost 80 columns are
+// ignored for both |src| and |dest|.
+// The caller is responsible for blanking out the margin area.
+void RotatePlaneByPixels(
+    const uint8_t* src,
+    uint8_t* dest,
+    int width,
+    int height,
+    int rotation,  // Clockwise.
+    bool flip_vert,
+    bool flip_horiz);
+
+// Return the largest centered rectangle with the same aspect ratio of |content|
+// that fits entirely inside of |bounds|.
+gfx::Rect ComputeLetterboxRegion(const gfx::Rect& bounds,
+                                              const IntSize& content);
+
+// Copy an RGB bitmap into the specified |region_in_frame| of a YUV video frame.
+// Fills the regions outside |region_in_frame| with black.
+void CopyRGBToVideoFrame(const uint8_t* source,
+                                      int stride,
+                                      const gfx::Rect& region_in_frame,
+                                      VideoFrame* frame);
+*/
+
+}  // namespace mp4_demuxer
+
+#endif  // MEDIA_BASE_VIDEO_UTIL_H_
diff --git a/content/media/fmp4/moz.build b/content/media/fmp4/moz.build
new file mode 100644
index 000000000000..01394cb1c9eb
--- /dev/null
+++ b/content/media/fmp4/moz.build
@@ -0,0 +1,64 @@
+# -*- Mode: python; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+EXPORTS += [
+    'MP4Decoder.h',
+    'MP4Reader.h',
+    'PlatformDecoderModule.h',
+    'wmf/MFTDecoder.h',
+    'wmf/WMFAudioDecoder.h',
+    'wmf/WMFDecoderModule.h',
+    'wmf/WMFVideoDecoder.h',
+]
+
+EXPORTS.mp4_demuxer += [
+    'demuxer/aac.h',
+    'demuxer/audio_decoder_config.h',
+    'demuxer/avc.h',
+    'demuxer/basictypes.h',
+    'demuxer/bit_reader.h',
+    'demuxer/box_definitions.h',
+    'demuxer/box_reader.h',
+    'demuxer/cenc.h',
+    'demuxer/channel_layout.h',
+    'demuxer/decrypt_config.h',
+    'demuxer/es_descriptor.h',
+    'demuxer/fourccs.h',
+    'demuxer/mp4_demuxer.h',
+    'demuxer/Streams.h',
+    'demuxer/track_run_iterator.h',
+    'demuxer/video_decoder_config.h',
+    'demuxer/video_util.h',
+]
+
+SOURCES += [
+    'BlankDecoderModule.cpp',
+    'demuxer/aac.cc',
+    'demuxer/audio_decoder_config.cc',
+    'demuxer/avc.cc',
+    'demuxer/bit_reader.cc',
+    'demuxer/box_definitions.cc',
+    'demuxer/box_reader.cc',
+    'demuxer/cenc.cc',
+    'demuxer/channel_layout.cc',
+    'demuxer/decrypt_config.cc',
+    'demuxer/es_descriptor.cc',
+    'demuxer/mp4_demuxer.cc',
+    'demuxer/track_run_iterator.cc',
+    'demuxer/video_decoder_config.cc',
+    'demuxer/video_util.cc',
+    'MP4Decoder.cpp',
+    'MP4Reader.cpp',
+    'PlatformDecoderModule.cpp',
+    'wmf/MFTDecoder.cpp',
+    'wmf/WMFAudioDecoder.cpp',
+    'wmf/WMFDecoderModule.cpp',
+    'wmf/WMFVideoDecoder.cpp',
+]
+
+FINAL_LIBRARY = 'gklayout'
+
+FAIL_ON_WARNINGS = True
diff --git a/content/media/fmp4/wmf/MFTDecoder.cpp b/content/media/fmp4/wmf/MFTDecoder.cpp
new file mode 100644
index 000000000000..65fe6224597a
--- /dev/null
+++ b/content/media/fmp4/wmf/MFTDecoder.cpp
@@ -0,0 +1,290 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "MFTDecoder.h"
+#include "nsThreadUtils.h"
+#include "WMFUtils.h"
+#include "prlog.h"
+
+#ifdef PR_LOGGING
+PRLogModuleInfo* GetDemuxerLog();
+#define LOG(...) PR_LOG(GetDemuxerLog(), PR_LOG_DEBUG, (__VA_ARGS__))
+#else
+#define LOG(...)
+#endif
+
+
+namespace mozilla {
+
+MFTDecoder::MFTDecoder()
+  : mMFTProvidesOutputSamples(false)
+{
+  memset(&mInputStreamInfo, 0, sizeof(MFT_INPUT_STREAM_INFO));
+  memset(&mOutputStreamInfo, 0, sizeof(MFT_OUTPUT_STREAM_INFO));
+}
+
+MFTDecoder::~MFTDecoder()
+{
+}
+
+HRESULT
+MFTDecoder::Create(const GUID& aMFTClsID)
+{
+  // Create the IMFTransform to do the decoding.
+  HRESULT hr;
+  hr = CoCreateInstance(aMFTClsID,
+                        NULL,
+                        CLSCTX_INPROC_SERVER,
+                        IID_IMFTransform,
+                        reinterpret_cast<void**>(static_cast<IMFTransform**>(byRef(mDecoder))));
+  NS_ENSURE_TRUE(SUCCEEDED(hr), hr);
+
+  return S_OK;
+}
+
+HRESULT
+MFTDecoder::SetMediaTypes(IMFMediaType* aInputType,
+                          const GUID& aOutputSubType)
+{
+  mOutputSubtype = aOutputSubType;
+
+  // Set the input type to the one the caller gave us...
+  HRESULT hr = mDecoder->SetInputType(0, aInputType, 0);
+  NS_ENSURE_TRUE(SUCCEEDED(hr), hr);
+
+  hr = SetDecoderOutputType();
+  NS_ENSURE_TRUE(SUCCEEDED(hr), hr);
+
+  hr = mDecoder->GetInputStreamInfo(0, &mInputStreamInfo);
+  NS_ENSURE_TRUE(SUCCEEDED(hr), hr);
+
+  hr = mDecoder->GetOutputStreamInfo(0, &mOutputStreamInfo);
+  NS_ENSURE_TRUE(SUCCEEDED(hr), hr);
+
+  mMFTProvidesOutputSamples = IsFlagSet(mOutputStreamInfo.dwFlags, MFT_OUTPUT_STREAM_PROVIDES_SAMPLES);
+
+  hr = SendMFTMessage(MFT_MESSAGE_NOTIFY_BEGIN_STREAMING, 0);
+  NS_ENSURE_TRUE(SUCCEEDED(hr), hr);
+
+  hr = SendMFTMessage(MFT_MESSAGE_NOTIFY_START_OF_STREAM, 0);
+  NS_ENSURE_TRUE(SUCCEEDED(hr), hr);
+
+  return S_OK;
+}
+
+TemporaryRef<IMFAttributes>
+MFTDecoder::GetAttributes()
+{
+  RefPtr<IMFAttributes> attr;
+  HRESULT hr = mDecoder->GetAttributes(byRef(attr));
+  NS_ENSURE_TRUE(SUCCEEDED(hr), nullptr);
+  return attr;
+}
+
+HRESULT
+MFTDecoder::SetDecoderOutputType()
+{
+  NS_ENSURE_TRUE(mDecoder != nullptr, E_POINTER);
+
+  // Iterate the enumerate the output types, until we find one compatible
+  // with what we need.
+  HRESULT hr;
+  RefPtr<IMFMediaType> outputType;
+  UINT32 typeIndex = 0;
+  while (SUCCEEDED(mDecoder->GetOutputAvailableType(0, typeIndex++, byRef(outputType)))) {
+    GUID subtype;
+    hr = outputType->GetGUID(MF_MT_SUBTYPE, &subtype);
+    if (FAILED(hr)) {
+      continue;
+    }
+    if (subtype == mOutputSubtype) {
+      hr = mDecoder->SetOutputType(0, outputType, 0);
+      NS_ENSURE_TRUE(SUCCEEDED(hr), hr);
+      return S_OK;
+    }
+  }
+  return E_FAIL;
+}
+
+HRESULT
+MFTDecoder::SendMFTMessage(MFT_MESSAGE_TYPE aMsg, UINT32 aData)
+{
+  NS_ENSURE_TRUE(mDecoder != nullptr, E_POINTER);
+  HRESULT hr = mDecoder->ProcessMessage(aMsg, aData);
+  NS_ENSURE_TRUE(SUCCEEDED(hr), hr);
+  return S_OK;
+}
+
+HRESULT
+MFTDecoder::CreateInputSample(const uint8_t* aData,
+                              uint32_t aDataSize,
+                              int64_t aTimestamp,
+                              RefPtr<IMFSample>* aOutSample)
+{
+  NS_ENSURE_TRUE(mDecoder != nullptr, E_POINTER);
+
+  HRESULT hr;
+  RefPtr<IMFSample> sample;
+  hr = wmf::MFCreateSample(byRef(sample));
+  NS_ENSURE_TRUE(SUCCEEDED(hr), hr);
+
+  RefPtr<IMFMediaBuffer> buffer;
+  int32_t bufferSize = std::max(uint32_t(mInputStreamInfo.cbSize), aDataSize);
+  UINT32 alignment = (mInputStreamInfo.cbAlignment > 1) ? mInputStreamInfo.cbAlignment - 1 : 0;
+  hr = wmf::MFCreateAlignedMemoryBuffer(bufferSize, alignment, byRef(buffer));
+  NS_ENSURE_TRUE(SUCCEEDED(hr), hr);
+
+  DWORD maxLength = 0;
+  DWORD currentLength = 0;
+  BYTE* dst = nullptr;
+  hr = buffer->Lock(&dst, &maxLength, &currentLength);
+  NS_ENSURE_TRUE(SUCCEEDED(hr), hr);
+
+  // Copy data into sample's buffer.
+  memcpy(dst, aData, aDataSize);
+
+  hr = buffer->Unlock();
+  NS_ENSURE_TRUE(SUCCEEDED(hr), hr);
+
+  hr = buffer->SetCurrentLength(aDataSize);
+  NS_ENSURE_TRUE(SUCCEEDED(hr), hr);
+
+  hr = sample->AddBuffer(buffer);
+  NS_ENSURE_TRUE(SUCCEEDED(hr), hr);
+
+  hr = sample->SetSampleTime(UsecsToHNs(aTimestamp));
+  NS_ENSURE_TRUE(SUCCEEDED(hr), hr);
+
+  *aOutSample = sample.forget();
+
+  return S_OK;
+}
+
+HRESULT
+MFTDecoder::CreateOutputSample(RefPtr<IMFSample>* aOutSample)
+{
+  NS_ENSURE_TRUE(mDecoder != nullptr, E_POINTER);
+
+  HRESULT hr;
+  RefPtr<IMFSample> sample;
+  hr = wmf::MFCreateSample(byRef(sample));
+  NS_ENSURE_TRUE(SUCCEEDED(hr), hr);
+
+  RefPtr<IMFMediaBuffer> buffer;
+  int32_t bufferSize = mOutputStreamInfo.cbSize;
+  UINT32 alignment = (mOutputStreamInfo.cbAlignment > 1) ? mOutputStreamInfo.cbAlignment - 1 : 0;
+  hr = wmf::MFCreateAlignedMemoryBuffer(bufferSize, alignment, byRef(buffer));
+  NS_ENSURE_TRUE(SUCCEEDED(hr), hr);
+
+  DWORD maxLength = 0;
+  DWORD currentLength = 0;
+  BYTE* dst = nullptr;
+
+  hr = sample->AddBuffer(buffer);
+  NS_ENSURE_TRUE(SUCCEEDED(hr), hr);
+
+  *aOutSample = sample.forget();
+
+  return S_OK;
+}
+
+HRESULT
+MFTDecoder::Output(RefPtr<IMFSample>* aOutput)
+{
+  NS_ENSURE_TRUE(mDecoder != nullptr, E_POINTER);
+
+  HRESULT hr;
+
+  MFT_OUTPUT_DATA_BUFFER output = {0};
+
+  RefPtr<IMFSample> sample;
+  if (!mMFTProvidesOutputSamples) {
+    hr = CreateOutputSample(&sample);
+    NS_ENSURE_TRUE(SUCCEEDED(hr), hr);
+    output.pSample = sample;
+  }
+
+  DWORD status = 0;
+  hr = mDecoder->ProcessOutput(0, 1, &output, &status);
+  if (output.pEvents) {
+    // We must release this, as per the IMFTransform::ProcessOutput()
+    // MSDN documentation.
+    output.pEvents->Release();
+    output.pEvents = nullptr;
+  }
+
+  if (hr == MF_E_TRANSFORM_STREAM_CHANGE) {
+    // Type change, probably geometric aperature change.
+    // Reconfigure decoder output type, so that GetOutputMediaType()
+    // returns the new type, and return the error code to caller.
+    // This is an expected failure, so don't warn on encountering it.
+    hr = SetDecoderOutputType();
+    NS_ENSURE_TRUE(SUCCEEDED(hr), hr);
+    // Return the error, so that the caller knows to retry.
+    return MF_E_TRANSFORM_STREAM_CHANGE;
+  }
+
+  if (hr == MF_E_TRANSFORM_NEED_MORE_INPUT) {
+    // Not enough input to produce output. This is an expected failure,
+    // so don't warn on encountering it.
+    return hr;
+  }
+  // Treat other errors as unexpected, and warn.
+  NS_ENSURE_TRUE(SUCCEEDED(hr), hr);
+
+  MOZ_ASSERT(output.pSample);
+
+  *aOutput = output.pSample; // AddRefs
+  if (mMFTProvidesOutputSamples) {
+    // If the MFT is providing samples, we must release the sample here.
+    // Typically only the H.264 MFT provides samples when using DXVA,
+    // and it always re-uses the same sample, so if we don't release it
+    // MFT::ProcessOutput() deadlocks waiting for the sample to be released.
+    output.pSample->Release();
+    output.pSample = nullptr;
+  }
+
+  return S_OK;
+}
+
+HRESULT
+MFTDecoder::Input(const uint8_t* aData,
+                  uint32_t aDataSize,
+                  int64_t aTimestamp)
+{
+  NS_ENSURE_TRUE(mDecoder != nullptr, E_POINTER);
+
+  RefPtr<IMFSample> input;
+  HRESULT hr = CreateInputSample(aData, aDataSize, aTimestamp, &input);
+  NS_ENSURE_TRUE(SUCCEEDED(hr) && input!=nullptr, hr);
+
+  hr = mDecoder->ProcessInput(0, input, 0);
+  if (hr == MF_E_NOTACCEPTING) {
+    // MFT *already* has enough data to produce a sample. Retrieve it.
+    return MF_E_NOTACCEPTING;
+  }
+  NS_ENSURE_TRUE(SUCCEEDED(hr), hr);
+
+  return S_OK;
+}
+
+HRESULT
+MFTDecoder::Flush()
+{
+  HRESULT hr = SendMFTMessage(MFT_MESSAGE_COMMAND_FLUSH, 0);
+  NS_ENSURE_TRUE(SUCCEEDED(hr), hr);
+
+  return S_OK;
+}
+
+HRESULT
+MFTDecoder::GetOutputMediaType(RefPtr<IMFMediaType>& aMediaType)
+{
+  NS_ENSURE_TRUE(mDecoder, E_POINTER);
+  return mDecoder->GetOutputCurrentType(0, byRef(aMediaType));
+}
+
+} // namespace mozilla
diff --git a/content/media/fmp4/wmf/MFTDecoder.h b/content/media/fmp4/wmf/MFTDecoder.h
new file mode 100644
index 000000000000..d1a4c444107e
--- /dev/null
+++ b/content/media/fmp4/wmf/MFTDecoder.h
@@ -0,0 +1,100 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#if !defined(MFTDecoder_h_)
+#define MFTDecoder_h_
+
+#include "wmf.h"
+#include "mozilla/RefPtr.h"
+#include "mozilla/ReentrantMonitor.h"
+#include "nsIThread.h"
+
+namespace mozilla {
+
+class MFTDecoder {
+public:
+  MFTDecoder();
+  ~MFTDecoder();
+
+  // Creates the MFT. First thing to do as part of setup.
+  //
+  // Params:
+  //  - aMFTClsID the clsid used by CoCreateInstance to instantiate the
+  //    decoder MFT.
+  HRESULT Create(const GUID& aMFTClsID);
+
+  // Sets the input and output media types. Call after Init().
+  //
+  // Params:
+  //  - aInputType needs at least major and minor types set.
+  //  - aOutputSubType is the minor type of the same major type e.g.
+  //    MFVideoFormat_H264. This is used to select the output type out
+  //    of all the available output types of the MFT.
+  HRESULT SetMediaTypes(IMFMediaType* aInputType,
+                        const GUID& aOutputSubType);
+
+  // Returns the MFT's IMFAttributes object.
+  TemporaryRef<IMFAttributes> GetAttributes();
+
+  // Retrieves the media type being output. This may not be valid until
+  //  the first sample is decoded.
+  HRESULT GetOutputMediaType(RefPtr<IMFMediaType>& aMediaType);
+
+  // Submits data into the MFT for processing.
+  //
+  // Returns:
+  //  - MF_E_NOTACCEPTING if the decoder can't accept input. The data
+  //    must be resubmitted after Output() stops producing output.
+  HRESULT Input(const uint8_t* aData,
+                uint32_t aDataSize,
+                int64_t aTimestampUsecs);
+
+  // Retrieves output from the MFT. Call this once Input() returns
+  // MF_E_NOTACCEPTING. Some MFTs with hardware acceleration (the H.264
+  // decoder MFT in particular) can't handle it if clients hold onto
+  // references to the output IMFSample, so don't do that.
+  //
+  // Returns:
+  //  - MF_E_TRANSFORM_STREAM_CHANGE if the underlying stream output
+  //    type changed. Retrieve the output media type and reconfig client,
+  //    else you may misinterpret the MFT's output.
+  //  - MF_E_TRANSFORM_NEED_MORE_INPUT if no output can be produced
+  //    due to lack of input.
+  //  - S_OK if an output frame is produced.
+  HRESULT Output(RefPtr<IMFSample>* aOutput);
+
+  // Sends a flush message to the MFT. This causes it to discard all
+  // input data. Use before seeking.
+  HRESULT Flush();
+
+  // Sends a message to the MFT.
+  HRESULT SendMFTMessage(MFT_MESSAGE_TYPE aMsg, UINT32 aData);
+
+private:
+
+  HRESULT SetDecoderOutputType();
+
+  HRESULT CreateInputSample(const uint8_t* aData,
+                            uint32_t aDataSize,
+                            int64_t aTimestampUsecs,
+                            RefPtr<IMFSample>* aOutSample);
+
+  HRESULT CreateOutputSample(RefPtr<IMFSample>* aOutSample);
+
+  MFT_INPUT_STREAM_INFO mInputStreamInfo;
+  MFT_OUTPUT_STREAM_INFO mOutputStreamInfo;
+
+  RefPtr<IMFTransform> mDecoder;
+
+  GUID mOutputSubtype;
+
+  // True if the IMFTransform allocates the samples that it returns.
+  bool mMFTProvidesOutputSamples;
+};
+
+} // namespace mozilla
+
+#endif
diff --git a/content/media/fmp4/wmf/WMFAudioDecoder.cpp b/content/media/fmp4/wmf/WMFAudioDecoder.cpp
new file mode 100644
index 000000000000..1dda4eb08835
--- /dev/null
+++ b/content/media/fmp4/wmf/WMFAudioDecoder.cpp
@@ -0,0 +1,283 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "WMFAudioDecoder.h"
+#include "VideoUtils.h"
+#include "WMFUtils.h"
+#include "nsTArray.h"
+
+#include "prlog.h"
+
+#ifdef PR_LOGGING
+PRLogModuleInfo* GetDemuxerLog();
+#define LOG(...) PR_LOG(GetDemuxerLog(), PR_LOG_DEBUG, (__VA_ARGS__))
+#else
+#define LOG(...)
+#endif
+
+
+namespace mozilla {
+
+WMFAudioDecoder::WMFAudioDecoder()
+  : mAudioChannels(0),
+    mAudioBytesPerSample(0),
+    mAudioRate(0),
+    mLastStreamOffset(0),
+    mAudioFrameOffset(0),
+    mAudioFrameSum(0),
+    mMustRecaptureAudioPosition(true)
+{
+}
+
+static void
+AACAudioSpecificConfigToUserData(const uint8_t* aAudioSpecConfig,
+                                 uint32_t aConfigLength,
+                                 nsTArray<BYTE>& aOutUserData)
+{
+  MOZ_ASSERT(aOutUserData.IsEmpty());
+
+  // The MF_MT_USER_DATA for AAC is defined here:
+  // http://msdn.microsoft.com/en-us/library/windows/desktop/dd742784%28v=vs.85%29.aspx
+  //
+  // For MFAudioFormat_AAC, MF_MT_USER_DATA contains the portion of
+  // the HEAACWAVEINFO structure that appears after the WAVEFORMATEX
+  // structure (that is, after the wfx member). This is followed by
+  // the AudioSpecificConfig() data, as defined by ISO/IEC 14496-3.
+  // [...]
+  // The length of the AudioSpecificConfig() data is 2 bytes for AAC-LC
+  // or HE-AAC with implicit signaling of SBR/PS. It is more than 2 bytes
+  // for HE-AAC with explicit signaling of SBR/PS.
+  //
+  // The value of audioObjectType as defined in AudioSpecificConfig()
+  // must be 2, indicating AAC-LC. The value of extensionAudioObjectType
+  // must be 5 for SBR or 29 for PS.
+  //
+  // HEAACWAVEINFO structure:
+  //    typedef struct heaacwaveinfo_tag {
+  //      WAVEFORMATEX wfx;
+  //      WORD         wPayloadType;
+  //      WORD         wAudioProfileLevelIndication;
+  //      WORD         wStructType;
+  //      WORD         wReserved1;
+  //      DWORD        dwReserved2;
+  //    }
+  const UINT32 heeInfoLen = 4 * sizeof(WORD) + sizeof(DWORD);
+
+  // The HEAACWAVEINFO must have payload and profile set,
+  // the rest can be all 0x00.
+  BYTE heeInfo[heeInfoLen] = {0};
+  WORD* w = (WORD*)heeInfo;
+  w[0] = 0x1; // Payload type ADTS
+  w[1] = 0xFE; // Profile level indication, none specified.
+
+  aOutUserData.AppendElements(heeInfo, heeInfoLen);
+  aOutUserData.AppendElements(aAudioSpecConfig, aConfigLength);
+}
+
+nsresult
+WMFAudioDecoder::Init(uint32_t aChannelCount,
+                      uint32_t aSampleRate,
+                      uint16_t aBitsPerSample,
+                      const uint8_t* aAudioSpecConfig,
+                      uint32_t aConfigLength)
+{
+  mDecoder = new MFTDecoder();
+
+  HRESULT hr = mDecoder->Create(CLSID_CMSAACDecMFT);
+  NS_ENSURE_TRUE(SUCCEEDED(hr), NS_ERROR_FAILURE);
+
+  // Setup input/output media types
+  RefPtr<IMFMediaType> type;
+
+  hr = wmf::MFCreateMediaType(byRef(type));
+  NS_ENSURE_TRUE(SUCCEEDED(hr), NS_ERROR_FAILURE);
+
+  hr = type->SetGUID(MF_MT_MAJOR_TYPE, MFMediaType_Audio);
+  NS_ENSURE_TRUE(SUCCEEDED(hr), NS_ERROR_FAILURE);
+
+  hr = type->SetGUID(MF_MT_SUBTYPE, MFAudioFormat_AAC);
+  NS_ENSURE_TRUE(SUCCEEDED(hr), NS_ERROR_FAILURE);
+
+  hr = type->SetUINT32(MF_MT_AUDIO_SAMPLES_PER_SECOND, aSampleRate);
+  NS_ENSURE_TRUE(SUCCEEDED(hr), NS_ERROR_FAILURE);
+
+  hr = type->SetUINT32(MF_MT_AUDIO_NUM_CHANNELS, aChannelCount);
+  NS_ENSURE_TRUE(SUCCEEDED(hr), NS_ERROR_FAILURE);
+
+  hr = type->SetUINT32(MF_MT_AAC_PAYLOAD_TYPE, 0x1); // ADTS
+  NS_ENSURE_TRUE(SUCCEEDED(hr), NS_ERROR_FAILURE);
+
+  nsTArray<BYTE> userData;
+  AACAudioSpecificConfigToUserData(aAudioSpecConfig,
+                                   aConfigLength,
+                                   userData);
+
+  hr = type->SetBlob(MF_MT_USER_DATA,
+                     userData.Elements(),
+                     userData.Length());
+  NS_ENSURE_TRUE(SUCCEEDED(hr), NS_ERROR_FAILURE);
+
+  hr = mDecoder->SetMediaTypes(type, MFAudioFormat_PCM);
+  NS_ENSURE_TRUE(SUCCEEDED(hr), NS_ERROR_FAILURE);
+
+  mAudioChannels = aChannelCount;
+  mAudioBytesPerSample = aBitsPerSample / 8;
+  mAudioRate = aSampleRate;
+  return NS_OK;
+}
+
+nsresult
+WMFAudioDecoder::Shutdown()
+{
+  return NS_OK;
+}
+
+DecoderStatus
+WMFAudioDecoder::Input(const uint8_t* aData,
+                       uint32_t aLength,
+                       Microseconds aDTS,
+                       Microseconds aPTS,
+                       int64_t aOffsetInStream)
+{
+  mLastStreamOffset = aOffsetInStream;
+  HRESULT hr = mDecoder->Input(aData, aLength, aPTS);
+  if (hr == MF_E_NOTACCEPTING) {
+    return DECODE_STATUS_NOT_ACCEPTING;
+  }
+  NS_ENSURE_TRUE(SUCCEEDED(hr), DECODE_STATUS_ERROR);
+
+  return DECODE_STATUS_OK;
+}
+
+DecoderStatus
+WMFAudioDecoder::Output(nsAutoPtr<MediaData>& aOutData)
+{
+  DecoderStatus status;
+  do {
+    status = OutputNonNegativeTimeSamples(aOutData);
+  } while (status == DECODE_STATUS_OK && !aOutData);
+  return status;
+}
+
+DecoderStatus
+WMFAudioDecoder::OutputNonNegativeTimeSamples(nsAutoPtr<MediaData>& aOutData)
+{
+
+  aOutData = nullptr;
+  RefPtr<IMFSample> sample;
+  HRESULT hr = mDecoder->Output(&sample);
+  if (hr == MF_E_TRANSFORM_NEED_MORE_INPUT) {
+    return DECODE_STATUS_NEED_MORE_INPUT;
+  }
+  NS_ENSURE_TRUE(SUCCEEDED(hr), DECODE_STATUS_ERROR);
+
+  RefPtr<IMFMediaBuffer> buffer;
+  hr = sample->ConvertToContiguousBuffer(byRef(buffer));
+  NS_ENSURE_TRUE(SUCCEEDED(hr), DECODE_STATUS_ERROR);
+
+  BYTE* data = nullptr; // Note: *data will be owned by the IMFMediaBuffer, we don't need to free it.
+  DWORD maxLength = 0, currentLength = 0;
+  hr = buffer->Lock(&data, &maxLength, &currentLength);
+  NS_ENSURE_TRUE(SUCCEEDED(hr), DECODE_STATUS_ERROR);
+
+  int32_t numSamples = currentLength / mAudioBytesPerSample;
+  int32_t numFrames = numSamples / mAudioChannels;
+
+  // Sometimes when starting decoding, the AAC decoder gives us samples
+  // with a negative timestamp. AAC does usually have preroll (or encoder
+  // delay) encoded into its bitstream, but the amount encoded to the stream
+  // is variable, and it not signalled in-bitstream. There is sometimes
+  // signalling in the MP4 container what the preroll amount, but it's
+  // inconsistent. It looks like WMF's AAC encoder may take this into
+  // account, so strip off samples with a negative timestamp to get us
+  // to a 0-timestamp start. This seems to maintain A/V sync, so we can run
+  // with this until someone complains...
+
+  // We calculate the timestamp and the duration based on the number of audio
+  // frames we've already played. We don't trust the timestamp stored on the
+  // IMFSample, as sometimes it's wrong, possibly due to buggy encoders?
+
+  // If this sample block comes after a discontinuity (i.e. a gap or seek)
+  // reset the frame counters, and capture the timestamp. Future timestamps
+  // will be offset from this block's timestamp.
+  UINT32 discontinuity = false;
+  int32_t numFramesToStrip = 0;
+  sample->GetUINT32(MFSampleExtension_Discontinuity, &discontinuity);
+  if (mMustRecaptureAudioPosition || discontinuity) {
+    mAudioFrameSum = 0;
+    LONGLONG timestampHns = 0;
+    hr = sample->GetSampleTime(&timestampHns);
+    NS_ENSURE_TRUE(SUCCEEDED(hr), DECODE_STATUS_ERROR);
+    hr = HNsToFrames(timestampHns, mAudioRate, &mAudioFrameOffset);
+    NS_ENSURE_TRUE(SUCCEEDED(hr), DECODE_STATUS_ERROR);
+    if (mAudioFrameOffset < 0) {
+      // First sample has a negative timestamp. Strip off the samples until
+      // we reach positive territory.
+      numFramesToStrip = -mAudioFrameOffset;
+      mAudioFrameOffset = 0;
+    }
+    mMustRecaptureAudioPosition = false;
+  }
+  MOZ_ASSERT(numFramesToStrip >= 0);
+  int32_t offset = std::min<int32_t>(numFramesToStrip, numFrames);
+  numFrames -= offset;
+  numSamples -= offset * mAudioChannels;
+  MOZ_ASSERT(numFrames >= 0);
+  MOZ_ASSERT(numSamples >= 0);
+  if (numFrames == 0) {
+    // All data from this chunk stripped, loop back and try to output the next
+    // frame, if possible.
+    return DECODE_STATUS_OK;
+  }
+
+  nsAutoArrayPtr<AudioDataValue> audioData(new AudioDataValue[numSamples]);
+
+  // Just assume PCM output for now...
+  MOZ_ASSERT(mAudioBytesPerSample == 2);
+  int16_t* pcm = ((int16_t*)data) + (offset * mAudioChannels);
+  MOZ_ASSERT(pcm >= (int16_t*)data);
+  MOZ_ASSERT(pcm <= (int16_t*)(data + currentLength));
+  MOZ_ASSERT(pcm+numSamples <= (int16_t*)(data + currentLength));
+  for (int32_t i = 0; i < numSamples; ++i) {
+    audioData[i] = AudioSampleToFloat(pcm[i]);
+  }
+
+  buffer->Unlock();
+  int64_t timestamp;
+  hr = FramesToUsecs(mAudioFrameOffset + mAudioFrameSum, mAudioRate, &timestamp);
+  NS_ENSURE_TRUE(SUCCEEDED(hr), DECODE_STATUS_ERROR);
+
+  mAudioFrameSum += numFrames;
+
+  int64_t duration;
+  hr = FramesToUsecs(numFrames, mAudioRate, &duration);
+  NS_ENSURE_TRUE(SUCCEEDED(hr), DECODE_STATUS_ERROR);
+
+  aOutData = new AudioData(mLastStreamOffset,
+                            timestamp,
+                            duration,
+                            numFrames,
+                            audioData.forget(),
+                            mAudioChannels);
+
+  #ifdef LOG_SAMPLE_DECODE
+  LOG("Decoded audio sample! timestamp=%lld duration=%lld currentLength=%u",
+      timestamp, duration, currentLength);
+  #endif
+
+  return DECODE_STATUS_OK;
+}
+
+DecoderStatus
+WMFAudioDecoder::Flush()
+{
+  NS_ENSURE_TRUE(mDecoder, DECODE_STATUS_ERROR);
+  HRESULT hr = mDecoder->Flush();
+  NS_ENSURE_TRUE(SUCCEEDED(hr), DECODE_STATUS_ERROR);
+  return DECODE_STATUS_OK;
+}
+
+} // namespace mozilla
diff --git a/content/media/fmp4/wmf/WMFAudioDecoder.h b/content/media/fmp4/wmf/WMFAudioDecoder.h
new file mode 100644
index 000000000000..89afdbf80cdd
--- /dev/null
+++ b/content/media/fmp4/wmf/WMFAudioDecoder.h
@@ -0,0 +1,77 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#if !defined(WMFAudioDecoder_h_)
+#define WMFAudioDecoder_h_
+
+#include "wmf.h"
+#include "MP4Reader.h"
+#include "MFTDecoder.h"
+
+namespace mozilla {
+
+class WMFAudioDecoder : public MediaDataDecoder {
+public:
+  WMFAudioDecoder();
+
+  nsresult Init(uint32_t aChannelCount,
+                uint32_t aSampleRate,
+                uint16_t aBitsPerSample,
+                const uint8_t* aUserData,
+                uint32_t aUserDataLength);
+
+  virtual nsresult Shutdown() MOZ_OVERRIDE;
+
+  // Inserts data into the decoder's pipeline.
+  virtual DecoderStatus Input(const uint8_t* aData,
+                              uint32_t aLength,
+                              Microseconds aDTS,
+                              Microseconds aPTS,
+                              int64_t aOffsetInStream);
+
+  // Blocks until a decoded sample is produced by the decoder.
+  virtual DecoderStatus Output(nsAutoPtr<MediaData>& aOutData);
+
+  virtual DecoderStatus Flush() MOZ_OVERRIDE;
+
+private:
+
+
+  // A helper for Output() above. This has the same interface as Output()
+  // above, except that it returns DECODE_STATUS_OK and sets aOutData to
+  // nullptr when all the output samples have been stripped due to having
+  // negative timestamps. WMF's AAC decoder sometimes output negatively
+  // timestamped samples, presumably they're the preroll samples, and we
+  // strip them.
+  DecoderStatus OutputNonNegativeTimeSamples(nsAutoPtr<MediaData>& aOutData);
+
+  nsAutoPtr<MFTDecoder> mDecoder;
+
+  uint32_t mAudioChannels;
+  uint32_t mAudioBytesPerSample;
+  uint32_t mAudioRate;
+
+  // The last offset into the media resource that was passed into Input().
+  // This is used to approximate the decoder's position in the media resource.
+  int64_t mLastStreamOffset;
+
+  // The offset, in audio frames, at which playback started since the
+  // last discontinuity.
+  int64_t mAudioFrameOffset;
+  // The number of audio frames that we've played since the last
+  // discontinuity.
+  int64_t mAudioFrameSum;
+  // True if we need to re-initialize mAudioFrameOffset and mAudioFrameSum
+  // from the next audio packet we decode. This happens after a seek, since
+  // WMF doesn't mark a stream as having a discontinuity after a seek(0).
+  bool mMustRecaptureAudioPosition;
+};
+
+
+
+} // namespace mozilla
+
+#endif
diff --git a/content/media/fmp4/wmf/WMFDecoderModule.cpp b/content/media/fmp4/wmf/WMFDecoderModule.cpp
new file mode 100644
index 000000000000..1a7b509f85f4
--- /dev/null
+++ b/content/media/fmp4/wmf/WMFDecoderModule.cpp
@@ -0,0 +1,104 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "wmf.h"
+#include "WMFDecoderModule.h"
+#include "WMFDecoder.h"
+#include "WMFVideoDecoder.h"
+#include "WMFAudioDecoder.h"
+#include "mozilla/Preferences.h"
+#include "mozilla/DebugOnly.h"
+
+namespace mozilla {
+
+WMFDecoderModule::WMFDecoderModule()
+  : mDXVAEnabled(Preferences::GetBool("media.windows-media-foundation.use-dxva", false))
+{
+  MOZ_ASSERT(NS_IsMainThread(), "Must be on main thread.");
+}
+
+WMFDecoderModule::~WMFDecoderModule()
+{
+  MOZ_ASSERT(NS_IsMainThread(), "Must be on main thread.");
+}
+
+nsresult
+WMFDecoderModule::Init()
+{
+  MOZ_ASSERT(NS_IsMainThread(), "Must be on main thread.");
+  if (!Preferences::GetBool("media.windows-media-foundation.enabled", false)) {
+    return NS_ERROR_FAILURE;
+  }
+
+  nsresult rv = WMFDecoder::LoadDLLs();
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  if (FAILED(wmf::MFStartup())) {
+    NS_WARNING("Failed to initialize Windows Media Foundation");
+    return NS_ERROR_FAILURE;
+  }
+
+  return NS_OK;
+}
+
+nsresult
+WMFDecoderModule::Shutdown()
+{
+  MOZ_ASSERT(NS_IsMainThread(), "Must be on main thread.");
+
+  DebugOnly<HRESULT> hr = wmf::MFShutdown();
+  NS_ASSERTION(SUCCEEDED(hr), "MFShutdown failed");
+
+  return NS_OK;
+}
+
+MediaDataDecoder*
+WMFDecoderModule::CreateVideoDecoder(mozilla::layers::LayersBackend aLayersBackend,
+                                     mozilla::layers::ImageContainer* aImageContainer)
+{
+  nsAutoPtr<WMFVideoDecoder> decoder(new WMFVideoDecoder(mDXVAEnabled));
+  nsresult rv = decoder->Init(aLayersBackend, aImageContainer);
+  NS_ENSURE_SUCCESS(rv, nullptr);
+  return decoder.forget();
+}
+
+MediaDataDecoder*
+WMFDecoderModule::CreateAudioDecoder(uint32_t aChannelCount,
+                                     uint32_t aSampleRate,
+                                     uint16_t aBitsPerSample,
+                                     const uint8_t* aUserData,
+                                     uint32_t aUserDataLength)
+{
+  nsAutoPtr<WMFAudioDecoder> decoder(new WMFAudioDecoder());
+  nsresult rv = decoder->Init(aChannelCount,
+                              aSampleRate,
+                              aBitsPerSample,
+                              aUserData,
+                              aUserDataLength);
+  NS_ENSURE_SUCCESS(rv, nullptr);
+  return decoder.forget();
+}
+
+void
+WMFDecoderModule::OnDecodeThreadStart()
+{
+  MOZ_ASSERT(!NS_IsMainThread(), "Must not be on main thread.");
+  // XXX WebAudio can call this on the main thread when using deprecated APIs.
+  // That should not happen. You cannot change the concurrency model once already set.
+  // The main thread will continue to be STA, which seems to work, but MSDN
+  // recommends that MTA be used.
+  // TODO: enforce that WebAudio stops doing that!
+  CoInitializeEx(0, COINIT_MULTITHREADED);
+}
+
+void
+WMFDecoderModule::OnDecodeThreadFinish()
+{
+  MOZ_ASSERT(!NS_IsMainThread(), "Must be on main thread.");
+  CoUninitialize();
+}
+
+} // namespace mozilla
diff --git a/content/media/fmp4/wmf/WMFDecoderModule.h b/content/media/fmp4/wmf/WMFDecoderModule.h
new file mode 100644
index 000000000000..983d807c5cc2
--- /dev/null
+++ b/content/media/fmp4/wmf/WMFDecoderModule.h
@@ -0,0 +1,48 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#if !defined(WMFPlatformDecoderModule_h_)
+#define WMFPlatformDecoderModule_h_
+
+#include "PlatformDecoderModule.h"
+
+namespace mozilla {
+
+class WMFDecoderModule : public PlatformDecoderModule {
+public:
+  WMFDecoderModule();
+  virtual ~WMFDecoderModule();
+
+  // Initializes the module, loads required dynamic libraries, etc.
+  // Main thread only.
+  nsresult Init();
+
+  // Called when the decoders have shutdown. Main thread only.
+  // Does this really need to be main thread only????
+  virtual nsresult Shutdown() MOZ_OVERRIDE;
+
+  // Decode thread.
+  virtual MediaDataDecoder*
+  CreateVideoDecoder(mozilla::layers::LayersBackend aLayersBackend,
+                     mozilla::layers::ImageContainer* aImageContainer) MOZ_OVERRIDE;
+
+  // Decode thread.
+  virtual MediaDataDecoder* CreateAudioDecoder(uint32_t aChannelCount,
+                                               uint32_t aSampleRate,
+                                               uint16_t aBitsPerSample,
+                                               const uint8_t* aUserData,
+                                               uint32_t aUserDataLength) MOZ_OVERRIDE;
+
+  // Platform decoders can override these. Base implementation does nothing.
+  virtual void OnDecodeThreadStart() MOZ_OVERRIDE;
+  virtual void OnDecodeThreadFinish() MOZ_OVERRIDE;
+private:
+  const bool mDXVAEnabled;
+};
+
+} // namespace mozilla
+
+#endif
diff --git a/content/media/fmp4/wmf/WMFVideoDecoder.cpp b/content/media/fmp4/wmf/WMFVideoDecoder.cpp
new file mode 100644
index 000000000000..e610a440d957
--- /dev/null
+++ b/content/media/fmp4/wmf/WMFVideoDecoder.cpp
@@ -0,0 +1,412 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "WMFVideoDecoder.h"
+#include "MediaDecoderReader.h"
+#include "WMFUtils.h"
+#include "ImageContainer.h"
+#include "VideoUtils.h"
+#include "DXVA2Manager.h"
+#include "nsThreadUtils.h"
+#include "WinUtils.h"
+#include "Layers.h"
+#include "mozilla/layers/LayersTypes.h"
+#include "prlog.h"
+
+#ifdef PR_LOGGING
+PRLogModuleInfo* GetDemuxerLog();
+#define LOG(...) PR_LOG(GetDemuxerLog(), PR_LOG_DEBUG, (__VA_ARGS__))
+#else
+#define LOG(...)
+#endif
+
+using mozilla::layers::Image;
+using mozilla::layers::LayerManager;
+using mozilla::layers::LayersBackend;
+
+namespace mozilla {
+
+WMFVideoDecoder::WMFVideoDecoder(bool aDXVAEnabled)
+  : mVideoStride(0),
+    mVideoWidth(0),
+    mVideoHeight(0),
+    mLastStreamOffset(0),
+    mDXVAEnabled(aDXVAEnabled),
+    mIsRunningOnVista(widget::WinUtils::GetWindowsVersion() == widget::WinUtils::WIN7_VERSION),
+    mUseHwAccel(false)
+{
+  NS_ASSERTION(!NS_IsMainThread(), "Must be on main thread.");
+  MOZ_COUNT_CTOR(WMFVideoDecoder);
+}
+
+WMFVideoDecoder::~WMFVideoDecoder()
+{
+  MOZ_COUNT_DTOR(WMFVideoDecoder);
+}
+
+class CreateDXVAManagerEvent : public nsRunnable {
+public:
+  NS_IMETHOD Run() {
+    NS_ASSERTION(NS_IsMainThread(), "Must be on main thread.");
+    mDXVA2Manager = DXVA2Manager::Create();
+    return NS_OK;
+  }
+  nsAutoPtr<DXVA2Manager> mDXVA2Manager;
+};
+
+bool
+WMFVideoDecoder::InitializeDXVA(mozilla::layers::LayersBackend aLayersBackend)
+{
+  // If we use DXVA but aren't running with a D3D layer manager then the
+  // readback of decoded video frames from GPU to CPU memory grinds painting
+  // to a halt, and makes playback performance *worse*.
+  if (!mDXVAEnabled ||
+      (aLayersBackend != LayersBackend::LAYERS_D3D9 &&
+       aLayersBackend != LayersBackend::LAYERS_D3D10)) {
+    return false;
+  }
+
+  // The DXVA manager must be created on the main thread.
+  nsRefPtr<CreateDXVAManagerEvent> event(new CreateDXVAManagerEvent());
+  NS_DispatchToMainThread(event, NS_DISPATCH_SYNC);
+  mDXVA2Manager = event->mDXVA2Manager;
+
+  return mDXVA2Manager != nullptr;
+}
+
+nsresult
+WMFVideoDecoder::Init(mozilla::layers::LayersBackend aLayersBackend,
+                      mozilla::layers::ImageContainer* aImageContainer)
+{
+  NS_ENSURE_ARG_POINTER(aImageContainer);
+
+  bool useDxva= InitializeDXVA(aLayersBackend);
+
+  mDecoder = new MFTDecoder();
+
+  HRESULT hr = mDecoder->Create(CLSID_CMSH264DecoderMFT);
+  NS_ENSURE_TRUE(SUCCEEDED(hr), NS_ERROR_FAILURE);
+
+  if (useDxva) {
+    RefPtr<IMFAttributes> attr(mDecoder->GetAttributes());
+
+    UINT32 aware = 0;
+    if (attr) {
+      attr->GetUINT32(MF_SA_D3D_AWARE, &aware);
+    }
+    if (aware) {
+      // TODO: Test if I need this anywhere... Maybe on Vista?
+      //hr = attr->SetUINT32(CODECAPI_AVDecVideoAcceleration_H264, TRUE);
+      //NS_ENSURE_TRUE(SUCCEEDED(hr), hr);
+      MOZ_ASSERT(mDXVA2Manager);
+      ULONG_PTR manager = ULONG_PTR(mDXVA2Manager->GetDXVADeviceManager());
+      hr = mDecoder->SendMFTMessage(MFT_MESSAGE_SET_D3D_MANAGER, manager);
+      if (SUCCEEDED(hr)) {
+        mUseHwAccel = true;
+      }
+    }
+  }
+
+  // Setup the input/output media types.
+  RefPtr<IMFMediaType> type;
+  hr = wmf::MFCreateMediaType(byRef(type));
+  NS_ENSURE_TRUE(SUCCEEDED(hr), NS_ERROR_FAILURE);
+
+  hr = type->SetGUID(MF_MT_MAJOR_TYPE, MFMediaType_Video);
+  NS_ENSURE_TRUE(SUCCEEDED(hr), NS_ERROR_FAILURE);
+
+  hr = type->SetGUID(MF_MT_SUBTYPE, MFVideoFormat_H264);
+  NS_ENSURE_TRUE(SUCCEEDED(hr), NS_ERROR_FAILURE);
+
+  hr = type->SetUINT32(MF_MT_INTERLACE_MODE, MFVideoInterlace_MixedInterlaceOrProgressive);
+  NS_ENSURE_TRUE(SUCCEEDED(hr), NS_ERROR_FAILURE);
+
+  GUID outputType = mUseHwAccel ? MFVideoFormat_NV12 : MFVideoFormat_YV12;
+  hr = mDecoder->SetMediaTypes(type, outputType);
+  NS_ENSURE_TRUE(SUCCEEDED(hr), NS_ERROR_FAILURE);
+
+  mImageContainer = aImageContainer;
+
+  LOG("Video Decoder initialized, Using DXVA: %s", (mUseHwAccel ? "Yes" : "No"));
+
+  return NS_OK;
+}
+
+HRESULT
+WMFVideoDecoder::ConfigureVideoFrameGeometry()
+{
+  RefPtr<IMFMediaType> mediaType;
+  HRESULT hr = mDecoder->GetOutputMediaType(mediaType);
+  NS_ENSURE_TRUE(SUCCEEDED(hr), hr);
+
+  // Verify that the video subtype is what we expect it to be.
+  // When using hardware acceleration/DXVA2 the video format should
+  // be NV12, which is DXVA2's preferred format. For software decoding
+  // we use YV12, as that's easier for us to stick into our rendering
+  // pipeline than NV12. NV12 has interleaved UV samples, whereas YV12
+  // is a planar format.
+  GUID videoFormat;
+  hr = mediaType->GetGUID(MF_MT_SUBTYPE, &videoFormat);
+  NS_ENSURE_TRUE(videoFormat == MFVideoFormat_NV12 || !mUseHwAccel, E_FAIL);
+  NS_ENSURE_TRUE(videoFormat == MFVideoFormat_YV12 || mUseHwAccel, E_FAIL);
+
+  nsIntRect pictureRegion;
+  hr = GetPictureRegion(mediaType, pictureRegion);
+  NS_ENSURE_TRUE(SUCCEEDED(hr), hr);
+
+  UINT32 width = 0, height = 0;
+  hr = MFGetAttributeSize(mediaType, MF_MT_FRAME_SIZE, &width, &height);
+  NS_ENSURE_TRUE(SUCCEEDED(hr), hr);
+
+  uint32_t aspectNum = 0, aspectDenom = 0;
+  hr = MFGetAttributeRatio(mediaType,
+                           MF_MT_PIXEL_ASPECT_RATIO,
+                           &aspectNum,
+                           &aspectDenom);
+  NS_ENSURE_TRUE(SUCCEEDED(hr), hr);
+
+  // Calculate and validate the picture region and frame dimensions after
+  // scaling by the pixel aspect ratio.
+  nsIntSize frameSize = nsIntSize(width, height);
+  nsIntSize displaySize = nsIntSize(pictureRegion.width, pictureRegion.height);
+  ScaleDisplayByAspectRatio(displaySize, float(aspectNum) / float(aspectDenom));
+  if (!VideoInfo::ValidateVideoRegion(frameSize, pictureRegion, displaySize)) {
+    // Video track's frame sizes will overflow. Ignore the video track.
+    return E_FAIL;
+  }
+
+  // Success! Save state.
+  mVideoInfo.mDisplay = displaySize;
+  mVideoInfo.mHasVideo = true;
+  GetDefaultStride(mediaType, &mVideoStride);
+  mVideoWidth = width;
+  mVideoHeight = height;
+  mPictureRegion = pictureRegion;
+
+  LOG("WMFReader frame geometry frame=(%u,%u) stride=%u picture=(%d, %d, %d, %d) display=(%d,%d) PAR=%d:%d",
+      width, height,
+      mVideoStride,
+      mPictureRegion.x, mPictureRegion.y, mPictureRegion.width, mPictureRegion.height,
+      displaySize.width, displaySize.height,
+      aspectNum, aspectDenom);
+
+  return S_OK;
+}
+
+nsresult
+WMFVideoDecoder::Shutdown()
+{
+  return NS_OK;
+}
+
+// Inserts data into the decoder's pipeline.
+DecoderStatus
+WMFVideoDecoder::Input(const uint8_t* aData,
+                       uint32_t aLength,
+                       Microseconds aDTS,
+                       Microseconds aPTS,
+                       int64_t aOffsetInStream)
+{
+  mLastStreamOffset = aOffsetInStream;
+  HRESULT hr = mDecoder->Input(aData, aLength, aPTS);
+  if (hr == MF_E_NOTACCEPTING) {
+    return DECODE_STATUS_NOT_ACCEPTING;
+  }
+  NS_ENSURE_TRUE(SUCCEEDED(hr), DECODE_STATUS_ERROR);
+
+  return DECODE_STATUS_OK;
+}
+
+HRESULT
+WMFVideoDecoder::CreateBasicVideoFrame(IMFSample* aSample,
+                                       VideoData** aOutVideoData)
+{
+  NS_ENSURE_TRUE(aSample, E_POINTER);
+  NS_ENSURE_TRUE(aOutVideoData, E_POINTER);
+
+  *aOutVideoData = nullptr;
+
+  HRESULT hr;
+  RefPtr<IMFMediaBuffer> buffer;
+
+  // Must convert to contiguous buffer to use IMD2DBuffer interface.
+  hr = aSample->ConvertToContiguousBuffer(byRef(buffer));
+  NS_ENSURE_TRUE(SUCCEEDED(hr), hr);
+
+  // Try and use the IMF2DBuffer interface if available, otherwise fallback
+  // to the IMFMediaBuffer interface. Apparently IMF2DBuffer is more efficient,
+  // but only some systems (Windows 8?) support it.
+  BYTE* data = nullptr;
+  LONG stride = 0;
+  RefPtr<IMF2DBuffer> twoDBuffer;
+  hr = buffer->QueryInterface(static_cast<IMF2DBuffer**>(byRef(twoDBuffer)));
+  if (SUCCEEDED(hr)) {
+    hr = twoDBuffer->Lock2D(&data, &stride);
+    NS_ENSURE_TRUE(SUCCEEDED(hr), hr);
+  } else {
+    hr = buffer->Lock(&data, NULL, NULL);
+    NS_ENSURE_TRUE(SUCCEEDED(hr), hr);
+    stride = mVideoStride;
+  }
+
+  // YV12, planar format: [YYYY....][VVVV....][UUUU....]
+  // i.e., Y, then V, then U.
+  VideoData::YCbCrBuffer b;
+
+  // Y (Y') plane
+  b.mPlanes[0].mData = data;
+  b.mPlanes[0].mStride = stride;
+  b.mPlanes[0].mHeight = mVideoHeight;
+  b.mPlanes[0].mWidth = mVideoWidth;
+  b.mPlanes[0].mOffset = 0;
+  b.mPlanes[0].mSkip = 0;
+
+  // The V and U planes are stored 16-row-aligned, so we need to add padding
+  // to the row heights to ensure the Y'CbCr planes are referenced properly.
+  uint32_t padding = 0;
+  if (mVideoHeight % 16 != 0) {
+    padding = 16 - (mVideoHeight % 16);
+  }
+  uint32_t y_size = stride * (mVideoHeight + padding);
+  uint32_t v_size = stride * (mVideoHeight + padding) / 4;
+  uint32_t halfStride = (stride + 1) / 2;
+  uint32_t halfHeight = (mVideoHeight + 1) / 2;
+  uint32_t halfWidth = (mVideoWidth + 1) / 2;
+
+  // U plane (Cb)
+  b.mPlanes[1].mData = data + y_size + v_size;
+  b.mPlanes[1].mStride = halfStride;
+  b.mPlanes[1].mHeight = halfHeight;
+  b.mPlanes[1].mWidth = halfWidth;
+  b.mPlanes[1].mOffset = 0;
+  b.mPlanes[1].mSkip = 0;
+
+  // V plane (Cr)
+  b.mPlanes[2].mData = data + y_size;
+  b.mPlanes[2].mStride = halfStride;
+  b.mPlanes[2].mHeight = halfHeight;
+  b.mPlanes[2].mWidth = halfWidth;
+  b.mPlanes[2].mOffset = 0;
+  b.mPlanes[2].mSkip = 0;
+
+  Microseconds pts = GetSampleTime(aSample);
+  Microseconds duration = GetSampleDuration(aSample);
+  VideoData *v = VideoData::Create(mVideoInfo,
+                                   mImageContainer,
+                                   mLastStreamOffset,
+                                   pts,
+                                   duration,
+                                   b,
+                                   false,
+                                   -1,
+                                   mPictureRegion);
+  if (twoDBuffer) {
+    twoDBuffer->Unlock2D();
+  } else {
+    buffer->Unlock();
+  }
+
+  *aOutVideoData = v;
+
+  return S_OK;
+}
+
+HRESULT
+WMFVideoDecoder::CreateD3DVideoFrame(IMFSample* aSample,
+                                     VideoData** aOutVideoData)
+{
+  NS_ENSURE_TRUE(aSample, E_POINTER);
+  NS_ENSURE_TRUE(aOutVideoData, E_POINTER);
+  NS_ENSURE_TRUE(mDXVA2Manager, E_ABORT);
+  NS_ENSURE_TRUE(mUseHwAccel, E_ABORT);
+
+  *aOutVideoData = nullptr;
+  HRESULT hr;
+
+  nsRefPtr<Image> image;
+  hr = mDXVA2Manager->CopyToImage(aSample,
+                                  mPictureRegion,
+                                  mImageContainer,
+                                  getter_AddRefs(image));
+  NS_ENSURE_TRUE(SUCCEEDED(hr), hr);
+  NS_ENSURE_TRUE(image, E_FAIL);
+
+  Microseconds pts = GetSampleTime(aSample);
+  Microseconds duration = GetSampleDuration(aSample);
+  VideoData *v = VideoData::CreateFromImage(mVideoInfo,
+                                            mImageContainer,
+                                            mLastStreamOffset,
+                                            pts,
+                                            duration,
+                                            image.forget(),
+                                            false,
+                                            -1,
+                                            mPictureRegion);
+
+  NS_ENSURE_TRUE(v, E_FAIL);
+  *aOutVideoData = v;
+
+  return S_OK;
+}
+
+// Blocks until decoded sample is produced by the deoder.
+DecoderStatus
+WMFVideoDecoder::Output(nsAutoPtr<MediaData>& aOutData)
+{
+  RefPtr<IMFSample> sample;
+  HRESULT hr;
+
+  // Loop until we decode a sample, or an unexpected error that we can't
+  // handle occurs.
+  while (true) {
+    hr = mDecoder->Output(&sample);
+    if (SUCCEEDED(hr)) {
+      NS_ENSURE_TRUE(sample, DECODE_STATUS_ERROR);
+      break;
+    }
+    if (hr == MF_E_TRANSFORM_NEED_MORE_INPUT) {
+      return DECODE_STATUS_NEED_MORE_INPUT;
+    }
+    if (hr == MF_E_TRANSFORM_STREAM_CHANGE) {
+      // Video stream output type change. Probably a geometric apperature
+      // change. Reconfigure the video geometry, so that we output the
+      // correct size frames.
+      MOZ_ASSERT(!sample);
+      hr = ConfigureVideoFrameGeometry();
+      NS_ENSURE_TRUE(SUCCEEDED(hr), DECODE_STATUS_ERROR);
+      // Loop back and try decoding again...
+      continue;
+    }
+    // Else unexpected error, assert, and bail.
+    NS_WARNING("WMFVideoDecoder::Output() unexpected error");
+    return DECODE_STATUS_ERROR;
+  }
+
+  VideoData* frame = nullptr;
+  if (mUseHwAccel) {
+    hr = CreateD3DVideoFrame(sample, &frame);
+  } else {
+    hr = CreateBasicVideoFrame(sample, &frame);
+  }
+  // Frame should be non null only when we succeeded.
+  MOZ_ASSERT((frame != nullptr) == SUCCEEDED(hr));
+  NS_ENSURE_TRUE(SUCCEEDED(hr) && frame, DECODE_STATUS_ERROR);
+
+  aOutData = frame;
+
+  return DECODE_STATUS_OK;
+}
+
+DecoderStatus
+WMFVideoDecoder::Flush()
+{
+  NS_ENSURE_TRUE(mDecoder, DECODE_STATUS_ERROR);
+  HRESULT hr = mDecoder->Flush();
+  NS_ENSURE_TRUE(SUCCEEDED(hr), DECODE_STATUS_ERROR);
+  return DECODE_STATUS_OK;
+}
+
+} // namespace mozilla
diff --git a/content/media/fmp4/wmf/WMFVideoDecoder.h b/content/media/fmp4/wmf/WMFVideoDecoder.h
new file mode 100644
index 000000000000..8aa59bdcd00f
--- /dev/null
+++ b/content/media/fmp4/wmf/WMFVideoDecoder.h
@@ -0,0 +1,79 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#if !defined(WMFVideoDecoder_h_)
+#define WMFVideoDecoder_h_
+
+#include "wmf.h"
+#include "MP4Reader.h"
+#include "MFTDecoder.h"
+#include "nsRect.h"
+
+#include "mozilla/RefPtr.h"
+
+namespace mozilla {
+
+class DXVA2Manager;
+
+class WMFVideoDecoder : public MediaDataDecoder {
+public:
+  WMFVideoDecoder(bool aDXVAEnabled);
+  ~WMFVideoDecoder();
+
+  // Decode thread.
+  nsresult Init(mozilla::layers::LayersBackend aLayersBackend,
+                mozilla::layers::ImageContainer* aImageContainer);
+
+  virtual nsresult Shutdown() MOZ_OVERRIDE;
+
+  // Inserts data into the decoder's pipeline.
+  virtual DecoderStatus Input(const uint8_t* aData,
+                              uint32_t aLength,
+                              Microseconds aDTS,
+                              Microseconds aPTS,
+                              int64_t aOffsetInStream) MOZ_OVERRIDE;
+
+  // Blocks until a decoded sample is produced by the decoder.
+  virtual DecoderStatus Output(nsAutoPtr<MediaData>& aOutData) MOZ_OVERRIDE;
+
+  virtual DecoderStatus Flush() MOZ_OVERRIDE;
+
+private:
+
+  bool InitializeDXVA(mozilla::layers::LayersBackend aLayersBackend);
+
+  HRESULT ConfigureVideoFrameGeometry();
+
+  HRESULT CreateBasicVideoFrame(IMFSample* aSample,
+                                VideoData** aOutVideoData);
+
+  HRESULT CreateD3DVideoFrame(IMFSample* aSample,
+                              VideoData** aOutVideoData);
+  // Video frame geometry.
+  VideoInfo mVideoInfo;
+  uint32_t mVideoStride;
+  uint32_t mVideoWidth;
+  uint32_t mVideoHeight;
+  nsIntRect mPictureRegion;
+
+  // The last offset into the media resource that was passed into Input().
+  // This is used to approximate the decoder's position in the media resource.
+  int64_t mLastStreamOffset;
+
+  nsAutoPtr<MFTDecoder> mDecoder;
+  RefPtr<layers::ImageContainer> mImageContainer;
+  nsAutoPtr<DXVA2Manager> mDXVA2Manager;
+
+  const bool mDXVAEnabled;
+  const bool mIsRunningOnVista;
+  bool mUseHwAccel;
+};
+
+
+
+} // namespace mozilla
+
+#endif
\ No newline at end of file
diff --git a/content/media/moz.build b/content/media/moz.build
index 31bd33881f54..bd2363c269a9 100644
--- a/content/media/moz.build
+++ b/content/media/moz.build
@@ -35,6 +35,9 @@ if CONFIG['MOZ_MEDIA_PLUGINS']:
 if CONFIG['MOZ_WMF']:
     PARALLEL_DIRS += ['wmf']
 
+if CONFIG['MOZ_FMP4']:
+    PARALLEL_DIRS += ['fmp4']
+
 if CONFIG['MOZ_APPLEMEDIA']:
     PARALLEL_DIRS += ['apple']
 
@@ -101,7 +104,7 @@ EXPORTS.mozilla.dom += [
     'VideoStreamTrack.h',
 ]
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'AudioAvailableEventManager.cpp',
     'AudioChannelFormat.cpp',
     'AudioNodeEngine.cpp',
@@ -111,7 +114,6 @@ SOURCES += [
     'AudioStream.cpp',
     'AudioStreamTrack.cpp',
     'BufferDecoder.cpp',
-    'DecoderTraits.cpp',
     'DOMMediaStream.cpp',
     'EncodedBufferCache.cpp',
     'FileBlockCache.cpp',
@@ -141,6 +143,11 @@ SOURCES += [
     'WebVTTListener.cpp',
 ]
 
+# DecoderTraits.cpp needs to be built separately because of Mac OS X headers.
+SOURCES += [
+    'DecoderTraits.cpp',
+]
+
 FAIL_ON_WARNINGS = True
 
 if CONFIG['CPU_ARCH'] == 'arm' and CONFIG['BUILD_ARM_NEON']:
diff --git a/content/media/omx/RtspOmxReader.cpp b/content/media/omx/RtspOmxReader.cpp
index fa443f87df34..d19d6800a9ad 100644
--- a/content/media/omx/RtspOmxReader.cpp
+++ b/content/media/omx/RtspOmxReader.cpp
@@ -124,7 +124,16 @@ status_t RtspMediaSource::read(MediaBuffer **out, const ReadOptions *options)
     rv = mRtspResource->ReadFrameFromTrack((uint8_t *)mBuffer->data(),
                                            mFrameMaxSize, mTrackIdx, readCount,
                                            time, actualFrameSize);
-    NS_ENSURE_SUCCESS(rv, ERROR_IO);
+    if (NS_FAILED(rv)) {
+      // Release mGroup and mBuffer.
+      stop();
+      // Since RtspMediaSource is an implementation of Android media source,
+      // it's held by OMXCodec and isn't released yet. So we have to re-construct
+      // mGroup and mBuffer.
+      start();
+      NS_WARNING("ReadFrameFromTrack failed; releasing buffers and returning.");
+      return ERROR_CONNECTION_LOST;
+    }
     if (actualFrameSize > mFrameMaxSize) {
       // release mGroup and mBuffer
       stop();
diff --git a/content/media/wmf/WMFReader.cpp b/content/media/wmf/WMFReader.cpp
index 48ba03be7d6a..98b0927f4f13 100644
--- a/content/media/wmf/WMFReader.cpp
+++ b/content/media/wmf/WMFReader.cpp
@@ -385,9 +385,12 @@ WMFReader::GetSupportedAudioCodecs(const GUID** aCodecs, uint32_t* aNumCodecs)
   MOZ_ASSERT(aNumCodecs);
 
   if (mIsMP3Enabled) {
+    GUID aacOrMp3 = MFMPEG4Format_Base;
+    aacOrMp3.Data1 = 0x6D703461;// FOURCC('m','p','4','a');
     static const GUID codecs[] = {
       MFAudioFormat_AAC,
-      MFAudioFormat_MP3
+      MFAudioFormat_MP3,
+      aacOrMp3
     };
     *aCodecs = codecs;
     *aNumCodecs = NS_ARRAY_LENGTH(codecs);
diff --git a/content/media/wmf/WMFUtils.h b/content/media/wmf/WMFUtils.h
index c3ef4d9d5027..0e39f9aabe82 100644
--- a/content/media/wmf/WMFUtils.h
+++ b/content/media/wmf/WMFUtils.h
@@ -93,4 +93,9 @@ GetSampleDuration(IMFSample* aSample);
 int64_t
 GetSampleTime(IMFSample* aSample);
 
+inline bool
+IsFlagSet(DWORD flags, DWORD pattern) {
+  return (flags & pattern) == pattern;
+}
+
 } // namespace mozilla
diff --git a/content/media/wmf/moz.build b/content/media/wmf/moz.build
index fe178c112712..48baf30f9cbb 100644
--- a/content/media/wmf/moz.build
+++ b/content/media/wmf/moz.build
@@ -5,6 +5,7 @@
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 EXPORTS += [
+    'DXVA2Manager.h',
     'WMF.h',
     'WMFDecoder.h',
     'WMFReader.h',
diff --git a/content/smil/moz.build b/content/smil/moz.build
index edf016dbe776..df5109727bda 100644
--- a/content/smil/moz.build
+++ b/content/smil/moz.build
@@ -32,7 +32,7 @@ EXPORTS += [
     'nsSMILValue.h',
 ]
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'nsDOMTimeEvent.cpp',
     'nsSMILAnimationController.cpp',
     'nsSMILAnimationFunction.cpp',
diff --git a/content/smil/nsSMILRepeatCount.h b/content/smil/nsSMILRepeatCount.h
index d57f06db4639..18c6d66db618 100644
--- a/content/smil/nsSMILRepeatCount.h
+++ b/content/smil/nsSMILRepeatCount.h
@@ -3,6 +3,9 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#ifndef nsSMILRepeatCount_h
+#define nsSMILRepeatCount_h
+
 #include "nsDebug.h"
 #include <math.h>
 
@@ -50,3 +53,5 @@ private:
 
   double  mCount;
 };
+
+#endif
diff --git a/content/svg/content/src/SVGAElement.cpp b/content/svg/content/src/SVGAElement.cpp
index 1c0500a08862..49d870980141 100644
--- a/content/svg/content/src/SVGAElement.cpp
+++ b/content/svg/content/src/SVGAElement.cpp
@@ -161,7 +161,7 @@ SVGAElement::IsAttributeMapped(const nsIAtom* name) const
 }
 
 bool
-SVGAElement::IsFocusable(int32_t *aTabIndex, bool aWithMouse)
+SVGAElement::IsFocusableInternal(int32_t *aTabIndex, bool aWithMouse)
 {
   nsCOMPtr<nsIURI> uri;
   if (IsLink(getter_AddRefs(uri))) {
diff --git a/content/svg/content/src/SVGAElement.h b/content/svg/content/src/SVGAElement.h
index 3984d9f9d5e3..29728f0c21f5 100644
--- a/content/svg/content/src/SVGAElement.h
+++ b/content/svg/content/src/SVGAElement.h
@@ -43,7 +43,7 @@ public:
   virtual void UnbindFromTree(bool aDeep = true,
                               bool aNullParent = true) MOZ_OVERRIDE;
   NS_IMETHOD_(bool) IsAttributeMapped(const nsIAtom* aAttribute) const MOZ_OVERRIDE;
-  virtual bool IsFocusable(int32_t *aTabIndex = nullptr, bool aWithMouse = false) MOZ_OVERRIDE;
+  virtual bool IsFocusableInternal(int32_t* aTabIndex, bool aWithMouse) MOZ_OVERRIDE;
   virtual bool IsLink(nsIURI** aURI) const MOZ_OVERRIDE;
   virtual void GetLinkTarget(nsAString& aTarget) MOZ_OVERRIDE;
   virtual already_AddRefed<nsIURI> GetHrefURI() const MOZ_OVERRIDE;
diff --git a/content/xbl/src/moz.build b/content/xbl/src/moz.build
index 1d7e0e900ef5..e8a93d589343 100644
--- a/content/xbl/src/moz.build
+++ b/content/xbl/src/moz.build
@@ -14,7 +14,7 @@ EXPORTS.mozilla.dom += [
     'XBLChildrenElement.h',
 ]
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'nsBindingManager.cpp',
     'nsXBLBinding.cpp',
     'nsXBLContentSink.cpp',
diff --git a/content/xbl/src/nsXBLDocumentInfo.cpp b/content/xbl/src/nsXBLDocumentInfo.cpp
index b5932f9ce89b..5c304c26566e 100644
--- a/content/xbl/src/nsXBLDocumentInfo.cpp
+++ b/content/xbl/src/nsXBLDocumentInfo.cpp
@@ -33,9 +33,11 @@
 #include "mozilla/scache/StartupCacheUtils.h"
 #include "nsCCUncollectableMarker.h"
 #include "mozilla/dom/BindingUtils.h"
+#include "mozilla/dom/URL.h"
 
-using namespace mozilla::scache;
 using namespace mozilla;
+using namespace mozilla::scache;
+using namespace mozilla::dom;
 
 static const char kXBLCachePrefix[] = "xblcache";
 
@@ -282,14 +284,6 @@ nsXBLDocGlobalObject::GetPrincipal()
   return document->NodePrincipal();
 }
 
-static bool IsChromeURI(nsIURI* aURI)
-{
-  bool isChrome = false;
-  if (NS_SUCCEEDED(aURI->SchemeIs("chrome", &isChrome)))
-      return isChrome;
-  return false;
-}
-
 /* Implementation file */
 
 static bool
diff --git a/content/xbl/src/nsXBLPrototypeResources.cpp b/content/xbl/src/nsXBLPrototypeResources.cpp
index 51ff4235b81c..d68d21ecba33 100644
--- a/content/xbl/src/nsXBLPrototypeResources.cpp
+++ b/content/xbl/src/nsXBLPrototypeResources.cpp
@@ -16,6 +16,9 @@
 #include "nsLayoutCID.h"
 #include "nsCSSRuleProcessor.h"
 #include "nsStyleSet.h"
+#include "mozilla/dom/URL.h"
+
+using mozilla::dom::IsChromeURI;
 
 nsXBLPrototypeResources::nsXBLPrototypeResources(nsXBLPrototypeBinding* aBinding)
 {
@@ -57,14 +60,6 @@ nsXBLPrototypeResources::AddResourceListener(nsIContent* aBoundElement)
     mLoader->AddResourceListener(aBoundElement);
 }
 
-static bool IsChromeURI(nsIURI* aURI)
-{
-  bool isChrome=false;
-  if (NS_SUCCEEDED(aURI->SchemeIs("chrome", &isChrome)) && isChrome)
-    return true;
-  return false;
-}
-
 nsresult
 nsXBLPrototypeResources::FlushSkinSheets()
 {
diff --git a/content/xbl/src/nsXBLResourceLoader.h b/content/xbl/src/nsXBLResourceLoader.h
index 114fcd2fab03..ab7fe285232f 100644
--- a/content/xbl/src/nsXBLResourceLoader.h
+++ b/content/xbl/src/nsXBLResourceLoader.h
@@ -3,6 +3,9 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#ifndef nsXBLResourceLoader_h
+#define nsXBLResourceLoader_h
+
 #include "mozilla/Attributes.h"
 #include "nsCOMPtr.h"
 #include "nsICSSLoaderObserver.h"
@@ -62,3 +65,4 @@ public:
   nsCOMArray<nsIContent> mBoundElements;
 };
 
+#endif
diff --git a/content/xul/content/src/nsXULElement.cpp b/content/xul/content/src/nsXULElement.cpp
index edb0e1cd3331..4f158f2944ba 100644
--- a/content/xul/content/src/nsXULElement.cpp
+++ b/content/xul/content/src/nsXULElement.cpp
@@ -511,7 +511,7 @@ static bool IsNonList(nsINodeInfo* aNodeInfo)
 }
 
 bool
-nsXULElement::IsFocusable(int32_t *aTabIndex, bool aWithMouse)
+nsXULElement::IsFocusableInternal(int32_t *aTabIndex, bool aWithMouse)
 {
   /* 
    * Returns true if an element may be focused, and false otherwise. The inout
diff --git a/content/xul/content/src/nsXULElement.h b/content/xul/content/src/nsXULElement.h
index de91e633dd2e..f9a6cc20d895 100644
--- a/content/xul/content/src/nsXULElement.h
+++ b/content/xul/content/src/nsXULElement.h
@@ -396,7 +396,7 @@ public:
 
     virtual nsIContent *GetBindingParent() const MOZ_OVERRIDE;
     virtual bool IsNodeOfType(uint32_t aFlags) const MOZ_OVERRIDE;
-    virtual bool IsFocusable(int32_t *aTabIndex = nullptr, bool aWithMouse = false) MOZ_OVERRIDE;
+    virtual bool IsFocusableInternal(int32_t* aTabIndex, bool aWithMouse) MOZ_OVERRIDE;
 
     NS_IMETHOD WalkContentStyleRules(nsRuleWalker* aRuleWalker) MOZ_OVERRIDE;
     virtual nsChangeHint GetAttributeChangeHint(const nsIAtom* aAttribute,
diff --git a/content/xul/document/src/XULDocument.cpp b/content/xul/document/src/XULDocument.cpp
index 88b7d9d5588c..0cd64b03ca58 100644
--- a/content/xul/document/src/XULDocument.cpp
+++ b/content/xul/document/src/XULDocument.cpp
@@ -38,7 +38,7 @@
 #include "nsIRDFService.h"
 #include "nsIStreamListener.h"
 #include "nsITimer.h"
-#include "nsIDocShell.h"
+#include "nsDocShell.h"
 #include "nsGkAtoms.h"
 #include "nsXMLContentSink.h"
 #include "nsXULContentSink.h"
@@ -90,6 +90,7 @@
 #include "mozilla/Preferences.h"
 #include "nsTextNode.h"
 #include "nsJSUtils.h"
+#include "mozilla/dom/URL.h"
 
 using namespace mozilla;
 using namespace mozilla::dom;
@@ -101,14 +102,6 @@ using namespace mozilla::dom;
 
 static NS_DEFINE_CID(kParserCID,                 NS_PARSER_CID);
 
-static bool IsChromeURI(nsIURI* aURI)
-{
-    bool isChrome = false;
-    if (NS_SUCCEEDED(aURI->SchemeIs("chrome", &isChrome)) && isChrome)
-        return true;
-    return false;
-}
-
 static bool IsOverlayAllowed(nsIURI* aURI)
 {
     bool canOverlay = false;
@@ -3187,8 +3180,7 @@ XULDocument::DoneWalking()
         // Before starting layout, check whether we're a toplevel chrome
         // window.  If we are, set our chrome flags now, so that we don't have
         // to restyle the whole frame tree after StartLayout.
-        nsCOMPtr<nsISupports> container = GetContainer();
-        nsCOMPtr<nsIDocShellTreeItem> item = do_QueryInterface(container);
+        nsCOMPtr<nsIDocShellTreeItem> item = GetDocShell();
         if (item) {
             nsCOMPtr<nsIDocShellTreeOwner> owner;
             item->GetTreeOwner(getter_AddRefs(owner));
@@ -3196,7 +3188,7 @@ XULDocument::DoneWalking()
             if (xulWin) {
                 nsCOMPtr<nsIDocShell> xulWinShell;
                 xulWin->GetDocShell(getter_AddRefs(xulWinShell));
-                if (SameCOMIdentity(xulWinShell, container)) {
+                if (SameCOMIdentity(xulWinShell, item)) {
                     // We're the chrome document!  Apply our chrome flags now.
                     xulWin->ApplyChromeFlags();
                 }
@@ -4667,7 +4659,7 @@ XULDocument::ParserObserver::OnStopRequest(nsIRequest *request,
 already_AddRefed<nsPIWindowRoot>
 XULDocument::GetWindowRoot()
 {
-    nsCOMPtr<nsIInterfaceRequestor> ir = do_QueryReferent(mDocumentContainer);
+    nsCOMPtr<nsIInterfaceRequestor> ir(mDocumentContainer);
     nsCOMPtr<nsIDOMWindow> window(do_GetInterface(ir));
     nsCOMPtr<nsPIDOMWindow> piWin(do_QueryInterface(window));
     return piWin ? piWin->GetTopWindowRoot() : nullptr;
diff --git a/content/xul/document/src/moz.build b/content/xul/document/src/moz.build
index 58485904db5f..4c1945575ea8 100644
--- a/content/xul/document/src/moz.build
+++ b/content/xul/document/src/moz.build
@@ -28,6 +28,7 @@ LOCAL_INCLUDES += [
     '/content/xml/document/src',
     '/content/xul/content/src',
     '/content/xul/templates/src',
+    '/docshell/base',
     '/dom/base',
     '/layout/base',
     '/layout/generic',
diff --git a/content/xul/templates/src/moz.build b/content/xul/templates/src/moz.build
index 672f61178562..722d3a812ccd 100644
--- a/content/xul/templates/src/moz.build
+++ b/content/xul/templates/src/moz.build
@@ -4,7 +4,7 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'nsContentSupportMap.cpp',
     'nsContentTestNode.cpp',
     'nsInstantiationNode.cpp',
diff --git a/content/xul/templates/src/nsXULSortService.h b/content/xul/templates/src/nsXULSortService.h
index 18ca34e656a1..c003974ead8b 100644
--- a/content/xul/templates/src/nsXULSortService.h
+++ b/content/xul/templates/src/nsXULSortService.h
@@ -20,6 +20,9 @@
   This sort service is used to sort template built content or content by attribute.
  */
 
+#ifndef nsXULTemplateResultSetRDF_h
+#define nsXULTemplateResultSetRDF_h
+
 #include "nsCOMPtr.h"
 #include "nsCOMArray.h"
 #include "nsTArray.h"
@@ -179,3 +182,5 @@ public:
                                const nsAString& aRight,
                                uint32_t aSortHints);
 };
+
+#endif
diff --git a/content/xul/templates/src/nsXULTemplateBuilder.cpp b/content/xul/templates/src/nsXULTemplateBuilder.cpp
index ff7ff8ee505b..f21d84073971 100644
--- a/content/xul/templates/src/nsXULTemplateBuilder.cpp
+++ b/content/xul/templates/src/nsXULTemplateBuilder.cpp
@@ -73,11 +73,6 @@
 using namespace mozilla::dom;
 using namespace mozilla;
 
-//----------------------------------------------------------------------
-
-static NS_DEFINE_CID(kRDFContainerUtilsCID,      NS_RDFCONTAINERUTILS_CID);
-static NS_DEFINE_CID(kRDFServiceCID,             NS_RDFSERVICE_CID);
-
 //----------------------------------------------------------------------
 //
 // nsXULTemplateBuilder
@@ -107,6 +102,7 @@ nsXULTemplateBuilder::nsXULTemplateBuilder(void)
       mTop(nullptr),
       mObservedDocument(nullptr)
 {
+    MOZ_COUNT_CTOR(nsXULTemplateBuilder);
 }
 
 static PLDHashOperator
@@ -133,6 +129,8 @@ nsXULTemplateBuilder::~nsXULTemplateBuilder(void)
         NS_IF_RELEASE(gScriptSecurityManager);
         NS_IF_RELEASE(gObserverService);
     }
+
+    MOZ_COUNT_DTOR(nsXULTemplateBuilder);
 }
 
 
@@ -144,10 +142,12 @@ nsXULTemplateBuilder::InitGlobals()
     if (gRefCnt++ == 0) {
         // Initialize the global shared reference to the service
         // manager and get some shared resource objects.
+        NS_DEFINE_CID(kRDFServiceCID, NS_RDFSERVICE_CID);
         rv = CallGetService(kRDFServiceCID, &gRDFService);
         if (NS_FAILED(rv))
             return rv;
 
+        NS_DEFINE_CID(kRDFContainerUtilsCID, NS_RDFCONTAINERUTILS_CID);
         rv = CallGetService(kRDFContainerUtilsCID, &gRDFContainerUtils);
         if (NS_FAILED(rv))
             return rv;
@@ -174,6 +174,23 @@ nsXULTemplateBuilder::InitGlobals()
     return NS_OK;
 }
 
+void
+nsXULTemplateBuilder::StartObserving(nsIDocument* aDocument)
+{
+    aDocument->AddObserver(this);
+    mObservedDocument = aDocument;
+    gObserverService->AddObserver(this, DOM_WINDOW_DESTROYED_TOPIC, false);
+}
+
+void
+nsXULTemplateBuilder::StopObserving()
+{
+    MOZ_ASSERT(mObservedDocument);
+    mObservedDocument->RemoveObserver(this);
+    mObservedDocument = nullptr;
+    gObserverService->RemoveObserver(this, DOM_WINDOW_DESTROYED_TOPIC);
+}
+
 void
 nsXULTemplateBuilder::CleanUp(bool aIsFinal)
 {
@@ -196,10 +213,7 @@ void
 nsXULTemplateBuilder::Uninit(bool aIsFinal)
 {
     if (mObservedDocument && aIsFinal) {
-        gObserverService->RemoveObserver(this, DOM_WINDOW_DESTROYED_TOPIC);
-        gObserverService->RemoveObserver(this, NS_XPCOM_SHUTDOWN_OBSERVER_ID);
-        mObservedDocument->RemoveObserver(this);
-        mObservedDocument = nullptr;
+        StopObserving();
     }
 
     if (mQueryProcessor)
@@ -431,14 +445,7 @@ nsXULTemplateBuilder::Init(nsIContent* aElement)
     nsresult rv = LoadDataSources(doc, &shouldDelay);
 
     if (NS_SUCCEEDED(rv)) {
-        // Add ourselves as a document observer
-        doc->AddObserver(this);
-
-        mObservedDocument = doc;
-        gObserverService->AddObserver(this, NS_XPCOM_SHUTDOWN_OBSERVER_ID,
-                                      false);
-        gObserverService->AddObserver(this, DOM_WINDOW_DESTROYED_TOPIC,
-                                      false);
+        StartObserving(doc);
     }
 
     return rv;
@@ -1076,8 +1083,6 @@ nsXULTemplateBuilder::Observe(nsISupports* aSubject,
             if (doc && doc == mObservedDocument)
                 NodeWillBeDestroyed(doc);
         }
-    } else if (!strcmp(aTopic, NS_XPCOM_SHUTDOWN_OBSERVER_ID)) {
-        UninitTrue();
     }
     return NS_OK;
 }
@@ -1127,7 +1132,8 @@ nsXULTemplateBuilder::ContentRemoved(nsIDocument* aDocument,
         nsContentUtils::AddScriptRunner(
             NS_NewRunnableMethod(this, &nsXULTemplateBuilder::UninitFalse));
 
-        aDocument->RemoveObserver(this);
+        MOZ_ASSERT(aDocument == mObservedDocument);
+        StopObserving();
 
         nsCOMPtr<nsIXULDocument> xuldoc = do_QueryInterface(aDocument);
         if (xuldoc)
diff --git a/content/xul/templates/src/nsXULTemplateBuilder.h b/content/xul/templates/src/nsXULTemplateBuilder.h
index f72b190f7b0d..9f3d839b98f6 100644
--- a/content/xul/templates/src/nsXULTemplateBuilder.h
+++ b/content/xul/templates/src/nsXULTemplateBuilder.h
@@ -480,6 +480,20 @@ protected:
     {
     }
 
+    /**
+     * Start observing events from the observer service and the given
+     * document.
+     *
+     * @param aDocument the document to observe
+     */
+    void StartObserving(nsIDocument* aDocument);
+
+    /**
+     * Stop observing events from the observer service and any associated
+     * document.
+     */
+    void StopObserving();
+
     /**
      * Document that we're observing. Weak ref!
      */
diff --git a/content/xul/templates/src/nsXULTemplateQueryProcessorRDF.cpp b/content/xul/templates/src/nsXULTemplateQueryProcessorRDF.cpp
index 3909840aebad..6f02e0c3c5ec 100644
--- a/content/xul/templates/src/nsXULTemplateQueryProcessorRDF.cpp
+++ b/content/xul/templates/src/nsXULTemplateQueryProcessorRDF.cpp
@@ -37,9 +37,6 @@
 
 //----------------------------------------------------------------------
 
-static NS_DEFINE_CID(kRDFContainerUtilsCID,      NS_RDFCONTAINERUTILS_CID);
-static NS_DEFINE_CID(kRDFServiceCID,             NS_RDFSERVICE_CID);
-
 #define PARSE_TYPE_INTEGER  "Integer"
 
 nsrefcnt                  nsXULTemplateQueryProcessorRDF::gRefCnt = 0;
@@ -145,12 +142,14 @@ nsXULTemplateQueryProcessorRDF::InitGlobals()
     // Initialize the global shared reference to the service
     // manager and get some shared resource objects.
     if (!gRDFService) {
+        NS_DEFINE_CID(kRDFServiceCID, NS_RDFSERVICE_CID);
         rv = CallGetService(kRDFServiceCID, &gRDFService);
         if (NS_FAILED(rv))
             return rv;
     }
 
     if (!gRDFContainerUtils) {
+        NS_DEFINE_CID(kRDFContainerUtilsCID, NS_RDFCONTAINERUTILS_CID);
         rv = CallGetService(kRDFContainerUtilsCID, &gRDFContainerUtils);
         if (NS_FAILED(rv))
             return rv;
diff --git a/docshell/base/moz.build b/docshell/base/moz.build
index 48f17f95e9f6..194cebba8d8c 100644
--- a/docshell/base/moz.build
+++ b/docshell/base/moz.build
@@ -47,7 +47,7 @@ EXPORTS.mozilla += [
     'LoadContext.h',
 ]
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'LoadContext.cpp',
     'nsAboutRedirector.cpp',
     'nsDefaultURIFixup.cpp',
diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
index 6f18217b93b7..4300f0e314b1 100644
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -7259,7 +7259,7 @@ nsDocShell::CreateAboutBlankContentViewer(nsIPrincipal* aPrincipal,
       // got Reset() with a channel.
       blankDoc->SetBaseURI(aBaseURI);
 
-      blankDoc->SetContainer(static_cast<nsIDocShell *>(this));
+      blankDoc->SetContainer(this);
 
       // Copy our sandbox flags to the document. These are immutable
       // after being set here.
@@ -7271,7 +7271,7 @@ nsDocShell::CreateAboutBlankContentViewer(nsIPrincipal* aPrincipal,
 
       // hook 'em up
       if (viewer) {
-        viewer->SetContainer(static_cast<nsIContentViewerContainer *>(this));
+        viewer->SetContainer(this);
         Embed(viewer, "", 0);
 
         SetCurrentURI(blankDoc->GetDocumentURI(), nullptr, true, 0);
@@ -7607,7 +7607,7 @@ nsDocShell::RestorePresentation(nsISHEntry *aSHEntry, bool *aRestoring)
     // different one.  We don't currently support restoring the presentation
     // in that case.
 
-    nsCOMPtr<nsISupports> container;
+    nsCOMPtr<nsIDocShell> container;
     viewer->GetContainer(getter_AddRefs(container));
     if (!::SameCOMIdentity(container, GetAsSupports(this))) {
 #ifdef DEBUG_PAGE_CACHE
@@ -8333,13 +8333,13 @@ nsDocShell::NewContentViewerObj(const char *aContentType,
     nsresult rv = docLoaderFactory->CreateInstance("view",
                                                    aOpenedChannel,
                                                    aLoadGroup, aContentType,
-                                                   static_cast<nsIContentViewerContainer*>(this),
+                                                   this,
                                                    nullptr,
                                                    aContentHandler,
                                                    aViewer);
     NS_ENSURE_SUCCESS(rv, rv);
 
-    (*aViewer)->SetContainer(static_cast<nsIContentViewerContainer *>(this));
+    (*aViewer)->SetContainer(this);
     return NS_OK;
 }
 
diff --git a/docshell/base/nsDocShell.h b/docshell/base/nsDocShell.h
index 650011cc2325..32a59c5a82c3 100644
--- a/docshell/base/nsDocShell.h
+++ b/docshell/base/nsDocShell.h
@@ -18,6 +18,7 @@
 #include "nsIContentViewerContainer.h"
 #include "nsIDOMStorageManager.h"
 #include "nsDocLoader.h"
+#include "mozilla/WeakPtr.h"
 
 // Helper Classes
 #include "nsCOMPtr.h"
@@ -137,7 +138,8 @@ class nsDocShell : public nsDocLoader,
                    public nsIWebShellServices,
                    public nsILinkHandler,
                    public nsIClipboardCommands,
-                   public nsIDOMStorageManager
+                   public nsIDOMStorageManager,
+                   public mozilla::SupportsWeakPtr<nsDocShell>
 {
     friend class nsDSURIContentListener;
 
diff --git a/docshell/base/nsDocShellEnumerator.h b/docshell/base/nsDocShellEnumerator.h
index d3c3d9040619..523050218248 100644
--- a/docshell/base/nsDocShellEnumerator.h
+++ b/docshell/base/nsDocShellEnumerator.h
@@ -4,13 +4,15 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#ifndef nsDocShellEnumerator_h___
+#define nsDocShellEnumerator_h___
+
 #include "nsISimpleEnumerator.h"
 #include "nsTArray.h"
 #include "nsIWeakReferenceUtils.h"
 
 class nsIDocShellTreeItem;
 
-
 /*
 // {13cbc281-35ae-11d5-be5b-bde0edece43c}
 #define NS_DOCSHELL_FORWARDS_ENUMERATOR_CID  \
@@ -105,5 +107,6 @@ public:
 protected:
 
   virtual nsresult            BuildArrayRecursive(nsIDocShellTreeItem* inItem, nsTArray<nsWeakPtr>& inItemArray);
-
 };
+
+#endif // nsDocShellEnumerator_h___
diff --git a/docshell/base/nsIContentViewer.idl b/docshell/base/nsIContentViewer.idl
index 6610ab66e5f0..1fba74fbbc18 100644
--- a/docshell/base/nsIContentViewer.idl
+++ b/docshell/base/nsIContentViewer.idl
@@ -4,6 +4,7 @@
 
 #include "nsISupports.idl"
 
+interface nsIDocShell;
 interface nsIDOMDocument;
 interface nsISHEntry;
 interface nsIPrintSettings;
@@ -34,7 +35,7 @@ interface nsIContentViewer : nsISupports
   [noscript] void init(in nsIWidgetPtr aParentWidget,
                        [const] in nsIntRectRef aBounds);
 
-  attribute nsISupports container;
+  attribute nsIDocShell container;
 
   void loadStart(in nsISupports aDoc);
   void loadComplete(in nsresult aStatus);
diff --git a/docshell/base/nsIDocumentLoaderFactory.idl b/docshell/base/nsIDocumentLoaderFactory.idl
index caacfcd58436..904882c836cf 100644
--- a/docshell/base/nsIDocumentLoaderFactory.idl
+++ b/docshell/base/nsIDocumentLoaderFactory.idl
@@ -9,6 +9,7 @@
 interface nsIChannel;
 interface nsIContentViewer;
 interface nsIStreamListener;
+interface nsIDocShell;
 interface nsIDocument;
 interface nsILoadGroup;
 interface nsIPrincipal;
@@ -21,13 +22,13 @@ interface nsIPrincipal;
  * The component is a service, so use GetService, not CreateInstance to get it.
  */
 
-[scriptable, uuid(5e7d2967-5a07-444f-95d5-25b533252d38)]
+[scriptable, uuid(70905274-8494-4e39-b011-d559adde3733)]
 interface nsIDocumentLoaderFactory : nsISupports {
     nsIContentViewer createInstance(in string aCommand,
                               in nsIChannel aChannel,
                               in nsILoadGroup aLoadGroup,
                               in string aContentType, 
-                              in nsISupports aContainer,
+                              in nsIDocShell aContainer,
                               in nsISupports aExtraInfo,
                               out nsIStreamListener aDocListenerResult);
 
diff --git a/docshell/shistory/src/moz.build b/docshell/shistory/src/moz.build
index ce07450b34bd..462fce8f84c4 100644
--- a/docshell/shistory/src/moz.build
+++ b/docshell/shistory/src/moz.build
@@ -8,7 +8,7 @@ EXPORTS += [
     'nsSHEntryShared.h',
 ]
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'nsSHEntry.cpp',
     'nsSHEntryShared.cpp',
     'nsSHistory.cpp',
diff --git a/docshell/shistory/src/nsSHEntryShared.cpp b/docshell/shistory/src/nsSHEntryShared.cpp
index 5d44492fc8a3..e24a6010d5c4 100644
--- a/docshell/shistory/src/nsSHEntryShared.cpp
+++ b/docshell/shistory/src/nsSHEntryShared.cpp
@@ -10,6 +10,7 @@
 #include "nsIDocument.h"
 #include "nsIWebNavigation.h"
 #include "nsIContentViewer.h"
+#include "nsIDocShell.h"
 #include "nsIDocShellTreeItem.h"
 #include "nsDocShellEditorData.h"
 #include "nsThreadUtils.h"
@@ -167,7 +168,7 @@ nsSHEntryShared::Expire()
   if (!mContentViewer) {
     return;
   }
-  nsCOMPtr<nsISupports> container;
+  nsCOMPtr<nsIDocShell> container;
   mContentViewer->GetContainer(getter_AddRefs(container));
   nsCOMPtr<nsIDocShellTreeItem> treeItem = do_QueryInterface(container);
   if (!treeItem) {
diff --git a/dom/alarm/AlarmsManager.js b/dom/alarm/AlarmsManager.js
index 38a9aea73a02..fe1ebd3e1be2 100644
--- a/dom/alarm/AlarmsManager.js
+++ b/dom/alarm/AlarmsManager.js
@@ -37,7 +37,8 @@ AlarmsManager.prototype = {
 
   QueryInterface : XPCOMUtils.generateQI([nsIDOMMozAlarmsManager,
                                           Ci.nsIDOMGlobalPropertyInitializer,
-                                          Ci.nsISupportsWeakReference]),
+                                          Ci.nsISupportsWeakReference,
+                                          Ci.nsIObserver]),
 
   classInfo : XPCOMUtils.generateCI({ classID: ALARMSMANAGER_CID,
                                       contractID: ALARMSMANAGER_CONTRACTID,
diff --git a/dom/apps/src/InterAppConnection.js b/dom/apps/src/InterAppConnection.js
index 6edb91029680..aa6bf55315ad 100644
--- a/dom/apps/src/InterAppConnection.js
+++ b/dom/apps/src/InterAppConnection.js
@@ -44,7 +44,8 @@ InterAppConnection.prototype = {
   contractID: "@mozilla.org/dom/inter-app-connection;1",
 
   QueryInterface: XPCOMUtils.generateQI([Ci.nsIDOMGlobalPropertyInitializer,
-                                         Ci.nsISupportsWeakReference]),
+                                         Ci.nsISupportsWeakReference,
+                                         Ci.nsIObserver]),
 
   __init: function(aKeyword, aPublisher, aSubscriber) {
     if (DEBUG) {
diff --git a/dom/apps/src/InterAppMessagePort.js b/dom/apps/src/InterAppMessagePort.js
index 377aac439997..9364f998a162 100644
--- a/dom/apps/src/InterAppMessagePort.js
+++ b/dom/apps/src/InterAppMessagePort.js
@@ -47,7 +47,8 @@ InterAppMessagePort.prototype = {
   contractID: "@mozilla.org/dom/inter-app-message-port;1",
 
   QueryInterface: XPCOMUtils.generateQI([Ci.nsIDOMGlobalPropertyInitializer,
-                                         Ci.nsISupportsWeakReference]),
+                                         Ci.nsISupportsWeakReference,
+                                         Ci.nsIObserver]),
 
   // Ci.nsIDOMGlobalPropertyInitializer implementation.
   init: function(aWindow) {
diff --git a/dom/apps/src/Webapps.js b/dom/apps/src/Webapps.js
index f007b5f81696..a57c0490499f 100644
--- a/dom/apps/src/Webapps.js
+++ b/dom/apps/src/Webapps.js
@@ -248,6 +248,7 @@ WebappsRegistry.prototype = {
   classID: Components.ID("{fff440b3-fae2-45c1-bf03-3b5a2e432270}"),
 
   QueryInterface: XPCOMUtils.generateQI([Ci.nsISupportsWeakReference,
+                                         Ci.nsIObserver,
                                          Ci.mozIDOMApplicationRegistry,
                                          Ci.mozIDOMApplicationRegistry2,
                                          Ci.nsIDOMGlobalPropertyInitializer]),
@@ -634,7 +635,8 @@ WebappsApplication.prototype = {
   classID: Components.ID("{723ed303-7757-4fb0-b261-4f78b1f6bd22}"),
 
   QueryInterface: XPCOMUtils.generateQI([Ci.mozIDOMApplication,
-                                         Ci.nsISupportsWeakReference]),
+                                         Ci.nsISupportsWeakReference,
+                                         Ci.nsIObserver]),
 
   classInfo: XPCOMUtils.generateCI({classID: Components.ID("{723ed303-7757-4fb0-b261-4f78b1f6bd22}"),
                                     contractID: "@mozilla.org/webapps/application;1",
@@ -789,7 +791,9 @@ WebappsApplicationMgmt.prototype = {
 
   classID: Components.ID("{8c1bca96-266f-493a-8d57-ec7a95098c15}"),
 
-  QueryInterface: XPCOMUtils.generateQI([Ci.mozIDOMApplicationMgmt, Ci.nsISupportsWeakReference]),
+  QueryInterface: XPCOMUtils.generateQI([Ci.mozIDOMApplicationMgmt,
+                                         Ci.nsISupportsWeakReference,
+                                         Ci.nsIObserver]),
 
   classInfo: XPCOMUtils.generateCI({classID: Components.ID("{8c1bca96-266f-493a-8d57-ec7a95098c15}"),
                                     contractID: "@mozilla.org/webapps/application-mgmt;1",
diff --git a/dom/base/DOMError.cpp b/dom/base/DOMError.cpp
index e1b101d39460..8da1b9ab7918 100644
--- a/dom/base/DOMError.cpp
+++ b/dom/base/DOMError.cpp
@@ -6,14 +6,9 @@
 
 #include "mozilla/dom/DOMError.h"
 #include "mozilla/dom/DOMErrorBinding.h"
+#include "mozilla/dom/DOMException.h"
 #include "nsPIDOMWindow.h"
 
-// Implemented in DOMException.cpp
-nsresult
-NS_GetNameAndMessageForDOMNSResult(nsresult aNSResult, const char** aName,
-                                   const char** aMessage,
-                                   uint16_t* aCode = nullptr);
-
 namespace mozilla {
 namespace dom {
 
diff --git a/dom/base/DOMRequestHelper.jsm b/dom/base/DOMRequestHelper.jsm
index 0184999b9419..ec8f239fda0b 100644
--- a/dom/base/DOMRequestHelper.jsm
+++ b/dom/base/DOMRequestHelper.jsm
@@ -141,6 +141,11 @@ DOMRequestIpcHelper.prototype = {
    *    will be added as a weak referred one by default.
    */
   initDOMRequestHelper: function(aWindow, aMessages) {
+    // Query our required interfaces to force a fast fail if they are not
+    // provided. These calls will throw if the interface is not available.
+    this.QueryInterface(Ci.nsISupportsWeakReference);
+    this.QueryInterface(Ci.nsIObserver);
+
     if (aMessages) {
       this.addMessageListeners(aMessages);
     }
@@ -157,7 +162,8 @@ DOMRequestIpcHelper.prototype = {
 
     this._destroyed = false;
 
-    Services.obs.addObserver(this, "inner-window-destroyed", false);
+    Services.obs.addObserver(this, "inner-window-destroyed",
+                             /* weak-ref */ true);
   },
 
   destroyDOMRequestHelper: function() {
diff --git a/dom/base/Navigator.cpp b/dom/base/Navigator.cpp
index 81263a7bd02e..a74da5d17a38 100644
--- a/dom/base/Navigator.cpp
+++ b/dom/base/Navigator.cpp
@@ -1236,8 +1236,7 @@ Navigator::GetMozIccManager(ErrorResult& aRv)
     }
     NS_ENSURE_TRUE(mWindow->GetDocShell(), nullptr);
 
-    mIccManager = new IccManager();
-    mIccManager->Init(mWindow);
+    mIccManager = new IccManager(mWindow);
   }
 
   return mIccManager;
diff --git a/dom/base/Navigator.h b/dom/base/Navigator.h
index 5b21ba15e33b..3278de16e49a 100644
--- a/dom/base/Navigator.h
+++ b/dom/base/Navigator.h
@@ -142,23 +142,6 @@ public:
   // Helper to initialize mMessagesManager.
   nsresult EnsureMessagesManager();
 
-  // WebIDL API
-  void GetAppName(nsString& aAppName)
-  {
-    NS_GetNavigatorAppName(aAppName);
-  }
-  void GetAppVersion(nsString& aAppVersion, ErrorResult& aRv)
-  {
-    aRv = GetAppVersion(aAppVersion);
-  }
-  void GetPlatform(nsString& aPlatform, ErrorResult& aRv)
-  {
-    aRv = GetPlatform(aPlatform);
-  }
-  void GetUserAgent(nsString& aUserAgent, ErrorResult& aRv)
-  {
-    aRv = GetUserAgent(aUserAgent);
-  }
   // The XPCOM GetProduct is OK
   // The XPCOM GetLanguage is OK
   bool OnLine();
diff --git a/dom/base/URL.cpp b/dom/base/URL.cpp
index 3dbafcaf9f4b..f9f521e98942 100644
--- a/dom/base/URL.cpp
+++ b/dom/base/URL.cpp
@@ -409,5 +409,13 @@ URL::SetHash(const nsAString& aHash)
   mURI->SetRef(NS_ConvertUTF16toUTF8(aHash));
 }
 
+bool IsChromeURI(nsIURI* aURI)
+{
+  bool isChrome = false;
+  if (NS_SUCCEEDED(aURI->SchemeIs("chrome", &isChrome)))
+      return isChrome;
+  return false;
+}
+
 }
 }
diff --git a/dom/base/URL.h b/dom/base/URL.h
index 1c80d6f6f184..762f4e292e67 100644
--- a/dom/base/URL.h
+++ b/dom/base/URL.h
@@ -130,6 +130,8 @@ private:
   friend class mozilla::dom::workers::URLProxy;
 };
 
+bool IsChromeURI(nsIURI* aURI);
+
 }
 }
 
diff --git a/dom/base/moz.build b/dom/base/moz.build
index 333a95984830..2f4a58e0fead 100644
--- a/dom/base/moz.build
+++ b/dom/base/moz.build
@@ -63,7 +63,7 @@ EXPORTS.mozilla.dom += [
     'URL.h',
 ]
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'BarProps.cpp',
     'CompositionStringSynthesizer.cpp',
     'Crypto.cpp',
@@ -72,7 +72,6 @@ SOURCES += [
     'DOMException.cpp',
     'DOMRequest.cpp',
     'MessageChannel.cpp',
-    'MessagePort.cpp',
     'MessagePortList.cpp',
     'Navigator.cpp',
     'nsContentPermissionHelper.cpp',
@@ -80,9 +79,7 @@ SOURCES += [
     'nsDOMNavigationTiming.cpp',
     'nsDOMScriptObjectFactory.cpp',
     'nsDOMWindowList.cpp',
-    'nsDOMWindowUtils.cpp',
     'nsFocusManager.cpp',
-    'nsGlobalWindow.cpp',
     'nsGlobalWindowCommands.cpp',
     'nsHistory.cpp',
     'nsJSEnvironment.cpp',
@@ -91,7 +88,6 @@ SOURCES += [
     'nsLocation.cpp',
     'nsMimeTypeArray.cpp',
     'nsPerformance.cpp',
-    'nsPluginArray.cpp',
     'nsQueryContentEventResult.cpp',
     'nsScreen.cpp',
     'nsScriptNameSpaceManager.cpp',
@@ -103,6 +99,18 @@ SOURCES += [
     'WindowNamedPropertiesHandler.cpp',
 ]
 
+# these files couldn't be in UNIFIED_SOURCES for now for reasons given below:
+SOURCES += [
+    # this file doesn't like windows.h
+    'MessagePort.cpp',
+    # this file doesn't like windows.h
+    'nsDOMWindowUtils.cpp',
+    # This file has a #error "Never include windows.h in this file!"
+    'nsGlobalWindow.cpp',
+    # nsPluginArray.cpp includes npapi.h indirectly, and that includes a lot of system headers
+    'nsPluginArray.cpp',
+]
+
 EXTRA_COMPONENTS += [
     'ConsoleAPI.js',
     'ConsoleAPI.manifest',
diff --git a/dom/base/nsFocusManager.cpp b/dom/base/nsFocusManager.cpp
index a3f7d1bccfa9..a71ac4ab401c 100644
--- a/dom/base/nsFocusManager.cpp
+++ b/dom/base/nsFocusManager.cpp
@@ -1396,10 +1396,12 @@ nsFocusManager::IsNonFocusableRoot(nsIContent* aContent)
   //       focusable.
   // Also, if aContent is not editable but it isn't in designMode, it's not
   // focusable.
+  // And in userfocusignored context nothing is focusable.
   nsIDocument* doc = aContent->GetCurrentDoc();
   NS_ASSERTION(doc, "aContent must have current document");
   return aContent == doc->GetRootElement() &&
-           (doc->HasFlag(NODE_IS_EDITABLE) || !aContent->IsEditable());
+           (doc->HasFlag(NODE_IS_EDITABLE) || !aContent->IsEditable() ||
+            nsContentUtils::IsUserFocusIgnored(aContent));
 }
 
 nsIContent*
@@ -1428,9 +1430,10 @@ nsFocusManager::CheckIfFocusable(nsIContent* aContent, uint32_t aFlags)
   if (!shell)
     return nullptr;
 
-  // the root content can always be focused
+  // the root content can always be focused,
+  // except in userfocusignored context.
   if (aContent == doc->GetRootElement())
-    return aContent;
+    return nsContentUtils::IsUserFocusIgnored(aContent) ? nullptr : aContent;
 
   // cannot focus content in print preview mode. Only the root can be focused.
   nsPresContext* presContext = shell->GetPresContext();
@@ -1881,10 +1884,18 @@ nsFocusManager::SendFocusOrBlurEvent(uint32_t aType,
 
   nsCOMPtr<EventTarget> eventTarget = do_QueryInterface(aTarget);
 
+  nsCOMPtr<nsINode> n = do_QueryInterface(aTarget);
+  if (!n) {
+    nsCOMPtr<nsPIDOMWindow> win = do_QueryInterface(aTarget);
+    n = win ? win->GetExtantDoc() : nullptr;
+  }
+  bool dontDispatchEvent = n && nsContentUtils::IsUserFocusIgnored(n);
+
   // for focus events, if this event was from a mouse or key and event
   // handling on the document is suppressed, queue the event and fire it
   // later. For blur events, a non-zero value would be set for aFocusMethod.
-  if (aFocusMethod && aDocument && aDocument->EventHandlingSuppressed()) {
+  if (aFocusMethod && !dontDispatchEvent &&
+      aDocument && aDocument->EventHandlingSuppressed()) {
     // aFlags is always 0 when aWindowRaised is true so this won't be called
     // on a window raise.
     NS_ASSERTION(!aWindowRaised, "aWindowRaised should not be set");
@@ -1914,9 +1925,11 @@ nsFocusManager::SendFocusOrBlurEvent(uint32_t aType,
   }
 #endif
 
-  nsContentUtils::AddScriptRunner(
-    new FocusBlurEvent(aTarget, aType, aPresShell->GetPresContext(),
-                       aWindowRaised, aIsRefocus));
+  if (!dontDispatchEvent) {
+    nsContentUtils::AddScriptRunner(
+      new FocusBlurEvent(aTarget, aType, aPresShell->GetPresContext(),
+                         aWindowRaised, aIsRefocus));
+  }
 }
 
 void
diff --git a/dom/base/nsHistory.cpp b/dom/base/nsHistory.cpp
index 0d0f768fc48b..6660790e487e 100644
--- a/dom/base/nsHistory.cpp
+++ b/dom/base/nsHistory.cpp
@@ -70,7 +70,7 @@ uint32_t
 nsHistory::GetLength(ErrorResult& aRv) const
 {
   nsCOMPtr<nsPIDOMWindow> win(do_QueryReferent(mInnerWindow));
-  if (!win || !nsContentUtils::CanCallerAccess(win->GetOuterWindow())) {
+  if (!win || !win->IsCurrentInnerWindow()) {
     aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
 
     return 0;
@@ -106,7 +106,7 @@ nsHistory::GetState(JSContext* aCx, ErrorResult& aRv) const
     return JS::UndefinedValue();
   }
 
-  if (!nsContentUtils::CanCallerAccess(win->GetOuterWindow())) {
+  if (!win->IsCurrentInnerWindow()) {
     aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
 
     return JS::UndefinedValue();
@@ -146,7 +146,7 @@ void
 nsHistory::Go(int32_t aDelta, ErrorResult& aRv)
 {
   nsCOMPtr<nsPIDOMWindow> win(do_QueryReferent(mInnerWindow));
-  if (!win || !nsContentUtils::CanCallerAccess(win->GetOuterWindow())) {
+  if (!win || !win->IsCurrentInnerWindow()) {
     aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
 
     return;
@@ -202,7 +202,7 @@ void
 nsHistory::Back(ErrorResult& aRv)
 {
   nsCOMPtr<nsPIDOMWindow> win(do_QueryReferent(mInnerWindow));
-  if (!win || !nsContentUtils::CanCallerAccess(win->GetOuterWindow())) {
+  if (!win || !win->IsCurrentInnerWindow()) {
     aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
 
     return;
@@ -223,7 +223,7 @@ void
 nsHistory::Forward(ErrorResult& aRv)
 {
   nsCOMPtr<nsPIDOMWindow> win(do_QueryReferent(mInnerWindow));
-  if (!win || !nsContentUtils::CanCallerAccess(win->GetOuterWindow())) {
+  if (!win || !win->IsCurrentInnerWindow()) {
     aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
 
     return;
@@ -268,7 +268,7 @@ nsHistory::PushOrReplaceState(JSContext* aCx, JS::Handle<JS::Value> aData,
     return;
   }
 
-  if (!nsContentUtils::CanCallerAccess(win->GetOuterWindow())) {
+  if (!win->IsCurrentInnerWindow()) {
     aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
 
     return;
diff --git a/dom/base/nsJSEnvironment.cpp b/dom/base/nsJSEnvironment.cpp
index 031631179f17..a93df5fb2fde 100644
--- a/dom/base/nsJSEnvironment.cpp
+++ b/dom/base/nsJSEnvironment.cpp
@@ -55,6 +55,7 @@
 #include "mozilla/dom/ImageData.h"
 #include "mozilla/dom/ImageDataBinding.h"
 #include "nsAXPCNativeCallContext.h"
+#include "mozilla/CycleCollectedJSRuntime.h"
 
 #include "nsJSPrincipals.h"
 
@@ -1977,53 +1978,131 @@ TimeBetween(PRTime start, PRTime end)
   return (uint32_t)(end - start) / PR_USEC_PER_MSEC;
 }
 
+struct CycleCollectorStats
+{
+  void Clear()
+  {
+    mBeginSliceTime = 0;
+    mBeginTime = 0;
+    mMaxGCDuration = 0;
+    mRanSyncForgetSkippable = false;
+    mSuspected = 0;
+    mMaxSkippableDuration = 0;
+    mAnyLockedOut = false;
+  }
+
+  // Time the current slice began, including any GC finishing.
+  PRTime mBeginSliceTime;
+
+  // Time the current cycle collection began.
+  PRTime mBeginTime;
+
+  // The longest GC finishing duration for any slice of the current CC.
+  uint32_t mMaxGCDuration;
+
+  // True if we ran sync forget skippable in any slice of the current CC.
+  bool mRanSyncForgetSkippable;
+
+  // Number of suspected objects at the start of the current CC.
+  uint32_t mSuspected;
+
+  // The longest duration spent on sync forget skippable in any slice of the
+  // current CC
+  uint32_t mMaxSkippableDuration;
+
+  // True if we were locked out by the GC in any slice of the current CC.
+  bool mAnyLockedOut;
+};
+
+CycleCollectorStats gCCStats;
+
+
+static void
+PrepareForCycleCollection(int32_t aExtraForgetSkippableCalls = 0)
+{
+  gCCStats.mBeginSliceTime = PR_Now();
+
+  // Before we begin the cycle collection, make sure there is no active GC.
+  PRTime endGCTime;
+  if (sCCLockedOut) {
+    gCCStats.mAnyLockedOut = true;
+    FinishAnyIncrementalGC();
+    endGCTime = PR_Now();
+    uint32_t gcTime = TimeBetween(gCCStats.mBeginSliceTime, endGCTime);
+    gCCStats.mMaxGCDuration = std::max(gCCStats.mMaxGCDuration, gcTime);
+  } else {
+    endGCTime = gCCStats.mBeginSliceTime;
+  }
+
+  // Run forgetSkippable synchronously to reduce the size of the CC graph. This
+  // is particularly useful if we recently finished a GC.
+  if (aExtraForgetSkippableCalls >= 0) {
+    bool ranSyncForgetSkippable = false;
+    while (sCleanupsSinceLastGC < NS_MAJOR_FORGET_SKIPPABLE_CALLS) {
+      FireForgetSkippable(nsCycleCollector_suspectedCount(), false);
+      ranSyncForgetSkippable = true;
+    }
+
+    for (int32_t i = 0; i < aExtraForgetSkippableCalls; ++i) {
+      FireForgetSkippable(nsCycleCollector_suspectedCount(), false);
+      ranSyncForgetSkippable = true;
+    }
+
+    if (ranSyncForgetSkippable) {
+      gCCStats.mMaxSkippableDuration =
+        std::max(gCCStats.mMaxSkippableDuration, TimeBetween(endGCTime, PR_Now()));
+      gCCStats.mRanSyncForgetSkippable = true;
+    }
+
+  }
+}
+
 //static
 void
 nsJSContext::CycleCollectNow(nsICycleCollectorListener *aListener,
-                             int32_t aExtraForgetSkippableCalls,
-                             bool aManuallyTriggered)
+                             int32_t aExtraForgetSkippableCalls)
 {
   if (!NS_IsMainThread()) {
     return;
   }
 
   PROFILER_LABEL("CC", "CycleCollectNow");
+  PrepareForCycleCollection(aExtraForgetSkippableCalls);
+  nsCycleCollector_collect(aListener);
+}
 
-  PRTime start = PR_Now();
+//static
+void
+nsJSContext::ScheduledCycleCollectNow()
+{
+  if (!NS_IsMainThread()) {
+    return;
+  }
 
-  // Before we begin the cycle collection, make sure there is no active GC.
-  bool finishedIGC = sCCLockedOut;
-  FinishAnyIncrementalGC();
-  PRTime endGCTime = PR_Now();
-  uint32_t gcDuration = TimeBetween(start, endGCTime);
+  PROFILER_LABEL("CC", "ScheduledCycleCollectNow");
+  PrepareForCycleCollection();
+  nsCycleCollector_scheduledCollect();
+}
+
+//static
+void
+nsJSContext::BeginCycleCollectionCallback()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+
+  gCCStats.mBeginTime = gCCStats.mBeginSliceTime ? gCCStats.mBeginSliceTime : PR_Now();
+  gCCStats.mSuspected = nsCycleCollector_suspectedCount();
 
   KillCCTimer();
+}
 
-  uint32_t suspected = nsCycleCollector_suspectedCount();
-  bool ranSyncForgetSkippable = false;
+//static
+void
+nsJSContext::EndCycleCollectionCallback(CycleCollectorResults &aResults)
+{
+  MOZ_ASSERT(NS_IsMainThread());
 
-  // Run forgetSkippable synchronously to reduce the size of the CC graph. This
-  // is particularly useful if we recently finished a GC.
-  if (sCleanupsSinceLastGC < NS_MAJOR_FORGET_SKIPPABLE_CALLS &&
-      aExtraForgetSkippableCalls >= 0) {
-    while (sCleanupsSinceLastGC < NS_MAJOR_FORGET_SKIPPABLE_CALLS) {
-      FireForgetSkippable(nsCycleCollector_suspectedCount(), false);
-      ranSyncForgetSkippable = true;
-    }
-  }
-
-  for (int32_t i = 0; i < aExtraForgetSkippableCalls; ++i) {
-    FireForgetSkippable(nsCycleCollector_suspectedCount(), false);
-    ranSyncForgetSkippable = true;
-  }
-
-  PRTime endSkippableTime = PR_Now();
-  uint32_t skippableDuration = TimeBetween(endGCTime, endSkippableTime);
-
-  // Prepare to actually run the CC.
-  nsCycleCollectorResults ccResults;
-  nsCycleCollector_collect(aManuallyTriggered, &ccResults, aListener);
-  sCCollectedWaitingForGC += ccResults.mFreedRefCounted + ccResults.mFreedGCed;
+  sCCollectedWaitingForGC += aResults.mFreedRefCounted + aResults.mFreedGCed;
 
   // If we collected a substantial amount of cycles, poke the GC since more objects
   // might be unreachable now.
@@ -2036,13 +2115,13 @@ nsJSContext::CycleCollectNow(nsICycleCollectorListener *aListener,
   PRTime endCCTime = PR_Now();
 
   // Log information about the CC via telemetry, JSON and the console.
-  uint32_t ccNowDuration = TimeBetween(start, endCCTime);
-  Telemetry::Accumulate(Telemetry::CYCLE_COLLECTOR_FINISH_IGC, finishedIGC);
-  Telemetry::Accumulate(Telemetry::CYCLE_COLLECTOR_SYNC_SKIPPABLE, ranSyncForgetSkippable);
+  uint32_t ccNowDuration = TimeBetween(gCCStats.mBeginTime, endCCTime);
+  Telemetry::Accumulate(Telemetry::CYCLE_COLLECTOR_FINISH_IGC, gCCStats.mAnyLockedOut);
+  Telemetry::Accumulate(Telemetry::CYCLE_COLLECTOR_SYNC_SKIPPABLE, gCCStats.mRanSyncForgetSkippable);
   Telemetry::Accumulate(Telemetry::CYCLE_COLLECTOR_FULL, ccNowDuration);
 
   if (sLastCCEndTime) {
-    uint32_t timeBetween = (uint32_t)(start - sLastCCEndTime) / PR_USEC_PER_SEC;
+    uint32_t timeBetween = TimeBetween(sLastCCEndTime, gCCStats.mBeginTime);
     Telemetry::Accumulate(Telemetry::CYCLE_COLLECTOR_TIME_BETWEEN, timeBetween);
   }
   sLastCCEndTime = endCCTime;
@@ -2058,23 +2137,23 @@ nsJSContext::CycleCollectNow(nsICycleCollectorListener *aListener,
 
   if (sPostGCEventsToConsole) {
     nsCString mergeMsg;
-    if (ccResults.mMergedZones) {
+    if (aResults.mMergedZones) {
       mergeMsg.AssignLiteral(" merged");
     }
 
     nsCString gcMsg;
-    if (ccResults.mForcedGC) {
+    if (aResults.mForcedGC) {
       gcMsg.AssignLiteral(", forced a GC");
     }
 
     NS_NAMED_MULTILINE_LITERAL_STRING(kFmt,
       MOZ_UTF16("CC(T+%.1f) duration: %lums, suspected: %lu, visited: %lu RCed and %lu%s GCed, collected: %lu RCed and %lu GCed (%lu|%lu waiting for GC)%s\n")
-      MOZ_UTF16("ForgetSkippable %lu times before CC, min: %lu ms, max: %lu ms, avg: %lu ms, total: %lu ms, sync: %lu ms, removed: %lu"));
+      MOZ_UTF16("ForgetSkippable %lu times before CC, min: %lu ms, max: %lu ms, avg: %lu ms, total: %lu ms, max sync: %lu ms, removed: %lu"));
     nsString msg;
     msg.Adopt(nsTextFormatter::smprintf(kFmt.get(), double(delta) / PR_USEC_PER_SEC,
-                                        ccNowDuration, suspected,
-                                        ccResults.mVisitedRefCounted, ccResults.mVisitedGCed, mergeMsg.get(),
-                                        ccResults.mFreedRefCounted, ccResults.mFreedGCed,
+                                        ccNowDuration, gCCStats.mSuspected,
+                                        aResults.mVisitedRefCounted, aResults.mVisitedGCed, mergeMsg.get(),
+                                        aResults.mFreedRefCounted, aResults.mFreedGCed,
                                         sCCollectedWaitingForGC, sLikelyShortLivingObjectsNeedingGC,
                                         gcMsg.get(),
                                         sForgetSkippableBeforeCC,
@@ -2083,7 +2162,7 @@ nsJSContext::CycleCollectNow(nsICycleCollectorListener *aListener,
                                         (sTotalForgetSkippableTime / cleanups) /
                                           PR_USEC_PER_MSEC,
                                         sTotalForgetSkippableTime / PR_USEC_PER_MSEC,
-                                        skippableDuration, sRemovedPurples));
+                                        gCCStats.mMaxSkippableDuration, sRemovedPurples));
     nsCOMPtr<nsIConsoleService> cs =
       do_GetService(NS_CONSOLESERVICE_CONTRACTID);
     if (cs) {
@@ -2095,8 +2174,8 @@ nsJSContext::CycleCollectNow(nsICycleCollectorListener *aListener,
     NS_NAMED_MULTILINE_LITERAL_STRING(kJSONFmt,
        MOZ_UTF16("{ \"timestamp\": %llu, ")
          MOZ_UTF16("\"duration\": %llu, ")
-         MOZ_UTF16("\"finish_gc_duration\": %llu, ")
-         MOZ_UTF16("\"sync_skippable_duration\": %llu, ")
+         MOZ_UTF16("\"max_finish_gc_duration\": %llu, ")
+         MOZ_UTF16("\"max_sync_skippable_duration\": %llu, ")
          MOZ_UTF16("\"suspected\": %lu, ")
          MOZ_UTF16("\"visited\": { ")
              MOZ_UTF16("\"RCed\": %lu, ")
@@ -2117,13 +2196,14 @@ nsJSContext::CycleCollectNow(nsICycleCollectorListener *aListener,
        MOZ_UTF16("}"));
     nsString json;
     json.Adopt(nsTextFormatter::smprintf(kJSONFmt.get(), endCCTime,
-                                         ccNowDuration, gcDuration, skippableDuration,
-                                         suspected,
-                                         ccResults.mVisitedRefCounted, ccResults.mVisitedGCed,
-                                         ccResults.mFreedRefCounted, ccResults.mFreedGCed,
+                                         ccNowDuration, gCCStats.mMaxGCDuration,
+                                         gCCStats.mMaxSkippableDuration,
+                                         gCCStats.mSuspected,
+                                         aResults.mVisitedRefCounted, aResults.mVisitedGCed,
+                                         aResults.mFreedRefCounted, aResults.mFreedGCed,
                                          sCCollectedWaitingForGC,
                                          sLikelyShortLivingObjectsNeedingGC,
-                                         ccResults.mForcedGC,
+                                         aResults.mForcedGC,
                                          sForgetSkippableBeforeCC,
                                          minForgetSkippableTime / PR_USEC_PER_MSEC,
                                          sMaxForgetSkippableTime / PR_USEC_PER_MSEC,
@@ -2145,6 +2225,7 @@ nsJSContext::CycleCollectNow(nsICycleCollectorListener *aListener,
   sForgetSkippableBeforeCC = 0;
   sNeedsFullCC = false;
   sNeedsGCAfterCC = false;
+  gCCStats.Clear();
 }
 
 // static
@@ -2235,7 +2316,7 @@ CCTimerFired(nsITimer *aTimer, void *aClosure)
       // We are in the final timer fire and still meet the conditions for
       // triggering a CC. Let CycleCollectNow finish the current IGC, if any,
       // because that will allow us to include the GC time in the CC pause.
-      nsJSContext::CycleCollectNow(nullptr, 0, false);
+      nsJSContext::ScheduledCycleCollectNow();
     }
   } else if ((sPreviousSuspectedCount + 100) <= suspected) {
       // Only do a forget skippable if there are more than a few new objects.
@@ -2600,6 +2681,7 @@ mozilla::dom::StartupJSEnvironment()
   sShuttingDown = false;
   sContextCount = 0;
   sSecurityManager = nullptr;
+  gCCStats.Clear();
 }
 
 static int
diff --git a/dom/base/nsJSEnvironment.h b/dom/base/nsJSEnvironment.h
index d24b87d2b545..40acd2813888 100644
--- a/dom/base/nsJSEnvironment.h
+++ b/dom/base/nsJSEnvironment.h
@@ -24,6 +24,7 @@ class nsCycleCollectionNoteRootCallback;
 
 namespace mozilla {
 template <class> class Maybe;
+struct CycleCollectorResults;
 }
 
 // The amount of time we wait between a request to GC (due to leaving
@@ -103,8 +104,10 @@ public:
   // If aExtraForgetSkippableCalls is -1, forgetSkippable won't be
   // called even if the previous collection was GC.
   static void CycleCollectNow(nsICycleCollectorListener *aListener = nullptr,
-                              int32_t aExtraForgetSkippableCalls = 0,
-                              bool aManuallyTriggered = true);
+                              int32_t aExtraForgetSkippableCalls = 0);
+  static void ScheduledCycleCollectNow();
+  static void BeginCycleCollectionCallback();
+  static void EndCycleCollectionCallback(mozilla::CycleCollectorResults &aResults);
 
   static void PokeGC(JS::gcreason::Reason aReason, int aDelay = 0);
   static void KillGCTimer();
diff --git a/dom/base/nsJSUtils.cpp b/dom/base/nsJSUtils.cpp
index abf4c8e8cb3d..ebdc7711f1b4 100644
--- a/dom/base/nsJSUtils.cpp
+++ b/dom/base/nsJSUtils.cpp
@@ -26,6 +26,7 @@
 #include "nsJSPrincipals.h"
 #include "xpcpublic.h"
 #include "nsContentUtils.h"
+#include "nsGlobalWindow.h"
 
 bool
 nsJSUtils::GetCallingLocation(JSContext* aContext, const char* *aFilename,
@@ -47,46 +48,9 @@ nsJSUtils::GetCallingLocation(JSContext* aContext, const char* *aFilename,
 nsIScriptGlobalObject *
 nsJSUtils::GetStaticScriptGlobal(JSObject* aObj)
 {
-  const JSClass* clazz;
-  JSObject* glob = aObj; // starting point for search
-
-  if (!glob)
+  if (!aObj)
     return nullptr;
-
-  glob = js::GetGlobalForObjectCrossCompartment(glob);
-  NS_ABORT_IF_FALSE(glob, "Infallible returns null");
-
-  clazz = JS_GetClass(glob);
-
-  // Whenever we end up with globals that are JSCLASS_IS_DOMJSCLASS
-  // and have an nsISupports DOM object, we will need to modify this
-  // check here.
-  MOZ_ASSERT(!(clazz->flags & JSCLASS_IS_DOMJSCLASS));
-  nsISupports* supports;
-  if (!(clazz->flags & JSCLASS_HAS_PRIVATE) ||
-      !(clazz->flags & JSCLASS_PRIVATE_IS_NSISUPPORTS) ||
-      !(supports = (nsISupports*)::JS_GetPrivate(glob))) {
-    return nullptr;
-  }
-
-  // We might either have a window directly (e.g. if the global is a
-  // sandbox whose script object principal pointer is a window), or an
-  // XPCWrappedNative for a window.  We could also have other
-  // sandbox-related script object principals, but we can't do much
-  // about those short of trying to walk the proto chain of |glob|
-  // looking for a window or something.
-  nsCOMPtr<nsIScriptGlobalObject> sgo(do_QueryInterface(supports));
-  if (!sgo) {
-    nsCOMPtr<nsIXPConnectWrappedNative> wrapper(do_QueryInterface(supports));
-    if (!wrapper) {
-      return nullptr;
-    }
-    sgo = do_QueryWrappedNative(wrapper);
-  }
-
-  // We're returning a pointer to something that's about to be
-  // released, but that's ok here.
-  return sgo;
+  return xpc::WindowGlobalOrNull(aObj);
 }
 
 nsIScriptContext *
diff --git a/dom/base/nsQueryContentEventResult.h b/dom/base/nsQueryContentEventResult.h
index 26a494289ab9..a9b9ff1f79d5 100644
--- a/dom/base/nsQueryContentEventResult.h
+++ b/dom/base/nsQueryContentEventResult.h
@@ -3,6 +3,9 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#ifndef mozilla_dom_nsQueryContentEventResult_h
+#define mozilla_dom_nsQueryContentEventResult_h
+
 #include "nsIQueryContentEventResult.h"
 #include "nsString.h"
 #include "nsRect.h"
@@ -32,3 +35,5 @@ protected:
   bool mSucceeded;
   bool mReversed;
 };
+
+#endif // mozilla_dom_nsQueryContentEventResult_h
\ No newline at end of file
diff --git a/dom/base/test/test_domrequesthelper.xul b/dom/base/test/test_domrequesthelper.xul
index 3db3e774999b..09b33da3e541 100644
--- a/dom/base/test/test_domrequesthelper.xul
+++ b/dom/base/test/test_domrequesthelper.xul
@@ -16,12 +16,24 @@
 
   <script type="application/javascript">
   <![CDATA[
-    Components.utils.import("resource://gre/modules/DOMRequestHelper.jsm");
+    const Cc = Components.classes;
+    const Cu = Components.utils;
+    const Ci = Components.interfaces;
+    Cu.import("resource://gre/modules/DOMRequestHelper.jsm");
+    let obs = Cc["@mozilla.org/observer-service;1"].
+              getService(Ci.nsIObserverService);
 
     function DummyHelperSubclass() {
+      this.onuninit = null;
     }
     DummyHelperSubclass.prototype = {
-      __proto__: DOMRequestIpcHelper.prototype
+      __proto__: DOMRequestIpcHelper.prototype,
+      uninit: function() {
+        if (typeof this.onuninit === "function") {
+          this.onuninit();
+        }
+        this.onuninit = null;
+      }
     };
 
     var dummy = new DummyHelperSubclass();
@@ -77,6 +89,78 @@
       checkMessageListeners(aExpectedListeners, aCount);
     }
 
+    /**
+     * Utility function to test window destruction behavior.  In general this
+     * function does the following:
+     *
+     *  1) Create a new iframe
+     *  2) Create a new DOMRequestHelper
+     *  3) initDOMRequestHelper(), optionally with weak or strong listeners
+     *  4) Optionally force a garbage collection to reap weak references
+     *  5) Destroy the iframe triggering an inner-window-destroyed event
+     *  6) Callback with a boolean indicating if DOMRequestHelper.uninit() was
+     *     called.
+     *
+     * Example usage:
+     *
+     *    checkWindowDestruction({ messages: ["foo"], gc: true },
+     *                           function(uninitCalled) {
+     *      // expect uninitCalled === false since GC with only weak refs
+     *    });
+     */
+    const TOPIC = "inner-window-destroyed";
+    function checkWindowDestruction(aOptions, aCallback) {
+      aOptions = aOptions || {};
+      aOptions.messages = aOptions.messages || [];
+      aOptions.gc = !!aOptions.gc;
+
+      if (typeof aCallback !== "function") {
+        aCallback = function() { };
+      }
+
+      let uninitCalled = false;
+
+      // Use a secondary observer so we know when to expect the uninit().  We
+      // can then reasonably expect uninitCalled to be set properly on the
+      // next tick.
+      let observer = {
+        observe: function(aSubject, aTopic, aData) {
+          if (aTopic !== TOPIC) {
+            return;
+          }
+          obs.removeObserver(observer, TOPIC);
+          setTimeout(function() {
+            aCallback(uninitCalled);
+          });
+        }
+      };
+
+      let frame = document.createElement("iframe");
+      frame.onload = function() {
+        obs.addObserver(observer, TOPIC, false);
+        // Create dummy DOMRequestHelper specific to checkWindowDestruction()
+        let cwdDummy = new DummyHelperSubclass();
+        cwdDummy.onuninit = function() {
+          uninitCalled = true;
+        };
+        cwdDummy.initDOMRequestHelper(frame.contentWindow, aOptions.messages);
+        // Make sure to clear our strong ref here so that we can test our
+        // weak reference listeners and observer.
+        cwdDummy = null;
+        if (aOptions.gc) {
+          Cu.schedulePreciseGC(function() {
+            SpecialPowers.DOMWindowUtils.cycleCollect();
+            SpecialPowers.DOMWindowUtils.garbageCollect();
+            SpecialPowers.DOMWindowUtils.garbageCollect();
+            document.documentElement.removeChild(frame);
+          });
+          return;
+        }
+        document.documentElement.removeChild(frame);
+      };
+      document.documentElement.appendChild(frame);
+    }
+
     /**
      * Test steps.
      */
@@ -334,6 +418,52 @@
           ok(r === undefined, "takeResolver: get failed");
           next();
         });
+      },
+      function() {
+        ok(true, "== Test window destroyed without messages and without GC");
+        checkWindowDestruction({ gc: false }, function(uninitCalled) {
+          ok(uninitCalled, "uninit() should have been called");
+          next();
+        });
+      },
+      function() {
+        ok(true, "== Test window destroyed without messages and with GC");
+        checkWindowDestruction({ gc: true }, function(uninitCalled) {
+          ok(!uninitCalled, "uninit() should NOT have been called");
+          next();
+        });
+      },
+      function() {
+        ok(true, "== Test window destroyed with weak messages and without GC");
+        checkWindowDestruction({ messages: [{ name: "foo", strongRef: false }],
+                                 gc: false }, function(uninitCalled) {
+          ok(uninitCalled, "uninit() should have been called");
+          next();
+        });
+      },
+      function() {
+        ok(true, "== Test window destroyed with weak messages and with GC");
+        checkWindowDestruction({ messages: [{ name: "foo", strongRef: false }],
+                                 gc: true }, function(uninitCalled) {
+          ok(!uninitCalled, "uninit() should NOT have been called");
+          next();
+        });
+      },
+      function() {
+        ok(true, "== Test window destroyed with strong messages and without GC");
+        checkWindowDestruction({ messages: [{ name: "foo", strongRef: true }],
+                                 gc: false }, function(uninitCalled) {
+          ok(uninitCalled, "uninit() should have been called");
+          next();
+        });
+      },
+      function() {
+        ok(true, "== Test window destroyed with strong messages and with GC");
+        checkWindowDestruction({ messages: [{ name: "foo", strongRef: true }],
+                                 gc: true }, function(uninitCalled) {
+          ok(uninitCalled, "uninit() should have been called");
+          next();
+        });
       }
     ];
 
diff --git a/dom/bindings/BindingUtils.cpp b/dom/bindings/BindingUtils.cpp
index ece2aaed67d7..cd688c7bedbe 100644
--- a/dom/bindings/BindingUtils.cpp
+++ b/dom/bindings/BindingUtils.cpp
@@ -214,16 +214,7 @@ ErrorResult::ReportJSExceptionFromJSImplementation(JSContext* aCx)
   nsString message;
   domError->GetMessage(message);
 
-  JSErrorReport errorReport;
-  memset(&errorReport, 0, sizeof(JSErrorReport));
-  errorReport.errorNumber = JSMSG_USER_DEFINED_ERROR;
-  errorReport.ucmessage = message.get();
-  errorReport.exnType = JSEXN_ERR;
-  JS::Rooted<JSScript*> script(aCx);
-  if (JS_DescribeScriptedCaller(aCx, &script, &errorReport.lineno)) {
-    errorReport.filename = JS_GetScriptFilename(aCx, script);
-  }
-  JS_ThrowReportedError(aCx, nullptr, &errorReport);
+  JS_ReportError(aCx, "%hs", message.get());
   JS_RemoveValueRoot(aCx, &mJSException);
   
   // We no longer have a useful exception but we do want to signal that an error
@@ -1117,7 +1108,7 @@ ResolvePrototypeOrConstructor(JSContext* cx, JS::Handle<JSObject*> wrapper,
   JS::Rooted<JSObject*> global(cx, js::GetGlobalForObjectCrossCompartment(obj));
   {
     JSAutoCompartment ac(cx, global);
-    JS::Heap<JSObject*>* protoAndIfaceArray = GetProtoAndIfaceArray(global);
+    ProtoAndIfaceArray& protoAndIfaceArray = *GetProtoAndIfaceArray(global);
     JSObject* protoOrIface = protoAndIfaceArray[protoAndIfaceArrayIndex];
     if (!protoOrIface) {
       return false;
diff --git a/dom/bindings/BindingUtils.h b/dom/bindings/BindingUtils.h
index 711c16a08f86..c37b5efba879 100644
--- a/dom/bindings/BindingUtils.h
+++ b/dom/bindings/BindingUtils.h
@@ -10,6 +10,7 @@
 #include "jsfriendapi.h"
 #include "jswrapper.h"
 #include "mozilla/Alignment.h"
+#include "mozilla/Array.h"
 #include "mozilla/dom/BindingDeclarations.h"
 #include "mozilla/dom/CallbackObject.h"
 #include "mozilla/dom/DOMJSClass.h"
@@ -280,21 +281,28 @@ static_assert((size_t)constructors::id::_ID_Start ==
               "Overlapping or discontiguous indexes.");
 const size_t kProtoAndIfaceCacheCount = constructors::id::_ID_Count;
 
+class ProtoAndIfaceArray : public Array<JS::Heap<JSObject*>, kProtoAndIfaceCacheCount>
+{
+public:
+  ProtoAndIfaceArray() {
+    MOZ_COUNT_CTOR(ProtoAndIfaceArray);
+  }
+
+  ~ProtoAndIfaceArray() {
+    MOZ_COUNT_DTOR(ProtoAndIfaceArray);
+  }
+};
+
 inline void
 AllocateProtoAndIfaceCache(JSObject* obj)
 {
   MOZ_ASSERT(js::GetObjectClass(obj)->flags & JSCLASS_DOM_GLOBAL);
   MOZ_ASSERT(js::GetReservedSlot(obj, DOM_PROTOTYPE_SLOT).isUndefined());
 
-  JS::Heap<JSObject*>* protoAndIfaceArray = new JS::Heap<JSObject*>[kProtoAndIfaceCacheCount];
+  ProtoAndIfaceArray* protoAndIfaceArray = new ProtoAndIfaceArray();
 
   js::SetReservedSlot(obj, DOM_PROTOTYPE_SLOT,
                       JS::PrivateValue(protoAndIfaceArray));
-
-#ifdef NS_BUILD_REFCNT_LOGGING
-  NS_LogCtor((void*)protoAndIfaceArray, "ProtoAndIfaceArray",
-             sizeof(JS::Heap<JSObject*>) * kProtoAndIfaceCacheCount);
-#endif
 }
 
 inline void
@@ -304,8 +312,8 @@ TraceProtoAndIfaceCache(JSTracer* trc, JSObject* obj)
 
   if (!HasProtoAndIfaceArray(obj))
     return;
-  JS::Heap<JSObject*>* protoAndIfaceArray = GetProtoAndIfaceArray(obj);
-  for (size_t i = 0; i < kProtoAndIfaceCacheCount; ++i) {
+  ProtoAndIfaceArray& protoAndIfaceArray = *GetProtoAndIfaceArray(obj);
+  for (size_t i = 0; i < ArrayLength(protoAndIfaceArray); ++i) {
     if (protoAndIfaceArray[i]) {
       JS_CallHeapObjectTracer(trc, &protoAndIfaceArray[i], "protoAndIfaceArray[i]");
     }
@@ -317,14 +325,9 @@ DestroyProtoAndIfaceCache(JSObject* obj)
 {
   MOZ_ASSERT(js::GetObjectClass(obj)->flags & JSCLASS_DOM_GLOBAL);
 
-  JS::Heap<JSObject*>* protoAndIfaceArray = GetProtoAndIfaceArray(obj);
+  ProtoAndIfaceArray* protoAndIfaceArray = GetProtoAndIfaceArray(obj);
 
-#ifdef NS_BUILD_REFCNT_LOGGING
-  NS_LogDtor((void*)protoAndIfaceArray, "ProtoAndIfaceArray",
-             sizeof(JS::Heap<JSObject*>) * kProtoAndIfaceCacheCount);
-#endif
-
-  delete [] protoAndIfaceArray;
+  delete protoAndIfaceArray;
 }
 
 /**
@@ -2066,7 +2069,7 @@ ReportLenientThisUnwrappingFailure(JSContext* cx, JSObject* obj);
 inline JSObject*
 GetUnforgeableHolder(JSObject* aGlobal, prototypes::ID aId)
 {
-  JS::Heap<JSObject*>* protoAndIfaceArray = GetProtoAndIfaceArray(aGlobal);
+  ProtoAndIfaceArray& protoAndIfaceArray = *GetProtoAndIfaceArray(aGlobal);
   JSObject* interfaceProto = protoAndIfaceArray[aId];
   return &js::GetReservedSlot(interfaceProto,
                               DOM_INTERFACE_PROTO_SLOTS_BASE).toObject();
diff --git a/dom/bindings/Bindings.conf b/dom/bindings/Bindings.conf
index 54c53404f1ee..73ea860569e7 100644
--- a/dom/bindings/Bindings.conf
+++ b/dom/bindings/Bindings.conf
@@ -789,6 +789,10 @@ DOMInterfaces = {
     'nativeType': 'mozilla::dom::CellBroadcast',
 },
 
+'MozIcc': {
+    'nativeType': 'mozilla::dom::Icc',
+},
+
 'MozMobileConnectionArray': {
     'nativeType': 'mozilla::dom::network::MobileConnectionArray',
     'resultNotAddRefed': [ 'item' ]
@@ -1855,7 +1859,8 @@ addExternalIface('MozConnection', headerFile='nsIDOMConnection.h')
 addExternalIface('MozControllers', nativeType='nsIControllers')
 addExternalIface('MozFrameLoader', nativeType='nsIFrameLoader', notflattened=True)
 addExternalIface('MozFrameRequestCallback', nativeType='nsIFrameRequestCallback',
-                 notflattened=True);
+                 notflattened=True)
+addExternalIface('MozIccInfo', headerFile='nsIDOMIccInfo.h')
 addExternalIface('MozIccManager', headerFile='nsIDOMIccManager.h')
 addExternalIface('MozMobileConnection', headerFile='nsIDOMMobileConnection.h')
 addExternalIface('MozMobileMessageManager', headerFile='nsIDOMMobileMessageManager.h')
diff --git a/dom/bindings/CallbackObject.cpp b/dom/bindings/CallbackObject.cpp
index 9cc3708edf0c..2d70de0f0a0f 100644
--- a/dom/bindings/CallbackObject.cpp
+++ b/dom/bindings/CallbackObject.cpp
@@ -18,6 +18,7 @@
 #include "nsIScriptSecurityManager.h"
 #include "xpcprivate.h"
 #include "WorkerPrivate.h"
+#include "nsGlobalWindow.h"
 
 namespace mozilla {
 namespace dom {
@@ -66,38 +67,26 @@ CallbackObject::CallSetup::CallSetup(JS::Handle<JSObject*> aCallback,
   JSContext* cx = nullptr;
 
   if (mIsMainThread) {
-    // Now get the nsIScriptGlobalObject for this callback.
-    nsIScriptContext* ctx = nullptr;
-    nsIScriptGlobalObject* sgo = nsJSUtils::GetStaticScriptGlobal(realCallback);
-    if (sgo) {
+    // Now get the global and JSContext for this callback.
+    nsGlobalWindow* win = xpc::WindowGlobalOrNull(realCallback);
+    if (win) {
       // Make sure that if this is a window it's the current inner, since the
       // nsIScriptContext and hence JSContext are associated with the outer
       // window.  Which means that if someone holds on to a function from a
       // now-unloaded document we'd have the new document as the script entry
       // point...
-      nsCOMPtr<nsPIDOMWindow> win = do_QueryInterface(sgo);
-      if (win) {
-        MOZ_ASSERT(win->IsInnerWindow());
-        nsPIDOMWindow* outer = win->GetOuterWindow();
-        if (!outer || win != outer->GetCurrentInnerWindow()) {
-          // Just bail out from here
-          return;
-        }
+      MOZ_ASSERT(win->IsInnerWindow());
+      nsPIDOMWindow* outer = win->GetOuterWindow();
+      if (!outer || win != outer->GetCurrentInnerWindow()) {
+        // Just bail out from here
+        return;
       }
-      // if not a window at all, just press on
-
-      ctx = sgo->GetContext();
-      if (ctx) {
-        // We don't check whether scripts are enabled on ctx, because
-        // CheckFunctionAccess will do that anyway... and because we ignore them
-        // being disabled if the callee is system.
-        cx = ctx->GetNativeContext();
-      }
-    }
-
-    if (!cx) {
-      // We didn't manage to hunt down a script global to work with.  Just fall
-      // back on using the safe context.
+      cx = win->GetContext() ? win->GetContext()->GetNativeContext()
+                             // This happens - Removing it causes
+                             // test_bug293235.xul to go orange.
+                             : nsContentUtils::GetSafeJSContext();
+    } else {
+      // No DOM Window. Use the SafeJSContext.
       cx = nsContentUtils::GetSafeJSContext();
     }
 
diff --git a/dom/bindings/Codegen.py b/dom/bindings/Codegen.py
index b4d90639d45b..657e5d5645db 100644
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -1141,6 +1141,11 @@ class CGClassConstructor(CGAbstractStaticMethod):
   JS::CallArgs args = JS::CallArgsFromVp(argc, vp);
   JS::Rooted<JSObject*> obj(cx, &args.callee());
 """
+        if isChromeOnly(self._ctor):
+            preamble += """  if (!%s) {
+    return ThrowingConstructor(cx, argc, vp);
+  }
+""" % GetAccessCheck(self.descriptor, "cx", "obj")
         name = self._ctor.identifier.name
         nativeName = MakeNativeName(self.descriptor.binaryNames.get(name, name))
         callGenerator = CGMethodCall(nativeName, True, self.descriptor,
@@ -1800,7 +1805,7 @@ class CGCreateInterfaceObjectsMethod(CGAbstractMethod):
     def __init__(self, descriptor, properties):
         args = [Argument('JSContext*', 'aCx'),
                 Argument('JS::Handle<JSObject*>', 'aGlobal'),
-                Argument('JS::Heap<JSObject*>*', 'aProtoAndIfaceArray'),
+                Argument('ProtoAndIfaceArray&', 'aProtoAndIfaceArray'),
                 Argument('bool', 'aDefineOnGlobal')]
         CGAbstractMethod.__init__(self, descriptor, 'CreateInterfaceObjects', 'void', args)
         self.properties = properties
@@ -1957,7 +1962,7 @@ if (!unforgeableHolder) {
         else:
             properties = "nullptr"
         if self.properties.hasChromeOnly():
-            accessCheck = GetAccessCheck(self.descriptor, "aGlobal")
+            accessCheck = GetAccessCheck(self.descriptor, "aCx", "aGlobal")
             chromeProperties = accessCheck + " ? &sChromeOnlyNativeProperties : nullptr"
         else:
             chromeProperties = "nullptr"
@@ -2012,7 +2017,7 @@ class CGGetPerInterfaceObject(CGAbstractMethod):
     return JS::NullPtr();
   }
   /* Check to see whether the interface objects are already installed */
-  JS::Heap<JSObject*>* protoAndIfaceArray = GetProtoAndIfaceArray(aGlobal);
+  ProtoAndIfaceArray& protoAndIfaceArray = *GetProtoAndIfaceArray(aGlobal);
   if (!protoAndIfaceArray[%s]) {
     CreateInterfaceObjects(aCx, aGlobal, protoAndIfaceArray, aDefineOnGlobal);
   }
@@ -2143,7 +2148,7 @@ class CGConstructorEnabledChromeOnly(CGAbstractMethod):
                                    Argument("JS::Handle<JSObject*>", "aObj")])
 
     def definition_body(self):
-        return "  return %s;" % GetAccessCheck(self.descriptor, "aObj")
+        return "  return %s;" % GetAccessCheck(self.descriptor, "aCx", "aObj")
 
 class CGConstructorEnabledViaFunc(CGAbstractMethod):
     """
@@ -2211,13 +2216,14 @@ def CreateBindingJSObject(descriptor, properties, parent):
 """
     return create % parent
 
-def GetAccessCheck(descriptor, object):
+def GetAccessCheck(descriptor, context, object):
     """
+    context is the name of a JSContext*
     object is the name of a JSObject*
 
     returns a string
     """
-    return "ThreadsafeCheckIsChrome(aCx, %s)" % object
+    return "ThreadsafeCheckIsChrome(%s, %s)" % (context, object)
 
 def InitUnforgeablePropertiesOnObject(descriptor, obj, properties, failureReturnValue=""):
     """
@@ -2241,7 +2247,7 @@ def InitUnforgeablePropertiesOnObject(descriptor, obj, properties, failureReturn
         unforgeables.append(
             CGIfWrapper(CGGeneric(defineUnforgeables %
                                   unforgeableAttrs.variableName(True)),
-                        GetAccessCheck(descriptor, obj)))
+                        GetAccessCheck(descriptor, "aCx", obj)))
     return CGList(unforgeables, "\n")
 
 def InitUnforgeableProperties(descriptor, properties):
@@ -9068,6 +9074,7 @@ class CGForwardDeclarations(CGWrapper):
 
         # We just about always need NativePropertyHooks
         builder.addInMozillaDom("NativePropertyHooks")
+        builder.addInMozillaDom("ProtoAndIfaceArray")
 
         for callback in mainCallbacks:
             forwardDeclareForType(callback)
@@ -9230,15 +9237,19 @@ class CGBindingRoot(CGThing):
         # Add header includes.
         bindingHeaders = [header for (header, include) in
                           bindingHeaders.iteritems() if include]
+        declareIncludes = ['mozilla/dom/BindingDeclarations.h',
+                          'mozilla/ErrorResult.h',
+                          'jspubtd.h',
+                          'js/RootingAPI.h',
+                          ]
+        if jsImplemented:
+            declareIncludes.append('nsWeakReference.h')
+
         curr = CGHeaders(descriptors,
                          dictionaries,
                          mainCallbacks + workerCallbacks,
                          callbackDescriptors,
-                         ['mozilla/dom/BindingDeclarations.h',
-                          'mozilla/ErrorResult.h',
-                          'jspubtd.h',
-                          'js/RootingAPI.h',
-                          ],
+                         declareIncludes,
                          bindingHeaders,
                          prefix,
                          curr,
@@ -10052,7 +10063,7 @@ class CGJSImplClass(CGBindingImplClass):
                 { "ifaceName": self.descriptor.name,
                   "parentClass": parentClass })
         else:
-            baseClasses = [ClassBase("nsISupports"),
+            baseClasses = [ClassBase("nsSupportsWeakReference"),
                            ClassBase("nsWrapperCache")]
             isupportsDecl = "NS_DECL_CYCLE_COLLECTING_ISUPPORTS"
             ccDecl = ("NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(%s)" %
@@ -10065,6 +10076,7 @@ class CGJSImplClass(CGBindingImplClass):
                 "NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(${ifaceName})\n"
                 "  NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY\n"
                 "  NS_INTERFACE_MAP_ENTRY(nsISupports)\n"
+                "  NS_INTERFACE_MAP_ENTRY(nsISupportsWeakReference)\n"
                 "NS_INTERFACE_MAP_END\n").substitute({ "ifaceName": self.descriptor.name })
 
         extradeclarations=(
diff --git a/dom/bindings/DOMJSClass.h b/dom/bindings/DOMJSClass.h
index c0842317ebc6..9d79dfe2d0e3 100644
--- a/dom/bindings/DOMJSClass.h
+++ b/dom/bindings/DOMJSClass.h
@@ -216,6 +216,8 @@ struct DOMIfaceAndProtoJSClass
   const JSClass* ToJSClass() const { return &mBase; }
 };
 
+class ProtoAndIfaceArray;
+
 inline bool
 HasProtoAndIfaceArray(JSObject* global)
 {
@@ -224,11 +226,11 @@ HasProtoAndIfaceArray(JSObject* global)
   return !js::GetReservedSlot(global, DOM_PROTOTYPE_SLOT).isUndefined();
 }
 
-inline JS::Heap<JSObject*>*
+inline ProtoAndIfaceArray*
 GetProtoAndIfaceArray(JSObject* global)
 {
   MOZ_ASSERT(js::GetObjectClass(global)->flags & JSCLASS_DOM_GLOBAL);
-  return static_cast<JS::Heap<JSObject*>*>(
+  return static_cast<ProtoAndIfaceArray*>(
     js::GetReservedSlot(global, DOM_PROTOTYPE_SLOT).toPrivate());
 }
 
diff --git a/dom/bindings/DOMJSProxyHandler.cpp b/dom/bindings/DOMJSProxyHandler.cpp
index edcf55a9b584..ca4189f069d5 100644
--- a/dom/bindings/DOMJSProxyHandler.cpp
+++ b/dom/bindings/DOMJSProxyHandler.cpp
@@ -80,7 +80,10 @@ DOMProxyHandler::GetAndClearExpandoObject(JSObject* obj)
 
   if (v.isObject()) {
     js::SetProxyExtra(obj, JSPROXYSLOT_EXPANDO, UndefinedValue());
-    xpc::GetObjectScope(obj)->RemoveDOMExpandoObject(obj);
+    XPCWrappedNativeScope* scope = xpc::MaybeGetObjectScope(obj);
+    if (scope) {
+      scope->RemoveDOMExpandoObject(obj);
+    }
   } else {
     js::ExpandoAndGeneration* expandoAndGeneration =
       static_cast<js::ExpandoAndGeneration*>(v.toPrivate());
diff --git a/dom/bindings/parser/WebIDL.py b/dom/bindings/parser/WebIDL.py
index 22842e70c282..0e3680aaf496 100644
--- a/dom/bindings/parser/WebIDL.py
+++ b/dom/bindings/parser/WebIDL.py
@@ -868,7 +868,7 @@ class IDLInterface(IDLObjectWithScope):
                                       [self.location])
 
                 self._noInterfaceObject = True
-            elif identifier == "Constructor" or identifier == "NamedConstructor":
+            elif identifier == "Constructor" or identifier == "NamedConstructor" or identifier == "ChromeConstructor":
                 if identifier == "Constructor" and not self.hasInterfaceObject():
                     raise WebIDLError(str(identifier) + " and NoInterfaceObject are incompatible",
                                       [self.location])
@@ -877,11 +877,15 @@ class IDLInterface(IDLObjectWithScope):
                     raise WebIDLError("NamedConstructor must either take an identifier or take a named argument list",
                                       [attr.location])
 
+                if identifier == "ChromeConstructor" and not self.hasInterfaceObject():
+                    raise WebIDLError(str(identifier) + " and NoInterfaceObject are incompatible",
+                                      [self.location])
+
                 args = attr.args() if attr.hasArgs() else []
 
                 retType = IDLWrapperType(self.location, self)
                 
-                if identifier == "Constructor":
+                if identifier == "Constructor" or identifier == "ChromeConstructor":
                     name = "constructor"
                     allowForbidden = True
                 else:
@@ -900,9 +904,11 @@ class IDLInterface(IDLObjectWithScope):
                 method.addExtendedAttributes(
                     [IDLExtendedAttribute(self.location, ("NewObject",)),
                      IDLExtendedAttribute(self.location, ("Throws",))])
+                if identifier == "ChromeConstructor":
+                    method.addExtendedAttributes(
+                        [IDLExtendedAttribute(self.location, ("ChromeOnly",))])
 
-
-                if identifier == "Constructor":
+                if identifier == "Constructor" or identifier == "ChromeConstructor":
                     method.resolve(self)
                 else:
                     # We need to detect conflicts for NamedConstructors across
diff --git a/dom/bindings/parser/tests/test_constructor.py b/dom/bindings/parser/tests/test_constructor.py
index 97ab90d4389e..348204c7dc12 100644
--- a/dom/bindings/parser/tests/test_constructor.py
+++ b/dom/bindings/parser/tests/test_constructor.py
@@ -12,7 +12,8 @@ def WebIDLTest(parser, harness):
 
     def checkMethod(method, QName, name, signatures,
                     static=True, getter=False, setter=False, creator=False,
-                    deleter=False, legacycaller=False, stringifier=False):
+                    deleter=False, legacycaller=False, stringifier=False,
+                    chromeOnly=False):
         harness.ok(isinstance(method, WebIDL.IDLMethod),
                    "Should be an IDLMethod")
         harness.ok(method.isMethod(), "Method is a method")
@@ -27,6 +28,7 @@ def WebIDLTest(parser, harness):
         harness.check(method.isDeleter(), deleter, "Method has the correct deleter value")
         harness.check(method.isLegacycaller(), legacycaller, "Method has the correct legacycaller value")
         harness.check(method.isStringifier(), stringifier, "Method has the correct stringifier value")
+        harness.check(method.getExtendedAttribute("ChromeOnly") is not None, chromeOnly, "Method has the correct value for ChromeOnly")
         harness.check(len(method.signatures()), len(signatures), "Method has the correct number of signatures")
 
         sigpairs = zip(method.signatures(), signatures)
@@ -55,11 +57,13 @@ def WebIDLTest(parser, harness):
         };
     """)
     results = parser.finish()
-    harness.check(len(results), 3, "Should be two productions")
+    harness.check(len(results), 3, "Should be three productions")
     harness.ok(isinstance(results[0], WebIDL.IDLInterface),
                "Should be an IDLInterface")
     harness.ok(isinstance(results[1], WebIDL.IDLInterface),
                "Should be an IDLInterface")
+    harness.ok(isinstance(results[2], WebIDL.IDLInterface),
+               "Should be an IDLInterface")
 
     checkMethod(results[0].ctor(), "::TestConstructorNoArgs::constructor",
                 "constructor", [("TestConstructorNoArgs (Wrapper)", [])])
@@ -73,3 +77,33 @@ def WebIDLTest(parser, harness):
                  [("::TestConstructorOverloads::constructor::foo", "foo", "Object", False, False)]),
                  ("TestConstructorOverloads (Wrapper)",
                  [("::TestConstructorOverloads::constructor::bar", "bar", "Boolean", False, False)])])
+
+    parser = parser.reset()
+    parser.parse("""
+        [ChromeConstructor()]
+        interface TestChromeConstructor {
+        };
+    """)
+    results = parser.finish()
+    harness.check(len(results), 1, "Should be one production")
+    harness.ok(isinstance(results[0], WebIDL.IDLInterface),
+               "Should be an IDLInterface")
+
+    checkMethod(results[0].ctor(), "::TestChromeConstructor::constructor",
+                "constructor", [("TestChromeConstructor (Wrapper)", [])],
+                chromeOnly=True)
+
+    parser = parser.reset()
+    threw = False
+    try:
+        parser.parse("""
+        [Constructor(),
+         ChromeConstructor(DOMString a)]
+        interface TestChromeConstructor {
+        };
+        """)
+        results = parser.finish()
+    except:
+        threw = True
+
+    harness.ok(threw, "Can't have both a Constructor and a ChromeConstructor")
diff --git a/dom/bluetooth/BluetoothService.cpp b/dom/bluetooth/BluetoothService.cpp
index c93d066927ce..035dd19b5825 100644
--- a/dom/bluetooth/BluetoothService.cpp
+++ b/dom/bluetooth/BluetoothService.cpp
@@ -146,29 +146,23 @@ public:
   {
     MOZ_ASSERT(NS_IsMainThread());
 
-    if (!gBluetoothService) {
-      return NS_OK;
-    }
-
-    if (!gInShutdown) {
-      gBluetoothService->SetEnabled(mEnabled);
-
-      nsAutoString signalName, signalPath;
-      BluetoothValue v = true;
-      if (mEnabled) {
-        signalName = NS_LITERAL_STRING("Enabled");
-      } else {
-        signalName = NS_LITERAL_STRING("Disabled");
-      }
-      signalPath = NS_LITERAL_STRING(KEY_MANAGER);
-      BluetoothSignal signal(signalName, signalPath, v);
-      gBluetoothService->DistributeSignal(signal);
-    }
+    NS_ENSURE_TRUE(gBluetoothService, NS_OK);
 
     if (gInShutdown) {
       gBluetoothService = nullptr;
+      return NS_OK;
     }
 
+    // Update mEnabled of BluetoothService object since
+    // StartInternal/StopInternal have been already done.
+    gBluetoothService->SetEnabled(mEnabled);
+
+    nsAutoString signalName;
+    signalName = mEnabled ? NS_LITERAL_STRING("Enabled")
+                          : NS_LITERAL_STRING("Disabled");
+    BluetoothSignal signal(signalName, NS_LITERAL_STRING(KEY_MANAGER), true);
+    gBluetoothService->DistributeSignal(signal);
+
     return NS_OK;
   }
 
diff --git a/dom/bluetooth/bluedroid/BluetoothA2dpManager.cpp b/dom/bluetooth/bluedroid/BluetoothA2dpManager.cpp
new file mode 100644
index 000000000000..39a95c126456
--- /dev/null
+++ b/dom/bluetooth/bluedroid/BluetoothA2dpManager.cpp
@@ -0,0 +1,568 @@
+/* -*- Mode: c++; c-basic-offset: 2; indent-tabs-mode: nil; tab-width: 40 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "base/basictypes.h"
+
+#include "BluetoothA2dpManager.h"
+
+#include <hardware/bluetooth.h>
+#include <hardware/bt_av.h>
+
+#include "BluetoothCommon.h"
+#include "BluetoothService.h"
+#include "BluetoothServiceBluedroid.h"
+#include "BluetoothSocket.h"
+#include "BluetoothUtils.h"
+
+#include "mozilla/dom/bluetooth/BluetoothTypes.h"
+#include "mozilla/Services.h"
+#include "mozilla/StaticPtr.h"
+#include "MainThreadUtils.h"
+#include "nsIObserverService.h"
+#include "nsThreadUtils.h"
+
+using namespace mozilla;
+USING_BLUETOOTH_NAMESPACE
+
+namespace {
+  StaticRefPtr<BluetoothA2dpManager> sBluetoothA2dpManager;
+  bool sInShutdown = false;
+  static const btav_interface_t* sBtA2dpInterface;
+} // anonymous namespace
+
+
+class SinkPropertyChangedHandler : public nsRunnable
+{
+public:
+  SinkPropertyChangedHandler(const BluetoothSignal& aSignal)
+    : mSignal(aSignal)
+  {
+  }
+
+  NS_IMETHOD
+  Run()
+  {
+    MOZ_ASSERT(NS_IsMainThread());
+
+    BluetoothA2dpManager* a2dp = BluetoothA2dpManager::Get();
+    NS_ENSURE_TRUE(a2dp, NS_ERROR_FAILURE);
+    a2dp->HandleSinkPropertyChanged(mSignal);
+    return NS_OK;
+  }
+
+private:
+  BluetoothSignal mSignal;
+};
+
+NS_IMETHODIMP
+BluetoothA2dpManager::Observe(nsISupports* aSubject,
+                              const char* aTopic,
+                              const PRUnichar* aData)
+{
+  MOZ_ASSERT(sBluetoothA2dpManager);
+
+  if (!strcmp(aTopic, NS_XPCOM_SHUTDOWN_OBSERVER_ID)) {
+    HandleShutdown();
+    return NS_OK;
+  }
+
+  MOZ_ASSERT(false, "BluetoothA2dpManager got unexpected topic!");
+  return NS_ERROR_UNEXPECTED;
+}
+
+BluetoothA2dpManager::BluetoothA2dpManager()
+{
+  ResetA2dp();
+  ResetAvrcp();
+}
+
+static void
+AvStatusToSinkString(btav_connection_state_t aStatus, nsAString& aState)
+{
+  nsAutoString state;
+  if (aStatus == BTAV_CONNECTION_STATE_DISCONNECTED) {
+    aState = NS_LITERAL_STRING("disconnected");
+  } else if (aStatus == BTAV_CONNECTION_STATE_CONNECTING) {
+    aState = NS_LITERAL_STRING("connecting");
+  } else if (aStatus == BTAV_CONNECTION_STATE_CONNECTED) {
+    aState = NS_LITERAL_STRING("connected");
+  } else if (aStatus == BTAV_CONNECTION_STATE_DISCONNECTING) {
+    aState = NS_LITERAL_STRING("disconnecting");
+  } else {
+    BT_WARNING("Unknown sink state");
+  }
+}
+
+static void
+A2dpConnectionStateCallback(btav_connection_state_t aState,
+                            bt_bdaddr_t* aBdAddress)
+{
+  MOZ_ASSERT(!NS_IsMainThread());
+
+  nsString remoteDeviceBdAddress;
+  BdAddressTypeToString(aBdAddress, remoteDeviceBdAddress);
+
+  nsString a2dpState;
+  AvStatusToSinkString(aState, a2dpState);
+
+  InfallibleTArray<BluetoothNamedValue> props;
+  props.AppendElement(
+    BluetoothNamedValue(NS_LITERAL_STRING("State"), a2dpState));
+
+  BluetoothSignal signal(NS_LITERAL_STRING("AudioSink"),
+                         remoteDeviceBdAddress, props);
+  NS_DispatchToMainThread(new SinkPropertyChangedHandler(signal));
+}
+
+static void
+A2dpAudioStateCallback(btav_audio_state_t aState,
+                       bt_bdaddr_t* aBdAddress)
+{
+  MOZ_ASSERT(!NS_IsMainThread());
+
+  nsString remoteDeviceBdAddress;
+  BdAddressTypeToString(aBdAddress, remoteDeviceBdAddress);
+
+  nsString a2dpState;
+
+  if (aState == BTAV_AUDIO_STATE_STARTED) {
+    a2dpState = NS_LITERAL_STRING("playing");
+  } else if (aState == BTAV_AUDIO_STATE_STOPPED) {
+    // for avdtp state stop stream
+    a2dpState = NS_LITERAL_STRING("connected");
+  } else if (aState == BTAV_AUDIO_STATE_REMOTE_SUSPEND) {
+    // for avdtp state suspend stream from remote side
+    a2dpState = NS_LITERAL_STRING("connected");
+  }
+
+  InfallibleTArray<BluetoothNamedValue> props;
+  props.AppendElement(
+    BluetoothNamedValue(NS_LITERAL_STRING("State"), a2dpState));
+
+  BluetoothSignal signal(NS_LITERAL_STRING("AudioSink"),
+                         remoteDeviceBdAddress, props);
+  NS_DispatchToMainThread(new SinkPropertyChangedHandler(signal));
+}
+
+static btav_callbacks_t sBtA2dpCallbacks = {
+  sizeof(sBtA2dpCallbacks),
+  A2dpConnectionStateCallback,
+  A2dpAudioStateCallback
+};
+
+/*
+ * This function will be only called when Bluetooth is turning on.
+ * It is important to register a2dp callbacks before enable() gets called.
+ * It is required to register a2dp callbacks before a2dp media task
+ * starts up.
+ */
+bool
+BluetoothA2dpManager::Init()
+{
+  const bt_interface_t* btInf = GetBluetoothInterface();
+  NS_ENSURE_TRUE(btInf, false);
+  sBtA2dpInterface = (btav_interface_t *)btInf->
+    get_profile_interface(BT_PROFILE_ADVANCED_AUDIO_ID);
+  NS_ENSURE_TRUE(sBtA2dpInterface, false);
+
+  int ret = sBtA2dpInterface->init(&sBtA2dpCallbacks);
+  if (ret != BT_STATUS_SUCCESS) {
+    BT_LOGR("failed to init a2dp module");
+    return false;
+  }
+  return true;
+}
+
+BluetoothA2dpManager::~BluetoothA2dpManager()
+{
+  nsCOMPtr<nsIObserverService> obs = services::GetObserverService();
+  NS_ENSURE_TRUE_VOID(obs);
+  if (NS_FAILED(obs->RemoveObserver(this, NS_XPCOM_SHUTDOWN_OBSERVER_ID))) {
+    BT_WARNING("Failed to remove shutdown observer!");
+  }
+}
+
+void
+BluetoothA2dpManager::ResetA2dp()
+{
+  mA2dpConnected = false;
+  mSinkState = SinkState::SINK_DISCONNECTED;
+  mController = nullptr;
+}
+
+void
+BluetoothA2dpManager::ResetAvrcp()
+{
+  mAvrcpConnected = false;
+  mDuration = 0;
+  mMediaNumber = 0;
+  mTotalMediaCount = 0;
+  mPosition = 0;
+  mPlayStatus = ControlPlayStatus::PLAYSTATUS_UNKNOWN;
+}
+
+/*
+ * Static functions
+ */
+
+static BluetoothA2dpManager::SinkState
+StatusStringToSinkState(const nsAString& aStatus)
+{
+  BluetoothA2dpManager::SinkState state =
+    BluetoothA2dpManager::SinkState::SINK_UNKNOWN;
+  if (aStatus.EqualsLiteral("disconnected")) {
+    state = BluetoothA2dpManager::SinkState::SINK_DISCONNECTED;
+  } else if (aStatus.EqualsLiteral("connecting")) {
+    state = BluetoothA2dpManager::SinkState::SINK_CONNECTING;
+  } else if (aStatus.EqualsLiteral("connected")) {
+    state = BluetoothA2dpManager::SinkState::SINK_CONNECTED;
+  } else if (aStatus.EqualsLiteral("playing")) {
+    state = BluetoothA2dpManager::SinkState::SINK_PLAYING;
+  } else {
+    BT_WARNING("Unknown sink state");
+  }
+  return state;
+}
+
+//static
+BluetoothA2dpManager*
+BluetoothA2dpManager::Get()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+
+  // If sBluetoothA2dpManager already exists, exit early
+  if (sBluetoothA2dpManager) {
+    return sBluetoothA2dpManager;
+  }
+
+  // If we're in shutdown, don't create a new instance
+  NS_ENSURE_FALSE(sInShutdown, nullptr);
+
+  // Create a new instance, register, and return
+  BluetoothA2dpManager* manager = new BluetoothA2dpManager();
+  NS_ENSURE_TRUE(manager->Init(), nullptr);
+
+  sBluetoothA2dpManager = manager;
+  return sBluetoothA2dpManager;
+}
+
+void
+BluetoothA2dpManager::HandleShutdown()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  sInShutdown = true;
+  Disconnect(nullptr);
+  sBluetoothA2dpManager = nullptr;
+}
+
+void
+BluetoothA2dpManager::Connect(const nsAString& aDeviceAddress,
+                              BluetoothProfileController* aController)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(!aDeviceAddress.IsEmpty());
+  MOZ_ASSERT(aController && !mController);
+
+  BluetoothService* bs = BluetoothService::Get();
+  if (!bs || sInShutdown) {
+    aController->OnConnect(NS_LITERAL_STRING(ERR_NO_AVAILABLE_RESOURCE));
+    return;
+  }
+
+  if (mA2dpConnected) {
+    aController->OnConnect(NS_LITERAL_STRING(ERR_ALREADY_CONNECTED));
+    return;
+  }
+
+  mDeviceAddress = aDeviceAddress;
+  mController = aController;
+
+  bt_bdaddr_t remoteAddress;
+  StringToBdAddressType(aDeviceAddress, &remoteAddress);
+  NS_ENSURE_TRUE_VOID(sBtA2dpInterface);
+  NS_ENSURE_TRUE_VOID(BT_STATUS_SUCCESS ==
+                      sBtA2dpInterface->connect(&remoteAddress));
+}
+
+void
+BluetoothA2dpManager::Disconnect(BluetoothProfileController* aController)
+{
+  BluetoothService* bs = BluetoothService::Get();
+  if (!bs) {
+    if (aController) {
+      aController->OnDisconnect(NS_LITERAL_STRING(ERR_NO_AVAILABLE_RESOURCE));
+    }
+    return;
+  }
+
+  if (!mA2dpConnected) {
+    if (aController) {
+      aController->OnDisconnect(NS_LITERAL_STRING(ERR_ALREADY_DISCONNECTED));
+    }
+    return;
+  }
+
+  MOZ_ASSERT(!mDeviceAddress.IsEmpty());
+  MOZ_ASSERT(!mController);
+
+  mController = aController;
+
+  bt_bdaddr_t remoteAddress;
+  StringToBdAddressType(mDeviceAddress, &remoteAddress);
+  if (sBtA2dpInterface) {
+    NS_ENSURE_TRUE_VOID(BT_STATUS_SUCCESS ==
+                        sBtA2dpInterface->disconnect(&remoteAddress));
+  }
+}
+
+void
+BluetoothA2dpManager::OnConnect(const nsAString& aErrorStr)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+
+  /**
+   * On the one hand, notify the controller that we've done for outbound
+   * connections. On the other hand, we do nothing for inbound connections.
+   */
+  NS_ENSURE_TRUE_VOID(mController);
+
+  nsRefPtr<BluetoothProfileController> controller = mController.forget();
+  controller->OnConnect(aErrorStr);
+}
+
+void
+BluetoothA2dpManager::OnDisconnect(const nsAString& aErrorStr)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+
+  /**
+   * On the one hand, notify the controller that we've done for outbound
+   * connections. On the other hand, we do nothing for inbound connections.
+   */
+  NS_ENSURE_TRUE_VOID(mController);
+
+  nsRefPtr<BluetoothProfileController> controller = mController.forget();
+  controller->OnDisconnect(aErrorStr);
+}
+
+/* HandleSinkPropertyChanged update sink state in A2dp
+ *
+ * Possible values: "disconnected", "connecting", "connected", "playing"
+ *
+ * 1. "disconnected" -> "connecting"
+ *    Either an incoming or outgoing connection attempt ongoing
+ * 2. "connecting" -> "disconnected"
+ *    Connection attempt failed
+ * 3. "connecting" -> "connected"
+ *    Successfully connected
+ * 4. "connected" -> "playing"
+ *    Audio stream active
+ * 5. "playing" -> "connected"
+ *    Audio stream suspended
+ * 6. "connected" -> "disconnected"
+ *    "playing" -> "disconnected"
+ *    Disconnected from local or the remote device
+ */
+void
+BluetoothA2dpManager::HandleSinkPropertyChanged(const BluetoothSignal& aSignal)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(aSignal.value().type() ==
+             BluetoothValue::TArrayOfBluetoothNamedValue);
+
+  const nsString& address = aSignal.path();
+  const InfallibleTArray<BluetoothNamedValue>& arr =
+    aSignal.value().get_ArrayOfBluetoothNamedValue();
+  MOZ_ASSERT(arr.Length() == 1);
+
+  /**
+   * There are three properties:
+   * - "State": a string
+   * - "Connected": a boolean value
+   * - "Playing": a boolean value
+   *
+   * Note that only "State" is handled in this function.
+   */
+
+  const nsString& name = arr[0].name();
+  NS_ENSURE_TRUE_VOID(name.EqualsLiteral("State"));
+
+  const BluetoothValue& value = arr[0].value();
+  MOZ_ASSERT(value.type() == BluetoothValue::TnsString);
+  SinkState newState = StatusStringToSinkState(value.get_nsString());
+  NS_ENSURE_TRUE_VOID((newState != SinkState::SINK_UNKNOWN) &&
+                      (newState != mSinkState));
+
+  SinkState prevState = mSinkState;
+  mSinkState = newState;
+
+  switch(mSinkState) {
+    case SinkState::SINK_CONNECTING:
+      // case 1: Either an incoming or outgoing connection attempt ongoing
+      MOZ_ASSERT(prevState == SinkState::SINK_DISCONNECTED);
+      break;
+    case SinkState::SINK_PLAYING:
+      // case 4: Audio stream active
+      MOZ_ASSERT(prevState == SinkState::SINK_CONNECTED);
+      break;
+    case SinkState::SINK_CONNECTED:
+      // case 5: Audio stream suspended
+      if (prevState == SinkState::SINK_PLAYING ||
+          prevState == SinkState::SINK_CONNECTED) {
+        break;
+      }
+
+      // case 3: Successfully connected
+      mA2dpConnected = true;
+      mDeviceAddress = address;
+      NotifyConnectionStatusChanged();
+
+      OnConnect(EmptyString());
+      break;
+    case SinkState::SINK_DISCONNECTED:
+      // case 2: Connection attempt failed
+      if (prevState == SinkState::SINK_CONNECTING) {
+        OnConnect(NS_LITERAL_STRING("A2dpConnectionError"));
+        break;
+      }
+
+      // case 6: Disconnected from the remote device
+      MOZ_ASSERT(prevState == SinkState::SINK_CONNECTED ||
+                 prevState == SinkState::SINK_PLAYING) ;
+
+      mA2dpConnected = false;
+      NotifyConnectionStatusChanged();
+      mDeviceAddress.Truncate();
+      OnDisconnect(EmptyString());
+      break;
+    default:
+      break;
+  }
+}
+
+void
+BluetoothA2dpManager::NotifyConnectionStatusChanged()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+
+  // Notify Gecko observers
+  nsCOMPtr<nsIObserverService> obs = services::GetObserverService();
+  NS_ENSURE_TRUE_VOID(obs);
+
+  if (NS_FAILED(obs->NotifyObservers(this,
+                                     BLUETOOTH_A2DP_STATUS_CHANGED_ID,
+                                     mDeviceAddress.get()))) {
+    BT_WARNING("Failed to notify bluetooth-a2dp-status-changed observsers!");
+  }
+
+  // Dispatch an event of status change
+  DispatchStatusChangedEvent(
+    NS_LITERAL_STRING(A2DP_STATUS_CHANGED_ID), mDeviceAddress, mA2dpConnected);
+}
+
+void
+BluetoothA2dpManager::OnGetServiceChannel(const nsAString& aDeviceAddress,
+                                          const nsAString& aServiceUuid,
+                                          int aChannel)
+{
+}
+
+void
+BluetoothA2dpManager::OnUpdateSdpRecords(const nsAString& aDeviceAddress)
+{
+}
+
+void
+BluetoothA2dpManager::GetAddress(nsAString& aDeviceAddress)
+{
+  aDeviceAddress = mDeviceAddress;
+}
+
+bool
+BluetoothA2dpManager::IsConnected()
+{
+  return mA2dpConnected;
+}
+
+void
+BluetoothA2dpManager::SetAvrcpConnected(bool aConnected)
+{
+  mAvrcpConnected = aConnected;
+  if (!aConnected) {
+    ResetAvrcp();
+  }
+}
+
+bool
+BluetoothA2dpManager::IsAvrcpConnected()
+{
+  return mAvrcpConnected;
+}
+
+void
+BluetoothA2dpManager::UpdateMetaData(const nsAString& aTitle,
+                                     const nsAString& aArtist,
+                                     const nsAString& aAlbum,
+                                     uint32_t aMediaNumber,
+                                     uint32_t aTotalMediaCount,
+                                     uint32_t aDuration)
+{
+  mTitle.Assign(aTitle);
+  mArtist.Assign(aArtist);
+  mAlbum.Assign(aAlbum);
+  mMediaNumber = aMediaNumber;
+  mTotalMediaCount = aTotalMediaCount;
+  mDuration = aDuration;
+}
+
+void
+BluetoothA2dpManager::UpdatePlayStatus(uint32_t aDuration,
+                                       uint32_t aPosition,
+                                       ControlPlayStatus aPlayStatus)
+{
+  mDuration = aDuration;
+  mPosition = aPosition;
+  mPlayStatus = aPlayStatus;
+}
+
+void
+BluetoothA2dpManager::GetAlbum(nsAString& aAlbum)
+{
+    aAlbum.Assign(mAlbum);
+}
+
+uint32_t
+BluetoothA2dpManager::GetDuration()
+{
+  return mDuration;
+}
+
+ControlPlayStatus
+BluetoothA2dpManager::GetPlayStatus()
+{
+  return mPlayStatus;
+}
+
+uint32_t
+BluetoothA2dpManager::GetPosition()
+{
+  return mPosition;
+}
+
+uint32_t
+BluetoothA2dpManager::GetMediaNumber()
+{
+  return mMediaNumber;
+}
+
+void
+BluetoothA2dpManager::GetTitle(nsAString& aTitle)
+{
+  aTitle.Assign(mTitle);
+}
+
+NS_IMPL_ISUPPORTS1(BluetoothA2dpManager, nsIObserver)
+
diff --git a/dom/bluetooth/bluedroid/BluetoothA2dpManager.h b/dom/bluetooth/bluedroid/BluetoothA2dpManager.h
new file mode 100644
index 000000000000..625c7ae1843b
--- /dev/null
+++ b/dom/bluetooth/bluedroid/BluetoothA2dpManager.h
@@ -0,0 +1,90 @@
+/* -*- Mode: c++; c-basic-offset: 2; indent-tabs-mode: nil; tab-width: 40 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_bluetooth_bluetootha2dpmanager_h__
+#define mozilla_dom_bluetooth_bluetootha2dpmanager_h__
+
+#include "BluetoothCommon.h"
+#include "BluetoothProfileController.h"
+#include "BluetoothProfileManagerBase.h"
+
+BEGIN_BLUETOOTH_NAMESPACE
+
+class BluetoothA2dpManager : public BluetoothProfileManagerBase
+{
+public:
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSIOBSERVER
+  BT_DECL_PROFILE_MGR_BASE
+  virtual void GetName(nsACString& aName)
+  {
+    aName.AssignLiteral("A2DP");
+  }
+
+  enum SinkState {
+    SINK_UNKNOWN,
+    SINK_DISCONNECTED,
+    SINK_CONNECTING,
+    SINK_CONNECTED,
+    SINK_PLAYING,
+  };
+
+  static BluetoothA2dpManager* Get();
+  ~BluetoothA2dpManager();
+  void ResetA2dp();
+  void ResetAvrcp();
+
+  // A2DP-specific functions
+  void HandleSinkPropertyChanged(const BluetoothSignal& aSignal);
+
+  // AVRCP-specific functions
+  void SetAvrcpConnected(bool aConnected);
+  bool IsAvrcpConnected();
+  void UpdateMetaData(const nsAString& aTitle,
+                      const nsAString& aArtist,
+                      const nsAString& aAlbum,
+                      uint32_t aMediaNumber,
+                      uint32_t aTotalMediaCount,
+                      uint32_t aDuration);
+  void UpdatePlayStatus(uint32_t aDuration,
+                        uint32_t aPosition,
+                        ControlPlayStatus aPlayStatus);
+  void GetAlbum(nsAString& aAlbum);
+  uint32_t GetDuration();
+  ControlPlayStatus GetPlayStatus();
+  uint32_t GetPosition();
+  uint32_t GetMediaNumber();
+  void GetTitle(nsAString& aTitle);
+
+private:
+  class SinkPropertyChangedHandler;
+  BluetoothA2dpManager();
+  bool Init();
+  void HandleShutdown();
+  void NotifyConnectionStatusChanged();
+
+  nsString mDeviceAddress;
+  nsRefPtr<BluetoothProfileController> mController;
+
+  // A2DP data member
+  bool mA2dpConnected;
+  SinkState mSinkState;
+
+  // AVRCP data member
+  bool mAvrcpConnected;
+  nsString mAlbum;
+  nsString mArtist;
+  nsString mTitle;
+  uint32_t mDuration;
+  uint32_t mMediaNumber;
+  uint32_t mTotalMediaCount;
+  uint32_t mPosition;
+  ControlPlayStatus mPlayStatus;
+};
+
+END_BLUETOOTH_NAMESPACE
+
+#endif
diff --git a/dom/bluetooth/bluedroid/gonk/BluetoothServiceBluedroid.cpp b/dom/bluetooth/bluedroid/gonk/BluetoothServiceBluedroid.cpp
index 41ed23115bd5..60539d03a208 100644
--- a/dom/bluetooth/bluedroid/gonk/BluetoothServiceBluedroid.cpp
+++ b/dom/bluetooth/bluedroid/gonk/BluetoothServiceBluedroid.cpp
@@ -20,12 +20,16 @@
 
 #include <hardware/hardware.h>
 
+#include "bluedroid/BluetoothA2dpManager.h"
+#include "bluedroid/BluetoothHfpManager.h"
 #include "BluetoothProfileController.h"
 #include "BluetoothReplyRunnable.h"
 #include "BluetoothUtils.h"
 #include "BluetoothUuid.h"
 #include "mozilla/dom/bluetooth/BluetoothTypes.h"
 #include "mozilla/ipc/UnixSocket.h"
+#include "mozilla/StaticMutex.h"
+#include "mozilla/StaticPtr.h"
 
 using namespace mozilla;
 using namespace mozilla::ipc;
@@ -75,6 +79,7 @@ static nsTArray<nsRefPtr<BluetoothReplyRunnable> > sGetPairedDeviceRunnableArray
 static nsTArray<nsRefPtr<BluetoothReplyRunnable> > sSetPropertyRunnableArray;
 static nsTArray<nsRefPtr<BluetoothReplyRunnable> > sUnbondingRunnableArray;
 static nsTArray<int> sRequestedDeviceCountArray;
+static StaticAutoPtr<Monitor> sToggleBtMonitor;
 
 /**
  *  Static callback functions
@@ -169,7 +174,7 @@ IsReady()
 const bt_interface_t*
 GetBluetoothInterface()
 {
-  return (IsReady()) ? sBtInterface : nullptr;
+  return sBtInterface;
 }
 
 void
@@ -184,7 +189,7 @@ StringToBdAddressType(const nsAString& aBdAddress,
   }
 }
 
-static void
+void
 BdAddressTypeToString(bt_bdaddr_t* aBdAddressType, nsAString& aRetBdAddress)
 {
   uint8_t* addr = aBdAddressType->address;
@@ -213,6 +218,16 @@ Setup()
   if (ret != BT_STATUS_SUCCESS) {
     BT_LOGR("%s: Fail to set: BT_SCAN_MODE_CONNECTABLE", __FUNCTION__);
   }
+
+  // Event 'AdapterAdded' has to be fired after enabled to notify Gaia
+  // that BluetoothAdapter is ready.
+  BluetoothSignal signal(NS_LITERAL_STRING("AdapterAdded"),
+                         NS_LITERAL_STRING(KEY_MANAGER), true);
+  nsRefPtr<DistributeBluetoothSignalTask>
+    t = new DistributeBluetoothSignalTask(signal);
+  if (NS_FAILED(NS_DispatchToMainThread(t))) {
+    BT_WARNING("Failed to dispatch to main thread!");
+  }
 }
 
 static void
@@ -222,22 +237,15 @@ AdapterStateChangeCallback(bt_state_t aStatus)
 
   BT_LOGR("%s, BT_STATE:%d", __FUNCTION__, aStatus);
 
-  nsAutoString signalName;
-  if (aStatus == BT_STATE_ON) {
-    Setup();
-    sIsBtEnabled = true;
-    signalName = NS_LITERAL_STRING("AdapterAdded");
-  } else {
-    sIsBtEnabled = false;
-    signalName = NS_LITERAL_STRING("Disabled");
+  sIsBtEnabled = (aStatus == BT_STATE_ON);
+
+  {
+    MonitorAutoLock lock(*sToggleBtMonitor);
+    lock.Notify();
   }
 
-  BluetoothSignal signal(signalName, NS_LITERAL_STRING(KEY_MANAGER),
-                         BluetoothValue(true));
-  nsRefPtr<DistributeBluetoothSignalTask>
-    t = new DistributeBluetoothSignalTask(signal);
-  if (NS_FAILED(NS_DispatchToMainThread(t))) {
-    NS_WARNING("Failed to dispatch to main thread!");
+  if (sIsBtEnabled) {
+    Setup();
   }
 }
 
@@ -321,7 +329,7 @@ AdapterPropertiesChangeCallback(bt_status_t aStatus, int aNumProperties,
     nsRefPtr<DistributeBluetoothSignalTask>
       t = new DistributeBluetoothSignalTask(signal);
     if (NS_FAILED(NS_DispatchToMainThread(t))) {
-      NS_WARNING("Failed to dispatch to main thread!");
+      BT_WARNING("Failed to dispatch to main thread!");
     }
 
     // bluedroid BTU task was stored in the task queue, see GKI_send_msg
@@ -447,7 +455,7 @@ DeviceFoundCallback(int aNumProperties, bt_property_t *aProperties)
   nsRefPtr<DistributeBluetoothSignalTask>
     t = new DistributeBluetoothSignalTask(signal);
   if (NS_FAILED(NS_DispatchToMainThread(t))) {
-    NS_WARNING("Failed to dispatch to main thread!");
+    BT_WARNING("Failed to dispatch to main thread!");
   }
 }
 
@@ -491,7 +499,7 @@ PinRequestCallback(bt_bdaddr_t* aRemoteBdAddress,
   nsRefPtr<DistributeBluetoothSignalTask>
     t = new DistributeBluetoothSignalTask(signal);
   if (NS_FAILED(NS_DispatchToMainThread(t))) {
-    NS_WARNING("Failed to dispatch to main thread!");
+    BT_WARNING("Failed to dispatch to main thread!");
   }
 }
 
@@ -524,7 +532,7 @@ SspRequestCallback(bt_bdaddr_t* aRemoteBdAddress, bt_bdname_t* aRemoteBdName,
   nsRefPtr<DistributeBluetoothSignalTask>
     t = new DistributeBluetoothSignalTask(signal);
   if (NS_FAILED(NS_DispatchToMainThread(t))) {
-    NS_WARNING("Failed to dispatch to main thread!");
+    BT_WARNING("Failed to dispatch to main thread!");
   }
 }
 
@@ -629,7 +637,12 @@ EnsureBluetoothHalLoad()
   module->methods->open(module, BT_HARDWARE_MODULE_ID, &device);
   sBtDevice = (bluetooth_device_t *)device;
   sBtInterface = sBtDevice->get_bluetooth_interface();
-  BT_LOGD("Bluetooth HAL loaded");
+
+  int ret = sBtInterface->init(&sBluetoothCallbacks);
+  if (ret != BT_STATUS_SUCCESS) {
+    BT_LOGR("Error while setting the callbacks %s", __FUNCTION__);
+    sBtInterface = nullptr;
+  }
 
   return true;
 }
@@ -639,28 +652,16 @@ StartStopGonkBluetooth(bool aShouldEnable)
 {
   MOZ_ASSERT(!NS_IsMainThread());
 
-  static bool sIsBtInterfaceInitialized = false;
+  NS_ENSURE_TRUE(sBtInterface, NS_ERROR_FAILURE);
+  NS_ENSURE_TRUE(sIsBtEnabled != aShouldEnable, NS_OK);
 
-  if (!EnsureBluetoothHalLoad()) {
-    BT_LOGR("Failed to load bluedroid library.\n");
-    return NS_ERROR_FAILURE;
-  }
-
-  if (sIsBtEnabled == aShouldEnable)
-    return NS_OK;
-
-  if (sBtInterface && !sIsBtInterfaceInitialized) {
-    int ret = sBtInterface->init(&sBluetoothCallbacks);
-    if (ret != BT_STATUS_SUCCESS) {
-      BT_LOGR("Error while setting the callbacks %s", __FUNCTION__);
-      sBtInterface = nullptr;
-      return NS_ERROR_FAILURE;
-    }
-    sIsBtInterfaceInitialized = true;
-  }
   int ret = aShouldEnable ? sBtInterface->enable() : sBtInterface->disable();
+  NS_ENSURE_TRUE(ret == BT_STATUS_SUCCESS, NS_ERROR_FAILURE);
 
-  return (ret == BT_STATUS_SUCCESS) ? NS_OK : NS_ERROR_FAILURE;
+  MonitorAutoLock lock(*sToggleBtMonitor);
+  lock.Wait();
+
+  return NS_OK;
 }
 
 static void
@@ -695,6 +696,26 @@ ReplyStatusError(BluetoothReplyRunnable* aBluetoothReplyRunnable,
 /**
  *  Member functions
  */
+BluetoothServiceBluedroid::BluetoothServiceBluedroid()
+{
+  sToggleBtMonitor = new Monitor("BluetoothService.sToggleBtMonitor");
+
+  if (!EnsureBluetoothHalLoad()) {
+    BT_LOGR("Error! Failed to load bluedroid library.\n");
+    return;
+  }
+
+  // Register all the bluedroid callbacks before enable() get called
+  // It is required to register a2dp callbacks before a2dp media task starts up.
+  BluetoothHfpManager::Get();
+  BluetoothA2dpManager::Get();
+}
+
+BluetoothServiceBluedroid::~BluetoothServiceBluedroid()
+{
+  sToggleBtMonitor = nullptr;
+}
+
 nsresult
 BluetoothServiceBluedroid::StartInternal()
 {
@@ -726,11 +747,6 @@ BluetoothServiceBluedroid::IsEnabledInternal()
 {
   MOZ_ASSERT(!NS_IsMainThread());
 
-  if (!EnsureBluetoothHalLoad()) {
-    NS_ERROR("Failed to load bluedroid library.\n");
-    return false;
-  }
-
   return sIsBtEnabled;
 }
 
@@ -1170,13 +1186,6 @@ BluetoothServiceBluedroid::Connect(const nsAString& aDeviceAddress,
                                    uint16_t aServiceUuid,
                                    BluetoothReplyRunnable* aRunnable)
 {
-  // TODO: Remove this error reply once Connect() is done in profile managers
-  if (aRunnable) {
-    DispatchBluetoothReply(aRunnable, BluetoothValue(),
-                           NS_LITERAL_STRING(ERR_CONNECTION_FAILED));
-    return;
-  }
-
   ConnectDisconnect(true, aDeviceAddress, aRunnable, aServiceUuid, aCod);
 }
 
@@ -1191,13 +1200,6 @@ BluetoothServiceBluedroid::Disconnect(
   const nsAString& aDeviceAddress, uint16_t aServiceUuid,
   BluetoothReplyRunnable* aRunnable)
 {
-  // TODO: Remove this error reply once Disconnect() is done in profile managers
-  if (aRunnable) {
-    DispatchBluetoothReply(aRunnable, BluetoothValue(),
-                           NS_LITERAL_STRING(ERR_CONNECTION_FAILED));
-    return;
-  }
-
   ConnectDisconnect(false, aDeviceAddress, aRunnable, aServiceUuid);
 }
 
diff --git a/dom/bluetooth/bluedroid/gonk/BluetoothServiceBluedroid.h b/dom/bluetooth/bluedroid/gonk/BluetoothServiceBluedroid.h
index 306b0a36e1a6..9a3f228f9583 100644
--- a/dom/bluetooth/bluedroid/gonk/BluetoothServiceBluedroid.h
+++ b/dom/bluetooth/bluedroid/gonk/BluetoothServiceBluedroid.h
@@ -20,14 +20,18 @@ GetBluetoothInterface();
 void
 StringToBdAddressType(const nsAString& aBdAddress,
                       bt_bdaddr_t *aRetBdAddressType);
-
-class DBusMessage;
+void
+BdAddressTypeToString(bt_bdaddr_t* aBdAddressType,
+                      nsAString& aRetBdAddress);
 
 BEGIN_BLUETOOTH_NAMESPACE
 
 class BluetoothServiceBluedroid : public BluetoothService
 {
 public:
+  BluetoothServiceBluedroid();
+  ~BluetoothServiceBluedroid();
+
   virtual nsresult StartInternal();
   virtual nsresult StopInternal();
   virtual bool IsEnabledInternal();
diff --git a/dom/bluetooth/BluetoothA2dpManager.cpp b/dom/bluetooth/bluez/BluetoothA2dpManager.cpp
similarity index 100%
rename from dom/bluetooth/BluetoothA2dpManager.cpp
rename to dom/bluetooth/bluez/BluetoothA2dpManager.cpp
diff --git a/dom/bluetooth/BluetoothA2dpManager.h b/dom/bluetooth/bluez/BluetoothA2dpManager.h
similarity index 100%
rename from dom/bluetooth/BluetoothA2dpManager.h
rename to dom/bluetooth/bluez/BluetoothA2dpManager.h
diff --git a/dom/bluetooth/moz.build b/dom/bluetooth/moz.build
index 304443e5674b..4b4451ca9369 100644
--- a/dom/bluetooth/moz.build
+++ b/dom/bluetooth/moz.build
@@ -7,9 +7,7 @@
 if CONFIG['MOZ_B2G_BT']:
     PARALLEL_DIRS += ['interfaces']
 
-
     SOURCES += [
-        'BluetoothA2dpManager.cpp',
         'BluetoothAdapter.cpp',
         'BluetoothDevice.cpp',
         'BluetoothHidManager.cpp',
@@ -37,6 +35,7 @@ if CONFIG['MOZ_B2G_BT']:
     if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'gonk':
         if CONFIG['MOZ_B2G_BT_BLUEZ']:
             SOURCES += [
+                'bluez/BluetoothA2dpManager.cpp',
                 'bluez/BluetoothHfpManager.cpp',
                 'bluez/gonk/BluetoothGonkService.cpp',
                 'bluez/linux/BluetoothDBusService.cpp',
@@ -48,6 +47,7 @@ if CONFIG['MOZ_B2G_BT']:
             ]
         elif CONFIG['MOZ_B2G_BT_BLUEDROID']:
             SOURCES += [
+                'bluedroid/BluetoothA2dpManager.cpp',
                 'bluedroid/BluetoothHfpManager.cpp',
                 'bluedroid/gonk/BluetoothServiceBluedroid.cpp',
             ]
diff --git a/dom/camera/DOMCameraManager.h b/dom/camera/DOMCameraManager.h
index ad5890c9538a..5758a475fd42 100644
--- a/dom/camera/DOMCameraManager.h
+++ b/dom/camera/DOMCameraManager.h
@@ -85,7 +85,7 @@ protected:
    * 'mActiveWindows' is only ever accessed while in the main thread,
    * so it is not otherwise protected.
    */
-  static WindowTable* sActiveWindows;
+  static ::WindowTable* sActiveWindows;
 };
 
 class GetCameraTask : public nsRunnable
diff --git a/dom/contacts/ContactManager.js b/dom/contacts/ContactManager.js
index 5cc196d3ce6b..8042325cfde4 100644
--- a/dom/contacts/ContactManager.js
+++ b/dom/contacts/ContactManager.js
@@ -811,6 +811,7 @@ ContactManager.prototype = {
   classID: Components.ID("{8beb3a66-d70a-4111-b216-b8e995ad3aff}"),
   contractID: "@mozilla.org/contactManager;1",
   QueryInterface: XPCOMUtils.generateQI([Ci.nsISupportsWeakReference,
+                                         Ci.nsIObserver,
                                          Ci.nsIDOMGlobalPropertyInitializer]),
 };
 
diff --git a/dom/icc/interfaces/nsIDOMIccManager.idl b/dom/icc/interfaces/nsIDOMIccManager.idl
index e717c063b191..f1c8ec69dab8 100644
--- a/dom/icc/interfaces/nsIDOMIccManager.idl
+++ b/dom/icc/interfaces/nsIDOMIccManager.idl
@@ -3,17 +3,14 @@
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "nsIDOMEventTarget.idl"
-#include "SimToolKit.idl"
 
-interface nsIDOMDOMRequest;
-interface nsIDOMEventListener;
-interface nsIDOMMozIccInfo;
+interface nsIDOMMozIcc;
 
-[scriptable, builtinclass, uuid(50782fe0-4185-4471-a374-e362b73febdb)]
+[scriptable, builtinclass, uuid(23067d6f-e0cb-4f34-8648-77c2b25a11f5)]
 interface nsIDOMMozIccManager : nsIDOMEventTarget
 {
   /**
-   * STK Menu Presentation types.
+   * STK menu presentation types.
    */
   const unsigned short STK_MENU_TYPE_NOT_SPECIFIED      = 0x00;
   const unsigned short STK_MENU_TYPE_DATA_VALUES        = 0x01;
@@ -27,7 +24,7 @@ interface nsIDOMMozIccManager : nsIDOMEventTarget
   const unsigned short STK_BROWSER_MODE_USING_NEW_BROWSER              = 0x03;
 
   /**
-   * STK Proactive commands.
+   * STK proactive commands.
    *
    * @see TS 11.14, clause 13.4
    */
@@ -56,7 +53,7 @@ interface nsIDOMMozIccManager : nsIDOMEventTarget
   const unsigned short STK_CMD_SEND_DATA             = 0x33;
 
   /**
-   * STK Result code.
+   * STK result code.
    *
    * @see TS 11.14, clause 12.12
    *
@@ -128,7 +125,7 @@ interface nsIDOMMozIccManager : nsIDOMEventTarget
   /** Command number not known by terminal */
   const unsigned short STK_RESULT_CMD_NUM_NOT_KNOWN                 = 0x33;
 
-  /** SS Return Error */
+  /** SS return error */
   const unsigned short STK_RESULT_SS_RETURN_ERROR                   = 0x34;
 
   /** SMS RP-ERROR */
@@ -137,7 +134,7 @@ interface nsIDOMMozIccManager : nsIDOMEventTarget
   /** Error, required values are missing */
   const unsigned short STK_RESULT_REQUIRED_VALUES_MISSING           = 0x36;
 
-  /** USSD Return Error */
+  /** USSD return error */
   const unsigned short STK_RESULT_USSD_RETURN_ERROR                 = 0x37;
 
   /** MultipleCard commands error */
@@ -145,40 +142,40 @@ interface nsIDOMMozIccManager : nsIDOMEventTarget
 
   /**
    * Interaction with call control by USIM or MO short message control by
-   * USIM, permanent problem
+   * USIM, permanent problem.
    */
   const unsigned short STK_RESULT_USIM_CALL_CONTROL_PERMANENT       = 0x39;
 
-  /** Bearer Independent Protocol error */
+  /** Bearer independent protocol error */
   const unsigned short STK_RESULT_BIP_ERROR                         = 0x3a;
 
   /**
-   * STK Event List
+   * STK event list.
    */
-   const unsigned short STK_EVENT_TYPE_MT_CALL                          = 0x00;
-   const unsigned short STK_EVENT_TYPE_CALL_CONNECTED                   = 0x01;
-   const unsigned short STK_EVENT_TYPE_CALL_DISCONNECTED                = 0x02;
-   const unsigned short STK_EVENT_TYPE_LOCATION_STATUS                  = 0x03;
-   const unsigned short STK_EVENT_TYPE_USER_ACTIVITY                    = 0x04;
-   const unsigned short STK_EVENT_TYPE_IDLE_SCREEN_AVAILABLE            = 0x05;
-   const unsigned short STK_EVENT_TYPE_CARD_READER_STATUS               = 0x06;
-   const unsigned short STK_EVENT_TYPE_LANGUAGE_SELECTION               = 0x07;
-   const unsigned short STK_EVENT_TYPE_BROWSER_TERMINATION              = 0x08;
-   const unsigned short STK_EVENT_TYPE_DATA_AVAILABLE                   = 0x09;
-   const unsigned short STK_EVENT_TYPE_CHANNEL_STATUS                   = 0x0a;
-   const unsigned short STK_EVENT_TYPE_SINGLE_ACCESS_TECHNOLOGY_CHANGED = 0x0b;
-   const unsigned short STK_EVENT_TYPE_DISPLAY_PARAMETER_CHANGED        = 0x0c;
-   const unsigned short STK_EVENT_TYPE_LOCAL_CONNECTION                 = 0x0d;
-   const unsigned short STK_EVENT_TYPE_NETWORK_SEARCH_MODE_CHANGED      = 0x0e;
-   const unsigned short STK_EVENT_TYPE_BROWSING_STATUS                  = 0x0f;
-   const unsigned short STK_EVENT_TYPE_FRAMES_INFORMATION_CHANGED       = 0x10;
+  const unsigned short STK_EVENT_TYPE_MT_CALL                          = 0x00;
+  const unsigned short STK_EVENT_TYPE_CALL_CONNECTED                   = 0x01;
+  const unsigned short STK_EVENT_TYPE_CALL_DISCONNECTED                = 0x02;
+  const unsigned short STK_EVENT_TYPE_LOCATION_STATUS                  = 0x03;
+  const unsigned short STK_EVENT_TYPE_USER_ACTIVITY                    = 0x04;
+  const unsigned short STK_EVENT_TYPE_IDLE_SCREEN_AVAILABLE            = 0x05;
+  const unsigned short STK_EVENT_TYPE_CARD_READER_STATUS               = 0x06;
+  const unsigned short STK_EVENT_TYPE_LANGUAGE_SELECTION               = 0x07;
+  const unsigned short STK_EVENT_TYPE_BROWSER_TERMINATION              = 0x08;
+  const unsigned short STK_EVENT_TYPE_DATA_AVAILABLE                   = 0x09;
+  const unsigned short STK_EVENT_TYPE_CHANNEL_STATUS                   = 0x0a;
+  const unsigned short STK_EVENT_TYPE_SINGLE_ACCESS_TECHNOLOGY_CHANGED = 0x0b;
+  const unsigned short STK_EVENT_TYPE_DISPLAY_PARAMETER_CHANGED        = 0x0c;
+  const unsigned short STK_EVENT_TYPE_LOCAL_CONNECTION                 = 0x0d;
+  const unsigned short STK_EVENT_TYPE_NETWORK_SEARCH_MODE_CHANGED      = 0x0e;
+  const unsigned short STK_EVENT_TYPE_BROWSING_STATUS                  = 0x0f;
+  const unsigned short STK_EVENT_TYPE_FRAMES_INFORMATION_CHANGED       = 0x10;
 
-   /**
-    * The service state of STK Location Status.
-    */
-   const unsigned short STK_SERVICE_STATE_NORMAL      = 0x00;
-   const unsigned short STK_SERVICE_STATE_LIMITED     = 0x01;
-   const unsigned short STK_SERVICE_STATE_UNAVAILABLE = 0x02;
+  /**
+   * The service state of STK location status.
+   */
+  const unsigned short STK_SERVICE_STATE_NORMAL      = 0x00;
+  const unsigned short STK_SERVICE_STATE_LIMITED     = 0x01;
+  const unsigned short STK_SERVICE_STATE_UNAVAILABLE = 0x02;
 
   /**
    * Tone type.
@@ -196,14 +193,14 @@ interface nsIDOMMozIccManager : nsIDOMEventTarget
   const unsigned short STK_TONE_TYPE_NEGATIVE_ACK_TONE        = 0x12;
 
   /**
-   * Time unit
+   * Time unit.
    */
   const unsigned short STK_TIME_UNIT_MINUTE       = 0x00;
   const unsigned short STK_TIME_UNIT_SECOND       = 0x01;
   const unsigned short STK_TIME_UNIT_TENTH_SECOND = 0x02;
 
   /**
-   * Local Information list
+   * Local Information list.
    *
    * @see TS 102.223, clause 8.6
    */
@@ -212,345 +209,41 @@ interface nsIDOMMozIccManager : nsIDOMEventTarget
   const unsigned short STK_LOCAL_INFO_DATE_TIME_ZONE = 0x03;
   const unsigned short STK_LOCAL_INFO_LANGUAGE       = 0x04;
 
-   /**
-   * Timer Management
+  /**
+   * Timer management.
    */
   const unsigned short STK_TIMER_START             = 0x00;
   const unsigned short STK_TIMER_DEACTIVATE        = 0x01;
   const unsigned short STK_TIMER_GET_CURRENT_VALUE = 0x02;
 
   /**
-   * Browser Termination Cause
+   * Browser termination cause.
    */
   const unsigned short STK_BROWSER_TERMINATION_CAUSE_USER  = 0x00;
   const unsigned short STK_BROWSER_TERMINATION_CAUSE_ERROR = 0x01;
 
   /**
-   * Send the response back to ICC after an attempt to execute STK Proactive
-   * Command.
-   *
-   * @param command
-   *        Command received from ICC. See MozStkCommand.
-   * @param response
-   *        The response that will be sent to ICC.
-   * @see MozStkResponse for the detail of response.
+   * Array of iccIds that are currently detected.
    */
-  void sendStkResponse(in jsval command, in jsval response);
+  readonly attribute jsval iccIds;  // DOMString[]
 
   /**
-   * Send the "Menu Selection" Envelope command to ICC for menu selection.
+   * Get ICC object by iccId.
    *
-   * @param itemIdentifier
-   *        The identifier of the item selected by user.
-   * @param helpRequested
-   *        true if user requests to provide help information, false otherwise.
+   * @param iccId
+   *        The identifier of the ICC.
+   *
+   * @return see MozIcc.webidl for the detail.
    */
-  void sendStkMenuSelection(in unsigned short itemIdentifier,
-                            in boolean        helpRequested);
+  nsISupports getIccById(in DOMString iccId);
 
   /**
-   * Send the "Timer Expiration" Envelope command to ICC for TIMER MANAGEMENT.
-   *
-   * @param timer
-   *        The identifier and value for a timer.
-   *        timerId: Identifier of the timer that has expired.
-   *        timerValue: Different between the time when this command is issued
-   *                    and when the timer was initially started.
-   *        @see MozStkTimer
+   * 'oniccdetected' event is notified whenever a new ICC is detected.
    */
-  void sendStkTimerExpiration(in jsval timer);
+  [implicit_jscontext] attribute jsval oniccdetected;
 
   /**
-   * Send "Event Download" Envelope command to ICC.
-   * ICC will not respond with any data for this command.
-   *
-   * @param event
-   *        one of events below:
-   *        - MozStkLocationEvent
-   *        - MozStkCallEvent
-   *        - MozStkLanguageSelectionEvent
-   *        - MozStkGeneralEvent
-   *        - MozStkBrowserTerminationEvent
+   * 'oniccundetected' event is notified whenever an ICC becomes undetected.
    */
-  void sendStkEventDownload(in jsval event);
-
-  /**
-   * The 'stkcommand' event is notified whenever STK Proactive Command is
-   * issued from ICC.
-   */
-  [implicit_jscontext] attribute jsval onstkcommand;
-
-  /**
-   * 'stksessionend' event is notified whenever STK Session is terminated by
-   * ICC.
-   */
-  [implicit_jscontext] attribute jsval onstksessionend;
-
-  // UICC Card Information.
-
-  /**
-   * Information stored in the device's ICC card.
-   *
-   * Null if the card is not detected.
-   */
-  readonly attribute nsIDOMMozIccInfo iccInfo;
-
-  /**
-   * The 'iccinfochange' event is notified whenever the icc info object
-   * changes.
-   */
-  [implicit_jscontext] attribute jsval oniccinfochange;
-
-  // UICC Card State.
-
-  /**
-   * Indicates the state of the device's ICC card.
-   *
-   * Possible values: null, 'illegal', 'unknown', 'absent', 'pinRequired',
-   * 'pukRequired', 'personalizationInProgress', 'networkLocked',
-   * 'corporateLocked', 'serviceProviderLocked', 'networkPukRequired',
-   * 'corporatePukRequired', 'serviceProviderPukRequired',
-   * 'personalizationReady', 'ready', 'permanentBlocked'.
-   */
-  readonly attribute DOMString cardState;
-
-  /**
-   * The 'cardstatechange' event is notified when the 'cardState' attribute
-   * changes value.
-   */
-  [implicit_jscontext] attribute jsval oncardstatechange;
-
-  // UICC Card Lock interfaces.
-
-  /**
-   * Find out about the status of an ICC lock (e.g. the PIN lock).
-   *
-   * @param lockType
-   *        Identifies the lock type, e.g. "pin" for the PIN lock, "fdn" for
-   *        the FDN lock.
-   *
-   * @return a DOM Request.
-   *         The request's result will be an object containing
-   *         information about the specified lock's status,
-   *         e.g. {lockType: "pin", enabled: true}.
-   */
-  nsIDOMDOMRequest getCardLock(in DOMString lockType);
-
-  /**
-   * Unlock a card lock.
-   *
-   * @param info
-   *        An object containing the information necessary to unlock
-   *        the given lock. At a minimum, this object must have a
-   *        "lockType" attribute which specifies the type of lock, e.g.
-   *        "pin" for the PIN lock. Other attributes are dependent on
-   *        the lock type.
-   *
-   * Examples:
-   *
-   * (1) Unlocking the PIN:
-   *
-   *   unlockCardLock({lockType: "pin",
-   *                   pin: "..."});
-   *
-   * (2) Unlocking the PUK and supplying a new PIN:
-   *
-   *   unlockCardLock({lockType: "puk",
-   *                   puk: "...",
-   *                   newPin: "..."});
-   *
-   * (3) Network depersonalization. Unlocking the network control key (NCK).
-   *
-   *   unlockCardLock({lockType: "nck",
-   *                   pin: "..."});
-   *
-   * (4) Corporate depersonalization. Unlocking the corporate control key (CCK).
-   *
-   *   unlockCardLock({lockType: "cck",
-   *                   pin: "..."});
-   *
-   * (5) Service Provider depersonalization. Unlocking the service provider
-   *     control key (SPCK).
-   *
-   *   unlockCardLock({lockType: "spck",
-   *                   pin: "..."});
-   *
-   * (6) Network PUK depersonalization. Unlocking the network control key (NCK).
-   *
-   *   unlockCardLock({lockType: "nckPuk",
-   *                   puk: "..."});
-   *
-   * (7) Corporate PUK depersonalization. Unlocking the corporate control key
-   *     (CCK).
-   *
-   *   unlockCardLock({lockType: "cckPuk",
-   *                   puk: "..."});
-   *
-   * (8) Service Provider PUK depersonalization. Unlocking the service provider
-   *     control key (SPCK).
-   *
-   *   unlockCardLock({lockType: "spckPuk",
-   *                   puk: "..."});
-   *
-   * @return a nsIDOMDOMRequest.
-   *         The request's result will be an object containing
-   *         information about the unlock operation.
-   *
-   * Examples:
-   *
-   * (1) Unlocking failed:
-   *
-   *     {
-   *       lockType:   "pin",
-   *       success:    false,
-   *       retryCount: 2
-   *     }
-   *
-   * (2) Unlocking succeeded:
-   *
-   *     {
-   *       lockType:  "pin",
-   *       success:   true
-   *     }
-   */
-  nsIDOMDOMRequest unlockCardLock(in jsval info);
-
-  /**
-   * Modify the state of a card lock.
-   *
-   * @param info
-   *        An object containing information about the lock and
-   *        how to modify its state. At a minimum, this object
-   *        must have a "lockType" attribute which specifies the
-   *        type of lock, e.g. "pin" for the PIN lock. Other
-   *        attributes are dependent on the lock type.
-   *
-   * Examples:
-   *
-   * (1a) Disabling the PIN lock:
-   *
-   *   setCardLock({lockType: "pin",
-   *                pin: "...",
-   *                enabled: false});
-   *
-   * (1b) Disabling the FDN lock:
-   *
-   *   setCardLock({lockType: "fdn",
-   *                pin2: "...",
-   *                enabled: false});
-   *
-   * (2) Changing the PIN:
-   *
-   *   setCardLock({lockType: "pin",
-   *                pin: "...",
-   *                newPin: "..."});
-   *
-   * @return a nsIDOMDOMRequest.
-   *         The request's result will be an object containing
-   *         information about the operation.
-   *
-   * Examples:
-   *
-   * (1) Enabling/Disabling card lock failed or change card lock failed.
-   *
-   *     {
-   *       lockType: "pin",
-   *       success: false,
-   *       retryCount: 2
-   *     }
-   *
-   * (2) Enabling/Disabling card lock succeed or change card lock succeed.
-   *
-   *     {
-   *       lockType: "pin",
-   *       success: true
-   *     }
-   */
-  nsIDOMDOMRequest setCardLock(in jsval info);
-
-  /**
-   * Retrieve the number of remaining tries for unlocking the card.
-   *
-   * @param lockType
-   *        Identifies the lock type, e.g. "pin" for the PIN lock, "puk" for
-   *        the PUK lock.
-   *
-   * @return a DOM Request.
-   *         If the lock type is "pin", or "puk", the request's result will be
-   *         an object containing the number of retries for the specified
-   *         lock. For any other lock type, the result is undefined.
-   */
-  nsIDOMDOMRequest getCardLockRetryCount(in DOMString lockType);
-
-  // UICC Phonebook Interfaces.
-
-  /**
-   * Read ICC contacts.
-   *
-   * @param contactType
-   *        One of type as below,
-   *        - 'adn': Abbreviated Dialling Number
-   *        - 'fdn': Fixed Dialling Number
-   */
-  nsIDOMDOMRequest readContacts(in DOMString contactType);
-
-  /**
-   * Update ICC Phonebook contact.
-   *
-   * @param contactType
-   *        One of type as below,
-   *        - 'adn': Abbreviated Dialling Number
-   *        - 'fdn': Fixed Dialling Number
-   * @param contact
-   *        The contact will be updated in ICC
-   * @param [optional] pin2
-   *        PIN2 is only required for 'fdn'.
-   */
-  nsIDOMDOMRequest updateContact(in DOMString contactType,
-                                 in jsval contact,
-                                 [optional] in DOMString pin2);
-
-  // End of UICC Phonebook Interfaces.
-
-  // UICC Secure Element Interfaces
-
-  /**
-   * A secure element is a smart card chip that can hold
-   * several different applications with the necessary security.
-   * The most known secure element is the Universal Integrated Circuit Card (UICC)
-   */
-
-  /**
-   * Send request to open a logical channel defined by its
-   * application identifier (AID)
-   *
-   * @param aid
-   *        The Application Identifier of the Applet to be selected on this channel
-   * return value : An instance of Channel (channelID) if available or null.
-   */
-  nsIDOMDOMRequest iccOpenChannel(in DOMString aid);
-
-  /**
-   * Interface, used to communicate with an applet through the
-   * Application Data Protocol Units (APDUs) and is
-   * used for all data that is exchanged between the UICC card and the terminal (ME).
-   *
-   * @param channel
-   *        The Application Identifier of the Applet to which APDU is directed
-   * @param apdu
-   *        Application Protocol Data Unit
-   * return value : Response APDU
-   */
-  nsIDOMDOMRequest iccExchangeAPDU(in long channel, in jsval apdu);
-
-  /**
-   * Send request to close the selected logical channel identified by its
-   * application identifier (AID)
-   *
-   * @param aid
-   *        The Application Identifier of the Applet , to be closed
-   */
-  nsIDOMDOMRequest iccCloseChannel(in long channel);
-
-  // End of UICC Secure Element Interfaces
+  [implicit_jscontext] attribute jsval oniccundetected;
 };
diff --git a/dom/icc/src/Icc.cpp b/dom/icc/src/Icc.cpp
new file mode 100644
index 000000000000..f757826af3d6
--- /dev/null
+++ b/dom/icc/src/Icc.cpp
@@ -0,0 +1,358 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "Icc.h"
+
+#include "mozilla/dom/MozIccBinding.h"
+#include "mozilla/dom/MozStkCommandEvent.h"
+#include "nsIDOMDOMRequest.h"
+#include "nsIDOMIccInfo.h"
+#include "nsJSON.h"
+#include "nsRadioInterfaceLayer.h"
+#include "nsServiceManagerUtils.h"
+
+using namespace mozilla::dom;
+
+Icc::Icc(nsPIDOMWindow* aWindow, long aClientId, const nsAString& aIccId)
+  : mLive(true)
+  , mClientId(aClientId)
+  , mIccId(aIccId)
+{
+  SetIsDOMBinding();
+  BindToOwner(aWindow);
+
+  mProvider = do_GetService(NS_RILCONTENTHELPER_CONTRACTID);
+
+  // Not being able to acquire the provider isn't fatal since we check
+  // for it explicitly below.
+  if (!mProvider) {
+    NS_WARNING("Could not acquire nsIIccProvider!");
+  }
+}
+
+void
+Icc::Shutdown()
+{
+  mProvider = nullptr;
+  mLive = false;
+}
+
+nsresult
+Icc::NotifyEvent(const nsAString& aName)
+{
+  return DispatchTrustedEvent(aName);
+}
+
+nsresult
+Icc::NotifyStkEvent(const nsAString& aName, const nsAString& aMessage)
+{
+  nsresult rv;
+  nsIScriptContext* sc = GetContextForEventHandlers(&rv);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  AutoPushJSContext cx(sc->GetNativeContext());
+  JS::Rooted<JS::Value> value(cx);
+
+  if (!aMessage.IsEmpty()) {
+    nsCOMPtr<nsIJSON> json(new nsJSON());
+    nsresult rv = json->DecodeToJSVal(aMessage, cx, value.address());
+    NS_ENSURE_SUCCESS(rv, rv);
+  } else {
+    value = JS::NullValue();
+  }
+
+  MozStkCommandEventInit init;
+  init.mBubbles = false;
+  init.mCancelable = false;
+  init.mCommand = value;
+
+  nsRefPtr<MozStkCommandEvent> event =
+    MozStkCommandEvent::Constructor(this, aName, init);
+
+  return DispatchTrustedEvent(event);
+}
+
+// WrapperCache
+
+JSObject*
+Icc::WrapObject(JSContext* aCx, JS::Handle<JSObject*> aScope)
+{
+  return MozIccBinding::Wrap(aCx, aScope, this);
+}
+
+// MozIcc WebIDL
+
+already_AddRefed<nsIDOMMozIccInfo>
+Icc::GetIccInfo() const
+{
+  if (!mProvider) {
+    return nullptr;
+  }
+
+  nsCOMPtr<nsIDOMMozIccInfo> iccInfo;
+  nsresult rv = mProvider->GetIccInfo(mClientId, getter_AddRefs(iccInfo));
+  if (NS_FAILED(rv)) {
+    return nullptr;
+  }
+
+  return iccInfo.forget();
+}
+
+void
+Icc::GetCardState(nsString& aCardState) const
+{
+  aCardState.SetIsVoid(true);
+
+  if (!mProvider) {
+    return;
+  }
+
+  nsresult rv = mProvider->GetCardState(mClientId, aCardState);
+  if (NS_FAILED(rv)) {
+    aCardState.SetIsVoid(true);
+  }
+}
+
+void
+Icc::SendStkResponse(const JSContext* aCx, const JS::Value& aCommand,
+                     const JS::Value& aResponse, ErrorResult& aRv)
+{
+  if (!mProvider) {
+    aRv.Throw(NS_ERROR_FAILURE);
+    return;
+  }
+
+  nsresult rv = mProvider->SendStkResponse(mClientId, GetOwner(), aCommand,
+                                           aResponse);
+  if (NS_FAILED(rv)) {
+    aRv.Throw(rv);
+  }
+}
+
+void
+Icc::SendStkMenuSelection(uint16_t aItemIdentifier, bool aHelpRequested,
+                          ErrorResult& aRv)
+{
+  if (!mProvider) {
+    aRv.Throw(NS_ERROR_FAILURE);
+    return;
+  }
+
+  nsresult rv = mProvider->SendStkMenuSelection(mClientId,
+                                                GetOwner(),
+                                                aItemIdentifier,
+                                                aHelpRequested);
+  if (NS_FAILED(rv)) {
+    aRv.Throw(rv);
+  }
+}
+
+void
+Icc::SendStkTimerExpiration(const JSContext* aCx, const JS::Value& aTimer,
+                            ErrorResult& aRv)
+{
+  if (!mProvider) {
+    aRv.Throw(NS_ERROR_FAILURE);
+    return;
+  }
+
+  nsresult rv = mProvider->SendStkTimerExpiration(mClientId, GetOwner(),
+                                                  aTimer);
+  if (NS_FAILED(rv)) {
+    aRv.Throw(rv);
+  }
+}
+
+void
+Icc::SendStkEventDownload(const JSContext* aCx, const JS::Value& aEvent,
+                          ErrorResult& aRv)
+{
+  if (!mProvider) {
+    aRv.Throw(NS_ERROR_FAILURE);
+    return;
+  }
+
+  nsresult rv = mProvider->SendStkEventDownload(mClientId, GetOwner(), aEvent);
+  if (NS_FAILED(rv)) {
+    aRv.Throw(rv);
+  }
+}
+
+already_AddRefed<nsISupports>
+Icc::GetCardLock(const nsAString& aLockType, ErrorResult& aRv)
+{
+  if (!mProvider) {
+    aRv.Throw(NS_ERROR_FAILURE);
+    return nullptr;
+  }
+
+  nsRefPtr<nsIDOMDOMRequest> request;
+  nsresult rv = mProvider->GetCardLockState(mClientId, GetOwner(), aLockType,
+                                            getter_AddRefs(request));
+  if (NS_FAILED(rv)) {
+    aRv.Throw(rv);
+    return nullptr;
+  }
+
+  return request.forget();
+}
+
+already_AddRefed<nsISupports>
+Icc::UnlockCardLock(const JSContext* aCx, const JS::Value& aInfo,
+                    ErrorResult& aRv)
+{
+  if (!mProvider) {
+    aRv.Throw(NS_ERROR_FAILURE);
+    return nullptr;
+  }
+
+  nsRefPtr<nsIDOMDOMRequest> request;
+  nsresult rv = mProvider->UnlockCardLock(mClientId, GetOwner(), aInfo,
+                                          getter_AddRefs(request));
+  if (NS_FAILED(rv)) {
+    aRv.Throw(rv);
+    return nullptr;
+  }
+
+  return request.forget();
+}
+
+already_AddRefed<nsISupports>
+Icc::SetCardLock(const JSContext* aCx, const JS::Value& aInfo, ErrorResult& aRv)
+{
+  if (!mProvider) {
+    aRv.Throw(NS_ERROR_FAILURE);
+    return nullptr;
+  }
+
+  nsRefPtr<nsIDOMDOMRequest> request;
+  nsresult rv = mProvider->SetCardLock(mClientId, GetOwner(), aInfo,
+                                       getter_AddRefs(request));
+  if (NS_FAILED(rv)) {
+    aRv.Throw(rv);
+    return nullptr;
+  }
+
+  return request.forget();
+}
+
+already_AddRefed<nsISupports>
+Icc::GetCardLockRetryCount(const nsAString& aLockType, ErrorResult& aRv)
+{
+  if (!mProvider) {
+    aRv.Throw(NS_ERROR_FAILURE);
+    return nullptr;
+  }
+
+  nsRefPtr<nsIDOMDOMRequest> request;
+  nsresult rv = mProvider->GetCardLockRetryCount(mClientId,
+                                                 GetOwner(),
+                                                 aLockType,
+                                                 getter_AddRefs(request));
+  if (NS_FAILED(rv)) {
+    aRv.Throw(rv);
+    return nullptr;
+  }
+
+  return request.forget();
+}
+
+already_AddRefed<nsISupports>
+Icc::ReadContacts(const nsAString& aContactType, ErrorResult& aRv)
+{
+  if (!mProvider) {
+    aRv.Throw(NS_ERROR_FAILURE);
+    return nullptr;
+  }
+
+  nsRefPtr<nsIDOMDOMRequest> request;
+  nsresult rv = mProvider->ReadContacts(mClientId, GetOwner(), aContactType,
+                                        getter_AddRefs(request));
+  if (NS_FAILED(rv)) {
+    aRv.Throw(rv);
+    return nullptr;
+  }
+
+  return request.forget();
+}
+
+already_AddRefed<nsISupports>
+Icc::UpdateContact(const JSContext* aCx, const nsAString& aContactType,
+                   const JS::Value& aContact, const nsAString& aPin2,
+                   ErrorResult& aRv)
+{
+  if (!mProvider) {
+    aRv.Throw(NS_ERROR_FAILURE);
+    return nullptr;
+  }
+
+  nsRefPtr<nsIDOMDOMRequest> request;
+  nsresult rv = mProvider->UpdateContact(mClientId, GetOwner(), aContactType,
+                                         aContact, aPin2,
+                                         getter_AddRefs(request));
+  if (NS_FAILED(rv)) {
+    aRv.Throw(rv);
+    return nullptr;
+  }
+
+  return request.forget();
+}
+
+already_AddRefed<nsISupports>
+Icc::IccOpenChannel(const nsAString& aAid, ErrorResult& aRv)
+{
+  if (!mProvider) {
+    aRv.Throw(NS_ERROR_FAILURE);
+    return nullptr;
+  }
+
+  nsRefPtr<nsIDOMDOMRequest> request;
+  nsresult rv = mProvider->IccOpenChannel(mClientId, GetOwner(), aAid,
+                                          getter_AddRefs(request));
+  if (NS_FAILED(rv)) {
+    aRv.Throw(rv);
+    return nullptr;
+  }
+
+  return request.forget();
+}
+
+already_AddRefed<nsISupports>
+Icc::IccExchangeAPDU(const JSContext* aCx, int32_t aChannel, const jsval& aApdu,
+                     ErrorResult& aRv)
+{
+  if (!mProvider) {
+    aRv.Throw(NS_ERROR_FAILURE);
+    return nullptr;
+  }
+
+  nsRefPtr<nsIDOMDOMRequest> request;
+  nsresult rv = mProvider->IccExchangeAPDU(mClientId, GetOwner(), aChannel,
+                                           aApdu, getter_AddRefs(request));
+  if (NS_FAILED(rv)) {
+    aRv.Throw(rv);
+    return nullptr;
+  }
+
+  return request.forget();
+}
+
+already_AddRefed<nsISupports>
+Icc::IccCloseChannel(int32_t aChannel, ErrorResult& aRv)
+{
+  if (!mProvider) {
+    aRv.Throw(NS_ERROR_FAILURE);
+    return nullptr;
+  }
+
+  nsRefPtr<nsIDOMDOMRequest> request;
+  nsresult rv = mProvider->IccCloseChannel(mClientId, GetOwner(), aChannel,
+                                           getter_AddRefs(request));
+  if (NS_FAILED(rv)) {
+    aRv.Throw(rv);
+    return nullptr;
+  }
+
+  return request.forget();
+}
diff --git a/dom/icc/src/Icc.h b/dom/icc/src/Icc.h
new file mode 100644
index 000000000000..0c3fc0285261
--- /dev/null
+++ b/dom/icc/src/Icc.h
@@ -0,0 +1,117 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_Icc_h
+#define mozilla_dom_Icc_h
+
+#include "nsDOMEventTargetHelper.h"
+#include "nsIIccProvider.h"
+
+namespace mozilla {
+namespace dom {
+
+class Icc MOZ_FINAL : public nsDOMEventTargetHelper
+{
+public:
+  NS_REALLY_FORWARD_NSIDOMEVENTTARGET(nsDOMEventTargetHelper)
+
+  Icc(nsPIDOMWindow* aWindow, long aClientId, const nsAString& aIccId);
+
+  void
+  Shutdown();
+
+  nsresult
+  NotifyEvent(const nsAString& aName);
+
+  nsresult
+  NotifyStkEvent(const nsAString& aName, const nsAString& aMessage);
+
+  nsString
+  GetIccId()
+  {
+    return mIccId;
+  }
+
+  nsPIDOMWindow*
+  GetParentObject() const
+  {
+    return GetOwner();
+  }
+
+  // WrapperCache
+  virtual JSObject*
+  WrapObject(JSContext* aCx, JS::Handle<JSObject*> aScope) MOZ_OVERRIDE;
+
+  // MozIcc WebIDL
+  already_AddRefed<nsIDOMMozIccInfo>
+  GetIccInfo() const;
+
+  void
+  GetCardState(nsString& aCardState) const;
+
+  void
+  SendStkResponse(const JSContext* aCx, const JS::Value& aCommand,
+                  const JS::Value& aResponse, ErrorResult& aRv);
+
+  void
+  SendStkMenuSelection(uint16_t aItemIdentifier, bool aHelpRequested,
+                       ErrorResult& aRv);
+
+  void
+  SendStkTimerExpiration(const JSContext* aCx, const JS::Value& aTimer,
+                         ErrorResult& aRv);
+
+  void
+  SendStkEventDownload(const JSContext* aCx, const JS::Value& aEvent,
+                       ErrorResult& aRv);
+
+  already_AddRefed<nsISupports>
+  GetCardLock(const nsAString& aLockType, ErrorResult& aRv);
+
+  already_AddRefed<nsISupports>
+  UnlockCardLock(const JSContext* aCx, const JS::Value& aInfo,
+                 ErrorResult& aRv);
+
+  already_AddRefed<nsISupports>
+  SetCardLock(const JSContext* aCx, const JS::Value& aInfo, ErrorResult& aRv);
+
+  already_AddRefed<nsISupports>
+  GetCardLockRetryCount(const nsAString& aLockType, ErrorResult& aRv);
+
+  already_AddRefed<nsISupports>
+  ReadContacts(const nsAString& aContactType, ErrorResult& aRv);
+
+  already_AddRefed<nsISupports>
+  UpdateContact(const JSContext* aCx, const nsAString& aContactType,
+                const JS::Value& aContact, const nsAString& aPin2,
+                ErrorResult& aRv);
+
+  already_AddRefed<nsISupports>
+  IccOpenChannel(const nsAString& aAid, ErrorResult& aRv);
+
+  already_AddRefed<nsISupports>
+  IccExchangeAPDU(const JSContext* aCx, int32_t aChannel, const jsval& aApdu,
+                  ErrorResult& aRv);
+
+  already_AddRefed<nsISupports>
+  IccCloseChannel(int32_t aChannel, ErrorResult& aRv);
+
+  IMPL_EVENT_HANDLER(iccinfochange)
+  IMPL_EVENT_HANDLER(cardstatechange)
+  IMPL_EVENT_HANDLER(stkcommand)
+  IMPL_EVENT_HANDLER(stksessionend)
+
+private:
+  bool mLive;
+  uint32_t mClientId;
+  nsString mIccId;
+  // mProvider is a xpcom service and will be released at shutdown, so it
+  // doesn't need to be cycle collected.
+  nsCOMPtr<nsIIccProvider> mProvider;
+};
+
+} // namespace dom
+} // namespace mozilla
+
+#endif // mozilla_dom_icc_Icc_h
diff --git a/dom/icc/src/IccListener.cpp b/dom/icc/src/IccListener.cpp
new file mode 100644
index 000000000000..303aacdad918
--- /dev/null
+++ b/dom/icc/src/IccListener.cpp
@@ -0,0 +1,130 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "IccListener.h"
+
+#include "Icc.h"
+#include "IccManager.h"
+#include "nsIDOMClassInfo.h"
+#include "nsIDOMIccInfo.h"
+#include "nsRadioInterfaceLayer.h"
+
+using namespace mozilla::dom;
+
+NS_IMPL_ISUPPORTS1(IccListener, nsIIccListener)
+
+IccListener::IccListener(IccManager* aIccManager, uint32_t aClientId)
+  : mClientId(aClientId)
+  , mIccManager(aIccManager)
+{
+  MOZ_ASSERT(mIccManager);
+
+  mProvider = do_GetService(NS_RILCONTENTHELPER_CONTRACTID);
+
+  if (!mProvider) {
+    NS_WARNING("Could not acquire nsIIccProvider!");
+    return;
+  }
+
+  nsCOMPtr<nsIDOMMozIccInfo> iccInfo;
+  mProvider->GetIccInfo(mClientId, getter_AddRefs(iccInfo));
+  if (iccInfo) {
+    nsString iccId;
+    iccInfo->GetIccid(iccId);
+    if (!iccId.IsEmpty()) {
+      mIcc = new Icc(mIccManager->GetOwner(), mClientId, iccId);
+    }
+  }
+
+  DebugOnly<nsresult> rv = mProvider->RegisterIccMsg(mClientId, this);
+  NS_WARN_IF_FALSE(NS_SUCCEEDED(rv),
+                   "Failed registering icc messages with provider");
+}
+
+IccListener::~IccListener()
+{
+  Shutdown();
+}
+
+void
+IccListener::Shutdown()
+{
+  if (mProvider) {
+    mProvider->UnregisterIccMsg(mClientId, this);
+    mProvider = nullptr;
+  }
+
+  if (mIcc) {
+    mIcc->Shutdown();
+    mIcc = nullptr;
+  }
+
+  mIccManager = nullptr;
+}
+
+// nsIIccListener
+
+NS_IMETHODIMP
+IccListener::NotifyStkCommand(const nsAString& aMessage)
+{
+  if (!mIcc) {
+    return NS_OK;
+  }
+
+  return mIcc->NotifyStkEvent(NS_LITERAL_STRING("stkcommand"), aMessage);
+}
+
+NS_IMETHODIMP
+IccListener::NotifyStkSessionEnd()
+{
+  if (!mIcc) {
+    return NS_OK;
+  }
+
+  return mIcc->NotifyEvent(NS_LITERAL_STRING("stksessionend"));
+}
+
+NS_IMETHODIMP
+IccListener::NotifyCardStateChanged()
+{
+  if (!mIcc) {
+    return NS_OK;
+  }
+
+  return mIcc->NotifyEvent(NS_LITERAL_STRING("cardstatechange"));
+}
+
+NS_IMETHODIMP
+IccListener::NotifyIccInfoChanged()
+{
+  nsCOMPtr<nsIDOMMozIccInfo> iccInfo;
+  mProvider->GetIccInfo(mClientId, getter_AddRefs(iccInfo));
+
+  // Create/delete icc object based on current iccInfo.
+  // 1. If the mIcc is nullptr and iccInfo has valid data, create icc object and
+  //    notify mIccManager a new icc is added.
+  // 2. If the mIcc is not nullptr and iccInfo becomes to null, delete existed
+  //    icc object and notify mIccManager the icc is removed.
+  if (!mIcc) {
+    if (iccInfo) {
+      nsString iccId;
+      iccInfo->GetIccid(iccId);
+      if (!iccId.IsEmpty()) {
+        mIcc = new Icc(mIccManager->GetOwner(), mClientId, iccId);
+        mIccManager->NotifyIccAdd(iccId);
+        mIcc->NotifyEvent(NS_LITERAL_STRING("iccinfochange"));
+      }
+    }
+  } else {
+    mIcc->NotifyEvent(NS_LITERAL_STRING("iccinfochange"));
+    if (!iccInfo) {
+      nsString iccId = mIcc->GetIccId();
+      mIcc->Shutdown();
+      mIcc = nullptr;
+      mIccManager->NotifyIccRemove(iccId);
+    }
+  }
+
+  return NS_OK;
+}
diff --git a/dom/icc/src/IccListener.h b/dom/icc/src/IccListener.h
new file mode 100644
index 000000000000..cc82155524ea
--- /dev/null
+++ b/dom/icc/src/IccListener.h
@@ -0,0 +1,52 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_IccListener_h
+#define mozilla_dom_IccListener_h
+
+#include "nsAutoPtr.h"
+#include "nsIIccProvider.h"
+
+namespace mozilla {
+namespace dom {
+
+class IccManager;
+class Icc;
+
+class IccListener : public nsIIccListener
+{
+public:
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSIICCLISTENER
+
+  IccListener(IccManager* aIccManager, uint32_t aClientId);
+  ~IccListener();
+
+  void
+  Shutdown();
+
+  already_AddRefed<Icc>
+  GetIcc()
+  {
+    nsRefPtr<Icc> icc = mIcc;
+    return icc.forget();
+  }
+
+private:
+  uint32_t mClientId;
+  // We did not setup 'mIcc' and 'mIccManager' being a participant of cycle
+  // collection is because in Navigator->Invalidate() it will call
+  // mIccManager->Shutdown(), then IccManager will call Shutdown() of each
+  // IccListener, this will release the reference and break the cycle.
+  nsRefPtr<Icc> mIcc;
+  nsRefPtr<IccManager> mIccManager;
+  // mProvider is a xpcom service and will be released at shutdown, so it
+  // doesn't need to be cycle collected.
+  nsCOMPtr<nsIIccProvider> mProvider;
+};
+
+} // namespace dom
+} // namespace mozilla
+
+#endif // mozilla_dom_IccListener_h
\ No newline at end of file
diff --git a/dom/icc/src/IccManager.cpp b/dom/icc/src/IccManager.cpp
index 5a9e72187496..b15ee1101e20 100644
--- a/dom/icc/src/IccManager.cpp
+++ b/dom/icc/src/IccManager.cpp
@@ -2,47 +2,42 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "mozilla/dom/IccManager.h"
+#include "IccManager.h"
 
 #include "GeneratedEvents.h"
-#include "mozilla/dom/MozStkCommandEvent.h"
+#include "Icc.h"
+#include "IccListener.h"
+#include "mozilla/dom/IccChangeEvent.h"
+#include "mozilla/Preferences.h"
 #include "mozilla/Services.h"
 #include "nsIDOMClassInfo.h"
 #include "nsIDOMIccInfo.h"
-#include "nsJSON.h"
-#include "SimToolKit.h"
-
-#define NS_RILCONTENTHELPER_CONTRACTID "@mozilla.org/ril/content-helper;1"
 
 using namespace mozilla::dom;
 
-class IccManager::Listener : public nsIIccListener
-{
-  IccManager* mIccManager;
-
-public:
-  NS_DECL_ISUPPORTS
-  NS_FORWARD_SAFE_NSIICCLISTENER(mIccManager)
-
-  Listener(IccManager* aIccManager)
-    : mIccManager(aIccManager)
-  {
-    MOZ_ASSERT(mIccManager);
-  }
-
-  void
-  Disconnect()
-  {
-    MOZ_ASSERT(mIccManager);
-    mIccManager = nullptr;
-  }
-};
-
-NS_IMPL_ISUPPORTS1(IccManager::Listener, nsIIccListener)
-
 DOMCI_DATA(MozIccManager, IccManager)
 
-NS_INTERFACE_MAP_BEGIN(IccManager)
+NS_IMPL_CYCLE_COLLECTION_CLASS(IccManager)
+
+NS_IMPL_CYCLE_COLLECTION_TRACE_BEGIN_INHERITED(IccManager,
+                                               nsDOMEventTargetHelper)
+  NS_IMPL_CYCLE_COLLECTION_TRACE_JS_MEMBER_CALLBACK(mJsIccIds)
+  // We did not setup 'mIccListeners' being a participant of cycle collection is
+  // because in Navigator->Invalidate() it will call mIccManager->Shutdown(),
+  // then IccManager will call Shutdown() of each IccListener, this will release
+  // the reference that held by each mIccListener and break the cycle.
+NS_IMPL_CYCLE_COLLECTION_TRACE_END
+
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(IccManager,
+                                                  nsDOMEventTargetHelper)
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
+
+NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(IccManager,
+                                                nsDOMEventTargetHelper)
+  tmp->Unroot();
+NS_IMPL_CYCLE_COLLECTION_UNLINK_END
+
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION_INHERITED(IccManager)
   NS_INTERFACE_MAP_ENTRY(nsIDOMMozIccManager)
   NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(MozIccManager)
 NS_INTERFACE_MAP_END_INHERITING(nsDOMEventTargetHelper)
@@ -50,261 +45,134 @@ NS_INTERFACE_MAP_END_INHERITING(nsDOMEventTargetHelper)
 NS_IMPL_ADDREF_INHERITED(IccManager, nsDOMEventTargetHelper)
 NS_IMPL_RELEASE_INHERITED(IccManager, nsDOMEventTargetHelper)
 
-IccManager::IccManager()
-{
-  mProvider = do_GetService(NS_RILCONTENTHELPER_CONTRACTID);
-
-  // Not being able to acquire the provider isn't fatal since we check
-  // for it explicitly below.
-  if (!mProvider) {
-    NS_WARNING("Could not acquire nsIIccProvider!");
-    return;
-  }
-
-  // TODO: Bug 814637 - WebIccManager API: support multiple sim cards
-  // In Multi-sim, there is more than one client in iccProvider. Each client
-  // represents a icc service. To maintain the backward compatibility with
-  // single sim, we always use client 0 for now. Adding support for multiple sim
-  // will be addressed in bug 814637.
-  mClientId = 0;
-
-  mListener = new Listener(this);
-  DebugOnly<nsresult> rv = mProvider->RegisterIccMsg(mClientId, mListener);
-  NS_WARN_IF_FALSE(NS_SUCCEEDED(rv),
-                   "Failed registering icc messages with provider");
-}
-
-void
-IccManager::Init(nsPIDOMWindow* aWindow)
+IccManager::IccManager(nsPIDOMWindow* aWindow)
+  : mJsIccIds(nullptr)
+  , mRooted(false)
 {
   BindToOwner(aWindow);
+
+  uint32_t numberOfServices =
+    mozilla::Preferences::GetUint("ril.numRadioInterfaces", 1);
+
+  for (uint32_t i = 0; i < numberOfServices; i++) {
+    nsRefPtr<IccListener> iccListener = new IccListener(this, i);
+    mIccListeners.AppendElement(iccListener);
+  }
+}
+
+IccManager::~IccManager()
+{
+  Shutdown();
+  Unroot();
 }
 
 void
 IccManager::Shutdown()
 {
-  if (mProvider && mListener) {
-    mListener->Disconnect();
-    mProvider->UnregisterIccMsg(mClientId, mListener);
-    mProvider = nullptr;
-    mListener = nullptr;
+  for (uint32_t i = 0; i < mIccListeners.Length(); i++) {
+    mIccListeners[i]->Shutdown();
+    mIccListeners[i] = nullptr;
+  }
+  mIccListeners.Clear();
+}
+
+nsresult
+IccManager::NotifyIccAdd(const nsAString& aIccId)
+{
+  mJsIccIds = nullptr;
+
+  IccChangeEventInit init;
+  init.mBubbles = false;
+  init.mCancelable = false;
+  init.mIccId = aIccId;
+
+  nsRefPtr<IccChangeEvent> event =
+    IccChangeEvent::Constructor(this, NS_LITERAL_STRING("iccdetected"), init);
+
+  return DispatchTrustedEvent(event);
+}
+
+nsresult
+IccManager::NotifyIccRemove(const nsAString& aIccId)
+{
+  mJsIccIds = nullptr;
+
+  IccChangeEventInit init;
+  init.mBubbles = false;
+  init.mCancelable = false;
+  init.mIccId = aIccId;
+
+  nsRefPtr<IccChangeEvent> event =
+    IccChangeEvent::Constructor(this, NS_LITERAL_STRING("iccundetected"), init);
+
+  return DispatchTrustedEvent(event);
+}
+
+void
+IccManager::Root()
+{
+  if (!mRooted) {
+    mozilla::HoldJSObjects(this);
+    mRooted = true;
+  }
+}
+
+void
+IccManager::Unroot()
+{
+  if (mRooted) {
+    mJsIccIds = nullptr;
+    mozilla::DropJSObjects(this);
+    mRooted = false;
   }
 }
 
 // nsIDOMMozIccManager
 
 NS_IMETHODIMP
-IccManager::SendStkResponse(const JS::Value& aCommand,
-                            const JS::Value& aResponse)
+IccManager::GetIccIds(JS::Value* aIccIds)
 {
-  if (!mProvider) {
-    return NS_ERROR_FAILURE;
-  }
+  if (!mJsIccIds) {
+    nsTArray<nsString> iccIds;
+    for (uint32_t i = 0; i < mIccListeners.Length(); i++) {
+      nsRefPtr<Icc> icc = mIccListeners[i]->GetIcc();
+      if (icc) {
+        iccIds.AppendElement(icc->GetIccId());
+      }
+    }
 
-  mProvider->SendStkResponse(mClientId, GetOwner(), aCommand, aResponse);
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-IccManager::SendStkMenuSelection(uint16_t aItemIdentifier, bool aHelpRequested)
-{
-  if (!mProvider) {
-    return NS_ERROR_FAILURE;
-  }
-
-  mProvider->SendStkMenuSelection(mClientId, GetOwner(), aItemIdentifier, aHelpRequested);
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-IccManager::SendStkTimerExpiration(const JS::Value& aTimer)
-{
-  if (!mProvider) {
-    return NS_ERROR_FAILURE;
-  }
-
-  mProvider->SendStkTimerExpiration(mClientId, GetOwner(), aTimer);
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-IccManager::SendStkEventDownload(const JS::Value& aEvent)
-{
-  if (!mProvider) {
-    return NS_ERROR_FAILURE;
-  }
-
-  mProvider->SendStkEventDownload(mClientId, GetOwner(), aEvent);
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-IccManager::GetIccInfo(nsIDOMMozIccInfo** aIccInfo)
-{
-  *aIccInfo = nullptr;
-
-  if (!mProvider) {
-    return NS_ERROR_FAILURE;
-  }
-
-  return mProvider->GetIccInfo(mClientId, aIccInfo);
-}
-
-NS_IMETHODIMP
-IccManager::GetCardState(nsAString& cardState)
-{
-  cardState.SetIsVoid(true);
-
-  if (!mProvider) {
-    return NS_ERROR_FAILURE;
-  }
-
-  return mProvider->GetCardState(mClientId, cardState);
-}
-
-NS_IMETHODIMP
-IccManager::GetCardLock(const nsAString& aLockType, nsIDOMDOMRequest** aDomRequest)
-{
-  if (!mProvider) {
-    return NS_ERROR_FAILURE;
-  }
-
-  return mProvider->GetCardLockState(mClientId, GetOwner(), aLockType, aDomRequest);
-}
-
-NS_IMETHODIMP
-IccManager::SetCardLock(const JS::Value& aInfo, nsIDOMDOMRequest** aDomRequest)
-{
-  if (!mProvider) {
-    return NS_ERROR_FAILURE;
-  }
-
-  return mProvider->SetCardLock(mClientId, GetOwner(), aInfo, aDomRequest);
-}
-
-NS_IMETHODIMP
-IccManager::UnlockCardLock(const JS::Value& aInfo, nsIDOMDOMRequest** aDomRequest)
-{
-  if (!mProvider) {
-    return NS_ERROR_FAILURE;
-  }
-
-  return mProvider->UnlockCardLock(mClientId, GetOwner(), aInfo, aDomRequest);
-}
-
-NS_IMETHODIMP
-IccManager::GetCardLockRetryCount(const nsAString& aLockType, nsIDOMDOMRequest** aDomRequest)
-{
-  if (!mProvider) {
-    return NS_ERROR_FAILURE;
-  }
-
-  return mProvider->GetCardLockRetryCount(mClientId, GetOwner(), aLockType, aDomRequest);
-}
-
-NS_IMETHODIMP
-IccManager::IccOpenChannel(const nsAString& aAid, nsIDOMDOMRequest** aRequest)
-{
-  if (!mProvider) {
-    return NS_ERROR_FAILURE;
-  }
-
-  return mProvider->IccOpenChannel(mClientId, GetOwner(), aAid, aRequest);
-}
-
-NS_IMETHODIMP
-IccManager::IccExchangeAPDU(int32_t aChannel, const jsval& aApdu, nsIDOMDOMRequest** aRequest)
-{
-  if (!mProvider) {
-    return NS_ERROR_FAILURE;
-  }
-
-  return mProvider->IccExchangeAPDU(mClientId, GetOwner(), aChannel, aApdu, aRequest);
-}
-
-NS_IMETHODIMP
-IccManager::IccCloseChannel(int32_t aChannel, nsIDOMDOMRequest** aRequest)
-{
-  if (!mProvider) {
-    return NS_ERROR_FAILURE;
-  }
-
-  return mProvider->IccCloseChannel(mClientId, GetOwner(), aChannel, aRequest);
-}
-
-NS_IMETHODIMP
-IccManager::ReadContacts(const nsAString& aContactType, nsIDOMDOMRequest** aRequest)
-{
-  if (!mProvider) {
-    return NS_ERROR_FAILURE;
-  }
-
-  return mProvider->ReadContacts(mClientId, GetOwner(), aContactType, aRequest);
-}
-
-NS_IMETHODIMP
-IccManager::UpdateContact(const nsAString& aContactType,
-                          const JS::Value& aContact,
-                          const nsAString& aPin2,
-                          nsIDOMDOMRequest** aRequest)
-{
-  if (!mProvider) {
-    return NS_ERROR_FAILURE;
-  }
-
-  return mProvider->UpdateContact(mClientId, GetOwner(), aContactType, aContact, aPin2, aRequest);
-}
-
-NS_IMPL_EVENT_HANDLER(IccManager, stkcommand)
-NS_IMPL_EVENT_HANDLER(IccManager, stksessionend)
-NS_IMPL_EVENT_HANDLER(IccManager, cardstatechange)
-NS_IMPL_EVENT_HANDLER(IccManager, iccinfochange)
-
-// nsIIccListener
-
-NS_IMETHODIMP
-IccManager::NotifyStkCommand(const nsAString& aMessage)
-{
-  nsresult rv;
-  nsIScriptContext* sc = GetContextForEventHandlers(&rv);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  AutoPushJSContext cx(sc->GetNativeContext());
-  JS::Rooted<JS::Value> value(cx);
-
-  if (!aMessage.IsEmpty()) {
-    nsCOMPtr<nsIJSON> json(new nsJSON());
-    nsresult rv = json->DecodeToJSVal(aMessage, cx, value.address());
+    nsresult rv;
+    nsIScriptContext* sc = GetContextForEventHandlers(&rv);
     NS_ENSURE_SUCCESS(rv, rv);
-  } else {
-    value = JSVAL_VOID;
+
+    AutoPushJSContext cx(sc->GetNativeContext());
+    JS::Rooted<JSObject*> jsIccIds(cx);
+    rv = nsTArrayToJSArray(cx, iccIds, jsIccIds.address());
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    mJsIccIds = jsIccIds;
+    Root();
   }
 
-  MozStkCommandEventInit init;
-  init.mBubbles = false;
-  init.mCancelable = false;
-  init.mCommand = value;
-
-  nsRefPtr<MozStkCommandEvent> event =
-    MozStkCommandEvent::Constructor(this, NS_LITERAL_STRING("stkcommand"), init);
-
-  return DispatchTrustedEvent(event);
+  aIccIds->setObject(*mJsIccIds);
+  return NS_OK;
 }
 
 NS_IMETHODIMP
-IccManager::NotifyStkSessionEnd()
+IccManager::GetIccById(const nsAString& aIccId, nsISupports** aIcc)
 {
-  return DispatchTrustedEvent(NS_LITERAL_STRING("stksessionend"));
+  *aIcc = nullptr;
+
+  for (uint32_t i = 0; i < mIccListeners.Length(); i++) {
+    nsRefPtr<Icc> icc = mIccListeners[i]->GetIcc();
+    if (icc && aIccId == icc->GetIccId()) {
+      icc.forget(aIcc);
+      return NS_OK;
+    }
+  }
+
+  return NS_OK;
 }
 
-NS_IMETHODIMP
-IccManager::NotifyCardStateChanged()
-{
-  return DispatchTrustedEvent(NS_LITERAL_STRING("cardstatechange"));
-}
-
-NS_IMETHODIMP
-IccManager::NotifyIccInfoChanged()
-{
-  return DispatchTrustedEvent(NS_LITERAL_STRING("iccinfochange"));
-}
+NS_IMPL_EVENT_HANDLER(IccManager, iccdetected)
+NS_IMPL_EVENT_HANDLER(IccManager, iccundetected)
diff --git a/dom/icc/src/IccManager.h b/dom/icc/src/IccManager.h
index 20f8029794ae..15f4aa5b8a25 100644
--- a/dom/icc/src/IccManager.h
+++ b/dom/icc/src/IccManager.h
@@ -9,40 +9,48 @@
 #include "nsDOMEventTargetHelper.h"
 #include "nsIDOMIccManager.h"
 #include "nsIIccProvider.h"
+#include "nsTArrayHelpers.h"
 
 namespace mozilla {
 namespace dom {
 
-class IccManager : public nsDOMEventTargetHelper
-                 , public nsIDOMMozIccManager
-{
-  /**
-   * Class IccManager doesn't actually inherit nsIIccListener. Instead, it owns
-   * an nsIIccListener derived instance mListener and passes it to
-   * nsIIccProvider. The onreceived events are first delivered to mListener and
-   * then forwarded to its owner, IccManager. See also bug 775997 comment #51.
-   */
-  class Listener;
+class IccListener;
 
+class IccManager MOZ_FINAL : public nsDOMEventTargetHelper
+                           , public nsIDOMMozIccManager
+{
 public:
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_NSIDOMMOZICCMANAGER
-  NS_DECL_NSIICCLISTENER
 
   NS_REALLY_FORWARD_NSIDOMEVENTTARGET(nsDOMEventTargetHelper)
 
-  IccManager();
+  NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS_INHERITED(IccManager,
+                                                         nsDOMEventTargetHelper)
 
-  void Init(nsPIDOMWindow *aWindow);
-  void Shutdown();
+  IccManager(nsPIDOMWindow* aWindow);
+  ~IccManager();
+
+  void
+  Shutdown();
+
+  nsresult
+  NotifyIccAdd(const nsAString& aIccId);
+
+  nsresult
+  NotifyIccRemove(const nsAString& aIccId);
 
 private:
-  // TODO: Bug 814637 - WebIccManager API: support multiple sim cards
-  // The private member, mClient, will be moved to other proper place for
-  // supporting multiple sim cards.
-  uint32_t mClientId;
-  nsCOMPtr<nsIIccProvider> mProvider;
-  nsRefPtr<Listener> mListener;
+  nsTArray<nsRefPtr<IccListener>> mIccListeners;
+
+  // Cached iccIds js array object. Cleared whenever the NotifyIccAdd() or
+  // NotifyIccRemove() is called, and then rebuilt once a page looks for the
+  // iccIds attribute.
+  JS::Heap<JSObject*> mJsIccIds;
+  bool mRooted;
+
+  void Root();
+  void Unroot();
 };
 
 } // namespace dom
diff --git a/dom/icc/src/moz.build b/dom/icc/src/moz.build
index c79d58fee172..a03423bc4349 100644
--- a/dom/icc/src/moz.build
+++ b/dom/icc/src/moz.build
@@ -5,10 +5,13 @@
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 EXPORTS.mozilla.dom += [
+    'Icc.h',
     'IccManager.h',
 ]
 
 SOURCES += [
+    'Icc.cpp',
+    'IccListener.cpp',
     'IccManager.cpp',
 ]
 
@@ -17,7 +20,9 @@ FAIL_ON_WARNINGS = True
 include('/ipc/chromium/chromium-config.mozbuild')
 
 FINAL_LIBRARY = 'gklayout'
+
 LOCAL_INCLUDES += [
+    '../../system/gonk',
     '/content/events/src',
 ]
 
diff --git a/dom/icc/tests/marionette/icc_header.js b/dom/icc/tests/marionette/icc_header.js
new file mode 100644
index 000000000000..670d624eae34
--- /dev/null
+++ b/dom/icc/tests/marionette/icc_header.js
@@ -0,0 +1,67 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+SpecialPowers.addPermission("mobileconnection", true, document);
+
+let iccManager = navigator.mozIccManager;
+ok(iccManager instanceof MozIccManager,
+   "iccManager is instanceof " + iccManager.constructor);
+
+// TODO: Bug 932650 - B2G RIL: WebIccManager API - add marionette tests for
+//                    multi-sim
+// In single sim scenario, there is only one sim card, we can use below way to
+// check iccId and get icc object. But in multi-sim, the index of iccIds may
+// not map to sim slot directly, we should have a better way to handle this.
+let iccIds = iccManager.iccIds;
+ok(Array.isArray(iccIds), "iccIds is an array");
+is(iccIds.length, 1, "iccIds.length is " + iccIds.length);
+
+let iccId = iccIds[0];
+is(iccId, "89014103211118510720", "iccId is " + iccId);
+
+let icc = iccManager.getIccById(iccId);
+ok(icc instanceof MozIcc, "icc is instanceof " + icc.constructor);
+
+/* Remove permission and execute finish() */
+let cleanUp = function () {
+  SpecialPowers.removePermission("mobileconnection", document);
+  finish();
+};
+
+/* Helper for tasks */
+let taskHelper = {
+  tasks: [],
+
+  push: function(task) {
+    this.tasks.push(task);
+  },
+
+  runNext: function() {
+    let task = this.tasks.shift();
+    if (!task) {
+      cleanUp();
+      return;
+    }
+
+    if (typeof task === "function") {
+      task();
+    }
+  },
+};
+
+/* Helper for emulator console command */
+let emulatorHelper = {
+  pendingCommandCount: 0,
+
+  sendCommand: function(cmd, callback) {
+    this.pendingCommandCount++;
+    runEmulatorCmd(cmd, function(result) {
+      this.pendingCommandCount--;
+      is(result[result.length - 1], "OK");
+
+      if (callback && typeof callback === "function") {
+        callback(result);
+      }
+    });
+  },
+};
diff --git a/dom/icc/tests/marionette/manifest.ini b/dom/icc/tests/marionette/manifest.ini
index 480ce3b3bd79..f336e0cb22b1 100644
--- a/dom/icc/tests/marionette/manifest.ini
+++ b/dom/icc/tests/marionette/manifest.ini
@@ -22,3 +22,7 @@ qemu = true
 [test_stk_select_item.js]
 [test_stk_setup_menu.js]
 [test_stk_setup_idle_mode_text.js]
+[test_icc_access_invalid_object.js]
+disabled = Bug 933654
+[test_icc_detected_undetected_event.js]
+disabled = Bug 933654
diff --git a/dom/icc/tests/marionette/stk_helper.js b/dom/icc/tests/marionette/stk_helper.js
index f29f153d8fb3..09f20f64d712 100644
--- a/dom/icc/tests/marionette/stk_helper.js
+++ b/dom/icc/tests/marionette/stk_helper.js
@@ -5,8 +5,24 @@ MARIONETTE_TIMEOUT = 30000;
 
 SpecialPowers.addPermission("mobileconnection", true, document);
 
-let icc = navigator.mozIccManager;
-ok(icc instanceof MozIccManager, "icc is instanceof " + icc.constructor);
+let iccManager = navigator.mozIccManager;
+ok(iccManager instanceof MozIccManager,
+   "iccManager is instanceof " + iccManager.constructor);
+
+// TODO: Bug 932650 - B2G RIL: WebIccManager API - add marionette tests for
+//                    multi-sim
+// In single sim scenario, there is only one sim card, we can use below way to
+// check iccId and get icc object. But in multi-sim, the index of iccIds may
+// not map to sim slot directly, we should have a better way to handle this.
+let iccIds = iccManager.iccIds;
+ok(Array.isArray(iccIds), "iccIds is an array");
+is(iccIds.length, 1, "iccIds.length is " + iccIds.length);
+
+let iccId = iccIds[0];
+is(iccId, "89014103211118510720", "iccId is " + iccId);
+
+let icc = iccManager.getIccById(iccId);
+ok(icc instanceof MozIcc, "icc is instanceof " + icc.constructor);
 
 let pendingEmulatorCmdCount = 0;
 function sendStkPduToEmulator(command, func, expect) {
diff --git a/dom/icc/tests/marionette/test_icc_access_invalid_object.js b/dom/icc/tests/marionette/test_icc_access_invalid_object.js
new file mode 100644
index 000000000000..98628ac2196f
--- /dev/null
+++ b/dom/icc/tests/marionette/test_icc_access_invalid_object.js
@@ -0,0 +1,121 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+MARIONETTE_TIMEOUT = 30000;
+MARIONETTE_HEAD_JS = "icc_header.js";
+
+function setRadioEnabled(enabled) {
+  SpecialPowers.addPermission("settings-write", true, document);
+
+  // TODO: Bug 856553 - [B2G] RIL: need an API to enable/disable radio
+  let settings = navigator.mozSettings;
+  let setLock = settings.createLock();
+  let obj = {
+    "ril.radio.disabled": !enabled
+  };
+  let setReq = setLock.set(obj);
+
+  setReq.addEventListener("success", function onSetSuccess() {
+    log("set 'ril.radio.disabled' to " + enabled);
+  });
+
+  setReq.addEventListener("error", function onSetError() {
+    ok(false, "cannot set 'ril.radio.disabled' to " + enabled);
+  });
+
+  SpecialPowers.removePermission("settings-write", document);
+}
+
+/* Test access invalid icc object */
+taskHelper.push(function testAccessRemovedIccObject() {
+  setRadioEnabled(false);
+  iccManager.addEventListener("iccundetected", function oniccundetected(evt) {
+    log("got icc undetected event");
+    iccManager.removeEventListener("iccundetected", oniccundetected);
+    is(evt.iccId, iccId, "icc " + evt.iccId + " becomes undetected");
+
+    // Test access iccInfo.
+    try {
+      is(icc.iccInfo, null, "iccInfo: expect to get null");
+    } catch(e) {
+      ok(false, "access iccInfo should not get exception");
+    }
+
+    // Test access cardState.
+    try {
+      is(icc.cardState, null, "cardState: expect to get null");
+    } catch(e) {
+      ok(false, "access cardState should not get exception");
+    }
+
+    // Test STK related function.
+    try {
+      icc.sendStkResponse({}, {});
+      ok(false, "sendStkResponse() should get exception");
+    } catch(e) {}
+    try {
+      icc.sendStkMenuSelection(0, false);
+      ok(false, "sendStkMenuSelection() should get exception");
+    } catch(e) {}
+    try {
+      icc.sendStkTimerExpiration({});
+      ok(false, "sendStkTimerExpiration() should get exception");
+    } catch(e) {}
+    try {
+      icc.sendStkEventDownload({});
+      ok(false, "sendStkEventDownload() should get exception");
+    } catch(e) {}
+
+    // Test card lock related function.
+    try {
+      icc.getCardLock("");
+      ok(false, "getCardLock() should get exception");
+    } catch(e) {}
+    try {
+      icc.unlockCardLock({});
+      ok(false, "unlockCardLock() should get exception");
+    } catch(e) {}
+    try {
+      icc.setCardLock({});
+      ok(false, "setCardLock() should get exception");
+    } catch(e) {}
+    try {
+      icc.getCardLockRetryCount("");
+      ok(false, "getCardLockRetryCount() should get exception");
+    } catch(e) {}
+
+    // Test contact related function.
+    try {
+      icc.readContacts("");
+      ok(false, "readContacts() should get exception");
+    } catch(e) {}
+    try {
+      icc.updateContact("", {});
+      ok(false, "updateContact() should get exception");
+    } catch(e) {}
+
+    // Test secure element related function.
+    try {
+      icc.iccOpenChannel("");
+      ok(false, "iccOpenChannel() should get exception");
+    } catch(e) {}
+    try {
+      icc.iccExchangeAPDU(0, {});
+      ok(false, "iccExchangeAPDU() should get exception");
+    } catch(e) {}
+    try {
+      icc.iccCloseChannel(0);
+      ok(false, "iccCloseChannel() should get exception");
+    } catch(e) {}
+
+    // We should restore the radio status.
+    setRadioEnabled(true);
+    iccManager.addEventListener("iccdetected", function oniccdetected(evt) {
+      iccManager.removeEventListener("iccdetected", oniccdetected);
+      taskHelper.runNext();
+    });
+  });
+});
+
+// Start test
+taskHelper.runNext();
diff --git a/dom/icc/tests/marionette/test_icc_card_lock.js b/dom/icc/tests/marionette/test_icc_card_lock.js
index cc47c81a22f7..29dd3b782c1f 100644
--- a/dom/icc/tests/marionette/test_icc_card_lock.js
+++ b/dom/icc/tests/marionette/test_icc_card_lock.js
@@ -2,31 +2,10 @@
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
 MARIONETTE_TIMEOUT = 30000;
-
-SpecialPowers.addPermission("mobileconnection", true, document);
-
-let icc = navigator.mozIccManager;
-ok(icc instanceof MozIccManager, "icc is instanceof " + icc.constructor);
-
-/* Reset pin retries by passing correct pin code. */
-function resetPinRetries(pin, callback) {
-  let request = icc.setCardLock(
-    {lockType: "pin",
-     pin: pin,
-     newPin: pin});
-
-  request.onsuccess = function onsuccess() {
-    callback();
-  };
-
-  request.onerror = function onerror() {
-    is(false, "Reset pin retries got error: " + request.error.name);
-    callback();
-  };
-}
+MARIONETTE_HEAD_JS = "icc_header.js";
 
 /* Test PIN code changes fail */
-function testPinChangeFailed() {
+taskHelper.push(function testPinChangeFailed() {
   // The default pin is '0000' in emulator
   let request = icc.setCardLock(
     {lockType: "pin",
@@ -42,12 +21,25 @@ function testPinChangeFailed() {
     // The default pin retries is 3, failed once becomes to 2
     is(request.error.retryCount, 2);
 
-    resetPinRetries("0000", runNextTest);
+    // Reset pin retries by passing correct pin code.
+    let resetRequest = icc.setCardLock(
+      {lockType: "pin",
+       pin: "0000",
+       newPin: "0000"});
+
+    resetRequest.onsuccess = function onsuccess() {
+      taskHelper.runNext();
+    };
+
+    resetRequest.onerror = function onerror() {
+      ok(false, "Reset pin retries got error: " + request.error.name);
+      taskHelper.runNext();
+    };
   };
-}
+});
 
 /* Test PIN code changes success */
-function testPinChangeSuccess() {
+taskHelper.push(function testPinChangeSuccess() {
   // The default pin is '0000' in emulator
   let request = icc.setCardLock(
     {lockType: "pin",
@@ -60,19 +52,19 @@ function testPinChangeSuccess() {
   request.onerror = function onerror() {
     ok(false, "Should not fail, got error: " + request.error.name);
 
-    runNextTest();
+    taskHelper.runNext();
   };
 
   request.onsuccess = function onsuccess() {
     is(request.result.lockType, "pin");
     is(request.result.success, true);
 
-    runNextTest();
+    taskHelper.runNext();
   };
-}
+});
 
 /* Read PIN-lock retry count */
-function testPinCardLockRetryCount() {
+taskHelper.push(function testPinCardLockRetryCount() {
   let request = icc.getCardLockRetryCount('pin');
 
   ok(request instanceof DOMRequest,
@@ -83,7 +75,7 @@ function testPinCardLockRetryCount() {
         'lockType is ' + request.result.lockType);
     ok(request.result.retryCount >= 0,
         'retryCount is ' + request.result.retryCount);
-    runNextTest();
+    taskHelper.runNext();
   };
   request.onerror = function onerror() {
     // The operation is optional any might not be supported for all
@@ -91,12 +83,12 @@ function testPinCardLockRetryCount() {
     // the valid lock types.
     is(request.error.name, 'RequestNotSupported',
         'error name is ' + request.error.name);
-    runNextTest();
+    taskHelper.runNext();
   };
-}
+});
 
 /* Read PUK-lock retry count */
-function testPukCardLockRetryCount() {
+taskHelper.push(function testPukCardLockRetryCount() {
   let request = icc.getCardLockRetryCount('puk');
 
   ok(request instanceof DOMRequest,
@@ -107,7 +99,7 @@ function testPukCardLockRetryCount() {
         'lockType is ' + request.result.lockType);
     ok(request.result.retryCount >= 0,
         'retryCount is ' + request.result.retryCount);
-    runNextTest();
+    taskHelper.runNext();
   };
   request.onerror = function onerror() {
     // The operation is optional any might not be supported for all
@@ -115,12 +107,12 @@ function testPukCardLockRetryCount() {
     // the valid lock types.
     is(request.error.name, 'RequestNotSupported',
         'error name is ' + request.error.name);
-    runNextTest();
+    taskHelper.runNext();
   };
-}
+});
 
 /* Read lock retry count for an invalid entries  */
-function testInvalidCardLockRetryCount() {
+taskHelper.push(function testInvalidCardLockRetryCount() {
   let request = icc.getCardLockRetryCount('invalid-lock-type');
 
   ok(request instanceof DOMRequest,
@@ -129,37 +121,14 @@ function testInvalidCardLockRetryCount() {
   request.onsuccess = function onsuccess() {
     ok(false,
         'request should never return success for an invalid lock type');
-    runNextTest();
+    taskHelper.runNext();
   };
   request.onerror = function onerror() {
     is(request.error.name, 'GenericFailure',
         'error name is ' + request.error.name);
-    runNextTest();
+    taskHelper.runNext();
   };
-}
+});
 
-let tests = [
-  testPinChangeFailed,
-  testPinChangeSuccess,
-  testPinCardLockRetryCount,
-  testPukCardLockRetryCount,
-  testInvalidCardLockRetryCount
-];
-
-function runNextTest() {
-  let test = tests.shift();
-  if (!test) {
-    cleanUp();
-    return;
-  }
-
-  test();
-}
-
-function cleanUp() {
-  SpecialPowers.removePermission("mobileconnection", document);
-
-  finish();
-}
-
-runNextTest();
+// Start test
+taskHelper.runNext();
diff --git a/dom/icc/tests/marionette/test_icc_card_state.js b/dom/icc/tests/marionette/test_icc_card_state.js
index 535ff77412af..adbed3346e77 100644
--- a/dom/icc/tests/marionette/test_icc_card_state.js
+++ b/dom/icc/tests/marionette/test_icc_card_state.js
@@ -2,40 +2,19 @@
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
 MARIONETTE_TIMEOUT = 30000;
+MARIONETTE_HEAD_JS = "icc_header.js";
 
-SpecialPowers.addPermission("mobileconnection", true, document);
-SpecialPowers.addPermission("settings-write", true, document);
+function setRadioEnabled(enabled) {
+  SpecialPowers.addPermission("settings-write", true, document);
 
-// Permission changes can't change existing Navigator.prototype
-// objects, so grab our objects from a new Navigator
-let ifr = document.createElement("iframe");
-let icc;
-ifr.onload = function() {
-  icc = ifr.contentWindow.navigator.mozIccManager;
-
-  ok(icc instanceof ifr.contentWindow.MozIccManager,
-     "icc is instanceof " + icc.constructor);
-
-  is(icc.cardState, "ready");
-
-  // Enable Airplane mode, expect got cardstatechange to null
-  testCardStateChange(true, null,
-    // Disable Airplane mode, expect got cardstatechange to 'ready'
-    testCardStateChange.bind(window, false, "ready", cleanUp)
-  );
-};
-document.body.appendChild(ifr);
-
-function setAirplaneModeEnabled(enabled) {
-  let settings = ifr.contentWindow.navigator.mozSettings;
+  // TODO: Bug 856553 - [B2G] RIL: need an API to enable/disable radio
+  let settings = navigator.mozSettings;
   let setLock = settings.createLock();
   let obj = {
-    "ril.radio.disabled": enabled
+    "ril.radio.disabled": !enabled
   };
   let setReq = setLock.set(obj);
 
-  log("set airplane mode to " + enabled);
-
   setReq.addEventListener("success", function onSetSuccess() {
     log("set 'ril.radio.disabled' to " + enabled);
   });
@@ -43,28 +22,35 @@ function setAirplaneModeEnabled(enabled) {
   setReq.addEventListener("error", function onSetError() {
     ok(false, "cannot set 'ril.radio.disabled' to " + enabled);
   });
+
+  SpecialPowers.removePermission("settings-write", document);
 }
 
-function waitCardStateChangedEvent(expectedCardState, callback) {
+/* Basic test */
+taskHelper.push(function basicTest() {
+  is(icc.cardState, "ready", "card state is " + icc.cardState);
+  taskHelper.runNext();
+});
+
+/* Test cardstatechange event by switching radio off */
+taskHelper.push(function testCardStateChange() {
+  // Turn off radio.
+  setRadioEnabled(false);
   icc.addEventListener("cardstatechange", function oncardstatechange() {
     log("card state changes to " + icc.cardState);
-    if (icc.cardState === expectedCardState) {
-      log("got expected card state: " + icc.cardState);
+    // Expect to get card state changing to null.
+    if (icc.cardState === null) {
       icc.removeEventListener("cardstatechange", oncardstatechange);
-      callback();
+      // We should restore radio status and expect to get iccdetected event.
+      setRadioEnabled(true);
+      iccManager.addEventListener("iccdetected", function oniccdetected(evt) {
+        log("icc iccdetected: " + evt.iccId);
+        iccManager.removeEventListener("iccdetected", oniccdetected);
+        taskHelper.runNext();
+      });
     }
   });
-}
+});
 
-// Test cardstatechange event by switching airplane mode
-function testCardStateChange(airplaneMode, expectedCardState, callback) {
-  setAirplaneModeEnabled(airplaneMode);
-  waitCardStateChangedEvent(expectedCardState, callback);
-}
-
-function cleanUp() {
-  SpecialPowers.removePermission("mobileconnection", document);
-  SpecialPowers.removePermission("settings-write", document);
-
-  finish();
-}
+// Start test
+taskHelper.runNext();
diff --git a/dom/icc/tests/marionette/test_icc_contact.js b/dom/icc/tests/marionette/test_icc_contact.js
index 9ebd89dc684c..9ecd518b544f 100644
--- a/dom/icc/tests/marionette/test_icc_contact.js
+++ b/dom/icc/tests/marionette/test_icc_contact.js
@@ -2,11 +2,7 @@
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
 MARIONETTE_TIMEOUT = 60000;
-
-SpecialPowers.addPermission("mobileconnection", true, document);
-
-let icc = navigator.mozIccManager;
-ok(icc instanceof MozIccManager, "icc is instanceof " + icc.constructor);
+MARIONETTE_HEAD_JS = "icc_header.js";
 
 function testReadContacts(type) {
   let request = icc.readContacts(type);
@@ -31,14 +27,14 @@ function testReadContacts(type) {
     is(contacts[3].tel[0].value, "15555218204");
     is(contacts[3].id, "890141032111185107204");
 
-    runNextTest();
+    taskHelper.runNext();
   };
 
   request.onerror = function onerror() {
     ok(false, "Cannot get " + type + " contacts");
-    runNextTest();
+    taskHelper.runNext();
   };
-};
+}
 
 function testAddContact(type, pin2) {
   let contact = new mozContact({
@@ -63,12 +59,12 @@ function testAddContact(type, pin2) {
       is(contacts[4].name[0], "add");
       is(contacts[4].tel[0].value, "0912345678");
 
-      runNextTest();
+      taskHelper.runNext();
     };
 
     getRequest.onerror = function onerror() {
       ok(false, "Cannot get " + type + " contacts: " + getRequest.error.name);
-      runNextTest();
+      taskHelper.runNext();
     };
   };
 
@@ -79,47 +75,34 @@ function testAddContact(type, pin2) {
     } else {
       ok(false, "Cannot add " + type + " contact: " + updateRequest.error.name);
     }
-    runNextTest();
+    taskHelper.runNext();
   };
-};
+}
 
-function testReadAdnContacts() {
+/* Test read adn contacts */
+taskHelper.push(function testReadAdnContacts() {
   testReadContacts("adn");
-}
+});
 
-function testAddAdnContact() {
+/* Test add adn contacts */
+taskHelper.push(function testAddAdnContact() {
   testAddContact("adn");
-}
+});
 
-function testReadFdnContacts() {
+/* Test read fdn contacts */
+taskHelper.push(function testReadAdnContacts() {
   testReadContacts("fdn");
-}
+});
 
-function testAddFdnContact() {
+/* Test add fdn contacts */
+taskHelper.push(function testReadAdnContacts() {
   testAddContact("fdn", "0000");
+});
+
+/* Test add fdn contacts without passing pin2 */
+taskHelper.push(function testReadAdnContacts() {
   testAddContact("fdn");
-}
+});
 
-let tests = [
-  testReadAdnContacts,
-  testAddAdnContact,
-  testReadFdnContacts,
-  testAddFdnContact
-];
-
-function runNextTest() {
-  let test = tests.pop();
-  if (!test) {
-    cleanUp();
-    return;
-  }
-
-  test();
-}
-
-function cleanUp() {
-  SpecialPowers.removePermission("mobileconnection", document);
-  finish();
-}
-
-runNextTest();
+// Start test
+taskHelper.runNext();
diff --git a/dom/icc/tests/marionette/test_icc_detected_undetected_event.js b/dom/icc/tests/marionette/test_icc_detected_undetected_event.js
new file mode 100644
index 000000000000..a8e270569c94
--- /dev/null
+++ b/dom/icc/tests/marionette/test_icc_detected_undetected_event.js
@@ -0,0 +1,72 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+MARIONETTE_TIMEOUT = 30000;
+MARIONETTE_HEAD_JS = "icc_header.js";
+
+function setRadioEnabled(enabled) {
+  SpecialPowers.addPermission("settings-write", true, document);
+
+  // TODO: Bug 856553 - [B2G] RIL: need an API to enable/disable radio
+  let settings = navigator.mozSettings;
+  let setLock = settings.createLock();
+  let obj = {
+    "ril.radio.disabled": !enabled
+  };
+  let setReq = setLock.set(obj);
+
+  setReq.addEventListener("success", function onSetSuccess() {
+    log("set 'ril.radio.disabled' to " + enabled);
+  });
+
+  setReq.addEventListener("error", function onSetError() {
+    ok(false, "cannot set 'ril.radio.disabled' to " + enabled);
+  });
+
+  SpecialPowers.removePermission("settings-write", document);
+}
+
+/* Test iccundetected event */
+taskHelper.push(function testIccUndetectedEvent() {
+  setRadioEnabled(false);
+  iccManager.addEventListener("iccundetected", function oniccundetected(evt) {
+    log("got icc undetected event");
+    iccManager.removeEventListener("iccundetected", oniccundetected);
+
+    // TODO: Bug 932650 - B2G RIL: WebIccManager API - add marionette tests for
+    //                    multi-sim
+    // In single sim scenario, there is only one sim card, we can use below way
+    // to check iccIds.
+    is(evt.iccId, iccId, "icc " + evt.iccId + " becomes undetected");
+    is(iccManager.iccIds.length, 0,
+       "iccIds.length becomes to " + iccManager.iccIds.length);
+    is(iccManager.getIccById(evt.iccId), null,
+       "should not get a valid icc object here");
+
+    taskHelper.runNext();
+  });
+});
+
+/* Test iccdetected event */
+taskHelper.push(function testIccDetectedEvent() {
+  setRadioEnabled(true);
+  iccManager.addEventListener("iccdetected", function oniccdetected(evt) {
+    log("got icc detected event");
+    iccManager.removeEventListener("iccdetected", oniccdetected);
+
+    // TODO: Bug 932650 - B2G RIL: WebIccManager API - add marionette tests for
+    //                    multi-sim
+    // In single sim scenario, there is only one sim card, we can use below way
+    // to check iccIds.
+    is(evt.iccId, iccId, "icc " + evt.iccId + " is detected");
+    is(iccManager.iccIds.length, 1,
+       "iccIds.length becomes to " + iccManager.iccIds.length);
+    ok(iccManager.getIccById(evt.iccId) instanceof MozIcc,
+       "should get a valid icc object here");
+
+    taskHelper.runNext();
+  });
+});
+
+// Start test
+taskHelper.runNext();
diff --git a/dom/icc/tests/marionette/test_icc_info.js b/dom/icc/tests/marionette/test_icc_info.js
index 3ef9e1a933a3..16619bd6bad1 100644
--- a/dom/icc/tests/marionette/test_icc_info.js
+++ b/dom/icc/tests/marionette/test_icc_info.js
@@ -2,27 +2,46 @@
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
 MARIONETTE_TIMEOUT = 30000;
+MARIONETTE_HEAD_JS = "icc_header.js";
 
-SpecialPowers.addPermission("mobileconnection", true, document);
+function setRadioEnabled(enabled) {
+  SpecialPowers.addPermission("settings-write", true, document);
 
-// Permission changes can't change existing Navigator.prototype
-// objects, so grab our objects from a new Navigator
-let ifr = document.createElement("iframe");
-let icc;
-let iccInfo;
-ifr.onload = function() {
-  icc = ifr.contentWindow.navigator.mozIccManager;
-  ok(icc instanceof ifr.contentWindow.MozIccManager,
-     "icc is instanceof " + icc.constructor);
+  // TODO: Bug 856553 - [B2G] RIL: need an API to enable/disable radio
+  let settings = navigator.mozSettings;
+  let setLock = settings.createLock();
+  let obj = {
+    "ril.radio.disabled": !enabled
+  };
+  let setReq = setLock.set(obj);
 
-  iccInfo = icc.iccInfo;
+  setReq.addEventListener("success", function onSetSuccess() {
+    log("set 'ril.radio.disabled' to " + enabled);
+  });
+
+  setReq.addEventListener("error", function onSetError() {
+    ok(false, "cannot set 'ril.radio.disabled' to " + enabled);
+  });
+
+  SpecialPowers.removePermission("settings-write", document);
+}
+
+function setEmulatorMccMnc(mcc, mnc) {
+  let cmd = "operator set 0 Android,Android," + mcc + mnc;
+  emulatorHelper.sendCommand(cmd, function (result) {
+    let re = new RegExp("" + mcc + mnc + "$");
+    ok(result[0].match(re), "MCC/MNC should be changed.");
+  });
+}
+
+/* Basic test */
+taskHelper.push(function basicTest() {
+  let iccInfo = icc.iccInfo;
 
   is(iccInfo.iccType, "sim");
-
   // The emulator's hard coded iccid value.
   // See it here {B2G_HOME}/external/qemu/telephony/sim_card.c#L299.
   is(iccInfo.iccid, 89014103211118510720);
-
   // The emulator's hard coded mcc and mnc codes.
   // See it here {B2G_HOME}/external/qemu/telephony/android_modem.c#L2465.
   is(iccInfo.mcc, 310);
@@ -32,103 +51,27 @@ ifr.onload = function() {
   // See {B2G_HOME}/external/qemu/telephony/sim_card.c, in asimcard_io()
   is(iccInfo.msisdn, "15555215554");
 
-  runNextTest();
-};
-document.body.appendChild(ifr);
+  taskHelper.runNext();
+});
 
-let emulatorCmdPendingCount = 0;
-function sendEmulatorCommand(cmd, callback) {
-  emulatorCmdPendingCount++;
-  runEmulatorCmd(cmd, function (result) {
-    emulatorCmdPendingCount--;
-    is(result[result.length - 1], "OK");
-    callback(result);
-  });
-}
+/* Test display condition change */
+taskHelper.push(function testDisplayConditionChange() {
+  function testSPN(mcc, mnc, expectedIsDisplayNetworkNameRequired,
+                   expectedIsDisplaySpnRequired, callback) {
+    icc.addEventListener("iccinfochange", function handler() {
+      icc.removeEventListener("iccinfochange", handler);
+      is(icc.iccInfo.isDisplayNetworkNameRequired,
+         expectedIsDisplayNetworkNameRequired);
+      is(icc.iccInfo.isDisplaySpnRequired,
+         expectedIsDisplaySpnRequired);
+      // operatorchange will be ignored if we send commands too soon.
+      window.setTimeout(callback, 100);
+    });
+    // Send emulator command to change network mcc and mnc.
+    setEmulatorMccMnc(mcc, mnc);
+  }
 
-function setEmulatorMccMnc(mcc, mnc) {
-  let cmd = "operator set 0 Android,Android," + mcc + mnc;
-  sendEmulatorCommand(cmd, function (result) {
-    let re = new RegExp("" + mcc + mnc + "$");
-    ok(result[0].match(re), "MCC/MNC should be changed.");
-  });
-}
-
-function setAirplaneModeEnabled(enabled) {
-  let settings = ifr.contentWindow.navigator.mozSettings;
-  let setLock = settings.createLock();
-  let obj = {
-    "ril.radio.disabled": enabled
-  };
-  let setReq = setLock.set(obj);
-
-  log("set airplane mode to " + enabled);
-
-  setReq.addEventListener("success", function onSetSuccess() {
-    log("set 'ril.radio.disabled' to " + enabled);
-  });
-
-  setReq.addEventListener("error", function onSetError() {
-    ok(false, "cannot set 'ril.radio.disabled' to " + enabled);
-  });
-}
-
-function waitForIccInfoChange(callback) {
-  icc.addEventListener("iccinfochange", function handler() {
-    icc.removeEventListener("iccinfochange", handler);
-    callback();
-  });
-}
-
-function waitForCardStateChange(expectedCardState, callback) {
-  icc.addEventListener("cardstatechange", function oncardstatechange() {
-    log("card state changes to " + icc.cardState);
-    if (icc.cardState === expectedCardState) {
-      log("got expected card state: " + icc.cardState);
-      icc.removeEventListener("cardstatechange", oncardstatechange);
-      callback();
-    }
-  });
-}
-
-// Test display condition change.
-function testDisplayConditionChange(func, caseArray, oncomplete) {
-  (function do_call(index) {
-    let next = index < (caseArray.length - 1) ? do_call.bind(null, index + 1) : oncomplete;
-    caseArray[index].push(next);
-    func.apply(null, caseArray[index]);
-  })(0);
-}
-
-function testSPN(mcc, mnc, expectedIsDisplayNetworkNameRequired,
-                  expectedIsDisplaySpnRequired, callback) {
-  waitForIccInfoChange(function() {
-    is(iccInfo.isDisplayNetworkNameRequired,
-       expectedIsDisplayNetworkNameRequired);
-    is(iccInfo.isDisplaySpnRequired,
-       expectedIsDisplaySpnRequired);
-    // operatorchange will be ignored if we send commands too soon.
-    window.setTimeout(callback, 100);
-  });
-  setEmulatorMccMnc(mcc, mnc);
-}
-
-// Test iccInfo when card is not ready
-function testCardIsNotReady() {
-  // Enable airplane mode
-  setAirplaneModeEnabled(true);
-
-  waitForCardStateChange(null, function callback() {
-    is(icc.iccInfo, null);
-
-    // Disable airplane mode
-    setAirplaneModeEnabled(false);
-    waitForCardStateChange("ready", runNextTest);
-  });
-}
-
-let tests = [
-  testDisplayConditionChange.bind(this, testSPN, [
+  let testCases = [
     // [MCC, MNC, isDisplayNetworkNameRequired, isDisplaySpnRequired]
     [123, 456, false, true], // Not in HPLMN.
     [234, 136,  true, true], // Not in HPLMN, but in PLMN specified in SPDI.
@@ -136,21 +79,33 @@ let tests = [
     [466,  92,  true, true], // Not in HPLMN, but in another PLMN specified in SPDI.
     [123, 456, false, true], // Not in HPLMN. Triggering iccinfochange
     [310, 260,  true, true], // inside HPLMN.
-  ], runNextTest),
-  testCardIsNotReady
-];
+  ];
 
-function runNextTest() {
-  let test = tests.shift();
-  if (!test) {
-    finalize();
-    return;
-  }
+  (function do_call(index) {
+    let next = index < (testCases.length - 1) ? do_call.bind(null, index + 1) : taskHelper.runNext.bind(taskHelper);
+    testCases[index].push(next);
+    testSPN.apply(null, testCases[index]);
+  })(0);
+});
 
-  test();
-}
+/* Test iccInfo when card becomes undetected */
+taskHelper.push(function testCardIsNotReady() {
+  // Turn off radio.
+  setRadioEnabled(false);
+  icc.addEventListener("iccinfochange", function oniccinfochange() {
+    // Expect iccInfo changes to null
+    if (icc.iccInfo === null) {
+      icc.removeEventListener("iccinfochange", oniccinfochange);
+      // We should restore radio status and expect to get iccdetected event.
+      setRadioEnabled(true);
+      iccManager.addEventListener("iccdetected", function oniccdetected(evt) {
+        log("icc detected: " + evt.iccId);
+        iccManager.removeEventListener("iccdetected", oniccdetected);
+        taskHelper.runNext();
+      });
+    }
+  });
+});
 
-function finalize() {
-  SpecialPowers.removePermission("mobileconnection", document);
-  finish();
-}
+// Start test
+taskHelper.runNext();
diff --git a/dom/icc/tests/marionette/test_stk_display_text.js b/dom/icc/tests/marionette/test_stk_display_text.js
index d8ce3cf50339..61f76054f241 100644
--- a/dom/icc/tests/marionette/test_stk_display_text.js
+++ b/dom/icc/tests/marionette/test_stk_display_text.js
@@ -5,7 +5,7 @@ MARIONETTE_HEAD_JS = "stk_helper.js";
 
 function testDisplayText(command, expect) {
   log("STK CMD " + JSON.stringify(command));
-  is(command.typeOfCommand, icc.STK_CMD_DISPLAY_TEXT, expect.name);
+  is(command.typeOfCommand, iccManager.STK_CMD_DISPLAY_TEXT, expect.name);
   is(command.options.text, expect.text, expect.name);
   is(command.commandQualifier, expect.commandQualifier, expect.name);
   is(command.options.userClear, expect.userClear, expect.name);
@@ -87,7 +87,7 @@ let tests = [
             commandQualifier: 0x80,
             text: "10 Second",
             userClear: true,
-            duration: {timeUnit: icc.STK_TIME_UNIT_SECOND,
+            duration: {timeUnit: iccManager.STK_TIME_UNIT_SECOND,
                        timeInterval: 0x0A}}},
 ];
 
diff --git a/dom/icc/tests/marionette/test_stk_get_inkey.js b/dom/icc/tests/marionette/test_stk_get_inkey.js
index 7620262c0d1f..f74f1075116e 100644
--- a/dom/icc/tests/marionette/test_stk_get_inkey.js
+++ b/dom/icc/tests/marionette/test_stk_get_inkey.js
@@ -5,7 +5,7 @@ MARIONETTE_HEAD_JS = "stk_helper.js";
 
 function testGetInKey(command, expect) {
   log("STK CMD " + JSON.stringify(command));
-  is(command.typeOfCommand, icc.STK_CMD_GET_INKEY, expect.name);
+  is(command.typeOfCommand, iccManager.STK_CMD_GET_INKEY, expect.name);
   is(command.commandQualifier, expect.commandQualifier, expect.name);
   is(command.options.text, expect.text, expect.name);
   is(command.options.isAlphabet, expect.isAlphabet, expect.name);
@@ -98,7 +98,7 @@ let tests = [
    expect: {name: "get_inkey_cmd_14",
             commandQualifier: 0x00,
             text: "Enter \"+\"",
-            duration: {timeUnit: icc.STK_TIME_UNIT_SECOND,
+            duration: {timeUnit: iccManager.STK_TIME_UNIT_SECOND,
                        timeInterval: 0x0A}}},
 ];
 
diff --git a/dom/icc/tests/marionette/test_stk_get_input.js b/dom/icc/tests/marionette/test_stk_get_input.js
index 2de92e5fe140..ef44880776bb 100644
--- a/dom/icc/tests/marionette/test_stk_get_input.js
+++ b/dom/icc/tests/marionette/test_stk_get_input.js
@@ -5,7 +5,7 @@ MARIONETTE_HEAD_JS = "stk_helper.js";
 
 function testGetInput(command, expect) {
   log("STK CMD " + JSON.stringify(command));
-  is(command.typeOfCommand, icc.STK_CMD_GET_INPUT, expect.name);
+  is(command.typeOfCommand, iccManager.STK_CMD_GET_INPUT, expect.name);
   is(command.commandQualifier, expect.commandQualifier, expect.name);
   is(command.options.text, expect.text, expect.name);
   is(command.options.minLength, expect.minLength, expect.name);
diff --git a/dom/icc/tests/marionette/test_stk_launch_browser.js b/dom/icc/tests/marionette/test_stk_launch_browser.js
index 416b7112c301..0888f42ca75a 100644
--- a/dom/icc/tests/marionette/test_stk_launch_browser.js
+++ b/dom/icc/tests/marionette/test_stk_launch_browser.js
@@ -5,7 +5,7 @@ MARIONETTE_HEAD_JS = "stk_helper.js";
 
 function testLaunchBrowser(command, expect) {
   log("STK CMD " + JSON.stringify(command));
-  is(command.typeOfCommand, icc.STK_CMD_LAUNCH_BROWSER, expect.name);
+  is(command.typeOfCommand, iccManager.STK_CMD_LAUNCH_BROWSER, expect.name);
   is(command.commandQualifier, expect.commandQualifier, expect.name);
   is(command.options.url, expect.url, expect.name);
   if (command.options.confirmMessage) {
diff --git a/dom/icc/tests/marionette/test_stk_poll_off.js b/dom/icc/tests/marionette/test_stk_poll_off.js
index 166007d9f9a7..8f3d32abef39 100644
--- a/dom/icc/tests/marionette/test_stk_poll_off.js
+++ b/dom/icc/tests/marionette/test_stk_poll_off.js
@@ -5,7 +5,7 @@ MARIONETTE_HEAD_JS = "stk_helper.js";
 
 function testPollOff(command, expect) {
   log("STK CMD " + JSON.stringify(command));
-  is(command.typeOfCommand, icc.STK_CMD_POLL_OFF, expect.name);
+  is(command.typeOfCommand, iccManager.STK_CMD_POLL_OFF, expect.name);
   is(command.commandQualifier, expect.commandQualifier, expect.name);
 
   runNextTest();
diff --git a/dom/icc/tests/marionette/test_stk_proactive_command.js b/dom/icc/tests/marionette/test_stk_proactive_command.js
index b10e2be0fe94..c78093327df2 100644
--- a/dom/icc/tests/marionette/test_stk_proactive_command.js
+++ b/dom/icc/tests/marionette/test_stk_proactive_command.js
@@ -5,47 +5,47 @@ MARIONETTE_HEAD_JS = "stk_helper.js";
 
 function testLocalInfoLocation(cmd) {
   log("STK CMD " + JSON.stringify(cmd));
-  is(cmd.typeOfCommand, icc.STK_CMD_PROVIDE_LOCAL_INFO);
+  is(cmd.typeOfCommand, iccManager.STK_CMD_PROVIDE_LOCAL_INFO);
   is(cmd.commandNumber, 0x01);
-  is(cmd.commandQualifier, icc.STK_LOCAL_INFO_LOCATION_INFO);
-  is(cmd.options.localInfoType, icc.STK_LOCAL_INFO_LOCATION_INFO);
+  is(cmd.commandQualifier, iccManager.STK_LOCAL_INFO_LOCATION_INFO);
+  is(cmd.options.localInfoType, iccManager.STK_LOCAL_INFO_LOCATION_INFO);
 
   runNextTest();
 }
 
 function testLocalInfoImei(cmd) {
   log("STK CMD " + JSON.stringify(cmd));
-  is(cmd.typeOfCommand, icc.STK_CMD_PROVIDE_LOCAL_INFO);
+  is(cmd.typeOfCommand, iccManager.STK_CMD_PROVIDE_LOCAL_INFO);
   is(cmd.commandNumber, 0x01);
-  is(cmd.commandQualifier, icc.STK_LOCAL_INFO_IMEI);
-  is(cmd.options.localInfoType, icc.STK_LOCAL_INFO_IMEI);
+  is(cmd.commandQualifier, iccManager.STK_LOCAL_INFO_IMEI);
+  is(cmd.options.localInfoType, iccManager.STK_LOCAL_INFO_IMEI);
 
   runNextTest();
 }
 
 function testLocalInfoDate(cmd) {
   log("STK CMD " + JSON.stringify(cmd));
-  is(cmd.typeOfCommand, icc.STK_CMD_PROVIDE_LOCAL_INFO);
+  is(cmd.typeOfCommand, iccManager.STK_CMD_PROVIDE_LOCAL_INFO);
   is(cmd.commandNumber, 0x01);
-  is(cmd.commandQualifier, icc.STK_LOCAL_INFO_DATE_TIME_ZONE);
-  is(cmd.options.localInfoType, icc.STK_LOCAL_INFO_DATE_TIME_ZONE);
+  is(cmd.commandQualifier, iccManager.STK_LOCAL_INFO_DATE_TIME_ZONE);
+  is(cmd.options.localInfoType, iccManager.STK_LOCAL_INFO_DATE_TIME_ZONE);
 
   runNextTest();
 }
 
 function testLocalInfoLanguage(cmd) {
   log("STK CMD " + JSON.stringify(cmd));
-  is(cmd.typeOfCommand, icc.STK_CMD_PROVIDE_LOCAL_INFO);
+  is(cmd.typeOfCommand, iccManager.STK_CMD_PROVIDE_LOCAL_INFO);
   is(cmd.commandNumber, 0x01);
-  is(cmd.commandQualifier, icc.STK_LOCAL_INFO_LANGUAGE);
-  is(cmd.options.localInfoType, icc.STK_LOCAL_INFO_LANGUAGE);
+  is(cmd.commandQualifier, iccManager.STK_LOCAL_INFO_LANGUAGE);
+  is(cmd.options.localInfoType, iccManager.STK_LOCAL_INFO_LANGUAGE);
 
   runNextTest();
 }
 
 function testRefresh(cmd) {
   log("STK CMD " + JSON.stringify(cmd));
-  is(cmd.typeOfCommand, icc.STK_CMD_REFRESH);
+  is(cmd.typeOfCommand, iccManager.STK_CMD_REFRESH);
   is(cmd.commandNumber, 0x01);
   is(cmd.commandQualifier, 0x01);
   is(cmd.options, null);
@@ -55,10 +55,10 @@ function testRefresh(cmd) {
 
 function testTimerManagementStart(cmd) {
   log("STK CMD " + JSON.stringify(cmd));
-  is(cmd.typeOfCommand, icc.STK_CMD_TIMER_MANAGEMENT);
+  is(cmd.typeOfCommand, iccManager.STK_CMD_TIMER_MANAGEMENT);
   is(cmd.commandNumber, 0x01);
-  is(cmd.commandQualifier, icc.STK_TIMER_START);
-  is(cmd.options.timerAction, icc.STK_TIMER_START);
+  is(cmd.commandQualifier, iccManager.STK_TIMER_START);
+  is(cmd.options.timerAction, iccManager.STK_TIMER_START);
   is(cmd.options.timerId, 0x01);
   is(cmd.options.timerValue, (0x01 * 60 * 60) + (0x02 * 60) + 0x03);
 
@@ -67,10 +67,10 @@ function testTimerManagementStart(cmd) {
 
 function testTimerManagementDeactivate(cmd) {
   log("STK CMD " + JSON.stringify(cmd));
-  is(cmd.typeOfCommand, icc.STK_CMD_TIMER_MANAGEMENT);
+  is(cmd.typeOfCommand, iccManager.STK_CMD_TIMER_MANAGEMENT);
   is(cmd.commandNumber, 0x01);
-  is(cmd.commandQualifier, icc.STK_TIMER_DEACTIVATE);
-  is(cmd.options.timerAction, icc.STK_TIMER_DEACTIVATE);
+  is(cmd.commandQualifier, iccManager.STK_TIMER_DEACTIVATE);
+  is(cmd.options.timerAction, iccManager.STK_TIMER_DEACTIVATE);
   is(cmd.options.timerId, 0x04);
 
   runNextTest();
@@ -78,10 +78,10 @@ function testTimerManagementDeactivate(cmd) {
 
 function testTimerManagementGetCurrentValue(cmd) {
   log("STK CMD " + JSON.stringify(cmd));
-  is(cmd.typeOfCommand, icc.STK_CMD_TIMER_MANAGEMENT);
+  is(cmd.typeOfCommand, iccManager.STK_CMD_TIMER_MANAGEMENT);
   is(cmd.commandNumber, 0x01);
-  is(cmd.commandQualifier, icc.STK_TIMER_GET_CURRENT_VALUE);
-  is(cmd.options.timerAction, icc.STK_TIMER_GET_CURRENT_VALUE);
+  is(cmd.commandQualifier, iccManager.STK_TIMER_GET_CURRENT_VALUE);
+  is(cmd.options.timerAction, iccManager.STK_TIMER_GET_CURRENT_VALUE);
   is(cmd.options.timerId, 0x08);
 
   runNextTest();
diff --git a/dom/icc/tests/marionette/test_stk_refresh.js b/dom/icc/tests/marionette/test_stk_refresh.js
index 5a137a672275..bd1add02af18 100644
--- a/dom/icc/tests/marionette/test_stk_refresh.js
+++ b/dom/icc/tests/marionette/test_stk_refresh.js
@@ -5,7 +5,7 @@ MARIONETTE_HEAD_JS = "stk_helper.js";
 
 function testRefresh(command, expect) {
   log("STK CMD " + JSON.stringify(command));
-  is(command.typeOfCommand, icc.STK_CMD_REFRESH, expect.name);
+  is(command.typeOfCommand, iccManager.STK_CMD_REFRESH, expect.name);
   is(command.commandQualifier, expect.commandQualifier, expect.name);
 
   runNextTest();
diff --git a/dom/icc/tests/marionette/test_stk_select_item.js b/dom/icc/tests/marionette/test_stk_select_item.js
index 413b09c23a61..9150a8a6e45c 100644
--- a/dom/icc/tests/marionette/test_stk_select_item.js
+++ b/dom/icc/tests/marionette/test_stk_select_item.js
@@ -5,7 +5,7 @@ MARIONETTE_HEAD_JS = "stk_helper.js";
 
 function testSelectItem(command, expect) {
   log("STK CMD " + JSON.stringify(command));
-  is(command.typeOfCommand, icc.STK_CMD_SELECT_ITEM, expect.name);
+  is(command.typeOfCommand, iccManager.STK_CMD_SELECT_ITEM, expect.name);
   is(command.commandQualifier, expect.commandQualifier, expect.name);
   is(command.options.title, expect.title, expect.name);
   for (let index in command.options.items) {
diff --git a/dom/icc/tests/marionette/test_stk_send_dtmf.js b/dom/icc/tests/marionette/test_stk_send_dtmf.js
index f12e7cb540fa..9760b5849bd3 100644
--- a/dom/icc/tests/marionette/test_stk_send_dtmf.js
+++ b/dom/icc/tests/marionette/test_stk_send_dtmf.js
@@ -5,7 +5,7 @@ MARIONETTE_HEAD_JS = "stk_helper.js";
 
 function testSendDTMF(command, expect) {
   log("STK CMD " + JSON.stringify(command));
-  is(command.typeOfCommand, icc.STK_CMD_SEND_DTMF, expect.name);
+  is(command.typeOfCommand, iccManager.STK_CMD_SEND_DTMF, expect.name);
   is(command.commandQualifier, expect.commandQualifier, expect.name);
   if (command.options.text) {
     is(command.options.text, expect.text, expect.name);
diff --git a/dom/icc/tests/marionette/test_stk_send_sms.js b/dom/icc/tests/marionette/test_stk_send_sms.js
index ec428cdc9fe8..dd12cb9cf11b 100644
--- a/dom/icc/tests/marionette/test_stk_send_sms.js
+++ b/dom/icc/tests/marionette/test_stk_send_sms.js
@@ -5,7 +5,7 @@ MARIONETTE_HEAD_JS = "stk_helper.js";
 
 function testSendSMS(command, expect) {
   log("STK CMD " + JSON.stringify(command));
-  is(command.typeOfCommand, icc.STK_CMD_SEND_SMS, expect.name);
+  is(command.typeOfCommand, iccManager.STK_CMD_SEND_SMS, expect.name);
   is(command.commandQualifier, expect.commandQualifier, expect.name);
   if (command.options.text) {
     is(command.options.text, expect.title, expect.name);
diff --git a/dom/icc/tests/marionette/test_stk_send_ss.js b/dom/icc/tests/marionette/test_stk_send_ss.js
index 8385d082f122..48dfcdc047d4 100644
--- a/dom/icc/tests/marionette/test_stk_send_ss.js
+++ b/dom/icc/tests/marionette/test_stk_send_ss.js
@@ -5,7 +5,7 @@ MARIONETTE_HEAD_JS = "stk_helper.js";
 
 function testSendSS(command, expect) {
   log("STK CMD " + JSON.stringify(command));
-  is(command.typeOfCommand, icc.STK_CMD_SEND_SS, expect.name);
+  is(command.typeOfCommand, iccManager.STK_CMD_SEND_SS, expect.name);
   is(command.commandQualifier, expect.commandQualifier, expect.name);
   if (command.options.text) {
     is(command.options.text, expect.title, expect.name);
diff --git a/dom/icc/tests/marionette/test_stk_send_ussd.js b/dom/icc/tests/marionette/test_stk_send_ussd.js
index b2cfa81b39a5..41812a63056c 100644
--- a/dom/icc/tests/marionette/test_stk_send_ussd.js
+++ b/dom/icc/tests/marionette/test_stk_send_ussd.js
@@ -5,7 +5,7 @@ MARIONETTE_HEAD_JS = "stk_helper.js";
 
 function testSendUSSD(command, expect) {
   log("STK CMD " + JSON.stringify(command));
-  is(command.typeOfCommand, icc.STK_CMD_SEND_USSD, expect.name);
+  is(command.typeOfCommand, iccManager.STK_CMD_SEND_USSD, expect.name);
   is(command.commandQualifier, expect.commandQualifier, expect.name);
   if (command.options.text) {
     is(command.options.text, expect.title, expect.name);
diff --git a/dom/icc/tests/marionette/test_stk_setup_call.js b/dom/icc/tests/marionette/test_stk_setup_call.js
index c4c278fdf7b2..e70f1a76e6f0 100644
--- a/dom/icc/tests/marionette/test_stk_setup_call.js
+++ b/dom/icc/tests/marionette/test_stk_setup_call.js
@@ -5,7 +5,7 @@ MARIONETTE_HEAD_JS = "stk_helper.js";
 
 function testSetupCall(command, expect) {
   log("STK CMD " + JSON.stringify(command));
-  is(command.typeOfCommand, icc.STK_CMD_SET_UP_CALL, expect.name);
+  is(command.typeOfCommand, iccManager.STK_CMD_SET_UP_CALL, expect.name);
   is(command.commandQualifier, expect.commandQualifier, expect.name);
   is(command.options.confirmMessage, expect.confirmMessage, expect.name);
   is(command.options.address, expect.address, expect.name);
@@ -68,7 +68,7 @@ let tests = [
             commandQualifier: 0x01,
             confirmMessage: "Duration",
             address: "+012340123456,1,2",
-            duration: {timeUnit: icc.STK_TIME_UNIT_SECOND,
+            duration: {timeUnit: iccManager.STK_TIME_UNIT_SECOND,
                        timeInterval: 0x0A}}},
   {command: "d028810301100082028183850c434f4e4649524d4154494f4e8609911032042143651c2c850443414c4c",
    func: testSetupCall,
@@ -336,7 +336,7 @@ let tests = [
             commandQualifier: 0x00,
              confirmMessage: "Not busy",
              address: "+012340123456,1,2",
-            duration: {timeUnit: icc.STK_TIME_UNIT_SECOND,
+            duration: {timeUnit: iccManager.STK_TIME_UNIT_SECOND,
                        timeInterval: 0x0A}}},
 
 ];
diff --git a/dom/icc/tests/marionette/test_stk_setup_event_list.js b/dom/icc/tests/marionette/test_stk_setup_event_list.js
index 24eff85cfe44..ac3033776f08 100644
--- a/dom/icc/tests/marionette/test_stk_setup_event_list.js
+++ b/dom/icc/tests/marionette/test_stk_setup_event_list.js
@@ -5,7 +5,7 @@ MARIONETTE_HEAD_JS = "stk_helper.js";
 
 function testSetupEventList(command, expect) {
   log("STK CMD " + JSON.stringify(command));
-  is(command.typeOfCommand, icc.STK_CMD_SET_UP_EVENT_LIST, expect.name);
+  is(command.typeOfCommand, iccManager.STK_CMD_SET_UP_EVENT_LIST, expect.name);
   is(command.commandQualifier, expect.commandQualifier, expect.name);
   for (let index in command.options.eventList) {
     is(command.options.eventList[index], expect.eventList[index], expect.name);
diff --git a/dom/icc/tests/marionette/test_stk_setup_idle_mode_text.js b/dom/icc/tests/marionette/test_stk_setup_idle_mode_text.js
index ae513cb1713e..6e4b5c912a1e 100644
--- a/dom/icc/tests/marionette/test_stk_setup_idle_mode_text.js
+++ b/dom/icc/tests/marionette/test_stk_setup_idle_mode_text.js
@@ -5,7 +5,7 @@ MARIONETTE_HEAD_JS = "stk_helper.js";
 
 function testSetupIdleModeText(command, expect) {
   log("STK CMD " + JSON.stringify(command));
-  is(command.typeOfCommand, icc.STK_CMD_SET_UP_IDLE_MODE_TEXT, expect.name);
+  is(command.typeOfCommand, iccManager.STK_CMD_SET_UP_IDLE_MODE_TEXT, expect.name);
   is(command.commandQualifier, expect.commandQualifier, expect.name);
   is(command.options.text, expect.text, expect.name);
 
diff --git a/dom/icc/tests/marionette/test_stk_setup_menu.js b/dom/icc/tests/marionette/test_stk_setup_menu.js
index 11074590d0d5..d42e9ff346a6 100644
--- a/dom/icc/tests/marionette/test_stk_setup_menu.js
+++ b/dom/icc/tests/marionette/test_stk_setup_menu.js
@@ -5,7 +5,7 @@ MARIONETTE_HEAD_JS = "stk_helper.js";
 
 function testSetupMenu(command, expect) {
   log("STK CMD " + JSON.stringify(command));
-  is(command.typeOfCommand, icc.STK_CMD_SET_UP_MENU, expect.name);
+  is(command.typeOfCommand, iccManager.STK_CMD_SET_UP_MENU, expect.name);
   is(command.commandQualifier, expect.commandQualifier, expect.name);
   is(command.options.title, expect.title, expect.name);
   for (let index in command.options.items) {
@@ -22,14 +22,14 @@ function isFirstMenuItemNull(command) {
 
 function testInitialSetupMenu(command) {
   log("STK CMD " + JSON.stringify(command));
-  is(command.typeOfCommand, icc.STK_CMD_SET_UP_MENU);
+  is(command.typeOfCommand, iccManager.STK_CMD_SET_UP_MENU);
   is(isFirstMenuItemNull(command), false);
 
   runNextTest();
 }
 function testRemoveSetupMenu(command) {
   log("STK CMD " + JSON.stringify(command));
-  is(command.typeOfCommand, icc.STK_CMD_SET_UP_MENU);
+  is(command.typeOfCommand, iccManager.STK_CMD_SET_UP_MENU);
   is(isFirstMenuItemNull(command), true);
 
   runNextTest();
diff --git a/dom/indexedDB/IDBObjectStore.cpp b/dom/indexedDB/IDBObjectStore.cpp
index 6acdc5b299d7..177ca1b9efac 100644
--- a/dom/indexedDB/IDBObjectStore.cpp
+++ b/dom/indexedDB/IDBObjectStore.cpp
@@ -55,6 +55,7 @@ using namespace mozilla::dom;
 using namespace mozilla::dom::indexedDB::ipc;
 using mozilla::dom::quota::FileOutputStream;
 using mozilla::ErrorResult;
+using mozilla::fallible_t;
 
 BEGIN_INDEXEDDB_NAMESPACE
 
@@ -1220,6 +1221,8 @@ IDBObjectStore::GetStructuredCloneReadInfoFromStatement(
   const char* compressed = reinterpret_cast<const char*>(blobData);
   size_t compressedLength = size_t(blobDataLength);
 
+  static const fallible_t fallible = fallible_t();
+
   size_t uncompressedLength;
   if (!snappy::GetUncompressedLength(compressed, compressedLength,
                                      &uncompressedLength)) {
@@ -1227,7 +1230,8 @@ IDBObjectStore::GetStructuredCloneReadInfoFromStatement(
     return NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR;
   }
 
-  nsAutoArrayPtr<char> uncompressed(new char[uncompressedLength]);
+  nsAutoArrayPtr<char> uncompressed(new (fallible) char[uncompressedLength]);
+  NS_ENSURE_TRUE(uncompressed, NS_ERROR_OUT_OF_MEMORY);
 
   if (!snappy::RawUncompress(compressed, compressedLength,
                              uncompressed.get())) {
@@ -1409,7 +1413,7 @@ StructuredCloneReadString(JSStructuredCloneReader* aReader,
   }
   length = SwapBytes(length);
 
-  if (!aString.SetLength(length, mozilla::fallible_t())) {
+  if (!aString.SetLength(length, fallible_t())) {
     NS_WARNING("Out of memory?");
     return false;
   }
@@ -3213,10 +3217,12 @@ AddHelper::DoDatabaseWork(mozIStorageConnection* aConnection)
     reinterpret_cast<const char*>(mCloneWriteInfo.mCloneBuffer.data());
   size_t uncompressedLength = mCloneWriteInfo.mCloneBuffer.nbytes();
 
+  static const fallible_t fallible = fallible_t();
   size_t compressedLength = snappy::MaxCompressedLength(uncompressedLength);
   // This will hold our compressed data until the end of the method. The
   // BindBlobByName function will copy it.
-  nsAutoArrayPtr<char> compressed(new char[compressedLength]);
+  nsAutoArrayPtr<char> compressed(new (fallible) char[compressedLength]);
+  NS_ENSURE_TRUE(compressed, NS_ERROR_OUT_OF_MEMORY);
 
   snappy::RawCompress(uncompressed, uncompressedLength, compressed.get(),
                       &compressedLength);
diff --git a/dom/indexedDB/OpenDatabaseHelper.cpp b/dom/indexedDB/OpenDatabaseHelper.cpp
index 1dc369793c9a..8d62eb894e34 100644
--- a/dom/indexedDB/OpenDatabaseHelper.cpp
+++ b/dom/indexedDB/OpenDatabaseHelper.cpp
@@ -881,8 +881,10 @@ public:
     rv = aArguments->GetSharedBlob(0, &uncompressedLength, &uncompressed);
     NS_ENSURE_SUCCESS(rv, rv);
 
+    static const fallible_t fallible = fallible_t();
     size_t compressedLength = snappy::MaxCompressedLength(uncompressedLength);
-    nsAutoArrayPtr<char> compressed(new char[compressedLength]);
+    nsAutoArrayPtr<char> compressed(new (fallible) char[compressedLength]);
+    NS_ENSURE_TRUE(compressed, NS_ERROR_OUT_OF_MEMORY);
 
     snappy::RawCompress(reinterpret_cast<const char*>(uncompressed),
                         uncompressedLength, compressed.get(),
diff --git a/dom/inputmethod/forms.js b/dom/inputmethod/forms.js
index 8bd5b48daccf..78318ee62274 100644
--- a/dom/inputmethod/forms.js
+++ b/dom/inputmethod/forms.js
@@ -767,6 +767,12 @@ function isPlainTextField(element) {
 }
 
 function getJSON(element, focusCounter) {
+  // <input type=number> has a nested anonymous <input type=text> element that
+  // takes focus on behalf of the number control when someone tries to focus
+  // the number control. If |element| is such an anonymous text control then we
+  // need it's number control here in order to get the correct 'type' etc.:
+  element = element.ownerNumberControl || element;
+
   let type = element.type || "";
   let value = element.value || "";
   let max = element.max || "";
diff --git a/dom/interfaces/core/nsIInlineEventHandlers.idl b/dom/interfaces/core/nsIInlineEventHandlers.idl
index cd123bc6f036..38ef4c6b78b9 100644
--- a/dom/interfaces/core/nsIInlineEventHandlers.idl
+++ b/dom/interfaces/core/nsIInlineEventHandlers.idl
@@ -7,7 +7,7 @@
 #include "jspubtd.h"
 %}
 
-[scriptable, uuid(22df6ed6-d094-4e45-97fc-a8eca11c390c)]
+[scriptable, uuid(6c1fcf3d-119b-4cf4-9437-b9357508976a)]
 interface nsIInlineEventHandlers : nsISupports
 {
   [implicit_jscontext] attribute jsval onabort;
@@ -71,6 +71,17 @@ interface nsIInlineEventHandlers : nsISupports
   [implicit_jscontext] attribute jsval onwaiting;
   [implicit_jscontext] attribute jsval onwheel;
 
+  [implicit_jscontext] attribute jsval onpointerdown;
+  [implicit_jscontext] attribute jsval onpointermove;
+  [implicit_jscontext] attribute jsval onpointerout;
+  [implicit_jscontext] attribute jsval onpointerover;
+  [implicit_jscontext] attribute jsval onpointerup;
+  [implicit_jscontext] attribute jsval onpointerenter;
+  [implicit_jscontext] attribute jsval onpointerleave;
+  [implicit_jscontext] attribute jsval ongotpointercapture;
+  [implicit_jscontext] attribute jsval onlostpointercapture;
+  [implicit_jscontext] attribute jsval onpointercancel;
+
   /**
    * Non-HTML5 event attributes
    */
diff --git a/dom/interfaces/events/nsIDOMEvent.idl b/dom/interfaces/events/nsIDOMEvent.idl
index 4abaa7e45b50..f3eabd56c53d 100644
--- a/dom/interfaces/events/nsIDOMEvent.idl
+++ b/dom/interfaces/events/nsIDOMEvent.idl
@@ -372,6 +372,11 @@ NS_NewDOMAnimationEvent(nsIDOMEvent** aInstancePtrResult,
                         nsPresContext* aPresContext,
                         mozilla::InternalAnimationEvent* aEvent);
 nsresult
+NS_NewDOMPointerEvent(nsIDOMEvent** aInstancePtrResult,
+                      mozilla::dom::EventTarget* aOwner,
+                      nsPresContext* aPresContext,
+                      mozilla::WidgetPointerEvent* aEvent);
+nsresult
 NS_NewDOMTouchEvent(nsIDOMEvent** aInstancePtrResult,
                     mozilla::dom::EventTarget* aOwner,
                     nsPresContext* aPresContext,
diff --git a/dom/ipc/ContentParent.cpp b/dom/ipc/ContentParent.cpp
index 96ab9f7b7864..596da8ed662f 100644
--- a/dom/ipc/ContentParent.cpp
+++ b/dom/ipc/ContentParent.cpp
@@ -1470,7 +1470,9 @@ ContentParent::ContentParent(mozIApplication* aApp,
     // which is otherwise a no-op, to sandbox it at an appropriate point
     // during startup.
     if (aOSPrivileges != base::PRIVILEGES_INHERIT) {
-        SendSetProcessPrivileges(base::PRIVILEGES_INHERIT);
+        if (!SendSetProcessPrivileges(base::PRIVILEGES_INHERIT)) {
+            KillHard();
+        }
     }
 #endif
 }
diff --git a/dom/ipc/TabChild.cpp b/dom/ipc/TabChild.cpp
index 85af550a8ef9..71834995ccc8 100644
--- a/dom/ipc/TabChild.cpp
+++ b/dom/ipc/TabChild.cpp
@@ -2476,8 +2476,7 @@ TabChild::GetFrom(nsIPresShell* aPresShell)
   if (!doc) {
       return nullptr;
   }
-  nsCOMPtr<nsISupports> container = doc->GetContainer();
-  nsCOMPtr<nsIDocShell> docShell(do_QueryInterface(container));
+  nsCOMPtr<nsIDocShell> docShell(doc->GetDocShell());
   return GetFrom(docShell);
 }
 
diff --git a/dom/ipc/TabParent.cpp b/dom/ipc/TabParent.cpp
index 0550f8d204aa..1852bbbc2d0c 100644
--- a/dom/ipc/TabParent.cpp
+++ b/dom/ipc/TabParent.cpp
@@ -842,10 +842,7 @@ TabParent::RecvSetStatus(const uint32_t& aType, const nsString& aStatus)
 {
   nsCOMPtr<nsIContent> frame = do_QueryInterface(mFrameElement);
   if (frame) {
-    nsCOMPtr<nsISupports> container = frame->OwnerDoc()->GetContainer();
-    if (!container)
-      return true;
-    nsCOMPtr<nsIDocShell> docShell = do_QueryInterface(container);
+    nsCOMPtr<nsIDocShell> docShell = frame->OwnerDoc()->GetDocShell();
     if (!docShell)
       return true;
     nsCOMPtr<nsIDocShellTreeOwner> treeOwner;
diff --git a/dom/network/interfaces/nsIDOMNetworkStatsManager.idl b/dom/network/interfaces/nsIDOMNetworkStatsManager.idl
index d0ba3c9a9acf..2aa0d922833f 100644
--- a/dom/network/interfaces/nsIDOMNetworkStatsManager.idl
+++ b/dom/network/interfaces/nsIDOMNetworkStatsManager.idl
@@ -20,7 +20,7 @@ interface nsIDOMMozNetworkStatsInterface : nsISupports
   readonly attribute DOMString id;
 };
 
-[scriptable,  uuid(5fbdcae6-a2cd-47b3-929f-83ac75bd4881)]
+[scriptable, uuid(5f033d31-c9a2-4e2d-83aa-6a807f1e0c11)]
 interface nsIDOMMozNetworkStatsManager : nsISupports
 {
   /**
@@ -53,9 +53,9 @@ interface nsIDOMMozNetworkStatsManager : nsISupports
   nsIDOMDOMRequest clearAllStats();
 
   /**
-   * Return currently available networks.
+   * Return available networks that used to be saved in the database.
    */
-  readonly attribute jsval availableNetworks; // array of nsIDOMMozNetworkStatsInterface.
+  nsIDOMDOMRequest getAvailableNetworks(); // array of nsIDOMMozNetworkStatsInterface.
 
   /**
    * Minimum time in milliseconds between samples stored in the database.
diff --git a/dom/network/src/NetworkStatsDB.jsm b/dom/network/src/NetworkStatsDB.jsm
index c8e64347cbf1..1e5530c8c201 100644
--- a/dom/network/src/NetworkStatsDB.jsm
+++ b/dom/network/src/NetworkStatsDB.jsm
@@ -474,6 +474,41 @@ NetworkStatsDB.prototype = {
     }
   },
 
+  getAvailableNetworks: function getAvailableNetworks(aResultCb) {
+    this.dbNewTxn("readonly", function(aTxn, aStore) {
+      if (!aTxn.result) {
+        aTxn.result = [];
+      }
+
+      let request = aStore.index("network").openKeyCursor(null, "nextunique");
+      request.onsuccess = function onsuccess(event) {
+        let cursor = event.target.result;
+        if (cursor) {
+          aTxn.result.push({ id: cursor.key[0],
+                             type: cursor.key[1] });
+          cursor.continue();
+          return;
+        }
+      };
+    }, aResultCb);
+  },
+
+  isNetworkAvailable: function isNetworkAvailable(aNetwork, aResultCb) {
+    this.dbNewTxn("readonly", function(aTxn, aStore) {
+      if (!aTxn.result) {
+        aTxn.result = false;
+      }
+
+      var network = [aNetwork.id, aNetwork.type];
+      let request = aStore.index("network").openKeyCursor(IDBKeyRange.only(network));
+      request.onsuccess = function onsuccess(event) {
+        if (event.target.result) {
+          aTxn.result = true;
+        }
+      };
+    }, aResultCb);
+  },
+
   get sampleRate () {
     return SAMPLE_RATE;
   },
diff --git a/dom/network/src/NetworkStatsManager.js b/dom/network/src/NetworkStatsManager.js
index da7a0d626569..22da59c0b708 100644
--- a/dom/network/src/NetworkStatsManager.js
+++ b/dom/network/src/NetworkStatsManager.js
@@ -128,7 +128,7 @@ NetworkStats.prototype = {
 // NetworkStatsManager
 
 const NETWORKSTATSMANAGER_CONTRACTID = "@mozilla.org/networkStatsManager;1";
-const NETWORKSTATSMANAGER_CID        = Components.ID("{5fbdcae6-a2cd-47b3-929f-83ac75bd4881}");
+const NETWORKSTATSMANAGER_CID        = Components.ID("{5f033d31-c9a2-4e2d-83aa-6a807f1e0c11}");
 const nsIDOMMozNetworkStatsManager   = Components.interfaces.nsIDOMMozNetworkStatsManager;
 
 function NetworkStatsManager() {
@@ -189,16 +189,13 @@ NetworkStatsManager.prototype = {
     return request;
   },
 
-  get availableNetworks() {
+  getAvailableNetworks: function getAvailableNetworks() {
     this.checkPrivileges();
 
-    let result = ObjectWrapper.wrap(cpmm.sendSyncMessage("NetworkStats:Networks")[0], this._window);
-    let networks = this.data = Cu.createArrayIn(this._window);
-    for (let i = 0; i < result.length; i++) {
-      networks.push(new NetworkStatsInterface(result[i]));
-    }
-
-    return networks;
+    let request = this.createRequest();
+    cpmm.sendAsyncMessage("NetworkStats:GetAvailableNetworks",
+                          { id: this.getRequestId(request) });
+    return request;
   },
 
   get sampleRate() {
@@ -239,6 +236,20 @@ NetworkStatsManager.prototype = {
         Services.DOMRequest.fireSuccess(req, result);
         break;
 
+      case "NetworkStats:GetAvailableNetworks:Return":
+        if (msg.error) {
+          Services.DOMRequest.fireError(req, msg.error);
+          return;
+        }
+
+        let networks = Cu.createArrayIn(this._window);
+        for (let i = 0; i < msg.result.length; i++) {
+          networks.push(new NetworkStatsInterface(msg.result[i]));
+        }
+
+        Services.DOMRequest.fireSuccess(req, networks);
+        break;
+
       case "NetworkStats:Clear:Return":
       case "NetworkStats:ClearAll:Return":
         if (msg.error) {
@@ -280,6 +291,7 @@ NetworkStatsManager.prototype = {
     }
 
     this.initDOMRequestHelper(aWindow, ["NetworkStats:Get:Return",
+                                        "NetworkStats:GetAvailableNetworks:Return",
                                         "NetworkStats:Clear:Return",
                                         "NetworkStats:ClearAll:Return"]);
   },
@@ -294,7 +306,8 @@ NetworkStatsManager.prototype = {
   classID : NETWORKSTATSMANAGER_CID,
   QueryInterface : XPCOMUtils.generateQI([nsIDOMMozNetworkStatsManager,
                                          Ci.nsIDOMGlobalPropertyInitializer,
-                                         Ci.nsISupportsWeakReference]),
+                                         Ci.nsISupportsWeakReference,
+                                         Ci.nsIObserver]),
 
   classInfo : XPCOMUtils.generateCI({classID: NETWORKSTATSMANAGER_CID,
                                      contractID: NETWORKSTATSMANAGER_CONTRACTID,
diff --git a/dom/network/src/NetworkStatsManager.manifest b/dom/network/src/NetworkStatsManager.manifest
index 4e6e4d33c215..1104719aa673 100644
--- a/dom/network/src/NetworkStatsManager.manifest
+++ b/dom/network/src/NetworkStatsManager.manifest
@@ -7,6 +7,6 @@ contract @mozilla.org/networkStats;1 {b6fc4b14-628d-4c99-bf4e-e4ed56916cbe}
 component {f540615b-d803-43ff-8200-2a9d145a5645} NetworkStatsManager.js
 contract @mozilla.org/networkstatsinterface;1 {f540615b-d803-43ff-8200-2a9d145a5645}
 
-component {5fbdcae6-a2cd-47b3-929f-83ac75bd4881} NetworkStatsManager.js
-contract @mozilla.org/networkStatsManager;1 {5fbdcae6-a2cd-47b3-929f-83ac75bd4881}
+component {5f033d31-c9a2-4e2d-83aa-6a807f1e0c11} NetworkStatsManager.js
+contract @mozilla.org/networkStatsManager;1 {5f033d31-c9a2-4e2d-83aa-6a807f1e0c11}
 category JavaScript-navigator-property mozNetworkStats @mozilla.org/networkStatsManager;1
diff --git a/dom/network/src/NetworkStatsService.jsm b/dom/network/src/NetworkStatsService.jsm
index 098b9df262f7..7af2aeba99ef 100644
--- a/dom/network/src/NetworkStatsService.jsm
+++ b/dom/network/src/NetworkStatsService.jsm
@@ -88,7 +88,7 @@ this.NetworkStatsService = {
     this.messages = ["NetworkStats:Get",
                      "NetworkStats:Clear",
                      "NetworkStats:ClearAll",
-                     "NetworkStats:Networks",
+                     "NetworkStats:GetAvailableNetworks",
                      "NetworkStats:SampleRate",
                      "NetworkStats:MaxStorageAge"];
 
@@ -130,8 +130,9 @@ this.NetworkStatsService = {
       case "NetworkStats:ClearAll":
         this.clearDB(mm, msg);
         break;
-      case "NetworkStats:Networks":
-        return this.availableNetworks();
+      case "NetworkStats:GetAvailableNetworks":
+        this.getAvailableNetworks(mm, msg);
+        break;
       case "NetworkStats:SampleRate":
         // This message is sync.
         return this._db.sampleRate;
@@ -158,6 +159,7 @@ this.NetworkStatsService = {
           break;
         }
 
+        debug("NetId: " + netId);
         this.updateStats(netId);
         break;
       case "xpcom-shutdown":
@@ -226,13 +228,11 @@ this.NetworkStatsService = {
     return aIccId + '' + aNetworkType;
   },
 
-  availableNetworks: function availableNetworks() {
-    let result = [];
-    for (let netId in this._networks) {
-      result.push(this._networks[netId].network);
-    }
-
-    return result;
+  getAvailableNetworks: function getAvailableNetworks(mm, msg) {
+    this._db.getAvailableNetworks(function onGetNetworks(aError, aResult) {
+      mm.sendAsyncMessage("NetworkStats:GetAvailableNetworks:Return",
+                          { id: msg.id, error: aError, result: aResult });
+    });
   },
 
   /*
@@ -248,12 +248,6 @@ this.NetworkStatsService = {
     let network = msg.network;
     let netId = this.getNetworkId(network.id, network.type);
 
-    if (!this._networks[netId]) {
-      mm.sendAsyncMessage("NetworkStats:Get:Return",
-                          { id: msg.id, error: "Invalid connectionType", result: null });
-      return;
-    }
-
     let appId = 0;
     let manifestURL = msg.manifestURL;
     if (manifestURL) {
@@ -269,17 +263,42 @@ this.NetworkStatsService = {
     let start = new Date(msg.start);
     let end = new Date(msg.end);
 
-    this.updateStats(netId, function onStatsUpdated(aResult, aMessage) {
-      debug("getstats for network " + network.id + " of type " + network.type);
-      debug("appId: " + appId + " from manifestURL: " + manifestURL);
+    // Check if the network is currently active. If yes, we need to update
+    // the cached stats first before retrieving stats from the DB.
+    if (this._networks[netId]) {
+      this.updateStats(netId, function onStatsUpdated(aResult, aMessage) {
+        debug("getstats for network " + network.id + " of type " + network.type);
+        debug("appId: " + appId + " from manifestURL: " + manifestURL);
 
-      this.updateCachedAppStats(function onAppStatsUpdated(aResult, aMessage) {
+        self.updateCachedAppStats(function onAppStatsUpdated(aResult, aMessage) {
+          self._db.find(function onStatsFound(aError, aResult) {
+            mm.sendAsyncMessage("NetworkStats:Get:Return",
+                                { id: msg.id, error: aError, result: aResult });
+          }, network, start, end, appId, manifestURL);
+        });
+      });
+      return;
+    }
+
+    // Check if the network is available in the DB. If yes, we also
+    // retrieve the stats for it from the DB.
+    this._db.isNetworkAvailable(network, function(aError, aResult) {
+      if (aResult) {
+        // If network is not active, there is no need to update stats.
         self._db.find(function onStatsFound(aError, aResult) {
           mm.sendAsyncMessage("NetworkStats:Get:Return",
                               { id: msg.id, error: aError, result: aResult });
         }, network, start, end, appId, manifestURL);
-      });
-    }.bind(this));
+        return;
+      }
+
+      if (!aError) {
+        aError = "Invalid connectionType";
+      }
+
+      mm.sendAsyncMessage("NetworkStats:Get:Return",
+                          { id: msg.id, error: aError, result: null });
+    });
   },
 
   clearInterfaceStats: function clearInterfaceStats(mm, msg) {
@@ -301,10 +320,19 @@ this.NetworkStatsService = {
   },
 
   clearDB: function clearDB(mm, msg) {
-    let networks = this.availableNetworks();
-    this._db.clearStats(networks, function onDBCleared(aError, aResult) {
-      mm.sendAsyncMessage("NetworkStats:ClearAll:Return",
-                          { id: msg.id, error: aError, result: aResult });
+    let self = this;
+    this._db.getAvailableNetworks(function onGetNetworks(aError, aResult) {
+      if (aError) {
+        mm.sendAsyncMessage("NetworkStats:ClearAll:Return",
+                            { id: msg.id, error: aError, result: aResult });
+        return;
+      }
+
+      let networks = aResult;
+      self._db.clearStats(networks, function onDBCleared(aError, aResult) {
+        mm.sendAsyncMessage("NetworkStats:ClearAll:Return",
+                            { id: msg.id, error: aError, result: aResult });
+      });
     });
   },
 
diff --git a/dom/network/tests/test_networkstats_basics.html b/dom/network/tests/test_networkstats_basics.html
index 171aa4eb79b0..70621a33474a 100644
--- a/dom/network/tests/test_networkstats_basics.html
+++ b/dom/network/tests/test_networkstats_basics.html
@@ -19,11 +19,6 @@ function test() {
   netStats = navigator.mozNetworkStats;
 
   // Test IDL attributes
-  ok('availableNetworks' in netStats,
-   "availableNetworks should be a NetworkStats attribute");
-  ok(Array.isArray(netStats.availableNetworks) && netStats.availableNetworks.length > 0,
-   "availableNetworks is an array not empty.");
-
   ok('sampleRate' in netStats,
    "sampleRate should be a NetworkStats attribute");
   ok(netStats.sampleRate > 0,
@@ -70,6 +65,19 @@ var index = -1;
 var netStats = null;
 
 var steps = [
+  function () {
+    // Test getAvailableNetworks
+    req = netStats.getAvailableNetworks();
+    req.onsuccess = function () {
+      ok(true, "getAvailableNetworks request ok");
+      ok(Array.isArray(req.result) && req.result.length > 0,
+         "getAvailableNetworks returns an array not empty");
+      next();
+    };
+    req.onerror = function () {
+      ok(false, "getAvailableNetworks failure!");
+    }
+  },
   function () {
     // Test clearAllStats
     req = netStats.clearAllStats();
@@ -85,22 +93,29 @@ var steps = [
     // Check if getSamples launch exception when start is greather than end
 
     // Prepare get params
-    var network = netStats.availableNetworks[0];
-    // Get dates
-    var endDate = new Date();
-    var startDate = new Date(endDate.getTime() + 1000);
+    req = netStats.getAvailableNetworks();
+    req.onsuccess = function () {
+      var network = req.result[0];
 
-    try {
-      netStats.getSamples(network, startDate, endDate);
-    } catch(ex) {
-      ok(true, "getSamples launch exception when start is greater than end");
+      // Get dates
+      var endDate = new Date();
+      var startDate = new Date(endDate.getTime() + 1000);
+
+      try {
+        netStats.getSamples(network, startDate, endDate);
+      } catch(ex) {
+        ok(true, "getSamples launch exception when start is greater than end");
+        next();
+        return;
+      }
+
+      ok(false, "getSamples launch exception when start is greater than end");
       next();
       return;
+    };
+    req.onerror = function () {
+      ok(false, "Error getting networks!");
     }
-
-    ok(false, "getSamples launch exception when start is greater than end");
-    next();
-    return;
   },
   function () {
     // Test if call getSamples with network of type different than
@@ -127,119 +142,151 @@ var steps = [
     // Test if call getSamples with start parameter type different than Date launch an exception
 
     // Prepare get params
-    var network = netStats.availableNetworks[0];
-    var endDate = new Date();
-    var startDate = new Date(endDate.getTime() - 1000);
-    startDate = startDate.toString();
+    req = netStats.getAvailableNetworks();
+    req.onsuccess = function () {
+      var network = req.result[0];
 
-    try {
-      netStats.getSamples(network, startDate, endDate);
-    } catch(ex) {
-      ok(true, "getSamples launch exception when start param is not a Date");
-      next();
-      return;
-    }
+      var endDate = new Date();
+      var startDate = new Date(endDate.getTime() - 1000);
+      startDate = startDate.toString();
 
-    ok(false, "getSamples launch exception when start param is not a Date");
+      try {
+        netStats.getSamples(network, startDate, endDate);
+      } catch(ex) {
+        ok(true, "getSamples launch exception when start param is not a Date");
+        next();
+        return;
+      }
+
+      ok(false, "getSamples launch exception when start param is not a Date");
+    };
+    req.onerror = function () {
+      ok(false, "Error getting networks!");
+    };
   },
   function () {
     // Test if call getSamples with end parameter type different than Date launch an exception
 
     // Prepare get params
-    var network = netStats.availableNetworks[0];
-    var endDate = new Date();
-    var startDate = new Date(endDate.getTime() - 1000);
-    endDate = startDate.toString();
+    req = netStats.getAvailableNetworks();
+    req.onsuccess = function () {
+      var network = req.result[0];
 
-    try {
-      netStats.getSamples(network, startDate, endDate);
-    } catch(ex) {
-      ok(true, "getSamples launch exception when end param is not a Date");
-      next();
-      return;
-    }
+      var endDate = new Date();
+      var startDate = new Date(endDate.getTime() - 1000);
+      endDate = startDate.toString();
 
-    ok(false, "getSamples launch exception when end param is not a Date");
+      try {
+        netStats.getSamples(network, startDate, endDate);
+      } catch(ex) {
+        ok(true, "getSamples launch exception when end param is not a Date");
+        next();
+        return;
+      }
+
+      ok(false, "getSamples launch exception when end param is not a Date");
+    };
+    req.onerror = function () {
+      ok(false, "Error getting networks!");
+    };
   },
   function () {
     ok(true, "Get stats for a network and dates adapted to samplerate");
     // Prepare get params
-    var network = netStats.availableNetworks[0];
-    var diff = 2;
-    // Get samplerate in millis
-    var sampleRate = netStats.sampleRate;
-    // Get date with samplerate's precision
-    var offset = new Date().getTimezoneOffset() * 60 * 1000;
-    var endDate = new Date(Math.floor((new Date().getTime() - offset) / sampleRate)
-                           * sampleRate + offset);
-    var startDate = new Date(endDate.getTime() - (sampleRate * diff));
-    // Calculate the number of samples that should be returned based on the
-    // the samplerate and including final and initial samples.
-    var samples = (endDate.getTime() - startDate.getTime()) / sampleRate + 1;
-
-    // Launch request
-    req = netStats.getSamples(network, startDate, endDate);
+    req = netStats.getAvailableNetworks();
     req.onsuccess = function () {
-      ok(true, "Get system stats request ok");
-      ok(req.result.manifestURL == null, "manifestURL should be null");
-      ok(compareNetworks(req.result.network, network), "networks should be equals");
-      ok(req.result.start.getTime() == startDate.getTime(), "starts should be equals");
-      ok(req.result.end.getTime() == endDate.getTime(), "ends should be equals");
-      var data = req.result.data;
-      ok(Array.isArray(data) && data.length == samples,
-         "data is an array of length " + samples);
-      checkDataDates(data, startDate, endDate, sampleRate);
-      next();
+      var network = req.result[0];
+      var diff = 2;
+      // Get samplerate in millis
+      var sampleRate = netStats.sampleRate;
+      // Get date with samplerate's precision
+      var offset = new Date().getTimezoneOffset() * 60 * 1000;
+      var endDate = new Date(Math.floor((new Date().getTime() - offset) / sampleRate)
+                             * sampleRate + offset);
+      var startDate = new Date(endDate.getTime() - (sampleRate * diff));
+      // Calculate the number of samples that should be returned based on the
+      // the samplerate and including final and initial samples.
+      var samples = (endDate.getTime() - startDate.getTime()) / sampleRate + 1;
+
+      // Launch request
+      req = netStats.getSamples(network, startDate, endDate);
+      req.onsuccess = function () {
+        ok(true, "Get system stats request ok");
+        ok(req.result.manifestURL == null, "manifestURL should be null");
+        ok(compareNetworks(req.result.network, network), "networks should be equals");
+        ok(req.result.start.getTime() == startDate.getTime(), "starts should be equals");
+        ok(req.result.end.getTime() == endDate.getTime(), "ends should be equals");
+        var data = req.result.data;
+        ok(Array.isArray(data) && data.length == samples,
+           "data is an array of length " + samples);
+        checkDataDates(data, startDate, endDate, sampleRate);
+        next();
+      };
+      req.onerror = function () {
+        ok(false, "Get stats failure!");
+      }
     };
     req.onerror = function () {
-      ok(false, "Get stats failure!");
-    }
+      ok(false, "Error getting networks!");
+    };
   },
   function () {
     ok(true, "Get system stats for a network and dates not adapted to samplerate");
     // Prepare get params
-    var network = netStats.availableNetworks[0];
-    var diff = 2;
-    // Get samplerate in millis
-    var sampleRate = netStats.sampleRate;
-    var endDate = new Date();
-    var startDate = new Date(endDate.getTime() - (sampleRate * diff));
-    // Calculate the number of samples that should be returned based on the
-    // the samplerate, including final and initial samples and taking into
-    // account that these will be filtered according to precision.
-    var samples = (Math.floor(endDate.getTime() / (sampleRate)) * sampleRate -
-                   Math.floor(startDate.getTime() / (sampleRate)) * sampleRate) / sampleRate + 1;
-
-    // Launch request
-    req = netStats.getSamples(network, startDate, endDate);
+    req = netStats.getAvailableNetworks();
     req.onsuccess = function () {
-      ok(true, "Get stats request ok");
-      ok(req.result.manifestURL == null, "manifestURL should be null");
-      ok(compareNetworks(req.result.network, network), "networks should be equals");
-      ok(req.result.start.getTime() == startDate.getTime(), "starts should be equals");
-      ok(req.result.end.getTime() == endDate.getTime(), "ends should be equals");
-      var data = req.result.data;
-      ok(Array.isArray(data) && data.length == samples,
-         "data is an array of length " + samples);
-      checkDataDates(data, startDate, endDate, sampleRate);
-      next();
+      var network = req.result[0];
+      var diff = 2;
+      // Get samplerate in millis
+      var sampleRate = netStats.sampleRate;
+      var endDate = new Date();
+      var startDate = new Date(endDate.getTime() - (sampleRate * diff));
+      // Calculate the number of samples that should be returned based on the
+      // the samplerate, including final and initial samples and taking into
+      // account that these will be filtered according to precision.
+      var samples = (Math.floor(endDate.getTime() / (sampleRate)) * sampleRate -
+                     Math.floor(startDate.getTime() / (sampleRate)) * sampleRate) / sampleRate + 1;
+
+      // Launch request
+      req = netStats.getSamples(network, startDate, endDate);
+      req.onsuccess = function () {
+        ok(true, "Get stats request ok");
+        ok(req.result.manifestURL == null, "manifestURL should be null");
+        ok(compareNetworks(req.result.network, network), "networks should be equals");
+        ok(req.result.start.getTime() == startDate.getTime(), "starts should be equals");
+        ok(req.result.end.getTime() == endDate.getTime(), "ends should be equals");
+        var data = req.result.data;
+        ok(Array.isArray(data) && data.length == samples,
+           "data is an array of length " + samples);
+        checkDataDates(data, startDate, endDate, sampleRate);
+        next();
+      };
+      req.onerror = function () {
+        ok(false, "Get stats failure!");
+      }
     };
     req.onerror = function () {
-      ok(false, "Get stats failure!");
-    }
+      ok(false, "Error getting networks!");
+    };
   },
   function () {
     // Test clearStats
-    var network = netStats.availableNetworks[0];
-
-    req = netStats.clearStats(network);
+    req = netStats.getAvailableNetworks();
     req.onsuccess = function () {
-      ok(true, "clearStats deleted the database");
-      next();
+      var network = req.result[0];
+
+      req = netStats.clearStats(network);
+      req.onsuccess = function () {
+        ok(true, "clearStats deleted the database");
+        next();
+      };
+      req.onerror = function () {
+        ok(false, "clearStats deleted the database");
+      }
     };
     req.onerror = function () {
-      ok(false, "clearStats deleted the database");
-    }
+      ok(false, "Error getting networks!");
+    };
   },
   function () {
     ok(true, "all done!\n");
diff --git a/dom/network/tests/test_networkstats_enabled_no_perm.html b/dom/network/tests/test_networkstats_enabled_no_perm.html
index cb9308600434..39615f968e6b 100644
--- a/dom/network/tests/test_networkstats_enabled_no_perm.html
+++ b/dom/network/tests/test_networkstats_enabled_no_perm.html
@@ -12,7 +12,7 @@
 <pre id="test">
 <script type="application/javascript">
 
-// Test to ensure NetworkStats is enabled but mozNetworkStats.availableNetworks
+// Test to ensure NetworkStats is enabled but mozNetworkStats.getAvailableNetworks
 // does not work in content.
 
 SpecialPowers.setBoolPref("dom.mozNetworkStats.enabled", true);
@@ -22,12 +22,12 @@ ok('mozNetworkStats' in navigator, "navigator.mozNetworkStats should be accessib
 
 var error;
 try {
-  navigator.mozNetworkStats.availableNetworks;
-  ok(false, "Accessing navigator.mozNetworkStats.availableNetworks should have thrown!");
+  navigator.mozNetworkStats.getAvailableNetworks;
+  ok(false, "Accessing navigator.mozNetworkStats.getAvailableNetworks should have thrown!");
 } catch (ex) {
   error = ex;
 }
-ok(error, "Got an exception accessing navigator.mozNetworkStats.availableNetworks");
+ok(error, "Got an exception accessing navigator.mozNetworkStats.getAvailableNetworks");
 
 </script>
 </pre>
diff --git a/dom/network/tests/unit_stats/test_networkstats_db.js b/dom/network/tests/unit_stats/test_networkstats_db.js
index b478f881dd90..6de5c4d75b16 100644
--- a/dom/network/tests/unit_stats/test_networkstats_db.js
+++ b/dom/network/tests/unit_stats/test_networkstats_db.js
@@ -7,6 +7,12 @@ Cu.import("resource://gre/modules/NetworkStatsDB.jsm");
 
 const netStatsDb = new NetworkStatsDB();
 
+function clearWholeDB(callback) {
+  netStatsDb.dbNewTxn("readwrite", function(aTxn, aStore) {
+    aStore.delete();
+  }, callback);
+}
+
 function filterTimestamp(date) {
   var sampleRate = netStatsDb.sampleRate;
   var offset = date.getTimezoneOffset() * 60 * 1000;
@@ -574,5 +580,9 @@ add_test(function test_saveMultipleAppStats () {
 function run_test() {
   do_get_profile();
 
-  run_next_test();
+  // Clear whole database to avoid start tests with unknown state
+  // due to previous tests.
+  clearWholeDB(function(){
+    run_next_test();
+  });
 }
diff --git a/dom/network/tests/unit_stats/test_networkstats_service.js b/dom/network/tests/unit_stats/test_networkstats_service.js
index d38906802739..31516eb4d865 100644
--- a/dom/network/tests/unit_stats/test_networkstats_service.js
+++ b/dom/network/tests/unit_stats/test_networkstats_service.js
@@ -3,33 +3,51 @@
 
 const {classes: Cc, interfaces: Ci, utils: Cu, results: Cr} = Components;
 
+function getNetworks(callback) {
+  NetworkStatsService._db.getAvailableNetworks(function onGetNetworks(aError, aResult) {
+    callback(aError, aResult);
+  });
+}
+
 add_test(function test_clearDB() {
-  var networks = NetworkStatsService.availableNetworks();
-  NetworkStatsService._db.clearStats(networks, function onDBCleared(error, result) {
-    do_check_eq(result, null);
-    run_next_test();
+  getNetworks(function onGetNetworks(error, result) {
+    do_check_eq(error, null);
+    var networks = result;
+    NetworkStatsService._db.clearStats(networks, function onDBCleared(error, result) {
+      do_check_eq(result, null);
+      run_next_test();
+    });
   });
 });
 
-function getNetworkId() {
-  var network = (NetworkStatsService.availableNetworks())[0];
-  return NetworkStatsService.getNetworkId(network.id, network.type);
+function getNetworkId(callback) {
+  getNetworks(function onGetNetworks(error, result) {
+    do_check_eq(error, null);
+    var netId = NetworkStatsService.getNetworkId(result[0].id, result[0].type);
+    callback(null, netId);
+  });
 }
 
 add_test(function test_networkStatsAvailable_ok() {
-  var netId = getNetworkId();
-  NetworkStatsService.networkStatsAvailable(function (success, msg) {
-    do_check_eq(success, true);
-    run_next_test();
-  }, netId, true, 1234, 4321, new Date());
+  getNetworkId(function onGetId(error, result) {
+    do_check_eq(error, null);
+    var netId = result;
+    NetworkStatsService.networkStatsAvailable(function (success, msg) {
+      do_check_eq(success, true);
+      run_next_test();
+    }, netId, true, 1234, 4321, new Date());
+  });
 });
 
 add_test(function test_networkStatsAvailable_failure() {
-  var netId = getNetworkId();
-  NetworkStatsService.networkStatsAvailable(function (success, msg) {
-    do_check_eq(success, false);
-    run_next_test();
-  }, netId, false, 1234, 4321, new Date());
+  getNetworkId(function onGetId(error, result) {
+    do_check_eq(error, null);
+    var netId = result;
+    NetworkStatsService.networkStatsAvailable(function (success, msg) {
+      do_check_eq(success, false);
+      run_next_test();
+    }, netId, false, 1234, 4321, new Date());
+  });
 });
 
 add_test(function test_update_invalidNetwork() {
@@ -41,10 +59,13 @@ add_test(function test_update_invalidNetwork() {
 });
 
 add_test(function test_update() {
-  var netId = getNetworkId();
-  NetworkStatsService.update(netId, function (success, msg) {
-    do_check_eq(success, true);
-    run_next_test();
+  getNetworkId(function onGetId(error, result) {
+    do_check_eq(error, null);
+    var netId = result;
+    NetworkStatsService.update(netId, function (success, msg) {
+      do_check_eq(success, true);
+      run_next_test();
+    });
   });
 });
 
@@ -71,10 +92,13 @@ add_test(function test_updateAllStats() {
 });
 
 add_test(function test_updateStats_ok() {
-  var netId = getNetworkId();
-  NetworkStatsService.updateStats(netId, function(success, msg){
-    do_check_eq(success, true);
-    run_next_test();
+  getNetworkId(function onGetId(error, result) {
+    do_check_eq(error, null);
+    var netId = result;
+    NetworkStatsService.updateStats(netId, function(success, msg){
+      do_check_eq(success, true);
+      run_next_test();
+    });
   });
 });
 
diff --git a/dom/payment/Payment.js b/dom/payment/Payment.js
index 746999e183ac..100b9a8ff20f 100644
--- a/dom/payment/Payment.js
+++ b/dom/payment/Payment.js
@@ -30,7 +30,8 @@ PaymentContentHelper.prototype = {
 
   QueryInterface: XPCOMUtils.generateQI([Ci.nsINavigatorPayment,
                                          Ci.nsIDOMGlobalPropertyInitializer,
-                                         Ci.nsISupportsWeakReference]),
+                                         Ci.nsISupportsWeakReference,
+                                         Ci.nsIObserver]),
   classID:        PAYMENTCONTENTHELPER_CID,
   classInfo:      XPCOMUtils.generateCI({
     classID: PAYMENTCONTENTHELPER_CID,
diff --git a/dom/phonenumberutils/PhoneNumberService.js b/dom/phonenumberutils/PhoneNumberService.js
index 5cfe7f3b715f..a91d8635442d 100644
--- a/dom/phonenumberutils/PhoneNumberService.js
+++ b/dom/phonenumberutils/PhoneNumberService.js
@@ -92,7 +92,8 @@ PhoneNumberService.prototype = {
   classID : Components.ID("{e2768710-eb17-11e2-91e2-0800200c9a66}"),
   contractID : "@mozilla.org/phoneNumberService;1",
   QueryInterface : XPCOMUtils.generateQI([Ci.nsIDOMGlobalPropertyInitializer,
-                                          Ci.nsISupportsWeakReference]),
+                                          Ci.nsISupportsWeakReference,
+                                          Ci.nsIObserver]),
 }
 
 this.NSGetFactory = XPCOMUtils.generateNSGetFactory([PhoneNumberService]);
diff --git a/dom/plugins/base/nsJSNPRuntime.cpp b/dom/plugins/base/nsJSNPRuntime.cpp
index 53b97e9a98f8..d602e91f9974 100644
--- a/dom/plugins/base/nsJSNPRuntime.cpp
+++ b/dom/plugins/base/nsJSNPRuntime.cpp
@@ -23,8 +23,10 @@
 #include "prmem.h"
 #include "nsIContent.h"
 #include "nsPluginInstanceOwner.h"
-#include "mozilla/HashFunctions.h"
 #include "nsWrapperCacheInlines.h"
+#include "js/HashTable.h"
+#include "mozilla/HashFunctions.h"
+
 
 #define NPRUNTIME_JSCLASS_NAME "NPObject JS wrapper class"
 
@@ -35,6 +37,21 @@ using namespace mozilla;
 using mozilla::plugins::PluginScriptableObjectParent;
 using mozilla::plugins::ParentNPObject;
 
+struct JSObjWrapperHasher : public js::DefaultHasher<nsJSObjWrapperKey>
+{
+  typedef nsJSObjWrapperKey Key;
+  typedef Key Lookup;
+
+  static uint32_t hash(const Lookup &l) {
+    return HashGeneric(l.mJSObj, l.mNpp);
+  }
+
+  static void rekey(Key &k, const Key& newKey) {
+    MOZ_ASSERT(k.mNpp == newKey.mNpp);
+    k.mJSObj = newKey.mJSObj;
+  }
+};
+
 // Hash of JSObject wrappers that wraps JSObjects as NPObjects. There
 // will be one wrapper per JSObject per plugin instance, i.e. if two
 // plugins access the JSObject x, two wrappers for x will be
@@ -42,7 +59,11 @@ using mozilla::plugins::ParentNPObject;
 // when a plugin is torn down in case there's a leak in the plugin (we
 // don't want to leak the world just because a plugin leaks an
 // NPObject).
-static PLDHashTable sJSObjWrappers;
+typedef js::HashMap<nsJSObjWrapperKey,
+                    nsJSObjWrapper*,
+                    JSObjWrapperHasher,
+                    js::SystemAllocPolicy> JSObjWrapperTable;
+static JSObjWrapperTable sJSObjWrappers;
 
 // Hash of NPObject wrappers that wrap NPObjects as JSObjects.
 static PLDHashTable sNPObjWrappers;
@@ -237,18 +258,16 @@ OnWrapperDestroyed()
   NS_ASSERTION(sWrapperCount, "Whaaa, unbalanced created/destroyed calls!");
 
   if (--sWrapperCount == 0) {
-    if (sJSObjWrappers.ops) {
-      NS_ASSERTION(sJSObjWrappers.entryCount == 0, "Uh, hash not empty?");
+    if (sJSObjWrappers.initialized()) {
+      MOZ_ASSERT(sJSObjWrappers.count() == 0);
 
       // No more wrappers, and our hash was initialized. Finish the
       // hash to prevent leaking it.
-      PL_DHashTableFinish(&sJSObjWrappers);
-
-      sJSObjWrappers.ops = nullptr;
+      sJSObjWrappers.finish();
     }
 
     if (sNPObjWrappers.ops) {
-      NS_ASSERTION(sNPObjWrappers.entryCount == 0, "Uh, hash not empty?");
+      MOZ_ASSERT(sNPObjWrappers.entryCount == 0);
 
       // No more wrappers, and our hash was initialized. Finish the
       // hash to prevent leaking it.
@@ -480,9 +499,8 @@ ReportExceptionIfPending(JSContext *cx)
   return false;
 }
 
-
 nsJSObjWrapper::nsJSObjWrapper(NPP npp)
-  : nsJSObjWrapperKey(nullptr, npp)
+  : mNpp(npp)
 {
   MOZ_COUNT_CTOR(nsJSObjWrapper);
   OnWrapperCreated();
@@ -498,6 +516,15 @@ nsJSObjWrapper::~nsJSObjWrapper()
   OnWrapperDestroyed();
 }
 
+void
+nsJSObjWrapper::ClearJSObject() {
+  // Unroot the object's JSObject
+  JS_RemoveObjectRootRT(sJSRuntime, &mJSObj);
+
+  // Forget our reference to the JSObject.
+  mJSObj = nullptr;
+}
+
 // static
 NPObject *
 nsJSObjWrapper::NP_Allocate(NPP npp, NPClass *aClass)
@@ -523,18 +550,13 @@ nsJSObjWrapper::NP_Invalidate(NPObject *npobj)
   nsJSObjWrapper *jsnpobj = (nsJSObjWrapper *)npobj;
 
   if (jsnpobj && jsnpobj->mJSObj) {
-    // Unroot the object's JSObject
-    JS_RemoveObjectRootRT(sJSRuntime, &jsnpobj->mJSObj);
 
-    if (sJSObjWrappers.ops) {
-      // Remove the wrapper from the hash
+    // Remove the wrapper from the hash
+    MOZ_ASSERT(sJSObjWrappers.initialized());
+    nsJSObjWrapperKey key(jsnpobj->mJSObj, jsnpobj->mNpp);
+    sJSObjWrappers.remove(key);
 
-      nsJSObjWrapperKey key(jsnpobj->mJSObj, jsnpobj->mNpp);
-      PL_DHashTableOperate(&sJSObjWrappers, &key, PL_DHASH_REMOVE);
-    }
-
-    // Forget our reference to the JSObject.
-    jsnpobj->mJSObj = nullptr;
+    jsnpobj->ClearJSObject();
   }
 }
 
@@ -915,34 +937,23 @@ nsJSObjWrapper::NP_Construct(NPObject *npobj, const NPVariant *args,
 }
 
 
-class JSObjWrapperHashEntry : public PLDHashEntryHdr
-{
-public:
-  nsJSObjWrapper *mJSObjWrapper;
-};
 
-
-static PLDHashNumber
-JSObjWrapperHash(PLDHashTable *table, const void *key)
-{
-  const nsJSObjWrapperKey *e = static_cast<const nsJSObjWrapperKey *>(key);
-  return HashGeneric(e->mJSObj, e->mNpp);
+/*
+ * This function is called during minor GCs for each key in the sJSObjWrappers
+ * table that has been moved.
+ */
+static void
+JSObjWrapperKeyMarkCallback(JSTracer *trc, void *key, void *data) {
+  JSObject *obj = static_cast<JSObject*>(key);
+  nsJSObjWrapper* wrapper = static_cast<nsJSObjWrapper*>(data);
+  JSObject *prior = obj;
+  JS_CallObjectTracer(trc, &obj, "sJSObjWrappers key object");
+  NPP npp = wrapper->mNpp;
+  nsJSObjWrapperKey oldKey(prior, npp);
+  nsJSObjWrapperKey newKey(obj, npp);
+  sJSObjWrappers.rekeyIfMoved(oldKey, newKey);
 }
 
-static bool
-JSObjWrapperHashMatchEntry(PLDHashTable *table, const PLDHashEntryHdr *entry,
-                           const void *key)
-{
-  const nsJSObjWrapperKey *objWrapperKey =
-    static_cast<const nsJSObjWrapperKey *>(key);
-  const JSObjWrapperHashEntry *e =
-    static_cast<const JSObjWrapperHashEntry *>(entry);
-
-  return (e->mJSObjWrapper->mJSObj == objWrapperKey->mJSObj &&
-          e->mJSObjWrapper->mNpp == objWrapperKey->mNpp);
-}
-
-
 // Look up or create an NPObject that wraps the JSObject obj.
 
 // static
@@ -990,22 +1001,9 @@ nsJSObjWrapper::GetNewOrUsed(NPP npp, JSContext *cx, JS::Handle<JSObject*> obj)
       return _retainobject(npobj);
   }
 
-  if (!sJSObjWrappers.ops) {
+  if (!sJSObjWrappers.initialized()) {
     // No hash yet (or any more), initialize it.
-
-    static const PLDHashTableOps ops =
-      {
-        PL_DHashAllocTable,
-        PL_DHashFreeTable,
-        JSObjWrapperHash,
-        JSObjWrapperHashMatchEntry,
-        PL_DHashMoveEntryStub,
-        PL_DHashClearEntryStub,
-        PL_DHashFinalizeStub
-      };
-
-    if (!PL_DHashTableInit(&sJSObjWrappers, &ops, nullptr,
-                           sizeof(JSObjWrapperHashEntry), 16)) {
+    if (!sJSObjWrappers.init(16)) {
       NS_ERROR("Error initializing PLDHashTable!");
 
       return nullptr;
@@ -1014,18 +1012,13 @@ nsJSObjWrapper::GetNewOrUsed(NPP npp, JSContext *cx, JS::Handle<JSObject*> obj)
 
   nsJSObjWrapperKey key(obj, npp);
 
-  JSObjWrapperHashEntry *entry = static_cast<JSObjWrapperHashEntry *>
-    (PL_DHashTableOperate(&sJSObjWrappers, &key, PL_DHASH_ADD));
+  JSObjWrapperTable::AddPtr p = sJSObjWrappers.lookupForAdd(key);
 
-  if (!entry) {
-    // Out of memory.
-    return nullptr;
-  }
-
-  if (PL_DHASH_ENTRY_IS_BUSY(entry) && entry->mJSObjWrapper) {
+  if (p/* && p->value*/) {
+    MOZ_ASSERT(p->value);
     // Found a live nsJSObjWrapper, return it.
 
-    return _retainobject(entry->mJSObjWrapper);
+    return _retainobject(p->value);
   }
 
   // No existing nsJSObjWrapper, create one.
@@ -1034,16 +1027,17 @@ nsJSObjWrapper::GetNewOrUsed(NPP npp, JSContext *cx, JS::Handle<JSObject*> obj)
     (nsJSObjWrapper *)_createobject(npp, &sJSObjWrapperNPClass);
 
   if (!wrapper) {
-    // OOM? Remove the stale entry from the hash.
-
-    PL_DHashTableRawRemove(&sJSObjWrappers, entry);
-
+    // Out of memory, entry not yet added to table.
     return nullptr;
   }
 
   wrapper->mJSObj = obj;
 
-  entry->mJSObjWrapper = wrapper;
+  if (!sJSObjWrappers.add(p, key, wrapper)) {
+    // Out of memory, free the wrapper we created.
+    _releaseobject(wrapper);
+    return nullptr;
+  }
 
   NS_ASSERTION(wrapper->mNpp == npp, "nsJSObjWrapper::mNpp not initialized!");
 
@@ -1052,13 +1046,15 @@ nsJSObjWrapper::GetNewOrUsed(NPP npp, JSContext *cx, JS::Handle<JSObject*> obj)
   if (!::JS_AddNamedObjectRoot(cx, &wrapper->mJSObj, "nsJSObjWrapper::mJSObject")) {
     NS_ERROR("Failed to root JSObject!");
 
+    sJSObjWrappers.remove(key);
     _releaseobject(wrapper);
 
-    PL_DHashTableRawRemove(&sJSObjWrappers, entry);
-
     return nullptr;
   }
 
+  // Add postbarrier for the hashtable key
+  JS_StoreObjectPostBarrierCallback(cx, JSObjWrapperKeyMarkCallback, obj, wrapper);
+
   return wrapper;
 }
 
@@ -1812,35 +1808,6 @@ nsNPObjWrapper::GetNewOrUsed(NPP npp, JSContext *cx, NPObject *npobj)
 }
 
 
-// PLDHashTable enumeration callbacks for destruction code.
-static PLDHashOperator
-JSObjWrapperPluginDestroyedCallback(PLDHashTable *table, PLDHashEntryHdr *hdr,
-                                    uint32_t number, void *arg)
-{
-  JSObjWrapperHashEntry *entry = (JSObjWrapperHashEntry *)hdr;
-
-  nsJSObjWrapper *npobj = entry->mJSObjWrapper;
-
-  if (npobj->mNpp == arg) {
-    // Prevent invalidate() and _releaseobject() from touching the hash
-    // we're enumerating.
-    const PLDHashTableOps *ops = table->ops;
-    table->ops = nullptr;
-
-    if (npobj->_class && npobj->_class->invalidate) {
-      npobj->_class->invalidate(npobj);
-    }
-
-    _releaseobject(npobj);
-
-    table->ops = ops;
-
-    return PL_DHASH_REMOVE;
-  }
-
-  return PL_DHASH_NEXT;
-}
-
 // Struct for passing an NPP and a JSContext to
 // NPObjWrapperPluginDestroyedCallback
 struct NppAndCx
@@ -1888,7 +1855,7 @@ NPObjWrapperPluginDestroyedCallback(PLDHashTable *table, PLDHashEntryHdr *hdr,
 
     ::JS_SetPrivate(entry->mJSObj, nullptr);
 
-    table->ops = ops;    
+    table->ops = ops;
 
     if (sDelayedReleases && sDelayedReleases->RemoveElement(npobj)) {
       OnWrapperDestroyed();
@@ -1904,9 +1871,16 @@ NPObjWrapperPluginDestroyedCallback(PLDHashTable *table, PLDHashEntryHdr *hdr,
 void
 nsJSNPRuntime::OnPluginDestroy(NPP npp)
 {
-  if (sJSObjWrappers.ops) {
-    PL_DHashTableEnumerate(&sJSObjWrappers,
-                           JSObjWrapperPluginDestroyedCallback, npp);
+  if (sJSObjWrappers.initialized()) {
+    for (JSObjWrapperTable::Enum e(sJSObjWrappers); !e.empty(); e.popFront()) {
+      nsJSObjWrapper *npobj = e.front().value;
+      MOZ_ASSERT(npobj->_class == &nsJSObjWrapper::sJSObjWrapperNPClass);
+      if (npobj->mNpp == npp) {
+        npobj->ClearJSObject();
+        _releaseobject(npobj);
+        e.removeFront();
+      }
+    }
   }
 
   // Use the safe JSContext here as we're not always able to find the
diff --git a/dom/plugins/base/nsJSNPRuntime.h b/dom/plugins/base/nsJSNPRuntime.h
index ba20f30c25b7..30869dbbdcac 100644
--- a/dom/plugins/base/nsJSNPRuntime.h
+++ b/dom/plugins/base/nsJSNPRuntime.h
@@ -25,20 +25,30 @@ public:
   {
   }
 
-  JSObject *mJSObj;
+  bool operator==(const nsJSObjWrapperKey& other) const {
+    return mJSObj == other.mJSObj && mNpp == other.mNpp;
+  }
+  bool operator!=(const nsJSObjWrapperKey& other) const {
+    return !(*this == other);
+  }
 
+  JSObject * mJSObj;
   const NPP mNpp;
 };
 
 extern const JSClass sNPObjectJSWrapperClass;
 
-class nsJSObjWrapper : public NPObject,
-                       public nsJSObjWrapperKey
+class nsJSObjWrapper : public NPObject
 {
 public:
+  JSObject *mJSObj;  /* Added as a GC root. */
+  const NPP mNpp;
+
   static NPObject *GetNewOrUsed(NPP npp, JSContext *cx,
                                 JS::Handle<JSObject*> obj);
 
+  void ClearJSObject();
+
 protected:
   nsJSObjWrapper(NPP npp);
   ~nsJSObjWrapper();
diff --git a/dom/promise/Promise.cpp b/dom/promise/Promise.cpp
index e715af35748e..4ec10453569d 100644
--- a/dom/promise/Promise.cpp
+++ b/dom/promise/Promise.cpp
@@ -320,7 +320,7 @@ Promise::Constructor(const GlobalObject& aGlobal,
 
 /* static */ already_AddRefed<Promise>
 Promise::Resolve(const GlobalObject& aGlobal, JSContext* aCx,
-                 JS::Handle<JS::Value> aValue, ErrorResult& aRv)
+                 const Optional<JS::Handle<JS::Value>>& aValue, ErrorResult& aRv)
 {
   nsCOMPtr<nsPIDOMWindow> window = do_QueryInterface(aGlobal.GetAsSupports());
   if (!window) {
@@ -330,13 +330,14 @@ Promise::Resolve(const GlobalObject& aGlobal, JSContext* aCx,
 
   nsRefPtr<Promise> promise = new Promise(window);
 
-  promise->MaybeResolveInternal(aCx, aValue);
+  promise->MaybeResolveInternal(aCx,
+    aValue.WasPassed() ? aValue.Value() : JS::UndefinedHandleValue);
   return promise.forget();
 }
 
 /* static */ already_AddRefed<Promise>
 Promise::Reject(const GlobalObject& aGlobal, JSContext* aCx,
-                JS::Handle<JS::Value> aValue, ErrorResult& aRv)
+                const Optional<JS::Handle<JS::Value>>& aValue, ErrorResult& aRv)
 {
   nsCOMPtr<nsPIDOMWindow> window = do_QueryInterface(aGlobal.GetAsSupports());
   if (!window) {
@@ -346,27 +347,28 @@ Promise::Reject(const GlobalObject& aGlobal, JSContext* aCx,
 
   nsRefPtr<Promise> promise = new Promise(window);
 
-  promise->MaybeRejectInternal(aCx, aValue);
+  promise->MaybeRejectInternal(aCx,
+    aValue.WasPassed() ? aValue.Value() : JS::UndefinedHandleValue);
   return promise.forget();
 }
 
 already_AddRefed<Promise>
-Promise::Then(const Optional<OwningNonNull<AnyCallback> >& aResolveCallback,
-              const Optional<OwningNonNull<AnyCallback> >& aRejectCallback)
+Promise::Then(const Optional<nsRefPtr<AnyCallback>>& aResolveCallback,
+              const Optional<nsRefPtr<AnyCallback>>& aRejectCallback)
 {
   nsRefPtr<Promise> promise = new Promise(GetParentObject());
 
   nsRefPtr<PromiseCallback> resolveCb =
     PromiseCallback::Factory(promise,
                              aResolveCallback.WasPassed()
-                               ? &aResolveCallback.Value()
+                               ? aResolveCallback.Value()
                                : nullptr,
                              PromiseCallback::Resolve);
 
   nsRefPtr<PromiseCallback> rejectCb =
     PromiseCallback::Factory(promise,
                              aRejectCallback.WasPassed()
-                               ? &aRejectCallback.Value()
+                               ? aRejectCallback.Value()
                                : nullptr,
                              PromiseCallback::Reject);
 
@@ -376,9 +378,9 @@ Promise::Then(const Optional<OwningNonNull<AnyCallback> >& aResolveCallback,
 }
 
 already_AddRefed<Promise>
-Promise::Catch(const Optional<OwningNonNull<AnyCallback> >& aRejectCallback)
+Promise::Catch(const Optional<nsRefPtr<AnyCallback>>& aRejectCallback)
 {
-  Optional<OwningNonNull<AnyCallback> > resolveCb;
+  Optional<nsRefPtr<AnyCallback>> resolveCb;
   return Then(resolveCb, aRejectCallback);
 }
 
diff --git a/dom/promise/Promise.h b/dom/promise/Promise.h
index f416e647e6bd..dea5ace85d47 100644
--- a/dom/promise/Promise.h
+++ b/dom/promise/Promise.h
@@ -66,19 +66,19 @@ public:
 
   static already_AddRefed<Promise>
   Resolve(const GlobalObject& aGlobal, JSContext* aCx,
-          JS::Handle<JS::Value> aValue, ErrorResult& aRv);
+          const Optional<JS::Handle<JS::Value>>& aValue, ErrorResult& aRv);
 
   static already_AddRefed<Promise>
   Reject(const GlobalObject& aGlobal, JSContext* aCx,
-         JS::Handle<JS::Value> aValue, ErrorResult& aRv);
+         const Optional<JS::Handle<JS::Value>>& aValue, ErrorResult& aRv);
 
   already_AddRefed<Promise>
-  Then(const Optional<OwningNonNull<AnyCallback> >& aResolveCallback,
-       const Optional<OwningNonNull<AnyCallback> >& aRejectCallback);
+  Then(const Optional<nsRefPtr<AnyCallback>>& aResolveCallback,
+       const Optional<nsRefPtr<AnyCallback>>& aRejectCallback);
 
 
   already_AddRefed<Promise>
-  Catch(const Optional<OwningNonNull<AnyCallback> >& aRejectCallback);
+  Catch(const Optional<nsRefPtr<AnyCallback>>& aRejectCallback);
 
   void AppendNativeHandler(PromiseNativeHandler* aRunnable);
 
diff --git a/dom/promise/tests/test_promise.html b/dom/promise/tests/test_promise.html
index 3e5b1f3cad6a..fceaa68cc4d8 100644
--- a/dom/promise/tests/test_promise.html
+++ b/dom/promise/tests/test_promise.html
@@ -34,6 +34,22 @@ function promiseResolve() {
   });
 }
 
+function promiseResolveNoArg() {
+  var promise = new Promise(function(resolve, reject) {
+    ok(resolve, "Promise.resolve exists");
+    ok(reject, "Promise.reject exists");
+
+    resolve();
+  }).then(function(what) {
+    ok(true, "Then - resolveCb has been called");
+    is(what, undefined, "ResolveCb received undefined");
+    runTest();
+  }, function() {
+    ok(false, "Then - rejectCb has been called");
+    runTest();
+  });
+}
+
 function promiseReject() {
   var promise = new Promise(function(resolve, reject) {
     reject(42);
@@ -47,6 +63,19 @@ function promiseReject() {
   });
 }
 
+function promiseRejectNoArg() {
+  var promise = new Promise(function(resolve, reject) {
+    reject();
+  }).then(function(what) {
+    ok(false, "Then - resolveCb has been called");
+    runTest();
+  }, function(what) {
+    ok(true, "Then - rejectCb has been called");
+    is(what, undefined, "RejectCb received undefined");
+    runTest();
+  });
+}
+
 function promiseException() {
   var promise = new Promise(function(resolve, reject) {
     throw 42;
@@ -164,6 +193,51 @@ function promiseThenCatchThen() {
   });
 }
 
+function promiseThenNoArg() {
+  var promise = new Promise(function(resolve, reject) {
+    resolve(42);
+  });
+
+  var clone = promise.then();
+  isnot(promise, clone, "These 2 promise objs are different");
+  promise.then(function(v) {
+    clone.then(function(cv) {
+      is(v, cv, "Both resolve to the same value");
+      runTest();
+    });
+  });
+}
+
+function promiseThenUndefinedResolveFunction() {
+  var promise = new Promise(function(resolve, reject) {
+    reject(42);
+  });
+
+  try {
+    promise.then(undefined, function(v) {
+      is(v, 42, "Promise rejected with 42");
+      runTest();
+    });
+  } catch (e) {
+    ok(false, "then should not throw on undefined resolve function");
+  }
+}
+
+function promiseThenNullResolveFunction() {
+  var promise = new Promise(function(resolve, reject) {
+    reject(42);
+  });
+
+  try {
+    promise.then(null, function(v) {
+      is(v, 42, "Promise rejected with 42");
+      runTest();
+    });
+  } catch (e) {
+    ok(false, "then should not throw on null resolve function");
+  }
+}
+
 function promiseRejectThenCatchThen() {
   var promise = new Promise(function(resolve, reject) {
     reject(42);
@@ -280,6 +354,21 @@ function promiseThenCatchOrderingReject() {
   });
 }
 
+function promiseCatchNoArg() {
+  var promise = new Promise(function(resolve, reject) {
+    reject(42);
+  });
+
+  var clone = promise.catch();
+  isnot(promise, clone, "These 2 promise objs are different");
+  promise.catch(function(v) {
+    clone.catch(function(cv) {
+      is(v, cv, "Both reject to the same value");
+      runTest();
+    });
+  });
+}
+
 function promiseNestedPromise() {
   new Promise(function(resolve, reject) {
     resolve(new Promise(function(resolve, reject) {
@@ -380,6 +469,12 @@ var tests = [ promiseResolve, promiseReject,
               promiseWrongNestedPromise, promiseLoop,
               promiseStaticReject, promiseStaticResolve,
               promiseResolveNestedPromise,
+              promiseResolveNoArg,
+              promiseRejectNoArg,
+              promiseThenNoArg,
+              promiseThenUndefinedResolveFunction,
+              promiseThenNullResolveFunction,
+              promiseCatchNoArg
             ];
 
 function runTest() {
diff --git a/dom/push/src/Push.js b/dom/push/src/Push.js
index 09d6da2b986e..81a253a25146 100644
--- a/dom/push/src/Push.js
+++ b/dom/push/src/Push.js
@@ -40,7 +40,8 @@ Push.prototype = {
   classID : PUSH_CID,
 
   QueryInterface : XPCOMUtils.generateQI([Ci.nsIDOMGlobalPropertyInitializer,
-                                          Ci.nsISupportsWeakReference]),
+                                          Ci.nsISupportsWeakReference,
+                                          Ci.nsIObserver]),
 
   init: function(aWindow) {
     // Set debug first so that all debugging actually works.
diff --git a/dom/quota/moz.build b/dom/quota/moz.build
index 2e88d564f760..94dc67cdd0b6 100644
--- a/dom/quota/moz.build
+++ b/dom/quota/moz.build
@@ -31,7 +31,7 @@ EXPORTS.mozilla.dom.quota += [
     'Utilities.h',
 ]
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'CheckQuotaHelper.cpp',
     'FileStreams.cpp',
     'QuotaManager.cpp',
diff --git a/dom/system/gonk/RILContentHelper.js b/dom/system/gonk/RILContentHelper.js
index 13b206f02441..3e0df151a7f2 100644
--- a/dom/system/gonk/RILContentHelper.js
+++ b/dom/system/gonk/RILContentHelper.js
@@ -491,7 +491,8 @@ RILContentHelper.prototype = {
                                          Ci.nsIVoicemailProvider,
                                          Ci.nsIIccProvider,
                                          Ci.nsIObserver,
-                                         Ci.nsISupportsWeakReference]),
+                                         Ci.nsISupportsWeakReference,
+                                         Ci.nsIObserver]),
   classID:   RILCONTENTHELPER_CID,
   classInfo: XPCOMUtils.generateCI({classID: RILCONTENTHELPER_CID,
                                     classDescription: "RILContentHelper",
@@ -556,7 +557,7 @@ RILContentHelper.prototype = {
     let rilContext = this.rilContexts[clientId];
 
     // Card is not detected, clear iccInfo to null.
-    if (!newInfo || !newInfo.iccType) {
+    if (!newInfo || !newInfo.iccType || !newInfo.iccid) {
       if (rilContext.iccInfo) {
         rilContext.iccInfo = null;
         this._deliverEvent(clientId,
diff --git a/dom/system/gonk/RadioInterfaceLayer.js b/dom/system/gonk/RadioInterfaceLayer.js
index 22f01ad15b1e..3750851a2a75 100644
--- a/dom/system/gonk/RadioInterfaceLayer.js
+++ b/dom/system/gonk/RadioInterfaceLayer.js
@@ -1562,6 +1562,7 @@ RadioInterface.prototype = {
       }
       this._radioOffTimer.initWithCallback(this._fireRadioOffTimer.bind(this),
                                            RADIO_POWER_OFF_TIMEOUT, Ci.nsITimer.TYPE_ONE_SHOT);
+      this._radioOffAfterDataDisconnected = true;
       return;
     }
     this.setRadioEnabled(false);
@@ -2004,7 +2005,7 @@ RadioInterface.prototype = {
     // Process pending radio power off request after all data calls
     // are disconnected.
     if (datacall.state == RIL.GECKO_NETWORK_STATE_UNKNOWN &&
-        this._changingRadioPower) {
+        this._radioOffAfterDataDisconnected) {
       let anyDataConnected = false;
       for each (let apnSetting in this.apnSettings.byApn) {
         for each (let type in apnSetting.types) {
@@ -2019,6 +2020,7 @@ RadioInterface.prototype = {
       }
       if (!anyDataConnected) {
         if (DEBUG) this.debug("All data connections are disconnected, set radio off.");
+        this._radioOffAfterDataDisconnected = false;
         this._cancelRadioOffTimer();
         this.setRadioEnabled(false);
       }
@@ -2282,6 +2284,10 @@ RadioInterface.prototype = {
   // the radio power.
   _changingRadioPower: false,
 
+  // Flag to determine if we need to set radio off when we are notified a data
+  // call has been disconnected.
+  _radioOffAfterDataDisconnected: false,
+
   // Data calls setting.
   dataCallSettings: null,
 
diff --git a/dom/system/gonk/ril_consts.js b/dom/system/gonk/ril_consts.js
index 07c2f7f34a47..ee09e3810dd6 100644
--- a/dom/system/gonk/ril_consts.js
+++ b/dom/system/gonk/ril_consts.js
@@ -2379,10 +2379,9 @@ this.GECKO_RADIOSTATE_UNAVAILABLE   = null;
 this.GECKO_RADIOSTATE_OFF           = "off";
 this.GECKO_RADIOSTATE_READY         = "ready";
 
-this.GECKO_CARDSTATE_NOT_READY                     = null;
+this.GECKO_CARDSTATE_UNDETECTED                    = null;
 this.GECKO_CARDSTATE_ILLEGAL                       = "illegal";
 this.GECKO_CARDSTATE_UNKNOWN                       = "unknown";
-this.GECKO_CARDSTATE_ABSENT                        = "absent";
 this.GECKO_CARDSTATE_PIN_REQUIRED                  = "pinRequired";
 this.GECKO_CARDSTATE_PUK_REQUIRED                  = "pukRequired";
 this.GECKO_CARDSTATE_PERSONALIZATION_IN_PROGRESS   = "personalizationInProgress";
diff --git a/dom/system/gonk/ril_worker.js b/dom/system/gonk/ril_worker.js
index 8e309176724f..fa8f98f0eb55 100644
--- a/dom/system/gonk/ril_worker.js
+++ b/dom/system/gonk/ril_worker.js
@@ -278,7 +278,7 @@ let RIL = {
     /**
      * Card state
      */
-    this.cardState = GECKO_CARDSTATE_UNKNOWN;
+    this.cardState = GECKO_CARDSTATE_UNDETECTED;
 
     /**
      * Strings
@@ -2954,51 +2954,36 @@ let RIL = {
   _processICCStatus: function _processICCStatus(iccStatus) {
     this.iccStatus = iccStatus;
     let newCardState;
-
-    if ((!iccStatus) || (iccStatus.cardState == CARD_STATE_ABSENT)) {
-      switch (this.radioState) {
-        case GECKO_RADIOSTATE_UNAVAILABLE:
-          newCardState = GECKO_CARDSTATE_UNKNOWN;
-          break;
-        case GECKO_RADIOSTATE_OFF:
-          newCardState = GECKO_CARDSTATE_NOT_READY;
-          break;
-        case GECKO_RADIOSTATE_READY:
-          if (DEBUG) {
-            debug("ICC absent");
-          }
-          newCardState = GECKO_CARDSTATE_ABSENT;
-          break;
-      }
-      if (newCardState == this.cardState) {
-        return;
-      }
-      this.iccInfo = {iccType: null};
-      ICCUtilsHelper.handleICCInfoChange();
-
-      this.cardState = newCardState;
-      this.sendChromeMessage({rilMessageType: "cardstatechange",
-                              cardState: this.cardState});
-      return;
-    }
-
     let index = this._isCdma ? iccStatus.cdmaSubscriptionAppIndex :
                                iccStatus.gsmUmtsSubscriptionAppIndex;
     let app = iccStatus.apps[index];
-    if (iccStatus.cardState == CARD_STATE_ERROR || !app) {
-      if (this.cardState == GECKO_CARDSTATE_UNKNOWN) {
+
+    // When |iccStatus.cardState| is not CARD_STATE_PRESENT or have incorrect
+    // app information, we can not get iccId. So treat ICC as undetected.
+    if (iccStatus.cardState !== CARD_STATE_PRESENT || !app) {
+      if (this.cardState !== GECKO_CARDSTATE_UNDETECTED) {
         this.operator = null;
-        return;
+        // We should send |cardstatechange| before |iccinfochange|, otherwise we
+        // may lost cardstatechange event when icc card becomes undetected.
+        this.cardState = GECKO_CARDSTATE_UNDETECTED;
+        this.sendChromeMessage({rilMessageType: "cardstatechange",
+                                cardState: this.cardState});
+
+        this.iccInfo = {iccType: null};
+        ICCUtilsHelper.handleICCInfoChange();
       }
-      this.operator = null;
-      this.cardState = GECKO_CARDSTATE_UNKNOWN;
-      this.sendChromeMessage({rilMessageType: "cardstatechange",
-                              cardState: this.cardState});
       return;
     }
+
     // fetchICCRecords will need to read aid, so read aid here.
     this.aid = app.aid;
     this.appType = app.app_type;
+    this.iccInfo.iccType = GECKO_CARD_TYPE[this.appType];
+    // Try to get iccId only when cardState left GECKO_CARDSTATE_UNDETECTED.
+    if (this.cardState === GECKO_CARDSTATE_UNDETECTED &&
+        iccStatus.cardState === CARD_STATE_PRESENT) {
+      ICCRecordHelper.readICCID();
+    }
 
     switch (app.app_state) {
       case CARD_APPSTATE_ILLEGAL:
@@ -3036,8 +3021,6 @@ let RIL = {
     // This was moved down from CARD_APPSTATE_READY
     this.requestNetworkInfo();
     if (newCardState == GECKO_CARDSTATE_READY) {
-      this.iccInfo.iccType = GECKO_CARD_TYPE[this.appType];
-
       // For type SIM, we need to check EF_phase first.
       // Other types of ICC we can send Terminal_Profile immediately.
       if (this.appType == CARD_APPTYPE_SIM) {
@@ -11205,7 +11188,6 @@ let ICCRecordHelper = {
    * Fetch ICC records.
    */
   fetchICCRecords: function fetchICCRecords() {
-    this.readICCID();
     RIL.getIMSI();
     this.readAD();
     this.readSST();
@@ -13181,7 +13163,6 @@ let ICCContactHelper = {
 
 let RuimRecordHelper = {
   fetchRuimRecords: function fetchRuimRecords() {
-    ICCRecordHelper.readICCID();
     this.getIMSI_M();
     this.readCST();
     this.readCDMAHome();
diff --git a/dom/system/gonk/tests/test_ril_worker_icc.js b/dom/system/gonk/tests/test_ril_worker_icc.js
index 4aed5a3cb748..7201b84e2f3d 100644
--- a/dom/system/gonk/tests/test_ril_worker_icc.js
+++ b/dom/system/gonk/tests/test_ril_worker_icc.js
@@ -1719,8 +1719,11 @@ add_test(function test_personalization_state() {
   let worker = newUint8Worker();
   let ril = worker.RIL;
 
+  worker.ICCRecordHelper.readICCID = function fakeReadICCID() {};
+
   function testPersonalization(cardPersoState, geckoCardState) {
     let iccStatus = {
+      cardState: CARD_STATE_PRESENT,
       gsmUmtsSubscriptionAppIndex: 0,
       apps: [
         {
@@ -1758,8 +1761,11 @@ add_test(function test_card_app_state() {
   let worker = newUint8Worker();
   let ril = worker.RIL;
 
+  worker.ICCRecordHelper.readICCID = function fakeReadICCID() {};
+
   function testCardAppState(cardAppState, geckoCardState) {
     let iccStatus = {
+      cardState: CARD_STATE_PRESENT,
       gsmUmtsSubscriptionAppIndex: 0,
       apps: [
       {
@@ -1794,8 +1800,11 @@ add_test(function test_icc_permanent_blocked() {
   let worker = newUint8Worker();
   let ril = worker.RIL;
 
+  worker.ICCRecordHelper.readICCID = function fakeReadICCID() {};
+
   function testPermanentBlocked(pin1_replaced, universalPINState, pin1) {
     let iccStatus = {
+      cardState: CARD_STATE_PRESENT,
       gsmUmtsSubscriptionAppIndex: 0,
       universalPINState: universalPINState,
       apps: [
diff --git a/dom/system/gonk/tests/test_ril_worker_ruim.js b/dom/system/gonk/tests/test_ril_worker_ruim.js
index c80ed4014eac..47fb987a973e 100644
--- a/dom/system/gonk/tests/test_ril_worker_ruim.js
+++ b/dom/system/gonk/tests/test_ril_worker_ruim.js
@@ -78,10 +78,6 @@ add_test(function test_fetch_ruim_recodes() {
   function testFetchRuimRecordes(expectCalled) {
     let ifCalled = [];
 
-    iccHelper.readICCID = function () {
-      ifCalled.push("readICCID");
-    };
-
     ruimHelper.getIMSI_M = function () {
       ifCalled.push("getIMSI_M");
     };
@@ -108,7 +104,7 @@ add_test(function test_fetch_ruim_recodes() {
     }
   }
 
-  let expectCalled = ["readICCID", "getIMSI_M", "readCST", "readCDMAHome",
+  let expectCalled = ["getIMSI_M", "readCST", "readCDMAHome",
                       "getCdmaSubscription"];
   testFetchRuimRecordes(expectCalled);
 
diff --git a/dom/telephony/test/marionette/test_outgoing_radio_off.js b/dom/telephony/test/marionette/test_outgoing_radio_off.js
index 28bd699e1aec..35faa87e2e90 100644
--- a/dom/telephony/test/marionette/test_outgoing_radio_off.js
+++ b/dom/telephony/test/marionette/test_outgoing_radio_off.js
@@ -26,14 +26,13 @@ function changeSetting(key, value, callback) {
 
 function setRadioEnabled(enabled, callback) {
   changeSetting("ril.radio.disabled", !enabled, function() {
-    icc.addEventListener("cardstatechange", function handler() {
-      // Wait until card state changes to "ready" after turning on radio.
-      // Wait until card state changes to "not-ready" after turning off radio.
-      if ((enabled && icc.cardState == "ready") ||
-          (!enabled && icc.cardState != "ready")) {
-        icc.removeEventListener("cardstatechange", handler);
-        callback();
-      }
+    // Wait for iccdetected event after turning on radio.
+    // Wait for iccundetected event after turning off radio.
+    let event = (enabled) ? "iccdetected" : "iccundetected";
+    icc.addEventListener(event, function handler(evt) {
+      log(event + ": " + evt.iccId);
+      icc.removeEventListener(event, handler);
+      callback();
     });
   });
 }
diff --git a/dom/tests/mochitest/general/test_interfaces.html b/dom/tests/mochitest/general/test_interfaces.html
index 57e13a6b4495..94509d340ccc 100644
--- a/dom/tests/mochitest/general/test_interfaces.html
+++ b/dom/tests/mochitest/general/test_interfaces.html
@@ -296,6 +296,7 @@ var interfaceNamesInGlobalScope =
     "HTMLUListElement",
     "HTMLUnknownElement",
     "HTMLVideoElement",
+    {name: "IccChangeEvent", b2g: true, pref: "dom.icc.enabled"},
     {name: "IccCardLockError", b2g: true, pref: "dom.icc.enabled"},
     "IDBCursor",
     "IDBCursorWithValue",
@@ -345,6 +346,7 @@ var interfaceNamesInGlobalScope =
     "MozCSSKeyframeRule",
     "MozCSSKeyframesRule",
     {name: "MozEmergencyCbModeEvent", b2g: true, pref: "dom.mobileconnection.enabled"},
+    {name: "MozIcc", b2g: true, pref: "dom.icc.enabled"},
     {name: "MozIccManager", b2g: true, pref: "dom.icc.enabled"},
     {name: "MozInputContext", b2g: true},
     {name: "MozInputMethodManager", b2g: true},
diff --git a/dom/time/moz.build b/dom/time/moz.build
index e7bdd99411a6..c7888cde018c 100644
--- a/dom/time/moz.build
+++ b/dom/time/moz.build
@@ -17,7 +17,7 @@ EXPORTS.mozilla.dom.time += [
     'TimeService.h',
 ]
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'DateCacheCleaner.cpp',
     'TimeChangeObserver.cpp',
     'TimeManager.cpp',
diff --git a/dom/webidl/EventHandler.webidl b/dom/webidl/EventHandler.webidl
index 088ab3c3f344..fd1d811b16b0 100644
--- a/dom/webidl/EventHandler.webidl
+++ b/dom/webidl/EventHandler.webidl
@@ -88,6 +88,22 @@ interface GlobalEventHandlers {
            attribute EventHandler onvolumechange;
            attribute EventHandler onwaiting;
 
+           // Pointer events handlers
+           [Pref="dom.w3c_pointer_events.enabled"]
+           attribute EventHandler onpointerdown;
+           [Pref="dom.w3c_pointer_events.enabled"]
+           attribute EventHandler onpointerup;
+           [Pref="dom.w3c_pointer_events.enabled"]
+           attribute EventHandler onpointermove;
+           [Pref="dom.w3c_pointer_events.enabled"]
+           attribute EventHandler onpointerout;
+           [Pref="dom.w3c_pointer_events.enabled"]
+           attribute EventHandler onpointerover;
+           [Pref="dom.w3c_pointer_events.enabled"]
+           attribute EventHandler onpointerenter;
+           [Pref="dom.w3c_pointer_events.enabled"]
+           attribute EventHandler onpointerleave;
+
            // Mozilla-specific handlers
            attribute EventHandler onmozfullscreenchange;
            attribute EventHandler onmozfullscreenerror;
diff --git a/dom/webidl/HTMLInputElement.webidl b/dom/webidl/HTMLInputElement.webidl
index ba1bb610f2ee..3c6f9c8c04d7 100644
--- a/dom/webidl/HTMLInputElement.webidl
+++ b/dom/webidl/HTMLInputElement.webidl
@@ -154,6 +154,18 @@ partial interface HTMLInputElement {
   [ChromeOnly]
   void mozSetFileNameArray(sequence<DOMString> fileNames);
 
+  // Number controls (<input type=number>) have an anonymous text control
+  // (<input type=text>) in the anonymous shadow tree that they contain. On
+  // such an anonymous text control this property provides access to the
+  // number control that owns the text control. This is useful, for example,
+  // in code that looks at the currently focused element to make decisions
+  // about which IME to bring up. Such code needs to be able to check for any
+  // owning number control since it probably wants to bring up a number pad
+  // instead of the standard keyboard, even when the anonymous text control has
+  // focus.
+  [ChromeOnly]
+  readonly attribute HTMLInputElement? ownerNumberControl;
+
   boolean mozIsTextField(boolean aExcludePassword);
 };
 
diff --git a/dom/webidl/IccChangeEvent.webidl b/dom/webidl/IccChangeEvent.webidl
new file mode 100644
index 000000000000..e3dab2f7db13
--- /dev/null
+++ b/dom/webidl/IccChangeEvent.webidl
@@ -0,0 +1,17 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+[Pref="dom.icc.enabled",
+ Constructor(DOMString type, optional IccChangeEventInit eventInitDict)]
+interface IccChangeEvent : Event
+{
+  readonly attribute DOMString iccId;
+};
+
+dictionary IccChangeEventInit : EventInit
+{
+  DOMString iccId = "";
+};
diff --git a/dom/webidl/MozIcc.webidl b/dom/webidl/MozIcc.webidl
new file mode 100644
index 000000000000..98b735c1b0e6
--- /dev/null
+++ b/dom/webidl/MozIcc.webidl
@@ -0,0 +1,368 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+interface MozIccInfo;
+
+[Pref="dom.icc.enabled"]
+interface MozIcc : EventTarget
+{
+  // Integrated Circuit Card Information.
+
+  /**
+   * Information stored in the device's ICC.
+   *
+   * Once the ICC becomes undetectable, iccinfochange event will be notified.
+   * Also, the attribute is set to null and this MozIcc object becomes invalid.
+   * Calling asynchronous functions raises exception then.
+   */
+  readonly attribute MozIccInfo? iccInfo;
+
+  /**
+   * The 'iccinfochange' event is notified whenever the icc info object
+   * changes.
+   */
+  attribute EventHandler oniccinfochange;
+
+  // Integrated Circuit Card State.
+
+  /**
+   * Indicates the state of the device's ICC.
+   *
+   * Possible values: 'illegal', 'unknown', 'pinRequired',
+   * 'pukRequired', 'personalizationInProgress', 'networkLocked',
+   * 'corporateLocked', 'serviceProviderLocked', 'networkPukRequired',
+   * 'corporatePukRequired', 'serviceProviderPukRequired',
+   * 'personalizationReady', 'ready', 'permanentBlocked'.
+   *
+   * Once the ICC becomes undetectable, cardstatechange event will be notified.
+   * Also, the attribute is set to null and this MozIcc object becomes invalid.
+   * Calling asynchronous functions raises exception then.
+   */
+  readonly attribute DOMString? cardState;
+
+  /**
+   * The 'cardstatechange' event is notified when the 'cardState' attribute
+   * changes value.
+   */
+  attribute EventHandler oncardstatechange;
+
+  // Integrated Circuit Card STK.
+
+  /**
+   * Send the response back to ICC after an attempt to execute STK proactive
+   * Command.
+   *
+   * @param command
+   *        Command received from ICC. See MozStkCommand.
+   * @param response
+   *        The response that will be sent to ICC.
+   *        @see MozStkResponse for the detail of response.
+   */
+  [Throws]
+  void sendStkResponse(any command, any response);
+
+  /**
+   * Send the "Menu Selection" envelope command to ICC for menu selection.
+   *
+   * @param itemIdentifier
+   *        The identifier of the item selected by user.
+   * @param helpRequested
+   *        true if user requests to provide help information, false otherwise.
+   */
+  [Throws]
+  void sendStkMenuSelection(unsigned short itemIdentifier,
+                            boolean helpRequested);
+
+  /**
+   * Send the "Timer Expiration" envelope command to ICC for TIMER MANAGEMENT.
+   *
+   * @param timer
+   *        The identifier and value for a timer.
+   *        timerId: Identifier of the timer that has expired.
+   *        timerValue: Different between the time when this command is issued
+   *                    and when the timer was initially started.
+   *        @see MozStkTimer
+   */
+  [Throws]
+  void sendStkTimerExpiration(any timer);
+
+  /**
+   * Send "Event Download" envelope command to ICC.
+   * ICC will not respond with any data for this command.
+   *
+   * @param event
+   *        one of events below:
+   *        - MozStkLocationEvent
+   *        - MozStkCallEvent
+   *        - MozStkLanguageSelectionEvent
+   *        - MozStkGeneralEvent
+   *        - MozStkBrowserTerminationEvent
+   */
+  [Throws]
+  void sendStkEventDownload(any event);
+
+  /**
+   * The 'stkcommand' event is notified whenever STK proactive command is
+   * issued from ICC.
+   */
+  attribute EventHandler onstkcommand;
+
+  /**
+   * 'stksessionend' event is notified whenever STK session is terminated by
+   * ICC.
+   */
+  attribute EventHandler onstksessionend;
+
+  // Integrated Circuit Card Lock interfaces.
+
+  /**
+   * Find out about the status of an ICC lock (e.g. the PIN lock).
+   *
+   * @param lockType
+   *        Identifies the lock type, e.g. "pin" for the PIN lock, "fdn" for
+   *        the FDN lock.
+   *
+   * @return a DOMRequest.
+   *         The request's result will be an object containing
+   *         information about the specified lock's status,
+   *         e.g. {lockType: "pin", enabled: true}.
+   */
+  [Throws]
+  nsISupports getCardLock(DOMString lockType);
+
+  /**
+   * Unlock a card lock.
+   *
+   * @param info
+   *        An object containing the information necessary to unlock
+   *        the given lock. At a minimum, this object must have a
+   *        "lockType" attribute which specifies the type of lock, e.g.
+   *        "pin" for the PIN lock. Other attributes are dependent on
+   *        the lock type.
+   *
+   * Examples:
+   *
+   * (1) Unlocking the PIN:
+   *
+   *   unlockCardLock({lockType: "pin",
+   *                   pin: "..."});
+   *
+   * (2) Unlocking the PUK and supplying a new PIN:
+   *
+   *   unlockCardLock({lockType: "puk",
+   *                   puk: "...",
+   *                   newPin: "..."});
+   *
+   * (3) Network depersonalization. Unlocking the network control key (NCK).
+   *
+   *   unlockCardLock({lockType: "nck",
+   *                   pin: "..."});
+   *
+   * (4) Corporate depersonalization. Unlocking the corporate control key (CCK).
+   *
+   *   unlockCardLock({lockType: "cck",
+   *                   pin: "..."});
+   *
+   * (5) Service Provider depersonalization. Unlocking the service provider
+   *     control key (SPCK).
+   *
+   *   unlockCardLock({lockType: "spck",
+   *                   pin: "..."});
+   *
+   * (6) Network PUK depersonalization. Unlocking the network control key (NCK).
+   *
+   *   unlockCardLock({lockType: "nckPuk",
+   *                   puk: "..."});
+   *
+   * (7) Corporate PUK depersonalization. Unlocking the corporate control key
+   *     (CCK).
+   *
+   *   unlockCardLock({lockType: "cckPuk",
+   *                   puk: "..."});
+   *
+   * (8) Service Provider PUK depersonalization. Unlocking the service provider
+   *     control key (SPCK).
+   *
+   *   unlockCardLock({lockType: "spckPuk",
+   *                   puk: "..."});
+   *
+   * @return a DOMRequest.
+   *         The request's result will be an object containing
+   *         information about the unlock operation.
+   *
+   * Examples:
+   *
+   * (1) Unlocking failed:
+   *
+   *     {
+   *       lockType:   "pin",
+   *       success:    false,
+   *       retryCount: 2
+   *     }
+   *
+   * (2) Unlocking succeeded:
+   *
+   *     {
+   *       lockType:  "pin",
+   *       success:   true
+   *     }
+   */
+  [Throws]
+  nsISupports unlockCardLock(any info);
+
+  /**
+   * Modify the state of a card lock.
+   *
+   * @param info
+   *        An object containing information about the lock and
+   *        how to modify its state. At a minimum, this object
+   *        must have a "lockType" attribute which specifies the
+   *        type of lock, e.g. "pin" for the PIN lock. Other
+   *        attributes are dependent on the lock type.
+   *
+   * Examples:
+   *
+   * (1a) Disabling the PIN lock:
+   *
+   *   setCardLock({lockType: "pin",
+   *                pin: "...",
+   *                enabled: false});
+   *
+   * (1b) Disabling the FDN lock:
+   *
+   *   setCardLock({lockType: "fdn",
+   *                pin2: "...",
+   *                enabled: false});
+   *
+   * (2) Changing the PIN:
+   *
+   *   setCardLock({lockType: "pin",
+   *                pin: "...",
+   *                newPin: "..."});
+   *
+   * @return a DOMRequest.
+   *         The request's result will be an object containing
+   *         information about the operation.
+   *
+   * Examples:
+   *
+   * (1) Enabling/Disabling card lock failed or change card lock failed.
+   *
+   *     {
+   *       lockType: "pin",
+   *       success: false,
+   *       retryCount: 2
+   *     }
+   *
+   * (2) Enabling/Disabling card lock succeed or change card lock succeed.
+   *
+   *     {
+   *       lockType: "pin",
+   *       success: true
+   *     }
+   */
+  [Throws]
+  nsISupports setCardLock(any info);
+
+  /**
+   * Retrieve the number of remaining tries for unlocking the card.
+   *
+   * @param lockType
+   *        Identifies the lock type, e.g. "pin" for the PIN lock, "puk" for
+   *        the PUK lock.
+   *
+   * @return a DOMRequest.
+   *         If the lock type is "pin", or "puk", the request's result will be
+   *         an object containing the number of retries for the specified
+   *         lock. For any other lock type, the result is undefined.
+   */
+  [Throws]
+  nsISupports getCardLockRetryCount(DOMString lockType);
+
+  // Integrated Circuit Card Phonebook Interfaces.
+
+  /**
+   * Read ICC contacts.
+   *
+   * @param contactType
+   *        One of type as below,
+   *        - 'adn': Abbreviated Dialling Number.
+   *        - 'fdn': Fixed Dialling Number.
+   *
+   * @return a DOMRequest.
+   */
+  [Throws]
+  nsISupports readContacts(DOMString contactType);
+
+  /**
+   * Update ICC Phonebook contact.
+   *
+   * @param contactType
+   *        One of type as below,
+   *        - 'adn': Abbreviated Dialling Number.
+   *        - 'fdn': Fixed Dialling Number.
+   * @param contact
+   *        The contact will be updated in ICC.
+   * @param [optional] pin2
+   *        PIN2 is only required for 'fdn'.
+   *
+   * @return a DOMRequest.
+   */
+  [Throws]
+  nsISupports updateContact(DOMString contactType,
+                           any contact,
+                           optional DOMString? pin2 = null);
+
+  // Integrated Circuit Card Secure Element Interfaces.
+
+  /**
+   * A secure element is a smart card chip that can hold
+   * several different applications with the necessary security.
+   * The most known secure element is the Universal Integrated Circuit Card
+   * (UICC).
+   */
+
+  /**
+   * Send request to open a logical channel defined by its
+   * application identifier (AID).
+   *
+   * @param aid
+   *        The application identifier of the applet to be selected on this
+   *        channel.
+   *
+   * @return a DOMRequest.
+   *         The request's result will be an instance of channel (channelID)
+   *         if available or null.
+   */
+  [Throws]
+  nsISupports iccOpenChannel(DOMString aid);
+
+  /**
+   * Interface, used to communicate with an applet through the
+   * application data protocol units (APDUs) and is
+   * used for all data that is exchanged between the UICC and the terminal (ME).
+   *
+   * @param channel
+   *        The application identifier of the applet to which APDU is directed.
+   * @param apdu
+   *        Application protocol data unit.
+   *
+   * @return a DOMRequest.
+   *         The request's result will be response APDU.
+   */
+  [Throws]
+  nsISupports iccExchangeAPDU(long channel, any apdu);
+
+  /**
+   * Send request to close the selected logical channel identified by its
+   * application identifier (AID).
+   *
+   * @param aid
+   *        The application identifier of the applet, to be closed.
+   *
+   * @return a DOMRequest.
+   */
+  [Throws]
+  nsISupports iccCloseChannel(long channel);
+};
diff --git a/dom/webidl/Navigator.webidl b/dom/webidl/Navigator.webidl
index eeb945e8a6fb..e838f4d88e43 100644
--- a/dom/webidl/Navigator.webidl
+++ b/dom/webidl/Navigator.webidl
@@ -32,18 +32,22 @@ Navigator implements NavigatorStorageUtils;
 
 [NoInterfaceObject]
 interface NavigatorID {
+  // WebKit/Blink/Trident/Presto support this (hardcoded "Mozilla").
+  [Constant]
+  readonly attribute DOMString appCodeName; // constant "Mozilla"
+  [Constant]
   readonly attribute DOMString appName;
-  [Throws]
+  [Constant]
   readonly attribute DOMString appVersion;
-  [Throws]
+  [Constant]
   readonly attribute DOMString platform;
-  [Throws]
+  [Constant]
   readonly attribute DOMString userAgent;
+  [Constant]
+  readonly attribute DOMString product; // constant "Gecko"
 
-  // Spec has this as a const, but that's wrong because it should not
-  // be on the interface object.
-  //const DOMString product = "Gecko"; // for historical reasons
-  readonly attribute DOMString product;
+  // Everyone but WebKit/Blink supports this.  See bug 679971.
+  boolean taintEnabled(); // constant false
 };
 
 [NoInterfaceObject]
@@ -136,9 +140,6 @@ callback interface MozIdleObserver {
 
 // nsIDOMNavigator
 partial interface Navigator {
-  // WebKit/Blink/Trident/Presto support this (hardcoded "Mozilla").
-  [Throws]
-  readonly attribute DOMString appCodeName;
   [Throws]
   readonly attribute DOMString oscpu;
   // WebKit/Blink support this; Trident/Presto do not.
@@ -157,8 +158,6 @@ partial interface Navigator {
   // WebKit/Blink/Trident/Presto support this.
   [Throws]
   boolean javaEnabled();
-  // Everyone but WebKit/Blink supports this.  See bug 679971.
-  boolean taintEnabled();
 
   /**
    * Navigator requests to add an idle observer to the existing window.
diff --git a/dom/webidl/NetDashboard.webidl b/dom/webidl/NetDashboard.webidl
index 2e5e0c535470..12bbb01f084a 100644
--- a/dom/webidl/NetDashboard.webidl
+++ b/dom/webidl/NetDashboard.webidl
@@ -3,60 +3,75 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-dictionary SocketsDict {
-  sequence<DOMString> host;
-  sequence<unsigned long> port;
-  sequence<boolean> active;
-  sequence<unsigned long> tcp;
-  sequence<double> socksent;
-  sequence<double> sockreceived;
+dictionary SocketElement {
+  DOMString host = "";
+  unsigned long port = 0;
+  boolean active = false;
+  boolean tcp = false;
   double sent = 0;
   double received = 0;
 };
 
-dictionary HttpConnInfoDict {
-  sequence<unsigned long> rtt;
-  sequence<unsigned long> ttl;
-  sequence<DOMString> protocolVersion;
+dictionary SocketsDict {
+  sequence<SocketElement> sockets;
+  double sent = 0;
+  double received = 0;
+};
+
+dictionary HttpConnInfo {
+  unsigned long rtt = 0;
+  unsigned long ttl = 0;
+  DOMString protocolVersion = "";
 };
 
 dictionary HalfOpenInfoDict {
-  sequence<boolean> speculative;
+  boolean speculative = false;
+};
+
+dictionary HttpConnectionElement {
+  DOMString host = "";
+  unsigned long port = 0;
+  boolean spdy = false;
+  boolean ssl = false;
+  sequence<HttpConnInfo> active;
+  sequence<HttpConnInfo> idle;
+  sequence<HalfOpenInfoDict> halfOpens;
 };
 
 dictionary HttpConnDict {
-  sequence<DOMString> host;
-  sequence<unsigned long> port;
-  sequence<HttpConnInfoDict> active;
-  sequence<HttpConnInfoDict> idle;
-  sequence<HalfOpenInfoDict> halfOpens;
-  sequence<boolean> spdy;
-  sequence<boolean> ssl;
+  sequence<HttpConnectionElement> connections;
+};
+
+dictionary WebSocketElement {
+  DOMString hostport = "";
+  unsigned long msgsent = 0;
+  unsigned long msgreceived = 0;
+  double sentsize = 0;
+  double receivedsize = 0;
+  boolean encrypted = false;
 };
 
 dictionary WebSocketDict {
-  sequence<DOMString> hostport;
-  sequence<unsigned long> msgsent;
-  sequence<unsigned long> msgreceived;
-  sequence<double> sentsize;
-  sequence<double> receivedsize;
-  sequence<boolean> encrypted;
+  sequence<WebSocketElement> websockets;
+};
+
+dictionary DnsCacheEntry {
+  DOMString hostname = "";
+  sequence<DOMString> hostaddr;
+  DOMString family = "";
+  double expiration = 0;
 };
 
 dictionary DNSCacheDict {
-  sequence<DOMString> hostname;
-  sequence<sequence<DOMString>> hostaddr;
-  sequence<DOMString> family;
-  sequence<double> expiration;
+  sequence<DnsCacheEntry> entries;
 };
 
 dictionary DNSLookupDict {
   sequence<DOMString> address;
-  DOMString error;
-  boolean answer;
+  DOMString error = "";
+  boolean answer = false;
 };
 
 dictionary ConnStatusDict {
-  DOMString status;
+  DOMString status = "";
 };
-
diff --git a/dom/webidl/PointerEvent.webidl b/dom/webidl/PointerEvent.webidl
new file mode 100644
index 000000000000..935342ae8ea7
--- /dev/null
+++ b/dom/webidl/PointerEvent.webidl
@@ -0,0 +1,37 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * For more information see nsIPointerEvent.idl.
+ *
+ * Portions Copyright 2013 Microsoft Open Technologies, Inc. */
+
+interface WindowProxy;
+
+[Pref="dom.w3c_pointer_events.enabled",
+ Constructor(DOMString type, optional PointerEventInit eventInitDict)]
+interface PointerEvent : MouseEvent
+{
+  readonly attribute long pointerId;
+  readonly attribute long width;
+  readonly attribute long height;
+  readonly attribute float pressure;
+  readonly attribute long tiltX;
+  readonly attribute long tiltY;
+  readonly attribute DOMString pointerType;
+  readonly attribute boolean isPrimary;
+};
+
+dictionary PointerEventInit : MouseEventInit
+{
+  long pointerId = 0;
+  long width = 0;
+  long height = 0;
+  float pressure = 0;
+  long tiltX = 0;
+  long tiltY = 0;
+  DOMString pointerType = "";
+  boolean isPrimary = false;
+};
+
diff --git a/dom/webidl/Promise.webidl b/dom/webidl/Promise.webidl
index f2ca4c665eca..99383ac63942 100644
--- a/dom/webidl/Promise.webidl
+++ b/dom/webidl/Promise.webidl
@@ -23,14 +23,14 @@ interface Promise {
   // Promise object in this scope without having resolved the interface object
   // first.
   [NewObject, Throws, Func="mozilla::dom::Promise::EnabledForScope"]
-  static Promise resolve(any value); // same as any(value)
+  static Promise resolve(optional any value);
   [NewObject, Throws, Func="mozilla::dom::Promise::EnabledForScope"]
-  static Promise reject(any value);
+  static Promise reject(optional any value);
 
   [NewObject]
-  Promise then(optional AnyCallback fulfillCallback,
-               optional AnyCallback rejectCallback);
+  Promise then(optional AnyCallback? fulfillCallback,
+               optional AnyCallback? rejectCallback);
 
   [NewObject]
-  Promise catch(optional AnyCallback rejectCallback);
+  Promise catch(optional AnyCallback? rejectCallback);
 };
diff --git a/dom/webidl/WorkerNavigator.webidl b/dom/webidl/WorkerNavigator.webidl
index 5ddc1f443185..a29b53a11e0c 100644
--- a/dom/webidl/WorkerNavigator.webidl
+++ b/dom/webidl/WorkerNavigator.webidl
@@ -3,12 +3,6 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 interface WorkerNavigator {
-  [Constant]
-  readonly attribute DOMString appName;
-  [Constant]
-  readonly attribute DOMString appVersion;
-  [Constant]
-  readonly attribute DOMString platform;
-  [Constant]
-  readonly attribute DOMString userAgent;
 };
+
+WorkerNavigator implements NavigatorID;
diff --git a/dom/webidl/moz.build b/dom/webidl/moz.build
index e3db21266b89..67945b365e96 100644
--- a/dom/webidl/moz.build
+++ b/dom/webidl/moz.build
@@ -254,6 +254,7 @@ WEBIDL_FILES = [
     'PhoneNumberService.webidl',
     'Plugin.webidl',
     'PluginArray.webidl',
+    'PointerEvent.webidl',
     'Position.webidl',
     'PositionError.webidl',
     'ProcessingInstruction.webidl',
@@ -513,6 +514,7 @@ if CONFIG['MOZ_B2G_RIL']:
         'MozCellBroadcast.webidl',
         'MozCellBroadcastEvent.webidl',
         'MozEmergencyCbModeEvent.webidl',
+        'MozIcc.webidl',
         'MozMobileConnectionArray.webidl',
         'MozOtaStatusEvent.webidl',
         'MozVoicemail.webidl',
@@ -564,6 +566,7 @@ GENERATED_EVENTS_WEBIDL_FILES = [
     'DeviceLightEvent.webidl',
     'DeviceProximityEvent.webidl',
     'ErrorEvent.webidl',
+    'IccChangeEvent.webidl',
     'MediaStreamEvent.webidl',
     'MozContactChangeEvent.webidl',
     'MozInterAppMessageEvent.webidl',
diff --git a/dom/wifi/DOMWifiManager.js b/dom/wifi/DOMWifiManager.js
index c61692c9d839..806b4c6b5ed3 100644
--- a/dom/wifi/DOMWifiManager.js
+++ b/dom/wifi/DOMWifiManager.js
@@ -57,7 +57,8 @@ DOMWifiManager.prototype = {
 
   QueryInterface: XPCOMUtils.generateQI([Ci.nsIDOMWifiManager,
                                          Ci.nsIDOMGlobalPropertyInitializer,
-                                         Ci.nsISupportsWeakReference]),
+                                         Ci.nsISupportsWeakReference,
+                                         Ci.nsIObserver]),
 
   // nsIDOMGlobalPropertyInitializer implementation
   init: function(aWindow) {
diff --git a/dom/workers/Navigator.h b/dom/workers/Navigator.h
index ec143e4c20ae..80cd555fb712 100644
--- a/dom/workers/Navigator.h
+++ b/dom/workers/Navigator.h
@@ -52,6 +52,10 @@ public:
     MOZ_COUNT_DTOR(WorkerNavigator);
   }
 
+  void GetAppCodeName(nsString& aAppCodeName) const
+  {
+    aAppCodeName.AssignLiteral("Mozilla");
+  }
   void GetAppName(nsString& aAppName) const
   {
     aAppName = mAppName;
@@ -64,6 +68,14 @@ public:
   {
     aPlatform = mPlatform;
   }
+  void GetProduct(nsString& aProduct) const
+  {
+    aProduct.AssignLiteral("Gecko");
+  }
+  bool TaintEnabled() const
+  {
+    return false;
+  }
   void GetUserAgent(nsString& aUserAgent) const
   {
     aUserAgent = mUserAgent;
diff --git a/dom/workers/RuntimeService.cpp b/dom/workers/RuntimeService.cpp
index 3e64dc70aa04..20d66c346715 100644
--- a/dom/workers/RuntimeService.cpp
+++ b/dom/workers/RuntimeService.cpp
@@ -880,6 +880,21 @@ public:
     mWorkerPrivate = nullptr;
   }
 
+  virtual void
+  PrepareForForgetSkippable() MOZ_OVERRIDE
+  {
+  }
+
+  virtual void
+  BeginCycleCollectionCallback() MOZ_OVERRIDE
+  {
+  }
+
+  virtual void
+  EndCycleCollectionCallback(CycleCollectorResults &aResults) MOZ_OVERRIDE
+  {
+  }
+
   void
   DispatchDeferredDeletion(bool aContinuation) MOZ_OVERRIDE
   {
@@ -899,7 +914,7 @@ public:
     mWorkerPrivate->AssertIsOnWorkerThread();
 
     if (aStatus == JSGC_END) {
-      nsCycleCollector_collect(true, nullptr, nullptr);
+      nsCycleCollector_collect(nullptr);
     }
   }
 
diff --git a/dom/workers/WorkerPrivate.cpp b/dom/workers/WorkerPrivate.cpp
index 33f945724630..f4dd03f2bdbc 100644
--- a/dom/workers/WorkerPrivate.cpp
+++ b/dom/workers/WorkerPrivate.cpp
@@ -2159,7 +2159,8 @@ WorkerPrivateParent<Derived>::WrapObject(JSContext* aCx,
 
   AssertIsOnParentThread();
 
-  JSObject* obj = WorkerBinding::Wrap(aCx, aScope, ParentAsWorkerPrivate());
+  JS::Rooted<JSObject*> obj(aCx, WorkerBinding::Wrap(aCx, aScope,
+                                                     ParentAsWorkerPrivate()));
 
   if (mRooted) {
     PreserveWrapper(this);
@@ -5259,16 +5260,23 @@ WorkerPrivate::ConnectMessagePort(JSContext* aCx, uint64_t aMessagePortSerial)
     return false;
   }
 
-  MessageEventInit init;
-  init.mBubbles = false;
-  init.mCancelable = false;
-  init.mSource = &jsPort.toObject();
+  nsRefPtr<nsDOMMessageEvent> event;
+  {
+    // Bug 940779 - MessageEventInit contains unrooted JS objects, and
+    // ~nsRefPtr can GC, so make sure 'init' is no longer live before ~nsRefPtr
+    // runs (or the nsRefPtr is even created) to avoid a rooting hazard. Note
+    // that 'init' is live until its destructor runs, not just until its final
+    // use.
+    MessageEventInit init;
+    init.mBubbles = false;
+    init.mCancelable = false;
+    init.mSource = &jsPort.toObject();
 
-  ErrorResult rv;
-
-  nsRefPtr<nsDOMMessageEvent> event =
-    nsDOMMessageEvent::Constructor(globalObject, aCx,
-                                   NS_LITERAL_STRING("connect"), init, rv);
+    ErrorResult rv;
+    event = nsDOMMessageEvent::Constructor(globalObject, aCx,
+                                           NS_LITERAL_STRING("connect"),
+                                           init, rv);
+  }
 
   event->SetTrusted(true);
 
diff --git a/dom/workers/XMLHttpRequest.cpp b/dom/workers/XMLHttpRequest.cpp
index 36308377817a..2265be93af2a 100644
--- a/dom/workers/XMLHttpRequest.cpp
+++ b/dom/workers/XMLHttpRequest.cpp
@@ -682,19 +682,19 @@ public:
       }
     }
 
-    XMLHttpRequest::StateData state;
-    StateDataAutoRooter rooter(aCx, &state);
+    nsAutoPtr<XMLHttpRequest::StateData> state(new XMLHttpRequest::StateData());
+    StateDataAutoRooter rooter(aCx, state);
 
-    state.mResponseTextResult = mResponseTextResult;
-    state.mResponseText = mResponseText;
+    state->mResponseTextResult = mResponseTextResult;
+    state->mResponseText = mResponseText;
 
     if (NS_SUCCEEDED(mResponseTextResult)) {
       MOZ_ASSERT(JSVAL_IS_VOID(mResponse) || JSVAL_IS_NULL(mResponse));
-      state.mResponseResult = mResponseTextResult;
-      state.mResponse = mResponse;
+      state->mResponseResult = mResponseTextResult;
+      state->mResponse = mResponse;
     }
     else {
-      state.mResponseResult = mResponseResult;
+      state->mResponseResult = mResponseResult;
 
       if (NS_SUCCEEDED(mResponseResult)) {
         if (mResponseBuffer.data()) {
@@ -716,23 +716,23 @@ public:
             return false;
           }
 
-          state.mResponse = response;
+          state->mResponse = response;
         }
         else {
-          state.mResponse = mResponse;
+          state->mResponse = mResponse;
         }
       }
     }
 
-    state.mStatusResult = mStatusResult;
-    state.mStatus = mStatus;
+    state->mStatusResult = mStatusResult;
+    state->mStatus = mStatus;
 
-    state.mStatusText = mStatusText;
+    state->mStatusText = mStatusText;
 
-    state.mReadyState = mReadyState;
+    state->mReadyState = mReadyState;
 
     XMLHttpRequest* xhr = mProxy->mXMLHttpRequestPrivate;
-    xhr->UpdateState(state);
+    xhr->UpdateState(*state);
 
     if (mUploadEvent && !xhr->GetUploadObjectNoCreate()) {
       return true;
diff --git a/dom/workers/test/navigator_worker.js b/dom/workers/test/navigator_worker.js
index 2ca3b6fdeadf..50934d92aef1 100644
--- a/dom/workers/test/navigator_worker.js
+++ b/dom/workers/test/navigator_worker.js
@@ -3,9 +3,12 @@
  * http://creativecommons.org/publicdomain/zero/1.0/
  */
 var supportedProps = [
+  "appCodeName",
   "appName",
   "appVersion",
   "platform",
+  "product",
+  "taintEnabled",
   "userAgent"
 ];
 
@@ -27,7 +30,7 @@ for (var index = 0; index < supportedProps.length; index++) {
 
   obj = {
     name:  prop,
-    value: navigator[prop]
+    value: prop === "taintEnabled" ? navigator[prop]() : navigator[prop]
   };
 
   postMessage(JSON.stringify(obj));
diff --git a/dom/workers/test/test_navigator.html b/dom/workers/test/test_navigator.html
index ccace0e446d1..056f9bac0282 100644
--- a/dom/workers/test/test_navigator.html
+++ b/dom/workers/test/test_navigator.html
@@ -35,6 +35,11 @@ Tests of DOM Worker Navigator
       return;
     }
 
+    if (args.name === "taintEnabled") {
+      is(navigator[args.name](), args.value, args.name + "() returns false.");
+      return;
+    }
+
     is(navigator[args.name], args.value,
        "Mismatched navigator string for " + args.name + "!");
   };
diff --git a/editor/composer/src/nsEditorSpellCheck.cpp b/editor/composer/src/nsEditorSpellCheck.cpp
index 7362c88da082..21f1d827d91d 100644
--- a/editor/composer/src/nsEditorSpellCheck.cpp
+++ b/editor/composer/src/nsEditorSpellCheck.cpp
@@ -97,8 +97,7 @@ GetLoadContext(nsIEditor* aEditor)
   nsCOMPtr<nsIDocument> doc = do_QueryInterface(domDoc);
   NS_ENSURE_TRUE(doc, nullptr);
 
-  nsCOMPtr<nsISupports> container = doc->GetContainer();
-  nsCOMPtr<nsILoadContext> loadContext = do_QueryInterface(container);
+  nsCOMPtr<nsILoadContext> loadContext = doc->GetLoadContext();
   return loadContext.forget();
 }
 
diff --git a/editor/libeditor/base/nsEditorUtils.cpp b/editor/libeditor/base/nsEditorUtils.cpp
index d5ee5afd2991..4d7b61f42b70 100644
--- a/editor/libeditor/base/nsEditorUtils.cpp
+++ b/editor/libeditor/base/nsEditorUtils.cpp
@@ -189,8 +189,7 @@ nsEditorHookUtils::GetHookEnumeratorFromDocument(nsIDOMDocument *aDoc,
   nsCOMPtr<nsIDocument> doc = do_QueryInterface(aDoc);
   NS_ENSURE_TRUE(doc, NS_ERROR_FAILURE);
 
-  nsCOMPtr<nsISupports> container = doc->GetContainer();
-  nsCOMPtr<nsIDocShell> docShell = do_QueryInterface(container);
+  nsCOMPtr<nsIDocShell> docShell = doc->GetDocShell();
   nsCOMPtr<nsIClipboardDragDropHookList> hookObj = do_GetInterface(docShell);
   NS_ENSURE_TRUE(hookObj, NS_ERROR_FAILURE);
 
diff --git a/editor/libeditor/text/nsPlaintextDataTransfer.cpp b/editor/libeditor/text/nsPlaintextDataTransfer.cpp
index 1724576712a1..8f5409b0441b 100644
--- a/editor/libeditor/text/nsPlaintextDataTransfer.cpp
+++ b/editor/libeditor/text/nsPlaintextDataTransfer.cpp
@@ -432,8 +432,7 @@ bool nsPlaintextEditor::IsSafeToInsertData(nsIDOMDocument* aSourceDoc)
 
   nsCOMPtr<nsIDocument> destdoc = GetDocument();
   NS_ASSERTION(destdoc, "Where is our destination doc?");
-  nsCOMPtr<nsISupports> container = destdoc->GetContainer();
-  nsCOMPtr<nsIDocShellTreeItem> dsti = do_QueryInterface(container);
+  nsCOMPtr<nsIDocShellTreeItem> dsti = destdoc->GetDocShell();
   nsCOMPtr<nsIDocShellTreeItem> root;
   if (dsti)
     dsti->GetRootTreeItem(getter_AddRefs(root));
diff --git a/gfx/2d/BasePoint3D.h b/gfx/2d/BasePoint3D.h
index 0312e425b8c8..c64ea247a5a2 100644
--- a/gfx/2d/BasePoint3D.h
+++ b/gfx/2d/BasePoint3D.h
@@ -6,7 +6,7 @@
 #ifndef MOZILLA_BASEPOINT3D_H_
 #define MOZILLA_BASEPOINT3D_H_
 
-#include "nsDebug.h"
+#include "mozilla/Assertions.h"
 
 namespace mozilla {
 namespace gfx {
@@ -31,12 +31,12 @@ struct BasePoint3D {
   // compiler generated default assignment operator
 
   T& operator[](int aIndex) {
-    NS_ABORT_IF_FALSE(aIndex >= 0 && aIndex <= 2, "Invalid array index");
+    MOZ_ASSERT(aIndex >= 0 && aIndex <= 2);
     return *((&x)+aIndex);
   }
 
   const T& operator[](int aIndex) const {
-    NS_ABORT_IF_FALSE(aIndex >= 0 && aIndex <= 2, "Invalid array index");
+    MOZ_ASSERT(aIndex >= 0 && aIndex <= 2);
     return *((&x)+aIndex);
   }
 
diff --git a/gfx/2d/BasePoint4D.h b/gfx/2d/BasePoint4D.h
index ab9fa452328e..a35deeed88b8 100644
--- a/gfx/2d/BasePoint4D.h
+++ b/gfx/2d/BasePoint4D.h
@@ -6,6 +6,8 @@
 #ifndef MOZILLA_BASEPOINT4D_H_
 #define MOZILLA_BASEPOINT4D_H_
 
+#include "mozilla/Assertions.h"
+
 namespace mozilla {
 namespace gfx {
 
@@ -86,12 +88,12 @@ struct BasePoint4D {
   }
 
   T& operator[](int aIndex) {
-    NS_ABORT_IF_FALSE(aIndex >= 0 && aIndex <= 3, "Invalid array index");
+    MOZ_ASSERT(aIndex >= 0 && aIndex <= 3, "Invalid array index");
     return *((&x)+aIndex);
   }
 
   const T& operator[](int aIndex) const {
-    NS_ABORT_IF_FALSE(aIndex >= 0 && aIndex <= 3, "Invalid array index");
+    MOZ_ASSERT(aIndex >= 0 && aIndex <= 3, "Invalid array index");
     return *((&x)+aIndex);
   }
 
diff --git a/gfx/2d/DrawTargetD2D.cpp b/gfx/2d/DrawTargetD2D.cpp
index c209c80788dc..163c9ebbe547 100644
--- a/gfx/2d/DrawTargetD2D.cpp
+++ b/gfx/2d/DrawTargetD2D.cpp
@@ -85,9 +85,7 @@ public:
     }
     mDT->mDevice->CopyResource(tmpTexture, mDT->mTexture);
 
-    D2D1_BITMAP_PROPERTIES props =
-      D2D1::BitmapProperties(D2D1::PixelFormat(DXGIFormat(format),
-                             AlphaMode(format)));
+    D2D1_BITMAP_PROPERTIES props = D2D1::BitmapProperties(D2DPixelFormat(format));
 
     RefPtr<IDXGISurface> surf;
 
@@ -306,7 +304,7 @@ DrawTargetD2D::GetBitmapForSurface(SourceSurface *aSurface,
                             (uint32_t)aSource.x * BytesPerPixel(srcSurf->GetFormat());
 
       D2D1_BITMAP_PROPERTIES props =
-        D2D1::BitmapProperties(D2D1::PixelFormat(DXGIFormat(srcSurf->GetFormat()), AlphaMode(srcSurf->GetFormat())));
+        D2D1::BitmapProperties(D2DPixelFormat(srcSurf->GetFormat()));
       mRT->CreateBitmap(D2D1::SizeU(UINT32(aSource.width), UINT32(aSource.height)), data, stride, props, byRef(bitmap));
 
       // subtract the integer part leaving the fractional part
diff --git a/gfx/2d/HelpersD2D.h b/gfx/2d/HelpersD2D.h
index 802a4e1b9a55..2e10643e1be0 100644
--- a/gfx/2d/HelpersD2D.h
+++ b/gfx/2d/HelpersD2D.h
@@ -162,7 +162,7 @@ static inline DXGI_FORMAT DXGIFormat(SurfaceFormat aFormat)
   }
 }
 
-static inline D2D1_ALPHA_MODE AlphaMode(SurfaceFormat aFormat)
+static inline D2D1_ALPHA_MODE D2DAlphaModeForFormat(SurfaceFormat aFormat)
 {
   switch (aFormat) {
   case FORMAT_B8G8R8X8:
@@ -174,7 +174,7 @@ static inline D2D1_ALPHA_MODE AlphaMode(SurfaceFormat aFormat)
 
 static inline D2D1_PIXEL_FORMAT D2DPixelFormat(SurfaceFormat aFormat)
 {
-  return D2D1::PixelFormat(DXGIFormat(aFormat), AlphaMode(aFormat));
+  return D2D1::PixelFormat(DXGIFormat(aFormat), D2DAlphaModeForFormat(aFormat));
 }
 
 #ifdef USE_D2D1_1
diff --git a/gfx/2d/SourceSurfaceD2D.cpp b/gfx/2d/SourceSurfaceD2D.cpp
index 005a6901e5f7..9704f1103925 100644
--- a/gfx/2d/SourceSurfaceD2D.cpp
+++ b/gfx/2d/SourceSurfaceD2D.cpp
@@ -68,8 +68,7 @@ SourceSurfaceD2D::InitFromData(unsigned char *aData,
     return false;
   }
 
-  D2D1_BITMAP_PROPERTIES props =
-    D2D1::BitmapProperties(D2D1::PixelFormat(DXGIFormat(aFormat), AlphaMode(aFormat)));
+  D2D1_BITMAP_PROPERTIES props = D2D1::BitmapProperties(D2DPixelFormat(aFormat));
   hr = aRT->CreateBitmap(D2DIntSize(aSize), aData, aStride, props, byRef(mBitmap));
 
   if (FAILED(hr)) {
@@ -105,8 +104,7 @@ SourceSurfaceD2D::InitFromTexture(ID3D10Texture2D *aTexture,
   mSize = IntSize(desc.Width, desc.Height);
   mFormat = aFormat;
 
-  D2D1_BITMAP_PROPERTIES props =
-    D2D1::BitmapProperties(D2D1::PixelFormat(DXGIFormat(aFormat), AlphaMode(aFormat)));
+  D2D1_BITMAP_PROPERTIES props = D2D1::BitmapProperties(D2DPixelFormat(aFormat));
   hr = aRT->CreateSharedBitmap(IID_IDXGISurface, surf, &props, byRef(mBitmap));
 
   if (FAILED(hr)) {
diff --git a/gfx/2d/SourceSurfaceD2DTarget.cpp b/gfx/2d/SourceSurfaceD2DTarget.cpp
index 4f7e484cb0c1..a7ba9f710e8a 100644
--- a/gfx/2d/SourceSurfaceD2DTarget.cpp
+++ b/gfx/2d/SourceSurfaceD2DTarget.cpp
@@ -138,15 +138,13 @@ SourceSurfaceD2DTarget::GetBitmap(ID2D1RenderTarget *aRT)
     return nullptr;
   }
 
-  D2D1_BITMAP_PROPERTIES props =
-    D2D1::BitmapProperties(D2D1::PixelFormat(DXGIFormat(mFormat), AlphaMode(mFormat)));
+  D2D1_BITMAP_PROPERTIES props = D2D1::BitmapProperties(D2DPixelFormat(mFormat));
   hr = aRT->CreateSharedBitmap(IID_IDXGISurface, surf, &props, byRef(mBitmap));
 
   if (FAILED(hr)) {
     // This seems to happen for FORMAT_A8 sometimes...
     aRT->CreateBitmap(D2D1::SizeU(desc.Width, desc.Height),
-                      D2D1::BitmapProperties(D2D1::PixelFormat(DXGIFormat(mFormat),
-                                             AlphaMode(mFormat))),
+                      D2D1::BitmapProperties(D2DPixelFormat(mFormat)),
                       byRef(mBitmap));
 
     RefPtr<ID2D1RenderTarget> rt;
@@ -169,7 +167,7 @@ SourceSurfaceD2DTarget::GetBitmap(ID2D1RenderTarget *aRT)
       }
 
       D2D1_RENDER_TARGET_PROPERTIES props =
-        D2D1::RenderTargetProperties(D2D1_RENDER_TARGET_TYPE_DEFAULT, D2D1::PixelFormat(DXGIFormat(mFormat), AlphaMode(mFormat)));
+        D2D1::RenderTargetProperties(D2D1_RENDER_TARGET_TYPE_DEFAULT, D2DPixelFormat(mFormat));
       hr = DrawTargetD2D::factory()->CreateDxgiSurfaceRenderTarget(surface, props, byRef(rt));
 
       if (FAILED(hr)) {
diff --git a/gfx/2d/SourceSurfaceRawData.cpp b/gfx/2d/SourceSurfaceRawData.cpp
index eca819cafa66..12c04b87b69a 100644
--- a/gfx/2d/SourceSurfaceRawData.cpp
+++ b/gfx/2d/SourceSurfaceRawData.cpp
@@ -5,7 +5,6 @@
 
 #include "SourceSurfaceRawData.h"
 #include "Logging.h"
-#include "Tools.h"
 
 namespace mozilla {
 namespace gfx {
diff --git a/gfx/2d/SourceSurfaceRawData.h b/gfx/2d/SourceSurfaceRawData.h
index 3a3e10a7cb57..60333432b778 100644
--- a/gfx/2d/SourceSurfaceRawData.h
+++ b/gfx/2d/SourceSurfaceRawData.h
@@ -7,6 +7,7 @@
 #define MOZILLA_GFX_SOURCESURFACERAWDATA_H_
 
 #include "2D.h"
+#include "Tools.h"
 
 namespace mozilla {
 namespace gfx {
diff --git a/gfx/gl/GLLibraryEGL.cpp b/gfx/gl/GLLibraryEGL.cpp
index 8ac22e8c7277..0043bfc81058 100644
--- a/gfx/gl/GLLibraryEGL.cpp
+++ b/gfx/gl/GLLibraryEGL.cpp
@@ -18,7 +18,7 @@ namespace gl {
 GLLibraryEGL sEGLLibrary;
 
 // should match the order of EGLExtensions, and be null-terminated.
-static const char *sExtensionNames[] = {
+static const char *sEGLExtensionNames[] = {
     "EGL_KHR_image_base",
     "EGL_KHR_image_pixmap",
     "EGL_KHR_gl_texture_2D_image",
@@ -321,7 +321,7 @@ GLLibraryEGL::InitExtensions()
     const bool firstRun = false;
 #endif
 
-    GLContext::InitializeExtensionsBitSet(mAvailableExtensions, extensions, sExtensionNames, firstRun && debugMode);
+    GLContext::InitializeExtensionsBitSet(mAvailableExtensions, extensions, sEGLExtensionNames, firstRun && debugMode);
 
 #ifdef DEBUG
     firstRun = false;
diff --git a/gfx/gl/moz.build b/gfx/gl/moz.build
index ba3ac861f407..df92abcc4ec9 100644
--- a/gfx/gl/moz.build
+++ b/gfx/gl/moz.build
@@ -59,36 +59,48 @@ if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'windows':
         'SharedSurfaceANGLE.h',
         'WGLLibrary.h',
     ]
-    SOURCES += [
+    UNIFIED_SOURCES += [
         'GLContextProviderEGL.cpp',
         'SharedSurfaceANGLE.cpp',
     ]
 if CONFIG['MOZ_ENABLE_SKIA_GPU']:
     EXPORTS += ['GLContextSkia.h']
-    SOURCES += [
+    UNIFIED_SOURCES += [
         'GLContextSkia.cpp',
     ]
 
 if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'gonk':
-    SOURCES += ['SharedSurfaceGralloc.cpp']
+    UNIFIED_SOURCES += ['SharedSurfaceGralloc.cpp']
     EXPORTS += ['SharedSurfaceGralloc.h']
 
 if gl_provider == 'CGL':
+    # This file includes Mac headers that are unfriendly to unified builds,
+    # and we have only one .mm file here anyway.
     SOURCES += [
         "GLContextProvider%s.mm" % (gl_provider),
     ]
     EXPORTS += [
         'SharedSurfaceIO.h',
     ]
+    # SharedSurfaceIO.cpp includes MacIOSurface.h which include Mac headers
+    # which define Size and Point types in root namespace with often conflict with
+    # our own types. While I haven't actually hit this issue in the present case,
+    # it's been an issue in gfx/layers so let's not risk it.
     SOURCES += [
         'SharedSurfaceIO.cpp',
     ]
-else:
+elif gl_provider == 'GLX':
+    # GLContextProviderGLX.cpp needs to be kept out of UNIFIED_SOURCES
+    # as it includes X11 headers which cause conflicts.
     SOURCES += [
+        'GLContextProviderGLX.cpp',
+    ]
+else:
+    UNIFIED_SOURCES += [
         'GLContextProvider%s.cpp' % gl_provider,
     ]
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'GfxTexturesReporter.cpp',
     'GLContext.cpp',
     'GLContextFeatures.cpp',
diff --git a/gfx/graphite2/src/moz.build b/gfx/graphite2/src/moz.build
index acbe4d2dad5d..f75fe45bc1b9 100644
--- a/gfx/graphite2/src/moz.build
+++ b/gfx/graphite2/src/moz.build
@@ -13,16 +13,16 @@ EXPORTS.graphite2 += [
 ]
 
 if CONFIG['GNU_CC']:
-    SOURCES += [
+    UNIFIED_SOURCES += [
         'direct_machine.cpp'
     ]
 else:
-    SOURCES += [
+    UNIFIED_SOURCES += [
         'call_machine.cpp'
     ]
 
 # This should contain all of the _SOURCES from files.mk, except *_machine.cpp
-SOURCES += [
+UNIFIED_SOURCES += [
     'Bidi.cpp',
     'CachedFace.cpp',
     'CmapCache.cpp',
diff --git a/gfx/layers/Layers.cpp b/gfx/layers/Layers.cpp
index 39fcbd4eb8b0..1ed1b033100a 100644
--- a/gfx/layers/Layers.cpp
+++ b/gfx/layers/Layers.cpp
@@ -1261,6 +1261,12 @@ Layer::LogSelf(const char* aPrefix)
   nsAutoCString str;
   PrintInfo(str, aPrefix);
   MOZ_LAYERS_LOG(("%s", str.get()));
+
+  if (mMaskLayer) {
+    nsAutoCString pfx(aPrefix);
+    pfx += "   \\ MaskLayer ";
+    mMaskLayer->LogSelf(pfx.get());
+  }
 }
 
 nsACString&
@@ -1305,6 +1311,9 @@ Layer::PrintInfo(nsACString& aTo, const char* aPrefix)
                      mStickyPositionData->mInner.x, mStickyPositionData->mInner.y,
                      mStickyPositionData->mInner.width, mStickyPositionData->mInner.height);
   }
+  if (mMaskLayer) {
+    aTo.AppendPrintf(" [mMaskLayer=%p]", mMaskLayer.get());
+  }
 
   return aTo;
 }
diff --git a/gfx/layers/composite/LayerManagerComposite.cpp b/gfx/layers/composite/LayerManagerComposite.cpp
index 49d6a51a733a..cd4421f1cb97 100644
--- a/gfx/layers/composite/LayerManagerComposite.cpp
+++ b/gfx/layers/composite/LayerManagerComposite.cpp
@@ -168,10 +168,11 @@ LayerManagerComposite::BeginTransactionWithDrawTarget(DrawTarget* aTarget)
 bool
 LayerManagerComposite::EndEmptyTransaction(EndTransactionFlags aFlags)
 {
-  mInTransaction = false;
-
-  if (!mRoot)
+  NS_ASSERTION(mInTransaction, "Didn't call BeginTransaction?");
+  if (!mRoot) {
+    mInTransaction = false;
     return false;
+  }
 
   EndTransaction(nullptr, nullptr);
   return true;
@@ -182,6 +183,7 @@ LayerManagerComposite::EndTransaction(DrawThebesLayerCallback aCallback,
                                       void* aCallbackData,
                                       EndTransactionFlags aFlags)
 {
+  NS_ASSERTION(mInTransaction, "Didn't call BeginTransaction?");
   mInTransaction = false;
 
 #ifdef MOZ_LAYERS_HAVE_LOG
diff --git a/gfx/layers/ipc/CompositorParent.cpp b/gfx/layers/ipc/CompositorParent.cpp
index c1f4a32a33f3..60e708fe3f5e 100644
--- a/gfx/layers/ipc/CompositorParent.cpp
+++ b/gfx/layers/ipc/CompositorParent.cpp
@@ -500,6 +500,15 @@ CompositorParent::ScheduleComposition()
 
 void
 CompositorParent::Composite()
+{
+  if (CanComposite()) {
+    mLayerManager->BeginTransaction();
+  }
+  CompositeInTransaction();
+}
+
+void
+CompositorParent::CompositeInTransaction()
 {
   profiler_tracing("Paint", "Composite", TRACING_INTERVAL_START);
   PROFILER_LABEL("CompositorParent", "Composite");
@@ -564,7 +573,7 @@ CompositorParent::ComposeToTarget(DrawTarget* aTarget)
   mLayerManager->BeginTransactionWithDrawTarget(aTarget);
   // Since CanComposite() is true, Composite() must end the layers txn
   // we opened above.
-  Composite();
+  CompositeInTransaction();
 }
 
 bool
@@ -629,10 +638,7 @@ CompositorParent::ShadowLayersUpdated(LayerTransactionParent* aLayerTree,
     }
   }
   ScheduleComposition();
-  LayerManagerComposite *layerComposite = mLayerManager->AsLayerManagerComposite();
-  if (layerComposite) {
-    layerComposite->NotifyShadowTreeTransaction();
-  }
+  mLayerManager->NotifyShadowTreeTransaction();
 }
 
 void
diff --git a/gfx/layers/ipc/CompositorParent.h b/gfx/layers/ipc/CompositorParent.h
index be1fbfe5d87d..544500b8b720 100644
--- a/gfx/layers/ipc/CompositorParent.h
+++ b/gfx/layers/ipc/CompositorParent.h
@@ -230,7 +230,8 @@ protected:
                                  bool* aSuccess);
   virtual bool DeallocPLayerTransactionParent(PLayerTransactionParent* aLayers);
   virtual void ScheduleTask(CancelableTask*, int);
-  virtual void Composite();
+  void Composite();
+  void CompositeInTransaction();
   virtual void ComposeToTarget(gfx::DrawTarget* aTarget);
 
   void SetEGLSurfaceSize(int width, int height);
diff --git a/gfx/ots/src/moz.build b/gfx/ots/src/moz.build
index 5a6e489a9ae1..ab39e428e64e 100644
--- a/gfx/ots/src/moz.build
+++ b/gfx/ots/src/moz.build
@@ -10,25 +10,31 @@ EXPORTS += [
 ]
 
 SOURCES += [
+    # don't unify sources that use a (file-specific) DROP_THIS_TABLE macro
+    'gasp.cc',
+    'gdef.cc',
+    'gpos.cc',
+    'gsub.cc',
+    'hdmx.cc',
+    'kern.cc',
+    'ltsh.cc',
+    'vdmx.cc',
+    'vorg.cc',
+]
+
+UNIFIED_SOURCES += [
     'cff.cc',
     'cff_type2_charstring.cc',
     'cmap.cc',
     'cvt.cc',
     'fpgm.cc',
-    'gasp.cc',
-    'gdef.cc',
     'glyf.cc',
-    'gpos.cc',
     'graphite.cc',
-    'gsub.cc',
-    'hdmx.cc',
     'head.cc',
     'hhea.cc',
     'hmtx.cc',
-    'kern.cc',
     'layout.cc',
     'loca.cc',
-    'ltsh.cc',
     'maxp.cc',
     'metrics.cc',
     'name.cc',
@@ -37,10 +43,8 @@ SOURCES += [
     'post.cc',
     'prep.cc',
     'svg.cc',
-    'vdmx.cc',
     'vhea.cc',
     'vmtx.cc',
-    'vorg.cc',
 ]
 
 MSVC_ENABLE_PGO = True
diff --git a/gfx/tests/reftest/reftest.list b/gfx/tests/reftest/reftest.list
index 7fd9bb9b425a..0e7583ea2429 100644
--- a/gfx/tests/reftest/reftest.list
+++ b/gfx/tests/reftest/reftest.list
@@ -1,4 +1,4 @@
 # 468496-1 will also detect bugs in video drivers.
 == 468496-1.html 468496-1-ref.html
-== 611498-1.html 611498-ref.html
+fuzzy-if(winWidget,175,443) == 611498-1.html 611498-ref.html
 skip-if(B2G) fuzzy-if(Android&&AndroidVersion>=15,8,1000) == 709477-1.html 709477-1-ref.html # bug 773482
diff --git a/image/src/Decoder.h b/image/src/Decoder.h
index 15b937de47e1..0387a98954b9 100644
--- a/image/src/Decoder.h
+++ b/image/src/Decoder.h
@@ -94,11 +94,6 @@ public:
     mSizeDecode = aSizeDecode;
   }
 
-  void SetSynchronous(bool aSynchronous)
-  {
-    mSynchronous = aSynchronous;
-  }
-
   bool IsSynchronous() const
   {
     return mSynchronous;
@@ -246,6 +241,17 @@ protected:
   bool mDataError;
 
 private:
+  // Decode in synchronous mode. This is unsafe off-main-thread since it may
+  // attempt to allocate frames. To ensure that we never accidentally leave the
+  // decoder in synchronous mode, this should only be called by
+  // AutoSetSyncDecode.
+  void SetSynchronous(bool aSynchronous)
+  {
+    mSynchronous = aSynchronous;
+  }
+
+  friend class AutoSetSyncDecode;
+
   uint32_t mFrameCount; // Number of frames, including anything in-progress
 
   nsIntRect mInvalidRect; // Tracks an invalidation region in the current frame.
@@ -285,6 +291,34 @@ private:
   bool mSynchronous;
 };
 
+// A RAII helper class to automatically pair a call to SetSynchronous(true)
+// with a call to SetSynchronous(false), since failing to do so can lead us
+// to try to allocate frames off-main-thread, which is unsafe. Synchronous
+// decoding may only happen within the scope of an AutoSetSyncDecode. Nested
+// AutoSetSyncDecode's are OK.
+class AutoSetSyncDecode
+{
+public:
+  AutoSetSyncDecode(Decoder* aDecoder)
+    : mDecoder(aDecoder)
+  {
+    MOZ_ASSERT(NS_IsMainThread());
+    MOZ_ASSERT(mDecoder);
+
+    mOriginalValue = mDecoder->IsSynchronous();
+    mDecoder->SetSynchronous(true);
+  }
+
+  ~AutoSetSyncDecode()
+  {
+    mDecoder->SetSynchronous(mOriginalValue);
+  }
+
+private:
+  nsRefPtr<Decoder> mDecoder;
+  bool              mOriginalValue;
+};
+
 } // namespace image
 } // namespace mozilla
 
diff --git a/image/src/ImageMetadata.h b/image/src/ImageMetadata.h
index 5ec74a3e209b..3c32ef66a3a3 100644
--- a/image/src/ImageMetadata.h
+++ b/image/src/ImageMetadata.h
@@ -4,6 +4,9 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#ifndef ImageMetadata_h___
+#define ImageMetadata_h___
+
 #include <stdint.h>
 #include "mozilla/Maybe.h"
 #include "nsSize.h"
@@ -72,3 +75,5 @@ private:
 
 } // namespace image
 } // namespace mozilla
+
+#endif // ImageMetadata_h___
diff --git a/image/src/RasterImage.cpp b/image/src/RasterImage.cpp
index 6f0db725dbdb..389e0716750a 100644
--- a/image/src/RasterImage.cpp
+++ b/image/src/RasterImage.cpp
@@ -1589,10 +1589,11 @@ RasterImage::AddSourceData(const char *aBuffer, uint32_t aCount)
   // write the data directly to the decoder. (If we haven't gotten the size,
   // we'll queue up the data and write it out when we do.)
   if (!StoringSourceData() && mHasSize) {
-    mDecoder->SetSynchronous(true);
-    rv = WriteToDecoder(aBuffer, aCount);
-    mDecoder->SetSynchronous(false);
-    CONTAINER_ENSURE_SUCCESS(rv);
+    {
+      AutoSetSyncDecode syncDecode(mDecoder);
+      rv = WriteToDecoder(aBuffer, aCount);
+      CONTAINER_ENSURE_SUCCESS(rv);
+    }
 
     // We're not storing source data, so this data is probably coming straight
     // from the network. In this case, we want to display data as soon as we
@@ -1961,7 +1962,7 @@ RasterImage::StoringSourceData() const {
 // Sets up a decoder for this image. It is an error to call this function
 // when decoding is already in process (ie - when mDecoder is non-null).
 nsresult
-RasterImage::InitDecoder(bool aDoSizeDecode, bool aIsSynchronous /* = false */)
+RasterImage::InitDecoder(bool aDoSizeDecode)
 {
   // Ensure that the decoder is not already initialized
   NS_ABORT_IF_FALSE(!mDecoder, "Calling InitDecoder() while already decoding!");
@@ -2026,7 +2027,6 @@ RasterImage::InitDecoder(bool aDoSizeDecode, bool aIsSynchronous /* = false */)
   mDecoder->SetObserver(mDecodeRequest->mStatusTracker->GetDecoderObserver());
   mDecoder->SetSizeDecode(aDoSizeDecode);
   mDecoder->SetDecodeFlags(mFrameDecodeFlags);
-  mDecoder->SetSynchronous(aIsSynchronous);
   if (!aDoSizeDecode) {
     // We already have the size; tell the decoder so it can preallocate a
     // frame.  By default, we create an ARGB frame with no offset. If decoders
@@ -2313,14 +2313,8 @@ RasterImage::RequestDecodeCore(RequestDecodeType aDecodeType)
   // to finish decoding.
   if (!mDecoded && !mInDecoder && mHasSourceData && aDecodeType == SYNCHRONOUS_NOTIFY_AND_SOME_DECODE) {
     PROFILER_LABEL_PRINTF("RasterImage", "DecodeABitOf", "%s", GetURIString().get());
-    mDecoder->SetSynchronous(true);
-
+    AutoSetSyncDecode syncDecode(mDecoder);
     DecodePool::Singleton()->DecodeABitOf(this);
-
-    // DecodeABitOf can destroy mDecoder.
-    if (mDecoder) {
-      mDecoder->SetSynchronous(false);
-    }
     return NS_OK;
   }
 
@@ -2398,15 +2392,17 @@ RasterImage::SyncDecode()
 
   // If we don't have a decoder, create one
   if (!mDecoder) {
-    rv = InitDecoder(/* aDoSizeDecode = */ false, /* aIsSynchronous = */ true);
+    rv = InitDecoder(/* aDoSizeDecode = */ false);
     CONTAINER_ENSURE_SUCCESS(rv);
-  } else {
-    mDecoder->SetSynchronous(true);
   }
 
-  // Write everything we have
-  rv = DecodeSomeData(mSourceData.Length() - mBytesDecoded);
-  CONTAINER_ENSURE_SUCCESS(rv);
+  {
+    AutoSetSyncDecode syncDecode(mDecoder);
+
+    // Write everything we have
+    rv = DecodeSomeData(mSourceData.Length() - mBytesDecoded);
+    CONTAINER_ENSURE_SUCCESS(rv);
+  }
 
   // When we're doing a sync decode, we want to get as much information from the
   // image as possible. We've send the decoder all of our data, so now's a good
@@ -2419,11 +2415,9 @@ RasterImage::SyncDecode()
 
   rv = FinishedSomeDecoding();
   CONTAINER_ENSURE_SUCCESS(rv);
-
+  
+  // If our decoder's still open, there's still work to be done.
   if (mDecoder) {
-    mDecoder->SetSynchronous(false);
-
-    // If our decoder's still open, there's still work to be done.
     DecodePool::Singleton()->RequestDecode(this);
   }
 
diff --git a/image/src/RasterImage.h b/image/src/RasterImage.h
index 13d116fbfab6..785fec2db492 100644
--- a/image/src/RasterImage.h
+++ b/image/src/RasterImage.h
@@ -690,7 +690,7 @@ private: // data
   // Decoding
   nsresult WantDecodedFrames();
   nsresult SyncDecode();
-  nsresult InitDecoder(bool aDoSizeDecode, bool aIsSynchronous = false);
+  nsresult InitDecoder(bool aDoSizeDecode);
   nsresult WriteToDecoder(const char *aBuffer, uint32_t aCount);
   nsresult DecodeSomeData(uint32_t aMaxBytes);
   bool     IsDecodeFinished();
diff --git a/image/src/SVGDocumentWrapper.cpp b/image/src/SVGDocumentWrapper.cpp
index 15984bae188d..3fcd869d7bde 100644
--- a/image/src/SVGDocumentWrapper.cpp
+++ b/image/src/SVGDocumentWrapper.cpp
@@ -28,6 +28,9 @@
 #include "mozilla/dom/SVGAnimatedLength.h"
 #include "nsMimeTypes.h"
 
+// undef the GetCurrentTime macro defined in WinBase.h from the MS Platform SDK
+#undef GetCurrentTime
+
 using namespace mozilla::dom;
 
 namespace mozilla {
diff --git a/image/src/SVGDocumentWrapper.h b/image/src/SVGDocumentWrapper.h
index 9b4cc9c02ac2..d70a0241f440 100644
--- a/image/src/SVGDocumentWrapper.h
+++ b/image/src/SVGDocumentWrapper.h
@@ -25,6 +25,8 @@ struct nsIntSize;
 
 #define OBSERVER_SVC_CID "@mozilla.org/observer-service;1"
 
+// undef the GetCurrentTime macro defined in WinBase.h from the MS Platform SDK
+#undef GetCurrentTime
 
 namespace mozilla {
 namespace dom {
diff --git a/image/src/VectorImage.cpp b/image/src/VectorImage.cpp
index 6a72d2157d36..e99c7a1f4fc3 100644
--- a/image/src/VectorImage.cpp
+++ b/image/src/VectorImage.cpp
@@ -26,6 +26,9 @@
 #include "nsIDOMEventListener.h"
 #include "SurfaceCache.h"
 
+// undef the GetCurrentTime macro defined in WinBase.h from the MS Platform SDK
+#undef GetCurrentTime
+
 namespace mozilla {
 
 using namespace dom;
@@ -488,20 +491,35 @@ VectorImage::RequestRefresh(const mozilla::TimeStamp& aTime)
   // TODO: Implement for b666446.
   EvaluateAnimation();
 
-  if (mHasPendingInvalidation && mStatusTracker) {
-    // This method is called under the Tick() of an observing document's
-    // refresh driver. We send out the following notifications here rather than
-    // under WillRefresh() (which would be called by our own refresh driver) so
-    // that we only send these notifications if we actually have a document
-    // that is observing us.
-    // XXX(seth): We may need to duplicate this code so that non-animated images
-    // get handled correctly. See bug 922899.
+  if (mHasPendingInvalidation) {
+    SendInvalidationNotifications();
+    mHasPendingInvalidation = false;
+  }
+}
+
+void
+VectorImage::SendInvalidationNotifications()
+{
+  // Animated images don't send out invalidation notifications as soon as
+  // they're generated. Instead, InvalidateObserversOnNextRefreshDriverTick
+  // records that there are pending invalidations and then returns immediately.
+  // The notifications are actually sent from RequestRefresh(). We send these
+  // notifications there to ensure that there is actually a document observing
+  // us. Otherwise, the notifications are just wasted effort.
+  //
+  // Non-animated images call this method directly from
+  // InvalidateObserversOnNextRefreshDriverTick, because RequestRefresh is never
+  // called for them. Ordinarily this isn't needed, since we send out
+  // invalidation notifications in OnSVGDocumentLoaded, but in rare cases the
+  // SVG document may not be 100% ready to render at that time. In those cases
+  // we would miss the subsequent invalidations if we didn't send out the
+  // notifications directly in |InvalidateObservers...|.
+
+  if (mStatusTracker) {
     SurfaceCache::Discard(this);
     mStatusTracker->FrameChanged(&nsIntRect::GetMaxSizedIntRect());
     mStatusTracker->OnStopFrame();
   }
-
-  mHasPendingInvalidation = false;
 }
 
 //******************************************************************************
@@ -1127,7 +1145,11 @@ VectorImage::OnDataAvailable(nsIRequest* aRequest, nsISupports* aCtxt,
 void
 VectorImage::InvalidateObserversOnNextRefreshDriverTick()
 {
-  mHasPendingInvalidation = true;
+  if (mHaveAnimations) {
+    mHasPendingInvalidation = true;
+  } else {
+    SendInvalidationNotifications();
+  }
 }
 
 } // namespace image
diff --git a/image/src/VectorImage.h b/image/src/VectorImage.h
index 6eda36e9e839..96f4e1a26aab 100644
--- a/image/src/VectorImage.h
+++ b/image/src/VectorImage.h
@@ -89,6 +89,7 @@ protected:
 
 private:
   void CancelAllListeners();
+  void SendInvalidationNotifications();
 
   nsRefPtr<SVGDocumentWrapper>       mSVGDocumentWrapper;
   nsRefPtr<SVGRootRenderingObserver> mRenderingObserver;
diff --git a/image/src/moz.build b/image/src/moz.build
index 11573ec861f3..7fc8d0559cf1 100644
--- a/image/src/moz.build
+++ b/image/src/moz.build
@@ -12,7 +12,7 @@ EXPORTS += [
     'Orientation.h',
 ]
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'ClippedImage.cpp',
     'Decoder.cpp',
     'DiscardTracker.cpp',
@@ -26,19 +26,23 @@ SOURCES += [
     'ImageOps.cpp',
     'ImageWrapper.cpp',
     'imgFrame.cpp',
-    'imgLoader.cpp',
-    'imgRequest.cpp',
-    'imgRequestProxy.cpp',
-    'imgStatusTracker.cpp',
     'imgTools.cpp',
     'OrientedImage.cpp',
-    'RasterImage.cpp',
     'ScriptedNotificationObserver.cpp',
     'SurfaceCache.cpp',
     'SVGDocumentWrapper.cpp',
     'VectorImage.cpp',
 ]
 
+# These files can't be unified because of ImageLogging.h #include order issues.
+SOURCES += [
+    'imgLoader.cpp',
+    'imgRequest.cpp',
+    'imgRequestProxy.cpp',
+    'imgStatusTracker.cpp',
+    'RasterImage.cpp',
+]
+
 FAIL_ON_WARNINGS = True
 
 include('/ipc/chromium/chromium-config.mozbuild')
diff --git a/image/test/mochitest/bug900200-ref.png b/image/test/mochitest/bug900200-ref.png
new file mode 100644
index 000000000000..636013132500
Binary files /dev/null and b/image/test/mochitest/bug900200-ref.png differ
diff --git a/image/test/mochitest/bug900200.png b/image/test/mochitest/bug900200.png
new file mode 100644
index 000000000000..d7d87adce09a
Binary files /dev/null and b/image/test/mochitest/bug900200.png differ
diff --git a/image/test/mochitest/clear.gif b/image/test/mochitest/clear.gif
new file mode 100644
index 000000000000..7ae79ba86e4e
Binary files /dev/null and b/image/test/mochitest/clear.gif differ
diff --git a/image/test/mochitest/clear.png b/image/test/mochitest/clear.png
new file mode 100644
index 000000000000..b09aecaaa031
Binary files /dev/null and b/image/test/mochitest/clear.png differ
diff --git a/image/test/mochitest/clear2-results.gif b/image/test/mochitest/clear2-results.gif
new file mode 100644
index 000000000000..965b65025334
Binary files /dev/null and b/image/test/mochitest/clear2-results.gif differ
diff --git a/image/test/mochitest/clear2.gif b/image/test/mochitest/clear2.gif
new file mode 100644
index 000000000000..00ad873c65d7
Binary files /dev/null and b/image/test/mochitest/clear2.gif differ
diff --git a/image/test/mochitest/green-background.html b/image/test/mochitest/green-background.html
new file mode 100644
index 000000000000..afc3c206e4fc
--- /dev/null
+++ b/image/test/mochitest/green-background.html
@@ -0,0 +1,28 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<title>Background color wrapper for clear image tests</title>
+<style>
+img {
+  background-color: rgb(0, 255, 0);
+}
+</style>
+</head>
+<body>
+<img id="image1">
+<script>
+// Loads an externally specified image and displays it
+// with a green background. Intended for use with tests
+// involving clear images.
+
+// Use as "green-background.html?image.png".
+
+// Get the image URL.
+var imgURL = document.location.search.substr(1);
+
+// Load it.
+var img = document.images[0];
+img.src = imgURL;
+</script>
+</body>
+</html>
diff --git a/image/test/mochitest/green.png b/image/test/mochitest/green.png
new file mode 100644
index 000000000000..7df25f33bdb2
Binary files /dev/null and b/image/test/mochitest/green.png differ
diff --git a/image/test/mochitest/grey.png b/image/test/mochitest/grey.png
new file mode 100644
index 000000000000..5c82cdeb10c8
Binary files /dev/null and b/image/test/mochitest/grey.png differ
diff --git a/image/test/mochitest/keep.gif b/image/test/mochitest/keep.gif
new file mode 100644
index 000000000000..e967d6a6dc96
Binary files /dev/null and b/image/test/mochitest/keep.gif differ
diff --git a/image/test/mochitest/keep.png b/image/test/mochitest/keep.png
new file mode 100644
index 000000000000..aa3ff7445025
Binary files /dev/null and b/image/test/mochitest/keep.png differ
diff --git a/image/test/mochitest/mochitest.ini b/image/test/mochitest/mochitest.ini
index 5846156b79d3..9d443106aba5 100644
--- a/image/test/mochitest/mochitest.ini
+++ b/image/test/mochitest/mochitest.ini
@@ -28,16 +28,31 @@ support-files =
   bug767779.sjs
   bug89419-iframe.html
   bug89419.sjs
+  bug900200.png
+  bug900200-ref.png
+  clear.gif
+  clear.png
+  clear2.gif
+  clear2-results.gif
   damon.jpg
   error-early.png
+  green.png
+  green-background.html
+  grey.png
   imgutils.js
   invalid.jpg
+  keep.gif
+  keep.png
   lime100x100.svg
   red.png
+  restore-previous.gif
+  restore-previous.png
   rillybad.jpg
   schrep.png
   shaver.png
   short_header.gif
+  source.png
+  over.png
 
 [test_ImageContentLoaded.html]
 [test_bug399925.html]
@@ -63,6 +78,7 @@ support-files =
 [test_bug865919.html]
 [test_bug89419-1.html]
 [test_bug89419-2.html]
+[test_animation_operators.html]
 [test_drawDiscardedImage.html]
 [test_error_events.html]
 [test_short_gif_header.html]
diff --git a/image/test/mochitest/over.png b/image/test/mochitest/over.png
new file mode 100644
index 000000000000..9e957182f7e7
Binary files /dev/null and b/image/test/mochitest/over.png differ
diff --git a/image/test/mochitest/restore-previous.gif b/image/test/mochitest/restore-previous.gif
new file mode 100644
index 000000000000..15ba9ddc48df
Binary files /dev/null and b/image/test/mochitest/restore-previous.gif differ
diff --git a/image/test/mochitest/restore-previous.png b/image/test/mochitest/restore-previous.png
new file mode 100644
index 000000000000..09dee6382089
Binary files /dev/null and b/image/test/mochitest/restore-previous.png differ
diff --git a/image/test/mochitest/source.png b/image/test/mochitest/source.png
new file mode 100644
index 000000000000..df1c76dae5d2
Binary files /dev/null and b/image/test/mochitest/source.png differ
diff --git a/image/test/mochitest/test_animation_operators.html b/image/test/mochitest/test_animation_operators.html
new file mode 100644
index 000000000000..b4b26b65af1b
--- /dev/null
+++ b/image/test/mochitest/test_animation_operators.html
@@ -0,0 +1,157 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=936720
+-->
+<head>
+  <title>Test for Bug 936720</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/WindowSnapshot.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=936720">Mozilla Bug 936720</a>
+<pre id="test">
+<script type="application/javascript">
+
+/** Test for Bug 936720 **/
+
+// Because there is no event telling us when an animated image finishes
+// animating, tests for the operators used by animated GIFs and PNGs
+// require that we poll until we get the correct result. A fixed timeout
+// can easily result in intermittent failures on tests running in VMs.
+
+// (Note that we do _not_ poll the reference, so it must not be animated.)
+
+var gTests = [
+  // IMPORTANT NOTE: For these tests, the test and reference are not
+  // snapshotted in the same way.  The REFERENCE (second file) is
+  // assumed to be complete when loaded, but we poll the TEST
+  // (first file) until the test passes.
+
+  // Tests of the allowed disposal operators for both GIF and APNG: keep, clear,
+  // and restore previous.
+  "== green-background.html?clear.gif green.png",
+  "== green-background.html?clear.png green.png",
+  "== keep.gif green.png",
+  "== keep.png green.png",
+  "== restore-previous.gif green.png",
+  "== restore-previous.png green.png",
+
+  // Tests of the blending/compositing operators that only APNG supports.
+  "== over.png grey.png",
+  "!= source.png grey.png",
+  "== bug900200.png bug900200-ref.png",
+
+  // Test of subframe updates.
+  "== clear2.gif clear2-results.gif",
+];
+
+// Maintain a reference count of how many things we're waiting for until
+// we can say the tests are done.
+var gDelayCount = 0;
+function AddFinishDependency()
+  { ++gDelayCount; }
+function RemoveFinishDependency()
+  { if (--gDelayCount == 0) SimpleTest.finish(); }
+
+// We record the maximum number of times we had to look at a test before
+// it switched to the passing state (though we assume it's 10 to start
+// rather than 0 so that we have a reasonable default).  Then we make a
+// test "time out" if it takes more than gTimeoutFactor times that
+// amount of time.  This allows us to report a test failure rather than
+// making a test failure just show up as a timeout.
+var gMaxPassingTries = 10;
+var gTimeoutFactor = 10;
+
+function takeSnapshot(iframe_element)
+{
+  return snapshotWindow(iframe_element.contentWindow, false);
+}
+
+function passes(op, shot1, shot2)
+{
+  var [correct, s1, s2] = compareSnapshots(shot1, shot2, op == "==");
+  return correct;
+}
+
+function startTest(i)
+{
+  var testLine = gTests[i];
+  var splitData = testLine.split(" ");
+  var testData =
+    { op: splitData[0], test: splitData[1], reference: splitData[2] };
+  var tries = 0;
+
+  // Maintain state specific to this test in the closure exposed to all
+  // the functions nested inside this one.
+
+  function startIframe(url)
+  {
+    var element = document.createElement("iframe");
+    element.addEventListener("load", handleLoad, false);
+    // Smaller than normal reftests, but enough for these.
+    element.setAttribute("style", "width: 100px; height: 100px");
+    element.setAttribute("frameborder", "0");
+    element.setAttribute("scrolling", "no");
+    element.src = url;
+    document.body.appendChild(element);
+    function handleLoad(event)
+    {
+      iframe.loaded = true;
+      if (iframe == reference) {
+        reference.snapshot = takeSnapshot(element);
+      }
+      var other = (iframe == test) ? reference : test;
+      if (other.loaded) {
+        setTimeout(checkTest, 100);
+      }
+    }
+    function checkTest()
+    {
+      var test_snapshot = takeSnapshot(test.element);
+      if (passes(testData.op, test_snapshot, reference.snapshot)) {
+        if (tries > gMaxPassingTries) {
+          gMaxPassingTries = tries;
+        }
+        report(true);
+      } else {
+        ++tries;
+        if (tries > gMaxPassingTries * gTimeoutFactor) {
+          info("Giving up after " + tries + " tries, " +
+               "maxp=" + gMaxPassingTries +
+               "fact=" + gTimeoutFactor);
+          report(false);
+        } else {
+          // The animation might not have finished.  Try again in 100ms.
+          setTimeout(checkTest, 100);
+        }
+      }
+    }
+    function report(result)
+    {
+      ok(result, "(" + i + ") " +
+                 testData.op + " " + testData.test + " " + testData.reference);
+      RemoveFinishDependency();
+    }
+    var iframe = { element: element, loaded: false };
+
+    return iframe;
+  }
+
+  AddFinishDependency();
+  var test = startIframe(testData.test);
+  var reference = startIframe(testData.reference);
+}
+
+SimpleTest.waitForExplicitFinish();
+
+// Run the tests.
+for (var i = 0; i < gTests.length; ++i) {
+  startTest(i);
+}
+
+</script>
+</pre>
+</body>
+</html>
diff --git a/image/test/reftest/animated/delay-test.html b/image/test/reftest/animated/delay-test.html
index f2ed5279e1b3..7372a6bc2435 100644
--- a/image/test/reftest/animated/delay-test.html
+++ b/image/test/reftest/animated/delay-test.html
@@ -38,7 +38,7 @@ function forceDecode() {
 }
 
 function startTimer() {
-  const delay = 1000;
+  const delay = 10000;
   setTimeout("document.documentElement.className = '';", delay);
 }
 </script>
diff --git a/js/public/MemoryMetrics.h b/js/public/MemoryMetrics.h
index f8782a41df3f..f758f52a96eb 100644
--- a/js/public/MemoryMetrics.h
+++ b/js/public/MemoryMetrics.h
@@ -272,7 +272,6 @@ struct NotableStringInfo : public StringInfo
 {
     NotableStringInfo();
     NotableStringInfo(JSString *str, const StringInfo &info);
-    NotableStringInfo(const NotableStringInfo& info);
     NotableStringInfo(NotableStringInfo &&info);
     NotableStringInfo &operator=(NotableStringInfo &&info);
 
@@ -286,10 +285,10 @@ struct NotableStringInfo : public StringInfo
         return js::MemoryReportingSundriesThreshold();
     }
 
-    // The amount of memory we requested for |buffer|; i.e.
-    // buffer = malloc(bufferSize).
-    size_t bufferSize;
     char *buffer;
+
+  private:
+    NotableStringInfo(const NotableStringInfo& info) MOZ_DELETE;
 };
 
 // These measurements relate directly to the JSRuntime, and not to zones and
diff --git a/js/public/Value.h b/js/public/Value.h
index 0beabd8fff3e..dc8225b6dfd9 100644
--- a/js/public/Value.h
+++ b/js/public/Value.h
@@ -1520,7 +1520,6 @@ template <> struct GCMethods<JS::Value>
 #endif
 };
 
-template <class Outer> class UnbarrieredMutableValueOperations;
 template <class Outer> class MutableValueOperations;
 
 /*
@@ -1532,7 +1531,6 @@ template <class Outer> class MutableValueOperations;
 template <class Outer>
 class ValueOperations
 {
-    friend class UnbarrieredMutableValueOperations<Outer>;
     friend class MutableValueOperations<Outer>;
 
     const JS::Value * value() const { return static_cast<const Outer*>(this)->extract(); }
@@ -1573,16 +1571,14 @@ class ValueOperations
 };
 
 /*
- * A class designed for CRTP use in implementing the mutating parts of the Value
- * interface in Value-like classes that don't need post barriers.  Outer must be
- * a class inheriting UnbarrieredMutableValueOperations<Outer> with visible
- * extractMutable() and extract() methods returning the const Value* and Value*
- * abstracted by Outer.
+ * A class designed for CRTP use in implementing all the mutating parts of the
+ * Value interface in Value-like classes.  Outer must be a class inheriting
+ * MutableValueOperations<Outer> with visible extractMutable() and extract()
+ * methods returning the const Value* and Value* abstracted by Outer.
  */
 template <class Outer>
-class UnbarrieredMutableValueOperations : public ValueOperations<Outer>
+class MutableValueOperations : public ValueOperations<Outer>
 {
-    friend class MutableValueOperations<Outer>;
     JS::Value * value() { return static_cast<Outer*>(this)->extractMutable(); }
 
   public:
@@ -1595,18 +1591,6 @@ class UnbarrieredMutableValueOperations : public ValueOperations<Outer>
     void setMagic(JSWhyMagic why) { value()->setMagic(why); }
     bool setNumber(uint32_t ui) { return value()->setNumber(ui); }
     bool setNumber(double d) { return value()->setNumber(d); }
-};
-
-/*
- * A class designed for CRTP use in implementing all the mutating parts of the
- * Value interface in Value-like classes.  Outer must be a class inheriting
- * MutableValueOperations<Outer> with visible extractMutable() and extract()
- * methods returning the const Value* and Value* abstracted by Outer.
- */
-template <class Outer>
-class MutableValueOperations : public UnbarrieredMutableValueOperations<Outer>
-{
-  public:
     void setString(JSString *str) { this->value()->setString(str); }
     void setString(const JS::Anchor<JSString *> &str) { this->value()->setString(str); }
     void setObject(JSObject &obj) { this->value()->setObject(obj); }
@@ -1696,7 +1680,6 @@ class MutableHandleBase<JS::Value> : public MutableValueOperations<JS::MutableHa
         return static_cast<const JS::MutableHandle<JS::Value>*>(this)->address();
     }
 
-    friend class UnbarrieredMutableValueOperations<JS::MutableHandle<JS::Value> >;
     friend class MutableValueOperations<JS::MutableHandle<JS::Value> >;
     JS::Value * extractMutable() {
         return static_cast<JS::MutableHandle<JS::Value>*>(this)->address();
@@ -1715,7 +1698,6 @@ class RootedBase<JS::Value> : public MutableValueOperations<JS::Rooted<JS::Value
         return static_cast<const JS::Rooted<JS::Value>*>(this)->address();
     }
 
-    friend class UnbarrieredMutableValueOperations<JS::Rooted<JS::Value> >;
     friend class MutableValueOperations<JS::Rooted<JS::Value> >;
     JS::Value * extractMutable() {
         return static_cast<JS::Rooted<JS::Value>*>(this)->address();
diff --git a/js/src/Makefile.in b/js/src/Makefile.in
index 2268b20f8854..cc7e38adadc4 100644
--- a/js/src/Makefile.in
+++ b/js/src/Makefile.in
@@ -238,7 +238,7 @@ ifeq ($(OS_ARCH),WINNT)
     ICU_LIB_SUFFIX=d
   endif
   ICU_LIB_RENAME = $(foreach libname,$(ICU_LIB_NAMES),\
-                     cp -p intl/icu/target/lib/s$(libname)$(ICU_LIB_SUFFIX).lib intl/icu/target/lib/$(libname).lib;)
+                     cp -p intl/icu/lib/s$(libname)$(ICU_LIB_SUFFIX).lib intl/icu/lib/$(libname).lib;)
 endif
 
 ifdef .PYMAKE
@@ -254,17 +254,11 @@ endif
 # - Options for genrb: -k strict parsing; -R omit collation tailoring rules.
 buildicu:
 # ICU's build system is full of races, so force non-parallel build.
-ifdef CROSS_COMPILE
-	+$(ICU_MAKE) -j1 -C intl/icu/host STATIC_O=$(OBJ_SUFFIX) GENRBOPTS='-k -R -C'
-endif
-	+$(ICU_MAKE) -j1 -C intl/icu/target STATIC_O=$(OBJ_SUFFIX) GENRBOPTS='-k -R'
+	+$(ICU_MAKE) -j1 -C intl/icu STATIC_O=$(OBJ_SUFFIX) GENRBOPTS='-k -R'
 	$(ICU_LIB_RENAME)
 
 distclean clean::
-ifdef CROSS_COMPILE
-	$(call SUBMAKE,$@,intl/icu/host)
-endif
-	$(call SUBMAKE,$@,intl/icu/target)
+	$(call SUBMAKE,$@,intl/icu)
 
 endif
 endif
@@ -274,14 +268,18 @@ endif
 #############################################
 
 
-# The "find any vanilla new/new[] calls" script is tailored to Linux, so
-# only run it there.  That should be enough to catch any such calls that
-# creep in.
-check-vanilla-new:
-	$(srcdir)/config/find_vanilla_new_calls $(LIBRARY)
+# check_vanilla_allocations.py is tailored to Linux, so only run it there.
+# That should be enough to catch any problems.
+check-vanilla-allocations:
+	$(PYTHON) $(srcdir)/config/check_vanilla_allocations.py $(REAL_LIBRARY)
+
+# The "aggressive" variant will likely fail on some compiler/platform
+# combinations, but is worth running by hand every once in a while.
+check-vanilla-allocations-aggressive:
+	$(PYTHON) $(srcdir)/config/check_vanilla_allocations.py --aggressive $(REAL_LIBRARY)
 
 ifeq ($(OS_ARCH),Linux)
-check:: check-vanilla-new
+check:: check-vanilla-allocations
 endif
 
 # Help ensure that the number of OOM errors in SpiderMonkey doesn't increase.
diff --git a/js/src/aclocal.m4 b/js/src/aclocal.m4
index ef750a638da3..cf2063441ec2 100644
--- a/js/src/aclocal.m4
+++ b/js/src/aclocal.m4
@@ -11,7 +11,6 @@ builtin(include, build/autoconf/ccache.m4)dnl
 builtin(include, build/autoconf/wrapper.m4)dnl
 builtin(include, build/autoconf/pkg.m4)dnl
 builtin(include, build/autoconf/nspr.m4)dnl
-builtin(include, build/autoconf/codeset.m4)dnl
 builtin(include, build/autoconf/altoptions.m4)dnl
 builtin(include, build/autoconf/mozprog.m4)dnl
 builtin(include, build/autoconf/mozheader.m4)dnl
diff --git a/js/src/assembler/assembler/X86Assembler.h b/js/src/assembler/assembler/X86Assembler.h
index 51354b36470a..bd3f2e542db5 100644
--- a/js/src/assembler/assembler/X86Assembler.h
+++ b/js/src/assembler/assembler/X86Assembler.h
@@ -283,6 +283,7 @@ private:
     } OneByteOpcodeID;
 
     typedef enum {
+        OP2_UD2             = 0x0B,
         OP2_MOVSD_VsdWsd    = 0x10,
         OP2_MOVSD_WsdVsd    = 0x11,
         OP2_UNPCKLPS_VsdWsd = 0x14,
@@ -3025,6 +3026,12 @@ public:
         m_formatter.oneByteOp(OP_INT3);
     }
 
+    void ud2()
+    {
+        spew("ud2");
+        m_formatter.twoByteOp(OP2_UD2);
+    }
+
     void ret()
     {
         spew("ret");
diff --git a/js/src/build/autoconf/codeset.m4 b/js/src/build/autoconf/codeset.m4
deleted file mode 100644
index 4dc1d50187c6..000000000000
--- a/js/src/build/autoconf/codeset.m4
+++ /dev/null
@@ -1,24 +0,0 @@
-# codeset.m4 serial AM1 (gettext-0.10.40)
-dnl Copyright (C) 2000-2002 Free Software Foundation, Inc.
-dnl This file is free software, distributed under the terms of the GNU
-dnl General Public License.  As a special exception to the GNU General
-dnl Public License, this file may be distributed as part of a program
-dnl that contains a configuration script generated by Autoconf, under
-dnl the same distribution terms as the rest of that program.
-
-dnl From Bruno Haible.
-
-AC_DEFUN([AM_LANGINFO_CODESET],
-[
-  AC_CACHE_CHECK([for nl_langinfo and CODESET], am_cv_langinfo_codeset,
-    [AC_TRY_LINK([#include <langinfo.h>],
-      [char* cs = nl_langinfo(CODESET);],
-      am_cv_langinfo_codeset=yes,
-      am_cv_langinfo_codeset=no)
-    ])
-  if test $am_cv_langinfo_codeset = yes; then
-    AC_DEFINE(HAVE_LANGINFO_CODESET, 1,
-      [Define if you have <langinfo.h> and nl_langinfo(CODESET).])
-      HAVE_LANGINFO_CODESET=1
-  fi
-])
diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctions.cpp
index 149392002ded..9d8df6ac7e71 100644
--- a/js/src/builtin/TestingFunctions.cpp
+++ b/js/src/builtin/TestingFunctions.cpp
@@ -268,6 +268,9 @@ static const struct ParamPair {
     {"markStackLimit",      JSGC_MARK_STACK_LIMIT}
 };
 
+// Keep this in sync with above params.
+#define GC_PARAMETER_ARGS_LIST "maxBytes, maxMallocBytes, gcBytes, gcNumber, sliceTimeBudget, or markStackLimit"
+ 
 static bool
 GCParameter(JSContext *cx, unsigned argc, Value *vp)
 {
@@ -285,9 +288,7 @@ GCParameter(JSContext *cx, unsigned argc, Value *vp)
     for (;; paramIndex++) {
         if (paramIndex == ArrayLength(paramMap)) {
             JS_ReportError(cx,
-                           "the first argument must be maxBytes, "
-                           "maxMallocBytes, gcStackpoolLifespan, gcBytes or "
-                           "gcNumber");
+                           "the first argument must be one of " GC_PARAMETER_ARGS_LIST);
             return false;
         }
         if (JS_FlatStringEqualsAscii(flatStr, paramMap[paramIndex].name))
@@ -1368,8 +1369,7 @@ static const JSFunctionSpecWithHelp TestingFunctions[] = {
 
     JS_FN_HELP("gcparam", GCParameter, 2, 0,
 "gcparam(name [, value])",
-"  Wrapper for JS_[GS]etGCParameter. The name is either maxBytes,\n"
-"  maxMallocBytes, gcBytes, gcNumber, or sliceTimeBudget."),
+"  Wrapper for JS_[GS]etGCParameter. The name is one of " GC_PARAMETER_ARGS_LIST),
 
     JS_FN_HELP("getBuildConfiguration", GetBuildConfiguration, 0, 0,
 "getBuildConfiguration()",
diff --git a/js/src/builtin/TypeRepresentation.cpp b/js/src/builtin/TypeRepresentation.cpp
index 26db68d59109..09af8fd2c234 100644
--- a/js/src/builtin/TypeRepresentation.cpp
+++ b/js/src/builtin/TypeRepresentation.cpp
@@ -62,6 +62,9 @@ TypeRepresentationHasher::match(TypeRepresentation *key1,
       case TypeRepresentation::Reference:
         return matchReferences(key1->asReference(), key2->asReference());
 
+      case TypeRepresentation::X4:
+        return matchX4s(key1->asX4(), key2->asX4());
+
       case TypeRepresentation::Struct:
         return matchStructs(key1->asStruct(), key2->asStruct());
 
@@ -86,6 +89,13 @@ TypeRepresentationHasher::matchReferences(ReferenceTypeRepresentation *key1,
     return key1->type() == key2->type();
 }
 
+bool
+TypeRepresentationHasher::matchX4s(X4TypeRepresentation *key1,
+                                   X4TypeRepresentation *key2)
+{
+    return key1->type() == key2->type();
+}
+
 bool
 TypeRepresentationHasher::matchStructs(StructTypeRepresentation *key1,
                                        StructTypeRepresentation *key2)
@@ -122,6 +132,9 @@ TypeRepresentationHasher::hash(TypeRepresentation *key) {
       case TypeRepresentation::Reference:
         return hashReference(key->asReference());
 
+      case TypeRepresentation::X4:
+        return hashX4(key->asX4());
+
       case TypeRepresentation::Struct:
         return hashStruct(key->asStruct());
 
@@ -144,6 +157,12 @@ TypeRepresentationHasher::hashReference(ReferenceTypeRepresentation *key)
     return HashGeneric(key->kind(), key->type());
 }
 
+HashNumber
+TypeRepresentationHasher::hashX4(X4TypeRepresentation *key)
+{
+    return HashGeneric(key->kind(), key->type());
+}
+
 HashNumber
 TypeRepresentationHasher::hashStruct(StructTypeRepresentation *key)
 {
@@ -172,32 +191,30 @@ TypeRepresentation::TypeRepresentation(Kind kind, size_t size,
     opaque_(opaque)
 {}
 
+static size_t ScalarSizes[] = {
+#define SCALAR_SIZE(_kind, _type, _name)                        \
+    sizeof(_type),
+    JS_FOR_EACH_SCALAR_TYPE_REPR(SCALAR_SIZE) 0
+#undef SCALAR_SIZE
+};
+
 ScalarTypeRepresentation::ScalarTypeRepresentation(Type type)
-  : TypeRepresentation(Scalar, 0, 1, false),
+  : TypeRepresentation(Scalar, ScalarSizes[type], ScalarSizes[type], false),
     type_(type)
 {
-    switch (type) {
-      case TYPE_INT8:
-      case TYPE_UINT8:
-      case TYPE_UINT8_CLAMPED:
-        size_ = alignment_ = 1;
-        break;
+}
 
-      case TYPE_INT16:
-      case TYPE_UINT16:
-        size_ = alignment_ = 2;
-        break;
+static size_t X4Sizes[] = {
+#define X4_SIZE(_kind, _type, _name)                        \
+    sizeof(_type) * 4,
+    JS_FOR_EACH_X4_TYPE_REPR(X4_SIZE) 0
+#undef X4_SIZE
+};
 
-      case TYPE_INT32:
-      case TYPE_UINT32:
-      case TYPE_FLOAT32:
-        size_ = alignment_ = 4;
-        break;
-
-      case TYPE_FLOAT64:
-        size_ = alignment_ = 8;
-        break;
-    }
+X4TypeRepresentation::X4TypeRepresentation(Type type)
+  : TypeRepresentation(X4, X4Sizes[type], X4Sizes[type], false),
+    type_(type)
+{
 }
 
 ReferenceTypeRepresentation::ReferenceTypeRepresentation(Type type)
@@ -358,6 +375,11 @@ TypeRepresentation::addToTableOrFree(JSContext *cx,
                                       Int32Value(asReference()->type()));
         break;
 
+      case X4:
+        ownerObject->initReservedSlot(JS_TYPEREPR_SLOT_TYPE,
+                                      Int32Value(asX4()->type()));
+        break;
+
       case Struct:
         break;
     }
@@ -366,27 +388,43 @@ TypeRepresentation::addToTableOrFree(JSContext *cx,
     return &*ownerObject;
 }
 
+namespace js {
+class TypeRepresentationHelper {
+  public:
+    template<typename T>
+    static JSObject *CreateSimple(JSContext *cx, typename T::Type type) {
+        JSCompartment *comp = cx->compartment();
+
+        T sample(type);
+        TypeRepresentationHash::AddPtr p = comp->typeReprs.lookupForAdd(&sample);
+        if (p)
+            return (*p)->ownerObject();
+
+        // Note: cannot use cx->new_ because constructor is private.
+        T *ptr = (T *) cx->malloc_(sizeof(T));
+        if (!ptr)
+            return nullptr;
+        new(ptr) T(type);
+
+        return ptr->addToTableOrFree(cx, p);
+    }
+};
+} // namespace js
+
 /*static*/
 JSObject *
 ScalarTypeRepresentation::Create(JSContext *cx,
                                  ScalarTypeRepresentation::Type type)
 {
-    JSCompartment *comp = cx->compartment();
+    return TypeRepresentationHelper::CreateSimple<ScalarTypeRepresentation>(cx, type);
+}
 
-    ScalarTypeRepresentation sample(type);
-    TypeRepresentationHash::AddPtr p = comp->typeReprs.lookupForAdd(&sample);
-    if (p)
-        return (*p)->ownerObject();
-
-    // Note: cannot use cx->new_ because constructor is private.
-    ScalarTypeRepresentation *ptr =
-        (ScalarTypeRepresentation *) cx->malloc_(
-            sizeof(ScalarTypeRepresentation));
-    if (!ptr)
-        return nullptr;
-    new(ptr) ScalarTypeRepresentation(type);
-
-    return ptr->addToTableOrFree(cx, p);
+/*static*/
+JSObject *
+X4TypeRepresentation::Create(JSContext *cx,
+                             X4TypeRepresentation::Type type)
+{
+    return TypeRepresentationHelper::CreateSimple<X4TypeRepresentation>(cx, type);
 }
 
 /*static*/
@@ -499,6 +537,7 @@ TypeRepresentation::traceFields(JSTracer *trace)
     switch (kind()) {
       case Scalar:
       case Reference:
+      case X4:
         break;
 
       case Struct:
@@ -552,6 +591,9 @@ TypeRepresentation::appendString(JSContext *cx, StringBuffer &contents)
       case Reference:
         return asReference()->appendStringReference(cx, contents);
 
+      case X4:
+        return asX4()->appendStringX4(cx, contents);
+
       case Array:
         return asArray()->appendStringArray(cx, contents);
 
@@ -607,6 +649,18 @@ ReferenceTypeRepresentation::appendStringReference(JSContext *cx, StringBuffer &
     MOZ_ASSUME_UNREACHABLE("Invalid type");
 }
 
+bool
+X4TypeRepresentation::appendStringX4(JSContext *cx, StringBuffer &contents)
+{
+    switch (type()) {
+      case TYPE_FLOAT32:
+        return contents.append("float32x4");
+      case TYPE_INT32:
+        return contents.append("int32x4");
+    }
+    MOZ_ASSUME_UNREACHABLE("Invalid type");
+}
+
 bool
 ArrayTypeRepresentation::appendStringArray(JSContext *cx, StringBuffer &contents)
 {
@@ -672,6 +726,7 @@ visitReferences(TypeRepresentation *repr, uint8_t *mem, V& visitor)
 
     switch (repr->kind()) {
       case TypeRepresentation::Scalar:
+      case TypeRepresentation::X4:
         return;
 
       case TypeRepresentation::Reference:
diff --git a/js/src/builtin/TypeRepresentation.h b/js/src/builtin/TypeRepresentation.h
index 4dce2f90265e..33b3d39b9101 100644
--- a/js/src/builtin/TypeRepresentation.h
+++ b/js/src/builtin/TypeRepresentation.h
@@ -68,6 +68,7 @@ namespace js {
 class TypeRepresentation;
 class ScalarTypeRepresentation;
 class ReferenceTypeRepresentation;
+class X4TypeRepresentation;
 class ArrayTypeRepresentation;
 class StructTypeRepresentation;
 
@@ -83,6 +84,7 @@ struct TypeRepresentationHasher
   private:
     static HashNumber hashScalar(ScalarTypeRepresentation *key);
     static HashNumber hashReference(ReferenceTypeRepresentation *key);
+    static HashNumber hashX4(X4TypeRepresentation *key);
     static HashNumber hashStruct(StructTypeRepresentation *key);
     static HashNumber hashArray(ArrayTypeRepresentation *key);
 
@@ -90,6 +92,8 @@ struct TypeRepresentationHasher
                              ScalarTypeRepresentation *key2);
     static bool matchReferences(ReferenceTypeRepresentation *key1,
                                 ReferenceTypeRepresentation *key2);
+    static bool matchX4s(X4TypeRepresentation *key1,
+                         X4TypeRepresentation *key2);
     static bool matchStructs(StructTypeRepresentation *key1,
                              StructTypeRepresentation *key2);
     static bool matchArrays(ArrayTypeRepresentation *key1,
@@ -100,11 +104,14 @@ typedef js::HashSet<TypeRepresentation *,
                     TypeRepresentationHasher,
                     RuntimeAllocPolicy> TypeRepresentationHash;
 
+class TypeRepresentationHelper;
+
 class TypeRepresentation {
   public:
     enum Kind {
         Scalar = JS_TYPEREPR_SCALAR_KIND,
         Reference = JS_TYPEREPR_REFERENCE_KIND,
+        X4 = JS_TYPEREPR_X4_KIND,
         Struct = JS_TYPEREPR_STRUCT_KIND,
         Array = JS_TYPEREPR_ARRAY_KIND
     };
@@ -112,6 +119,9 @@ class TypeRepresentation {
   protected:
     TypeRepresentation(Kind kind, size_t size, size_t align, bool opaque);
 
+    // in order to call addToTableOrFree()
+    friend class TypeRepresentationHelper;
+
     size_t size_;
     size_t alignment_;
     Kind kind_;
@@ -167,6 +177,15 @@ class TypeRepresentation {
         return (ReferenceTypeRepresentation*) this;
     }
 
+    bool isX4() const {
+        return kind() == X4;
+    }
+
+    X4TypeRepresentation *asX4() {
+        JS_ASSERT(isX4());
+        return (X4TypeRepresentation*) this;
+    }
+
     bool isArray() const {
         return kind() == Array;
     }
@@ -213,7 +232,10 @@ class ScalarTypeRepresentation : public TypeRepresentation {
     // so TypeRepresentation can call appendStringScalar() etc
     friend class TypeRepresentation;
 
-    Type type_;
+    // in order to call constructor
+    friend class TypeRepresentationHelper;
+
+    const Type type_;
 
     explicit ScalarTypeRepresentation(Type type);
 
@@ -290,6 +312,40 @@ class ReferenceTypeRepresentation : public TypeRepresentation {
     macro_(ReferenceTypeRepresentation::TYPE_OBJECT, HeapPtrObject, Object) \
     macro_(ReferenceTypeRepresentation::TYPE_STRING, HeapPtrString, string)
 
+class X4TypeRepresentation : public TypeRepresentation {
+  public:
+    enum Type {
+        TYPE_INT32 = JS_X4TYPEREPR_INT32,
+        TYPE_FLOAT32 = JS_X4TYPEREPR_FLOAT32,
+    };
+
+  private:
+    // so TypeRepresentation can call appendStringScalar() etc
+    friend class TypeRepresentation;
+
+    // in order to call constructor
+    friend class TypeRepresentationHelper;
+
+    const Type type_;
+
+    explicit X4TypeRepresentation(Type type);
+
+    // See TypeRepresentation::appendString()
+    bool appendStringX4(JSContext *cx, StringBuffer &buffer);
+
+  public:
+    Type type() const {
+        return type_;
+    }
+
+    static JSObject *Create(JSContext *cx, Type type);
+};
+
+// Must be in same order as the enum ScalarTypeRepresentation::Type:
+#define JS_FOR_EACH_X4_TYPE_REPR(macro_)                                      \
+    macro_(X4TypeRepresentation::TYPE_INT32, int32_t, int32)                  \
+    macro_(X4TypeRepresentation::TYPE_FLOAT32, float, float32)
+
 class ArrayTypeRepresentation : public TypeRepresentation {
   private:
     // so TypeRepresentation can call appendStringArray() etc
diff --git a/js/src/builtin/TypedObject.cpp b/js/src/builtin/TypedObject.cpp
index 63b6aecf7d6f..f82a2421d71e 100644
--- a/js/src/builtin/TypedObject.cpp
+++ b/js/src/builtin/TypedObject.cpp
@@ -41,6 +41,11 @@ const Class js::TypedObjectClass = {
     JS_ConvertStub
 };
 
+static const JSFunctionSpec TypedObjectMethods[] = {
+    JS_SELF_HOSTED_FN("objectType", "TypeOfTypedDatum", 1, 0),
+    JS_FS_END
+};
+
 static void
 ReportCannotConvertTo(JSContext *cx, HandleValue fromValue, const char *toType)
 {
@@ -129,11 +134,25 @@ IsStructTypeObject(JSObject &type)
     return type.hasClass(&StructType::class_);
 }
 
+static inline bool
+IsX4TypeObject(JSObject &type)
+{
+    return type.hasClass(&X4Type::class_);
+}
+
+static inline bool
+IsComplexTypeObject(JSObject &type)
+{
+    return IsArrayTypeObject(type) || IsStructTypeObject(type);
+}
+
 static inline bool
 IsTypeObject(JSObject &type)
 {
-    return IsScalarTypeObject(type) || IsArrayTypeObject(type) ||
-           IsStructTypeObject(type) || IsReferenceTypeObject(type);
+    return IsScalarTypeObject(type) ||
+           IsReferenceTypeObject(type) ||
+           IsX4TypeObject(type) ||
+           IsComplexTypeObject(type);
 }
 
 static inline bool
@@ -1265,6 +1284,164 @@ DefineSimpleTypeObject(JSContext *cx,
     return true;
 }
 
+///////////////////////////////////////////////////////////////////////////
+// X4
+
+const Class X4Type::class_ = {
+    "X4",
+    JSCLASS_HAS_RESERVED_SLOTS(JS_TYPEOBJ_X4_SLOTS),
+    JS_PropertyStub,
+    JS_DeletePropertyStub,
+    JS_PropertyStub,
+    JS_StrictPropertyStub,
+    JS_EnumerateStub,
+    JS_ResolveStub,
+    JS_ConvertStub,
+    nullptr,
+    nullptr,
+    call,
+    nullptr,
+    nullptr,
+    nullptr
+};
+
+// These classes just exist to group together various properties and so on.
+namespace js {
+class Int32x4Defn {
+  public:
+    static const X4TypeRepresentation::Type type = X4TypeRepresentation::TYPE_INT32;
+    static const JSPropertySpec TypedObjectProperties[];
+    static const JSFunctionSpec TypedObjectMethods[];
+};
+class Float32x4Defn {
+  public:
+    static const X4TypeRepresentation::Type type = X4TypeRepresentation::TYPE_FLOAT32;
+    static const JSPropertySpec TypedObjectProperties[];
+    static const JSFunctionSpec TypedObjectMethods[];
+};
+} // namespace js
+
+const JSPropertySpec js::Int32x4Defn::TypedObjectProperties[] = {
+    JS_SELF_HOSTED_GET("x", "Int32x4Lane0", JSPROP_PERMANENT),
+    JS_SELF_HOSTED_GET("y", "Int32x4Lane1", JSPROP_PERMANENT),
+    JS_SELF_HOSTED_GET("z", "Int32x4Lane2", JSPROP_PERMANENT),
+    JS_SELF_HOSTED_GET("w", "Int32x4Lane3", JSPROP_PERMANENT),
+    JS_PS_END
+};
+
+const JSFunctionSpec js::Int32x4Defn::TypedObjectMethods[] = {
+    JS_SELF_HOSTED_FN("toSource", "X4ToSource", 0, 0),
+    JS_FS_END
+};
+
+const JSPropertySpec js::Float32x4Defn::TypedObjectProperties[] = {
+    JS_SELF_HOSTED_GET("x", "Float32x4Lane0", JSPROP_PERMANENT),
+    JS_SELF_HOSTED_GET("y", "Float32x4Lane1", JSPROP_PERMANENT),
+    JS_SELF_HOSTED_GET("z", "Float32x4Lane2", JSPROP_PERMANENT),
+    JS_SELF_HOSTED_GET("w", "Float32x4Lane3", JSPROP_PERMANENT),
+    JS_PS_END
+};
+
+const JSFunctionSpec js::Float32x4Defn::TypedObjectMethods[] = {
+    JS_SELF_HOSTED_FN("toSource", "X4ToSource", 0, 0),
+    JS_FS_END
+};
+
+template<typename T>
+static JSObject *
+CreateX4Class(JSContext *cx, Handle<GlobalObject*> global)
+{
+    RootedObject funcProto(cx, global->getOrCreateFunctionPrototype(cx));
+    if (!funcProto)
+        return nullptr;
+
+    // Create type representation
+
+    RootedObject typeReprObj(cx);
+    typeReprObj = X4TypeRepresentation::Create(cx, T::type);
+    if (!typeReprObj)
+        return nullptr;
+
+    // Create prototype property, which inherits from Object.prototype
+
+    RootedObject objProto(cx, global->getOrCreateObjectPrototype(cx));
+    if (!objProto)
+        return nullptr;
+    RootedObject proto(cx);
+    proto = NewObjectWithGivenProto(cx, &JSObject::class_, objProto, global, SingletonObject);
+    if (!proto)
+        return nullptr;
+
+    // Create type constructor itself
+
+    RootedObject x4(cx);
+    x4 = NewObjectWithClassProto(cx, &X4Type::class_, funcProto, global);
+    if (!x4 ||
+        !InitializeCommonTypeDescriptorProperties(cx, x4, typeReprObj) ||
+        !DefinePropertiesAndBrand(cx, proto, nullptr, nullptr))
+    {
+        return nullptr;
+    }
+
+    // Link type constructor to the type representation
+
+    x4->initReservedSlot(JS_TYPEOBJ_SLOT_TYPE_REPR, ObjectValue(*typeReprObj));
+
+    // Link constructor to prototype and install properties
+
+    if (!LinkConstructorAndPrototype(cx, x4, proto) ||
+        !DefinePropertiesAndBrand(cx, proto, T::TypedObjectProperties,
+                                  T::TypedObjectMethods))
+    {
+        return nullptr;
+    }
+
+    return x4;
+}
+
+bool
+X4Type::call(JSContext *cx, unsigned argc, Value *vp)
+{
+    CallArgs args = CallArgsFromVp(argc, vp);
+    const uint32_t LANES = 4;
+
+    if (args.length() < LANES) {
+        JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_MORE_ARGS_NEEDED,
+                             args.callee().getClass()->name, "3", "s");
+        return false;
+    }
+
+    double values[LANES];
+    for (uint32_t i = 0; i < LANES; i++) {
+        if (!ToNumber(cx, args[i], &values[i]))
+            return false;
+    }
+
+    RootedObject typeObj(cx, &args.callee());
+    RootedObject result(cx, TypedObject::createZeroed(cx, typeObj));
+    if (!result)
+        return false;
+
+    X4TypeRepresentation *typeRepr = typeRepresentation(*typeObj)->asX4();
+    switch (typeRepr->type()) {
+#define STORE_LANES(_constant, _type, _name)                                  \
+      case _constant:                                                         \
+      {                                                                       \
+        _type *mem = (_type*) TypedMem(*result);                              \
+        for (uint32_t i = 0; i < LANES; i++) {                                \
+            mem[i] = values[i];                                               \
+        }                                                                     \
+        break;                                                                \
+      }
+      JS_FOR_EACH_X4_TYPE_REPR(STORE_LANES)
+#undef STORE_LANES
+    }
+    args.rval().setObject(*result);
+    return true;
+}
+
+///////////////////////////////////////////////////////////////////////////
+
 template<typename T>
 static JSObject *
 DefineMetaTypeObject(JSContext *cx,
@@ -1349,6 +1526,9 @@ js_InitTypedObjectClass(JSContext *cx, HandleObject obj)
     if (!module)
         return nullptr;
 
+    if (!JS_DefineFunctions(cx, module, TypedObjectMethods))
+        return nullptr;
+
     // Define TypedObject global.
 
     RootedValue moduleValue(cx, ObjectValue(*module));
@@ -1369,6 +1549,38 @@ js_InitTypedObjectClass(JSContext *cx, HandleObject obj)
     JS_FOR_EACH_REFERENCE_TYPE_REPR(BINARYDATA_REFERENCE_DEFINE)
 #undef BINARYDATA_REFERENCE_DEFINE
 
+    // float32x4
+
+    RootedObject float32x4Object(cx);
+    float32x4Object = CreateX4Class<Float32x4Defn>(cx, global);
+    if (!float32x4Object)
+        return nullptr;
+
+    RootedValue float32x4Value(cx, ObjectValue(*float32x4Object));
+    if (!JSObject::defineProperty(cx, module, cx->names().float32x4,
+                                  float32x4Value,
+                                  nullptr, nullptr,
+                                  JSPROP_READONLY | JSPROP_PERMANENT))
+    {
+        return nullptr;
+    }
+
+    // int32x4
+
+    RootedObject int32x4Object(cx);
+    int32x4Object = CreateX4Class<Int32x4Defn>(cx, global);
+    if (!int32x4Object)
+        return nullptr;
+
+    RootedValue int32x4Value(cx, ObjectValue(*int32x4Object));
+    if (!JSObject::defineProperty(cx, module, cx->names().int32x4,
+                                  int32x4Value,
+                                  nullptr, nullptr,
+                                  JSPROP_READONLY | JSPROP_PERMANENT))
+    {
+        return nullptr;
+    }
+
     // ArrayType.
 
     RootedObject arrayType(cx, DefineMetaTypeObject<ArrayType>(cx, global));
@@ -1609,7 +1821,7 @@ TypedDatum::obj_finalize(js::FreeOp *op, JSObject *obj)
 
 bool
 TypedDatum::obj_lookupGeneric(JSContext *cx, HandleObject obj, HandleId id,
-                                MutableHandleObject objp, MutableHandleShape propp)
+                              MutableHandleObject objp, MutableHandleShape propp)
 {
     JS_ASSERT(IsTypedDatum(*obj));
 
@@ -1619,6 +1831,7 @@ TypedDatum::obj_lookupGeneric(JSContext *cx, HandleObject obj, HandleId id,
     switch (typeRepr->kind()) {
       case TypeRepresentation::Scalar:
       case TypeRepresentation::Reference:
+      case TypeRepresentation::X4:
         break;
 
       case TypeRepresentation::Array:
@@ -1797,6 +2010,9 @@ TypedDatum::obj_getGeneric(JSContext *cx, HandleObject obj, HandleObject receive
       case TypeRepresentation::Reference:
         break;
 
+      case TypeRepresentation::X4:
+        break;
+
       case TypeRepresentation::Array:
         if (JSID_IS_ATOM(id, cx->names().length)) {
             vp.setInt32(typeRepr->asArray()->length());
@@ -1854,6 +2070,7 @@ TypedDatum::obj_getElementIfPresent(JSContext *cx, HandleObject obj,
     switch (typeRepr->kind()) {
       case TypeRepresentation::Scalar:
       case TypeRepresentation::Reference:
+      case TypeRepresentation::X4:
       case TypeRepresentation::Struct:
         break;
 
@@ -1907,6 +2124,9 @@ TypedDatum::obj_setGeneric(JSContext *cx, HandleObject obj, HandleId id,
       case TypeRepresentation::Reference:
         break;
 
+      case ScalarTypeRepresentation::X4:
+        break;
+
       case ScalarTypeRepresentation::Array:
         if (JSID_IS_ATOM(id, cx->names().length)) {
             JS_ReportErrorNumber(cx, js_GetErrorMessage,
@@ -1950,6 +2170,7 @@ TypedDatum::obj_setElement(JSContext *cx, HandleObject obj, uint32_t index,
     switch (typeRepr->kind()) {
       case TypeRepresentation::Scalar:
       case TypeRepresentation::Reference:
+      case TypeRepresentation::X4:
       case TypeRepresentation::Struct:
         break;
 
@@ -1982,7 +2203,7 @@ TypedDatum::obj_setSpecial(JSContext *cx, HandleObject obj,
 
 bool
 TypedDatum::obj_getGenericAttributes(JSContext *cx, HandleObject obj,
-                                       HandleId id, unsigned *attrsp)
+                                     HandleId id, unsigned *attrsp)
 {
     uint32_t index;
     RootedObject type(cx, GetType(*obj));
@@ -1993,6 +2214,9 @@ TypedDatum::obj_getGenericAttributes(JSContext *cx, HandleObject obj,
       case TypeRepresentation::Reference:
         break;
 
+      case TypeRepresentation::X4:
+        break;
+
       case TypeRepresentation::Array:
         if (js_IdIsIndex(id, &index)) {
             *attrsp = JSPROP_ENUMERATE | JSPROP_PERMANENT;
@@ -2031,6 +2255,7 @@ IsOwnId(JSContext *cx, HandleObject obj, HandleId id)
     switch (typeRepr->kind()) {
       case TypeRepresentation::Scalar:
       case TypeRepresentation::Reference:
+      case TypeRepresentation::X4:
         return false;
 
       case TypeRepresentation::Array:
@@ -2123,6 +2348,7 @@ TypedDatum::obj_enumerate(JSContext *cx, HandleObject obj, JSIterateOp enum_op,
     switch (typeRepr->kind()) {
       case TypeRepresentation::Scalar:
       case TypeRepresentation::Reference:
+      case TypeRepresentation::X4:
         switch (enum_op) {
           case JSENUMERATE_INIT_ALL:
           case JSENUMERATE_INIT:
@@ -2518,6 +2744,15 @@ const JSJitInfo js::MemcpyJitInfo =
     JS_JITINFO_NATIVE_PARALLEL(
         JSParallelNativeThreadSafeWrapper<js::Memcpy>);
 
+bool
+js::StandardTypeObjectDescriptors(JSContext *cx, unsigned argc, Value *vp)
+{
+    CallArgs args = CallArgsFromVp(argc, vp);
+    Rooted<GlobalObject*> global(cx, cx->global());
+    args.rval().setObject(global->getTypedObject());
+    return true;
+}
+
 #define JS_STORE_SCALAR_CLASS_IMPL(_constant, T, _name)                       \
 bool                                                                          \
 js::StoreScalar##T::Func(ThreadSafeContext *, unsigned argc, Value *vp)       \
diff --git a/js/src/builtin/TypedObject.h b/js/src/builtin/TypedObject.h
index a8391055ac7c..b678914c239e 100644
--- a/js/src/builtin/TypedObject.h
+++ b/js/src/builtin/TypedObject.h
@@ -130,6 +130,18 @@ class ReferenceType
     static bool call(JSContext *cx, unsigned argc, Value *vp);
 };
 
+/*
+ * Type descriptors `float32x4` and `int32x4`
+ */
+class X4Type : public JSObject
+{
+  private:
+  public:
+    static const Class class_;
+
+    static bool call(JSContext *cx, unsigned argc, Value *vp);
+};
+
 /*
  * Type descriptor created by `new ArrayType(...)`
  */
@@ -426,6 +438,17 @@ extern const JSJitInfo ClampToUint8JitInfo;
 bool Memcpy(ThreadSafeContext *cx, unsigned argc, Value *vp);
 extern const JSJitInfo MemcpyJitInfo;
 
+/*
+ * Usage: StandardTypeObjectDescriptors()
+ *
+ * Returns the global "typed object" object, which provides access
+ * to the various builtin type descriptors. These are currently
+ * exported as immutable properties so it is safe for self-hosted code
+ * to access them; eventually this should be linked into the module
+ * system.
+ */
+bool StandardTypeObjectDescriptors(JSContext *cx, unsigned argc, Value *vp);
+
 /*
  * Usage: Store_int8(targetDatum, targetOffset, value)
  *        ...
diff --git a/js/src/builtin/TypedObject.js b/js/src/builtin/TypedObject.js
index 3ebd50b65008..99162d28e6e8 100644
--- a/js/src/builtin/TypedObject.js
+++ b/js/src/builtin/TypedObject.js
@@ -107,6 +107,7 @@ TypedObjectPointer.prototype.moveTo = function(propName) {
   switch (this.kind()) {
   case JS_TYPEREPR_SCALAR_KIND:
   case JS_TYPEREPR_REFERENCE_KIND:
+  case JS_TYPEREPR_X4_KIND:
     break;
 
   case JS_TYPEREPR_ARRAY_KIND:
@@ -188,13 +189,22 @@ TypedObjectPointer.prototype.moveToField = function(propName) {
 TypedObjectPointer.prototype.get = function() {
   assert(ObjectIsAttached(this.datum), "get() called with unattached datum");
 
-  if (REPR_KIND(this.typeRepr) == JS_TYPEREPR_SCALAR_KIND)
+  switch (REPR_KIND(this.typeRepr)) {
+  case JS_TYPEREPR_SCALAR_KIND:
     return this.getScalar();
 
-  if (REPR_KIND(this.typeRepr) == JS_TYPEREPR_REFERENCE_KIND)
+  case JS_TYPEREPR_REFERENCE_KIND:
     return this.getReference();
 
-  return NewDerivedTypedDatum(this.typeObj, this.datum, this.offset);
+  case JS_TYPEREPR_X4_KIND:
+    return this.getX4();
+
+  case JS_TYPEREPR_ARRAY_KIND:
+  case JS_TYPEREPR_STRUCT_KIND:
+    return NewDerivedTypedDatum(this.typeObj, this.datum, this.offset);
+  }
+
+  assert(false, "Unhandled kind: " + REPR_KIND(this.typeRepr));
 }
 
 TypedObjectPointer.prototype.getScalar = function() {
@@ -245,6 +255,27 @@ TypedObjectPointer.prototype.getReference = function() {
   assert(false, "Unhandled scalar type: " + type);
 }
 
+TypedObjectPointer.prototype.getX4 = function() {
+  var type = REPR_TYPE(this.typeRepr);
+  var T = StandardTypeObjectDescriptors();
+  switch (type) {
+  case JS_X4TYPEREPR_FLOAT32:
+    var x = Load_float32(this.datum, this.offset + 0);
+    var y = Load_float32(this.datum, this.offset + 4);
+    var z = Load_float32(this.datum, this.offset + 8);
+    var w = Load_float32(this.datum, this.offset + 12);
+    return T.float32x4(x, y, z, w);
+
+  case JS_X4TYPEREPR_INT32:
+    var x = Load_int32(this.datum, this.offset + 0);
+    var y = Load_int32(this.datum, this.offset + 4);
+    var z = Load_int32(this.datum, this.offset + 8);
+    var w = Load_int32(this.datum, this.offset + 12);
+    return T.int32x4(x, y, z, w);
+  }
+  assert(false, "Unhandled x4 type: " + type);
+}
+
 ///////////////////////////////////////////////////////////////////////////
 // Setting values
 //
@@ -281,6 +312,10 @@ TypedObjectPointer.prototype.set = function(fromValue) {
     this.setReference(fromValue);
     return;
 
+  case JS_TYPEREPR_X4_KIND:
+    this.setX4(fromValue);
+    return;
+
   case JS_TYPEREPR_ARRAY_KIND:
     if (!IsObject(fromValue))
       break;
@@ -382,6 +417,17 @@ TypedObjectPointer.prototype.setReference = function(fromValue) {
   assert(false, "Unhandled scalar type: " + type);
 }
 
+// Sets `fromValue` to `this` assuming that `this` is a scalar type.
+TypedObjectPointer.prototype.setX4 = function(fromValue) {
+  // It is only permitted to set a float32x4/int32x4 value from another
+  // float32x4/int32x4; in that case, the "fast path" that uses memcopy will
+  // have already matched. So if we get to this point, we're supposed
+  // to "adapt" fromValue, but there are no legal adaptions.
+  ThrowError(JSMSG_CANT_CONVERT_TO,
+             typeof(fromValue),
+             this.typeRepr.toSource())
+}
+
 ///////////////////////////////////////////////////////////////////////////
 // C++ Wrappers
 //
@@ -605,9 +651,93 @@ function HandleTest(obj) {
   return IsObject(obj) && ObjectIsTypedHandle(obj);
 }
 
+///////////////////////////////////////////////////////////////////////////
+// X4
+
+function X4ProtoString(type) {
+  switch (type) {
+  case JS_X4TYPEREPR_INT32:
+    return "int32x4";
+  case JS_X4TYPEREPR_FLOAT32:
+    return "float32x4";
+  }
+  assert(false, "Unhandled type constant");
+}
+
+X4LaneStrings = ["x", "y", "z", "w"];
+
+// Generalized handler for the various properties for accessing a
+// single lane of an X4 vector value. Note that this is the slow path;
+// the fast path will be inlined into ion code.
+function X4GetLane(datum, type, lane) {
+  if (!IsObject(datum) || !ObjectIsTypedDatum(datum))
+    ThrowError(JSMSG_INCOMPATIBLE_PROTO, X4ProtoString(type),
+               X4LaneStrings[lane], typeof this);
+
+  var repr = DATUM_TYPE_REPR(datum);
+  if (REPR_KIND(repr) != JS_TYPEREPR_X4_KIND || REPR_TYPE(repr) != type)
+    ThrowError(JSMSG_INCOMPATIBLE_PROTO, X4ProtoString(type),
+               X4LaneStrings[lane], typeof this);
+
+  switch (type) {
+  case JS_X4TYPEREPR_INT32:
+    return Load_int32(datum, lane * 4);
+  case JS_X4TYPEREPR_FLOAT32:
+    return Load_float32(datum, lane * 4);
+  }
+  assert(false, "Unhandled type constant");
+}
+
+function Float32x4Lane0() { return X4GetLane(this, JS_X4TYPEREPR_FLOAT32, 0); }
+function Float32x4Lane1() { return X4GetLane(this, JS_X4TYPEREPR_FLOAT32, 1); }
+function Float32x4Lane2() { return X4GetLane(this, JS_X4TYPEREPR_FLOAT32, 2); }
+function Float32x4Lane3() { return X4GetLane(this, JS_X4TYPEREPR_FLOAT32, 3); }
+
+function Int32x4Lane0() { return X4GetLane(this, JS_X4TYPEREPR_INT32, 0); }
+function Int32x4Lane1() { return X4GetLane(this, JS_X4TYPEREPR_INT32, 1); }
+function Int32x4Lane2() { return X4GetLane(this, JS_X4TYPEREPR_INT32, 2); }
+function Int32x4Lane3() { return X4GetLane(this, JS_X4TYPEREPR_INT32, 3); }
+
+function X4ToSource() {
+  if (!IsObject(this) || !ObjectIsTypedDatum(this))
+    ThrowError(JSMSG_INCOMPATIBLE_PROTO, "X4", "toSource", typeof this);
+
+  var repr = DATUM_TYPE_REPR(this);
+  if (REPR_KIND(repr) != JS_TYPEREPR_X4_KIND)
+    ThrowError(JSMSG_INCOMPATIBLE_PROTO, "X4", "toSource", typeof this);
+
+  var type = REPR_TYPE(repr);
+  return X4ProtoString(type)+"("+this.x+", "+this.y+", "+this.z+", "+this.w+")";
+}
+
 ///////////////////////////////////////////////////////////////////////////
 // Miscellaneous
 
+// This is the `objectType()` function defined in the spec.
+// It returns the type of its argument.
+//
+// Warning: user exposed!
+function TypeOfTypedDatum(obj) {
+  if (IsObject(obj) && ObjectIsTypedDatum(obj))
+    return DATUM_TYPE_OBJ(obj);
+
+  // Note: Do not create bindings for `Any`, `String`, etc in
+  // Utilities.js, but rather access them through
+  // `StandardTypeObjectDescriptors()`. The reason is that bindings
+  // you create in Utilities.js are part of the self-hosted global,
+  // vs the user-accessible global, and hence should not escape to
+  // user script.
+  var T = StandardTypeObjectDescriptors();
+  switch (typeof obj) {
+    case "object": return T.Object;
+    case "function": return T.Object;
+    case "string": return T.String;
+    case "number": return T.float64;
+    case "undefined": return T.Any;
+    default: return T.Any;
+  }
+}
+
 function ObjectIsTypedDatum(obj) {
   assert(IsObject(obj), "ObjectIsTypedDatum invoked with non-object")
   return ObjectIsTypedObject(obj) || ObjectIsTypedHandle(obj);
diff --git a/js/src/builtin/TypedObjectConstants.h b/js/src/builtin/TypedObjectConstants.h
index 0da7bee5533a..2c47dbbc53e7 100644
--- a/js/src/builtin/TypedObjectConstants.h
+++ b/js/src/builtin/TypedObjectConstants.h
@@ -26,6 +26,9 @@
 // Slots on references
 #define JS_TYPEOBJ_REFERENCE_SLOTS         1  // Maximum number
 
+// Slots on x4s
+#define JS_TYPEOBJ_X4_SLOTS                1  // Maximum number
+
 // Slots on arrays
 #define JS_TYPEOBJ_SLOT_ARRAY_ELEM_TYPE    1
 #define JS_TYPEOBJ_ARRAY_SLOTS             2  // Maximum number
@@ -34,7 +37,6 @@
 #define JS_TYPEOBJ_SLOT_STRUCT_FIELD_TYPES 1
 #define JS_TYPEOBJ_STRUCT_SLOTS            2  // Maximum number
 
-
 ///////////////////////////////////////////////////////////////////////////
 // Slots for type representation objects
 //
@@ -52,7 +54,7 @@
 // Slots on arrays:
 #define JS_TYPEREPR_SLOT_LENGTH    3 // Length of the array
 
-// Slots on scalars and references:
+// Slots on scalars, references, and X4s:
 #define JS_TYPEREPR_SLOT_TYPE      3 // One of the constants below
 
 // Maximum number of slots for any type representation
@@ -61,10 +63,11 @@
 // These constants are for use exclusively in JS code. In C++ code,
 // prefer TypeRepresentation::Scalar etc, which allows you to
 // write a switch which will receive a warning if you omit a case.
-#define JS_TYPEREPR_SCALAR_KIND 0
+#define JS_TYPEREPR_SCALAR_KIND    0
 #define JS_TYPEREPR_REFERENCE_KIND 1
-#define JS_TYPEREPR_STRUCT_KIND 2
-#define JS_TYPEREPR_ARRAY_KIND  3
+#define JS_TYPEREPR_X4_KIND        2
+#define JS_TYPEREPR_STRUCT_KIND    3
+#define JS_TYPEREPR_ARRAY_KIND     4
 
 // These constants are for use exclusively in JS code. In C++ code,
 // prefer ScalarTypeRepresentation::TYPE_INT8 etc, which allows
@@ -88,6 +91,13 @@
 #define JS_REFERENCETYPEREPR_OBJECT     1
 #define JS_REFERENCETYPEREPR_STRING     2
 
+// These constants are for use exclusively in JS code.  In C++ code,
+// prefer X4TypeRepresentation::TYPE_INT32 etc, since that allows
+// you to write a switch which will receive a warning if you omit a
+// case.
+#define JS_X4TYPEREPR_INT32         0
+#define JS_X4TYPEREPR_FLOAT32       1
+
 ///////////////////////////////////////////////////////////////////////////
 // Slots for typed objects (actually, any TypedContents objects)
 
diff --git a/js/src/config/check_vanilla_allocations.py b/js/src/config/check_vanilla_allocations.py
new file mode 100644
index 000000000000..74ea5e61d0c0
--- /dev/null
+++ b/js/src/config/check_vanilla_allocations.py
@@ -0,0 +1,159 @@
+# vim: set ts=8 sts=4 et sw=4 tw=79:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+#----------------------------------------------------------------------------
+# All heap allocations in SpiderMonkey must go through js_malloc, js_calloc,
+# js_realloc, and js_free.  This is so that any embedder who uses a custom
+# allocator (by defining JS_USE_CUSTOM_ALLOCATOR) will see all heap allocation
+# go through that custom allocator.
+#
+# Therefore, the presence of any calls to "vanilla" allocation/free functions
+# (e.g. malloc(), free()) is a bug.
+#
+# This script checks for the presence of such disallowed vanilla
+# allocation/free function in SpiderMonkey when it's built as a library.  It
+# relies on |nm| from the GNU binutils, and so only works on Linux, but one
+# platform is good enough to catch almost all violations.
+#
+# This checking is only 100% reliable in a JS_USE_CUSTOM_ALLOCATOR build in
+# which the default definitions of js_malloc et al (in Utility.h) -- which call
+# malloc et al -- are replaced with empty definitions.  This is because the
+# presence and possible inlining of the default js_malloc et al can cause
+# malloc/calloc/realloc/free calls show up in unpredictable places.
+#
+# Unfortunately, that configuration cannot be tested on Mozilla's standard
+# testing infrastructure.  Instead, by default this script only tests that none
+# of the other vanilla allocation/free functions (operator new, memalign, etc)
+# are present.  If given the --aggressive flag, it will also check for
+# malloc/calloc/realloc/free.
+#
+# Note:  We don't check for |operator delete| and |operator delete[]|.  These
+# can be present somehow due to virtual destructors, but this is not too
+# because vanilla delete/delete[] calls don't make sense without corresponding
+# vanilla new/new[] calls, and any explicit calls will be caught by Valgrind's
+# mismatched alloc/free checking.
+#----------------------------------------------------------------------------
+
+from __future__ import print_function
+
+import argparse
+import re
+import subprocess
+import sys
+
+# The obvious way to implement this script is to search for occurrences of
+# malloc et al, succeed if none are found, and fail is some are found.
+# However, "none are found" does not necessarily mean "none are present" --
+# this script could be buggy.  (Or the output format of |nm| might change in
+# the future.)
+#
+# So jsutil.cpp deliberately contains a (never-called) function that contains a
+# single use of all the vanilla allocation/free functions.  And this script
+# fails if it (a) finds uses of those functions in files other than jsutil.cpp,
+# *or* (b) fails to find them in jsutil.cpp.
+
+# Tracks overall success of the test.
+has_failed = False
+
+
+def fail(msg):
+    print('TEST-UNEXPECTED-FAIL | check_vanilla_allocations.py |', msg)
+    global has_failed
+    has_failed = True
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument('--aggressive', action='store_true',
+                        help='also check for malloc, calloc, realloc and free')
+    parser.add_argument('file', type=str,
+                        help='name of the file to check')
+    args = parser.parse_args()
+
+    # Run |nm|.  Options:
+    # -u: show only undefined symbols
+    # -C: demangle symbol names
+    # -l: show a filename and line number for each undefined symbol
+    cmd = ['nm', '-u', '-C', '-l', args.file]
+    lines = subprocess.check_output(cmd, universal_newlines=True,
+                                    stderr=subprocess.PIPE).split('\n')
+
+    # alloc_fns contains all the vanilla allocation/free functions that we look
+    # for. Regexp chars are escaped appropriately.
+
+    alloc_fns = [
+        # Matches |operator new(unsigned T)|, where |T| is |int| or |long|.
+        r'operator new\(unsigned',
+
+        # Matches |operator new[](unsigned T)|, where |T| is |int| or |long|.
+        r'operator new\[\]\(unsigned',
+
+        r'memalign',
+        # These two aren't available on all Linux configurations.
+        #r'posix_memalign',
+        #r'aligned_alloc',
+        r'valloc',
+        r'strdup'
+    ]
+
+    if args.aggressive:
+        alloc_fns += [
+            r'malloc',
+            r'calloc',
+            r'realloc',
+            r'free'
+        ]
+
+    # This is like alloc_fns, but regexp chars are not escaped.
+    alloc_fns_unescaped = [fn.translate(None, r'\\') for fn in alloc_fns]
+
+    # This regexp matches the relevant lines in the output of |nm|, which look
+    # like the following.
+    #
+    #   U malloc  /path/to/objdir/dist/include/js/Utility.h:142
+    #
+    alloc_fns_re = r'U (' + r'|'.join(alloc_fns) + r').*\/([\w\.]+):(\d+)$'
+
+    # This tracks which allocation/free functions have been seen in jsutil.cpp.
+    jsutil_cpp = set([])
+
+    for line in lines:
+        m = re.search(alloc_fns_re, line)
+        if m is None:
+            continue
+
+        fn = m.group(1)
+        filename = m.group(2)
+        linenum = m.group(3)
+        if filename == 'jsutil.cpp':
+            jsutil_cpp.add(fn)
+        else:
+            # An allocation is present in a non-special file.  Fail!
+            fail("'" + fn + "' present at " + filename + ':' + linenum)
+
+
+    # Check that all functions we expect are used in jsutil.cpp.  (This will
+    # fail if the function-detection code breaks at any point.)
+    for fn in alloc_fns_unescaped:
+        if fn not in jsutil_cpp:
+            fail("'" + fn + "' isn't used as expected in jsutil.cpp")
+        else:
+            jsutil_cpp.remove(fn)
+
+    # This should never happen, but check just in case.
+    if jsutil_cpp:
+        fail('unexpected allocation fns used in jsutil.cpp: ' +
+             ', '.join(jsutil_cpp))
+
+    if has_failed:
+        sys.exit(1)
+
+    print('TEST-PASS | check_vanilla_allocations.py | ok')
+    sys.exit(0)
+
+
+if __name__ == '__main__':
+    main()
+
diff --git a/js/src/config/find_vanilla_new_calls b/js/src/config/find_vanilla_new_calls
deleted file mode 100755
index 320abc1403eb..000000000000
--- a/js/src/config/find_vanilla_new_calls
+++ /dev/null
@@ -1,80 +0,0 @@
-# /bin/bash
-
-#----------------------------------------------------------------------------
-# We must avoid using the vanilla new/new[] operators (and consequently, the
-# vanilla delete/delete[] operators) in SpiderMonkey, see bug 624878 for why.
-#
-# This script:
-# - Detects if any of the vanilla new/new[] operators are used in a file.
-#   Its exit code is 1 if it found some, and 0 if it didn't.
-# - Doesn't detect delete/delete[] because it appears they can be present
-#   somehow due to virtual destructors, but this is ok because vanilla
-#   delete/delete[] calls don't make sense without corresponding new/new[]
-#   calls, and any explicit calls will be caught by Valgrind's mismatched
-#   alloc/free checking.
-# - Doesn't detect the 'nothrow' variants, which are ok but probably still
-#   best avoided.
-# - Is designed to only run on Linux (though it may also work on Mac);  one
-#   platform will be enough to catch any violations.
-#
-# If this script fails:
-# - You need to find the uses of vanilla new/delete and replace them with
-#   {js::OffTheBooks,JSContext,JSRuntime}::{new_,/array_new}.
-# - Run this script on each of the .o files, that should narrow it down.
-# - After that, one way to find them is to run 'objdump -r -C' on the
-#   relevant .o files.  For example, you might search for 'operator new' and
-#   find a record like this:
-#
-#  RELOCATION RECORDS FOR [.text._ZN3JSC14ExecutablePool6createEj]:
-#  OFFSET   TYPE              VALUE
-#  00000009 R_386_PC32        __i686.get_pc_thunk.bx
-#  0000000f R_386_GOTPC       _GLOBAL_OFFSET_TABLE_
-#  0000001b R_386_PLT32       operator new(unsigned int)
-#  0000002e R_386_PC32        JSC::ExecutablePool::ExecutablePool(unsigned int)
-#  0000004a R_386_PC32        JSC::ExecutablePool::~ExecutablePool()
-#  00000052 R_386_PLT32       operator delete(void*)
-#
-#   This says that vanilla 'new' and 'delete' are both used in
-#   JSC::ExecutablePool::create(unsigned int).  This doesn't always work,
-#   though.  (Nb: use 'c++filt' to demangle names like
-#   _ZN3JSC14ExecutablePool6createEj.)
-#
-# If that doesn't work, use grep.
-#----------------------------------------------------------------------------
-
-if [ -z $1 ] ; then
-    echo "usage: find_vanilla_new_calls <file>"
-    exit 1
-fi
-
-file=$1
-
-if [ ! -f $file ] ; then
-    echo "TEST-UNEXPECTED-FAIL | find_vanilla_new_calls | file '$file' not found"
-    exit 1
-fi
-
-tmpfile1=`mktemp`
-tmpfile2=`mktemp`
-nm -C $file > $tmpfile1
-
-# Need to double-escape '[' and ']' to stop grep from interpreting them
-# specially.
-grep '^operator new(unsigned int)'        $tmpfile1 >> $tmpfile2
-grep '^operator new(unsigned long)'       $tmpfile1 >> $tmpfile2
-grep '^operator new\\[\\](unsigned int)'  $tmpfile1 >> $tmpfile2
-grep '^operator new\\[\\](unsigned long)' $tmpfile1 >> $tmpfile2
-rm -f $tmpfile1
-
-if [ -s $tmpfile2 ] ; then
-    echo "TEST-UNEXPECTED-FAIL | find_vanilla_new_calls | found calls are listed below"
-    cat $tmpfile2
-    echo
-    rm -f $tmpfile2
-    exit 1
-fi
-
-echo "TEST-PASS | find_vanilla_new_calls | ok"
-echo
-
-exit 0
diff --git a/js/src/configure.in b/js/src/configure.in
index a5596763dec8..f22895f078b6 100644
--- a/js/src/configure.in
+++ b/js/src/configure.in
@@ -2573,8 +2573,6 @@ dnl    AC_CHECK_LIB(bind, res_ninit, AC_DEFINE(HAVE_RES_NINIT),
 dnl        AC_CHECK_LIB(resolv, res_ninit, AC_DEFINE(HAVE_RES_NINIT)))
 fi
 
-AM_LANGINFO_CODESET
-
 AC_LANG_C
 
 dnl **********************
@@ -4198,7 +4196,7 @@ if test -n "$ENABLE_INTL_API"; then
             *)
                 AC_MSG_ERROR([ECMAScript Internationalization API is not yet supported on this platform])
         esac
-        MOZ_ICU_LIBS='$(call EXPAND_LIBNAME_PATH,$(ICU_LIB_NAMES),$(DEPTH)/intl/icu/target/lib)'
+        MOZ_ICU_LIBS='$(call EXPAND_LIBNAME_PATH,$(ICU_LIB_NAMES),$(DEPTH)/intl/icu/lib)'
     fi
 fi
 
@@ -4228,94 +4226,33 @@ if test -n "$ENABLE_INTL_API" -a -z "$MOZ_NATIVE_ICU"; then
     ICU_CPPFLAGS="$ICU_CPPFLAGS -DUCONFIG_NO_REGULAR_EXPRESSIONS"
     ICU_CPPFLAGS="$ICU_CPPFLAGS -DUCONFIG_NO_BREAK_ITERATION"
 
-    ICU_CROSS_BUILD_OPT=""
     ICU_SRCDIR=""
-    if test "$HOST_OS_ARCH" = "WINNT"; then
-        ICU_SRCDIR="--srcdir=$(cd $srcdir/../../intl/icu/source; pwd -W)"
-    fi
-
-    if test "$CROSS_COMPILE"; then
-        # Building host tools.  It is necessary to build target binary.
-        case "$HOST_OS_ARCH" in
-            Darwin)
-                ICU_TARGET=MacOSX
-                ;;
-            Linux)
-                ICU_TARGET=Linux
-                ;;
-            WINNT)
-                ICU_TARGET=MSYS/MSVC
-                ;;
-            *bsd*|dragonfly*)
-                ICU_TARGET=BSD
-                ;;
-        esac
-
-        # Remove _DEPEND_CFLAGS from HOST_FLAGS to avoid configure error
-        HOST_ICU_CFLAGS="$HOST_CFLAGS"
-        HOST_ICU_CXXFLAGS="$HOST_CXXFLAGS"
-
-        HOST_ICU_CFLAGS=`echo $HOST_ICU_CFLAGS | sed "s|$_DEPEND_CFLAGS||g"`
-        HOST_ICU_CXXFLAGS=`echo $HOST_ICU_CFXXLAGS | sed "s|$_DEPEND_CFLAGS||g"`
-
-        # ICU requires RTTI
-        if test "$GNU_CC"; then
-            HOST_ICU_CXXFLAGS=`echo $HOST_ICU_CXXFLAGS | sed 's|-fno-rtti|-frtti|g'`
-        elif test "$_MSC_VER"; then
-            HOST_ICU_CXXFLAGS=`echo $HOST_ICU_CXXFLAGS | sed 's|-GR-|-GR|g'`
-        fi
-
-        HOST_ICU_BUILD_OPTS=""
-        if test -n "$MOZ_DEBUG"; then
-            HOST_ICU_BUILD_OPTS="$HOST_ICU_BUILD_OPTS --enable-debug"
-        fi
-
-        abs_srcdir=`(cd $srcdir; pwd)`
-        mkdir -p $_objdir/intl/icu/host
-        (cd $_objdir/intl/icu/host
-         MOZ_SUBCONFIGURE_WRAP([.],[
-         CC="$HOST_CC" CXX="$HOST_CXX" LD="$HOST_LD" \
-         CFLAGS="$HOST_ICU_CFLAGS $HOST_OPTIMIZE_FLAGS" \
-         CPPFLAGS="$ICU_CPPFLAGS" \
-         CXXFLAGS="$HOST_ICU_CXXFLAGS $HOST_OPTIMZIE_FLAGS" \
-                $SHELL $abs_srcdir/../../intl/icu/source/runConfigureICU \
-                $HOST_ICU_BUILD_OPTS \
-                $ICU_TARGET \
-        dnl Shell quoting is fun.
-                ${ICU_SRCDIR+"$ICU_SRCDIR"} \
-                --enable-static --disable-shared \
-                --enable-extras=no --enable-icuio=no --enable-layout=no \
-                --enable-tests=no --enable-samples=no || exit 1
-         ])
-        ) || exit 1
-
-        # generate config/icucross.mk
-        $GMAKE -C $_objdir/intl/icu/host/ config/icucross.mk
-
-        # --with-cross-build requires absolute path
-        ICU_HOST_PATH=`cd $_objdir/intl/icu/host && pwd`
-        ICU_CROSS_BUILD_OPT="--with-cross-build=$ICU_HOST_PATH"
-    fi
+    # Set OS dependent options for ICU
+    case "$OS_TARGET" in
+        Darwin)
+            ICU_TARGET=MacOSX
+            ;;
+        Linux)
+            ICU_TARGET=Linux
+            ;;
+        WINNT)
+            ICU_TARGET=MSYS/MSVC
+            ICU_SRCDIR="--srcdir=$(cd $srcdir/../../intl/icu/source; pwd -W)"
+            ;;
+        DragonFly|FreeBSD|NetBSD|OpenBSD)
+            ICU_TARGET=BSD
+            ;;
+    esac
 
     # To reduce library size, use static linking
     ICU_LINK_OPTS="--enable-static --disable-shared"
     # Force the ICU static libraries to be position independent code
-    ICU_CFLAGS="$DSO_PIC_CFLAGS $CFLAGS"
-    ICU_CXXFLAGS="$DSO_PIC_CFLAGS $CXXFLAGS"
+    ICU_CFLAGS="$DSO_PIC_CFLAGS"
+    ICU_CXXFLAGS="$DSO_PIC_CFLAGS"
 
     ICU_BUILD_OPTS=""
-    if test -n "$MOZ_DEBUG" -o "MOZ_DEBUG_SYMBOLS"; then
-        ICU_CFLAGS="$ICU_CFLAGS $MOZ_DEBUG_FLAGS"
-        ICU_CXXFLAGS="$ICU_CXXFLAGS $MOZ_DEBUG_FLAGS"
-        ICU_LDFLAGS="$MOZ_DEBUG_LDFLAGS"
-        if test -z "$MOZ_DEBUG"; then
-            # To generate debug symbols, it requires MOZ_DEBUG_FLAGS.
-            # But, not debug build.
-            ICU_CFLAGS="$ICU_CFLAGS -UDEBUG -DNDEBUG"
-            ICU_CXXFLAGS="$ICU_CXXFLAGS -UDEBUG -DNDEBUG"
-        else
-            ICU_BUILD_OPTS="$ICU_BUILD_OPTS --enable-debug"
-        fi
+    if test -n "$MOZ_DEBUG"; then
+        ICU_BUILD_OPTS="$ICU_BUILD_OPTS --enable-debug"
     fi
     if test -z "$MOZ_OPTIMIZE"; then
         ICU_BUILD_OPTS="$ICU_BUILD_OPTS --disable-release"
@@ -4324,43 +4261,21 @@ if test -n "$ENABLE_INTL_API" -a -z "$MOZ_NATIVE_ICU"; then
         ICU_CXXFLAGS="$ICU_CXXFLAGS $MOZ_OPTIMIZE_FLAGS"
     fi
 
-    if test "$am_cv_langinfo_codeset" = "no"; then
-        # ex. Android
-        ICU_CPPFLAGS="$ICU_CPPFLAGS -DU_HAVE_NL_LANGINFO_CODESET=0"
-    fi
-
-    # ICU requires RTTI
-    if test "$GNU_CC"; then
-        ICU_CXXFLAGS=`echo $ICU_CXXFLAGS | sed 's|-fno-rtti|-frtti|g'`
-    else
-        if test "$_MSC_VER"; then
-            ICU_CXXFLAGS=`echo $ICU_CXXFLAGS | sed 's|-GR-|-GR|g'`
-        fi
-    fi
-
-    # We cannot use AC_OUTPUT_SUBDIRS since ICU tree is out of spidermonkey.
-    # When using AC_OUTPUT_SUBDIRS, objdir of ICU is out of objdir
-    # due to relative path.
-    # If building ICU moves into root of mozilla tree, we can use
-    # AC_OUTPUT_SUBDIR instead.
-    mkdir -p $_objdir/intl/icu/target
-    (cd $_objdir/intl/icu/target
+    abs_srcdir=`(cd $srcdir; pwd)`
+    mkdir -p $_objdir/intl/icu
+    (cd $_objdir/intl/icu
      MOZ_SUBCONFIGURE_WRAP([.],[
-       AR="$AR" CC="$CC" CXX="$CXX" LD="$LD" \
-       ARFLAGS="$ARFLAGS" \
-       CPPFLAGS="$ICU_CPPFLAGS $CPPFLAGS" \
-       CFLAGS="$ICU_CFLAGS" \
-       CXXFLAGS="$ICU_CXXFLAGS" \
-       LDFLAGS="$ICU_LDFLAGS $LDFLAGS" \
-       $SHELL $_topsrcdir/../../intl/icu/source/configure \
-                $ICU_BUILD_OPTS \
-                $ICU_CROSS_BUILD_OPT \
-                $ICU_LINK_OPTS \
-                ${ICU_SRCDIR+"$ICU_SRCDIR"} \
-                --build=$build --host=$target \
-                --disable-extras --disable-icuio --disable-layout \
-                --disable-tests --disable-samples || exit 1
-       ])
+     CC="$CC" CXX="$CXX" \
+     CFLAGS="$ICU_CFLAGS" CPPFLAGS="$ICU_CPPFLAGS" CXXFLAGS="$ICU_CXXFLAGS" \
+            $SHELL $abs_srcdir/../../intl/icu/source/runConfigureICU \
+            $ICU_BUILD_OPTS \
+            $ICU_TARGET \
+            $ICU_LINK_OPTS \
+dnl Shell quoting is fun.
+            ${ICU_SRCDIR+"$ICU_SRCDIR"} \
+            --enable-extras=no --enable-icuio=no  --enable-layout=no \
+            --enable-tests=no --enable-samples=no || exit 1
+     ])
     ) || exit 1
 fi
 
diff --git a/js/src/devtools/rootAnalysis/annotations.js b/js/src/devtools/rootAnalysis/annotations.js
index 45a7e0473603..05de1e4f3239 100644
--- a/js/src/devtools/rootAnalysis/annotations.js
+++ b/js/src/devtools/rootAnalysis/annotations.js
@@ -160,6 +160,9 @@ var ignoreFunctions = {
     // FIXME!
     "NS_DebugBreak": true,
 
+    // Bug 940765 - fetching preferences should not GC
+    "PrefHashEntry* pref_HashTableLookup(void*)": true,
+
     // These are a little overzealous -- these destructors *can* GC if they end
     // up wrapping a pending exception. See bug 898815 for the heavyweight fix.
     "void js::AutoCompartment::~AutoCompartment(int32)" : true,
@@ -225,5 +228,6 @@ function isRootedPointerTypeName(name)
 function isSuppressConstructor(name)
 {
     return /::AutoSuppressGC/.test(name)
-        || /::AutoEnterAnalysis/.test(name);
+        || /::AutoEnterAnalysis/.test(name)
+        || /::AutoAssertNoGC/.test(name);
 }
diff --git a/js/src/gc/Statistics.cpp b/js/src/gc/Statistics.cpp
index 7fa0093bea84..7744b61d53f5 100644
--- a/js/src/gc/Statistics.cpp
+++ b/js/src/gc/Statistics.cpp
@@ -281,7 +281,6 @@ static const PhaseInfo phases[] = {
     { PHASE_SWEEP, "Sweep", PHASE_NO_PARENT },
     { PHASE_SWEEP_MARK, "Mark During Sweeping", PHASE_SWEEP },
     { PHASE_SWEEP_MARK_TYPES, "Mark Types During Sweeping", PHASE_SWEEP_MARK },
-    { PHASE_SWEEP_MARK_DELAYED, "Mark Delayed During Sweeping", PHASE_SWEEP_MARK },
     { PHASE_SWEEP_MARK_INCOMING_BLACK, "Mark Incoming Black Pointers", PHASE_SWEEP_MARK },
     { PHASE_SWEEP_MARK_WEAK, "Mark Weak", PHASE_SWEEP_MARK },
     { PHASE_SWEEP_MARK_INCOMING_GRAY, "Mark Incoming Gray Pointers", PHASE_SWEEP_MARK },
diff --git a/js/src/gc/Statistics.h b/js/src/gc/Statistics.h
index 301292fcf836..3240fd238f53 100644
--- a/js/src/gc/Statistics.h
+++ b/js/src/gc/Statistics.h
@@ -33,7 +33,6 @@ enum Phase {
     PHASE_SWEEP,
     PHASE_SWEEP_MARK,
     PHASE_SWEEP_MARK_TYPES,
-    PHASE_SWEEP_MARK_DELAYED,
     PHASE_SWEEP_MARK_INCOMING_BLACK,
     PHASE_SWEEP_MARK_WEAK,
     PHASE_SWEEP_MARK_INCOMING_GRAY,
@@ -207,6 +206,30 @@ struct AutoPhase
     MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
 };
 
+struct MaybeAutoPhase
+{
+    MaybeAutoPhase(MOZ_GUARD_OBJECT_NOTIFIER_ONLY_PARAM)
+      : stats(nullptr)
+    {
+        MOZ_GUARD_OBJECT_NOTIFIER_INIT;
+    }
+    void construct(Statistics &statsArg, Phase phaseArg)
+    {
+        JS_ASSERT(!stats);
+        stats = &statsArg;
+        phase = phaseArg;
+        stats->beginPhase(phase);
+    }
+    ~MaybeAutoPhase() {
+        if (stats)
+            stats->endPhase(phase);
+    }
+
+    Statistics *stats;
+    Phase phase;
+    MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
+};
+
 struct AutoSCC
 {
     AutoSCC(Statistics &stats, unsigned scc
diff --git a/js/src/gc/Zone.h b/js/src/gc/Zone.h
index 557ec9710768..e14eea162764 100644
--- a/js/src/gc/Zone.h
+++ b/js/src/gc/Zone.h
@@ -133,7 +133,7 @@ struct Zone : public JS::shadow::Zone,
     }
 
   public:
-    enum CompartmentGCState {
+    enum GCState {
         NoGC,
         Mark,
         MarkGray,
@@ -143,7 +143,7 @@ struct Zone : public JS::shadow::Zone,
 
   private:
     bool                         gcScheduled;
-    CompartmentGCState           gcState;
+    GCState                      gcState;
     bool                         gcPreserveCode;
 
   public:
@@ -166,7 +166,7 @@ struct Zone : public JS::shadow::Zone,
         return runtimeFromMainThread()->isHeapMajorCollecting() && gcState != NoGC;
     }
 
-    void setGCState(CompartmentGCState state) {
+    void setGCState(GCState state) {
         JS_ASSERT(runtimeFromMainThread()->isHeapBusy());
         JS_ASSERT_IF(state != NoGC, canCollect());
         gcState = state;
diff --git a/js/src/jit-test/tests/baseline/bug938130.js b/js/src/jit-test/tests/baseline/bug938130.js
new file mode 100644
index 000000000000..5f0ecbe7e375
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug938130.js
@@ -0,0 +1,7 @@
+// |jit-test| error: TypeError
+
+function f() {    }
+function g() {    }
+var x = [f,f,f,undefined,g];
+for (var i = 0; i < 5; ++i)
+  y = x[i]("x");
diff --git a/js/src/jit-test/tests/basic/bug908915.js b/js/src/jit-test/tests/basic/bug908915.js
index dbdbff98e266..86d1a514aff5 100644
--- a/js/src/jit-test/tests/basic/bug908915.js
+++ b/js/src/jit-test/tests/basic/bug908915.js
@@ -1,7 +1,8 @@
 // |jit-test| error: 42
 function f(y) {}
 for each(let e in newGlobal()) {
-    if (e.name === "quit" || e.name == "readline" || e.name == "terminate")
+    if (e.name === "quit" || e.name == "readline" || e.name == "terminate" ||
+	e.name == "nestedShell")
 	continue;
     try {
         e();
@@ -13,7 +14,8 @@ for each(let e in newGlobal()) {
         y()
     }
     for each(b in []) {
-	if (b.name === "quit" || b.name == "readline" || b.name == "terminate")
+	if (b.name === "quit" || b.name == "readline" || b.name == "terminate" ||
+	    b.name == "nestedShell")
 	    continue;
         try {
             f(b)
diff --git a/js/src/jit/AsmJS.cpp b/js/src/jit/AsmJS.cpp
index de05a9c56020..a4a6e03ef048 100644
--- a/js/src/jit/AsmJS.cpp
+++ b/js/src/jit/AsmJS.cpp
@@ -4339,16 +4339,18 @@ CheckExpr(FunctionCompiler &f, ParseNode *expr, MDefinition **def, Type *type)
       case PNK_NAME:        return CheckVarRef(f, expr, def, type);
       case PNK_ELEM:        return CheckArrayLoad(f, expr, def, type);
       case PNK_ASSIGN:      return CheckAssign(f, expr, def, type);
-      case PNK_CALL:        return f.fail(expr, "non-expression-statement call must be coerced");
       case PNK_POS:         return CheckPos(f, expr, def, type);
       case PNK_NOT:         return CheckNot(f, expr, def, type);
       case PNK_NEG:         return CheckNeg(f, expr, def, type);
       case PNK_BITNOT:      return CheckBitNot(f, expr, def, type);
       case PNK_COMMA:       return CheckComma(f, expr, def, type);
       case PNK_CONDITIONAL: return CheckConditional(f, expr, def, type);
-
       case PNK_STAR:        return CheckMultiply(f, expr, def, type);
 
+      case PNK_CALL:        return f.fail(expr, "all function calls must either be ignored (via "
+                                                "f(); or comma-expression), coerced to signed "
+                                                "(via f()|0) or coerced to double (via +f())");
+
       case PNK_ADD:
       case PNK_SUB:         return CheckAddOrSub(f, expr, def, type);
 
diff --git a/js/src/jit/BaselineCompiler.cpp b/js/src/jit/BaselineCompiler.cpp
index 21f49248e635..4324968887f4 100644
--- a/js/src/jit/BaselineCompiler.cpp
+++ b/js/src/jit/BaselineCompiler.cpp
@@ -251,6 +251,9 @@ BaselineCompiler::compile()
         bytecodeMap[script->nTypeSets] = 0;
     }
 
+    if (script->compartment()->debugMode())
+        baselineScript->setDebugMode();
+
     return Method_Compiled;
 }
 
diff --git a/js/src/jit/BaselineIC.cpp b/js/src/jit/BaselineIC.cpp
index 50223fd56fc3..fdde3ce01a02 100644
--- a/js/src/jit/BaselineIC.cpp
+++ b/js/src/jit/BaselineIC.cpp
@@ -2537,8 +2537,7 @@ DoBinaryArithFallback(JSContext *cx, BaselineFrame *frame, ICBinaryArith_Fallbac
 
     // Check to see if a new stub should be generated.
     if (stub->numOptimizedStubs() >= ICBinaryArith_Fallback::MAX_OPTIMIZED_STUBS) {
-        // TODO: Discard all stubs in this IC and replace with inert megamorphic stub.
-        // But for now we just bail.
+        stub->noteUnoptimizableOperands();
         return true;
     }
 
@@ -2585,8 +2584,10 @@ DoBinaryArithFallback(JSContext *cx, BaselineFrame *frame, ICBinaryArith_Fallbac
     }
 
     // Handle only int32 or double.
-    if (!lhs.isNumber() || !rhs.isNumber())
+    if (!lhs.isNumber() || !rhs.isNumber()) {
+        stub->noteUnoptimizableOperands();
         return true;
+    }
 
     JS_ASSERT(ret.isNumber());
 
@@ -2653,6 +2654,7 @@ DoBinaryArithFallback(JSContext *cx, BaselineFrame *frame, ICBinaryArith_Fallbac
         }
     }
 
+    stub->noteUnoptimizableOperands();
     return true;
 }
 #if defined(_MSC_VER)
@@ -4449,17 +4451,20 @@ ICGetElem_Dense::Compiler::generateStubCode(MacroAssembler &masm)
         Label skipNoSuchMethod;
         regs = availableGeneralRegs(0);
         regs.takeUnchecked(obj);
-        regs.take(R1);
+        regs.takeUnchecked(key);
+        ValueOperand val = regs.takeValueOperand();
 
-        masm.pushValue(R1);
-        masm.loadValue(element, R1);
-        masm.branchTestUndefined(Assembler::NotEqual, R1, &skipNoSuchMethod);
+        masm.loadValue(element, val);
+        masm.branchTestUndefined(Assembler::NotEqual, val, &skipNoSuchMethod);
+        regs.add(val);
 
         // Call __noSuchMethod__ checker.  Object pointer is in objReg.
-        scratchReg = regs.takeAnyExcluding(BaselineTailCallReg);
-        enterStubFrame(masm, scratchReg);
+        enterStubFrame(masm, regs.getAnyExcluding(BaselineTailCallReg));
 
-        // propName (R1) already pushed above.
+        regs.take(val);
+
+        masm.tagValue(JSVAL_TYPE_INT32, key, val);
+        masm.pushValue(val);
         masm.push(obj);
         if (!callVM(LookupNoSuchMethodHandlerInfo, masm))
             return false;
@@ -4469,8 +4474,7 @@ ICGetElem_Dense::Compiler::generateStubCode(MacroAssembler &masm)
         masm.jump(&afterNoSuchMethod);
         masm.bind(&skipNoSuchMethod);
 
-        masm.moveValue(R1, R0);
-        masm.addPtr(Imm32(sizeof(Value)), BaselineStackReg); // pop previously pushed propName (R1)
+        masm.moveValue(val, R0);
         masm.bind(&afterNoSuchMethod);
     } else {
         masm.loadValue(element, R0);
diff --git a/js/src/jit/BaselineIC.h b/js/src/jit/BaselineIC.h
index 1e96b8178365..665ce2576f87 100644
--- a/js/src/jit/BaselineIC.h
+++ b/js/src/jit/BaselineIC.h
@@ -2419,6 +2419,9 @@ class ICBinaryArith_Fallback : public ICFallbackStub
         extra_ = 0;
     }
 
+    static const uint16_t SAW_DOUBLE_RESULT_BIT = 0x1;
+    static const uint16_t UNOPTIMIZABLE_OPERANDS_BIT = 0x2;
+
   public:
     static const uint32_t MAX_OPTIMIZED_STUBS = 8;
 
@@ -2428,11 +2431,17 @@ class ICBinaryArith_Fallback : public ICFallbackStub
         return space->allocate<ICBinaryArith_Fallback>(code);
     }
 
-    bool sawDoubleResult() {
-        return extra_;
+    bool sawDoubleResult() const {
+        return extra_ & SAW_DOUBLE_RESULT_BIT;
     }
     void setSawDoubleResult() {
-        extra_ = 1;
+        extra_ |= SAW_DOUBLE_RESULT_BIT;
+    }
+    bool hadUnoptimizableOperands() const {
+        return extra_ & UNOPTIMIZABLE_OPERANDS_BIT;
+    }
+    void noteUnoptimizableOperands() {
+        extra_ |= UNOPTIMIZABLE_OPERANDS_BIT;
     }
 
     // Compiler for this stub kind.
diff --git a/js/src/jit/BaselineInspector.cpp b/js/src/jit/BaselineInspector.cpp
index ea996156d33d..4768ced51887 100644
--- a/js/src/jit/BaselineInspector.cpp
+++ b/js/src/jit/BaselineInspector.cpp
@@ -295,6 +295,14 @@ BaselineInspector::expectedBinaryArithSpecialization(jsbytecode *pc)
     MIRType result;
     ICStub *stubs[2];
 
+    const ICEntry &entry = icEntryFromPC(pc);
+    ICStub *stub = entry.fallbackStub();
+    if (stub->isBinaryArith_Fallback() &&
+        stub->toBinaryArith_Fallback()->hadUnoptimizableOperands())
+    {
+        return MIRType_None;
+    }
+
     stubs[0] = monomorphicStub(pc);
     if (stubs[0]) {
         if (TryToSpecializeBinaryArithOp(stubs, 1, &result))
diff --git a/js/src/jit/BaselineJIT.cpp b/js/src/jit/BaselineJIT.cpp
index 2a1b6956924a..6ea55d9010f6 100644
--- a/js/src/jit/BaselineJIT.cpp
+++ b/js/src/jit/BaselineJIT.cpp
@@ -746,6 +746,10 @@ BaselineScript::toggleDebugTraps(JSScript *script, jsbytecode *pc)
 {
     JS_ASSERT(script->baselineScript() == this);
 
+    // Only scripts compiled for debug mode have toggled calls.
+    if (!debugMode())
+        return;
+
     SrcNoteLineScanner scanner(script->notes(), script->lineno);
 
     JSRuntime *rt = script->runtimeFromMainThread();
diff --git a/js/src/jit/BaselineJIT.h b/js/src/jit/BaselineJIT.h
index d9c8960a4fce..473edf187112 100644
--- a/js/src/jit/BaselineJIT.h
+++ b/js/src/jit/BaselineJIT.h
@@ -132,7 +132,11 @@ struct BaselineScript
 
         // Flag set when the script contains any writes to its on-stack
         // (rather than call object stored) arguments.
-        MODIFIES_ARGUMENTS = 1 << 2
+        MODIFIES_ARGUMENTS = 1 << 2,
+
+        // Flag set when compiled for use for debug mode. Handles various
+        // Debugger hooks and compiles toggled calls for traps.
+        DEBUG_MODE = 1 << 3
     };
 
   private:
@@ -201,6 +205,13 @@ struct BaselineScript
         return flags_ & MODIFIES_ARGUMENTS;
     }
 
+    void setDebugMode() {
+        flags_ |= DEBUG_MODE;
+    }
+    bool debugMode() const {
+        return flags_ & DEBUG_MODE;
+    }
+
     uint32_t prologueOffset() const {
         return prologueOffset_;
     }
diff --git a/js/src/jit/IonAnalysis.cpp b/js/src/jit/IonAnalysis.cpp
index 42c1e5a3f917..999c38c2eae9 100644
--- a/js/src/jit/IonAnalysis.cpp
+++ b/js/src/jit/IonAnalysis.cpp
@@ -1576,11 +1576,16 @@ TryEliminateTypeBarrierFromTest(MTypeBarrier *barrier, bool filtersNull, bool fi
 
     // Disregard the possible unbox added before the Typebarrier for checking.
     MDefinition *input = barrier->input();
-    if (input->isUnbox() && input->toUnbox()->mode() == MUnbox::TypeBarrier)
-        input = input->toUnbox()->input();
+    MUnbox *inputUnbox = nullptr;
+    if (input->isUnbox() && input->toUnbox()->mode() != MUnbox::Fallible) {
+        inputUnbox = input->toUnbox();
+        input = inputUnbox->input();
+    }
 
     if (test->getOperand(0) == input && direction == TRUE_BRANCH) {
         *eliminated = true;
+        if (inputUnbox)
+            inputUnbox->makeInfallible();
         barrier->replaceAllUsesWith(barrier->input());
         return;
     }
@@ -1614,6 +1619,8 @@ TryEliminateTypeBarrierFromTest(MTypeBarrier *barrier, bool filtersNull, bool fi
     }
 
     *eliminated = true;
+    if (inputUnbox)
+        inputUnbox->makeInfallible();
     barrier->replaceAllUsesWith(barrier->input());
 }
 
@@ -1626,11 +1633,8 @@ TryEliminateTypeBarrier(MTypeBarrier *barrier, bool *eliminated)
     const types::TemporaryTypeSet *inputTypes = barrier->input()->resultTypeSet();
 
     // Disregard the possible unbox added before the Typebarrier.
-    if (barrier->input()->isUnbox() &&
-        barrier->input()->toUnbox()->mode() == MUnbox::TypeBarrier)
-    {
+    if (barrier->input()->isUnbox() && barrier->input()->toUnbox()->mode() != MUnbox::Fallible)
         inputTypes = barrier->input()->toUnbox()->input()->resultTypeSet();
-    }
 
     if (!barrierTypes || !inputTypes)
         return true;
diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index 3f59b68a839a..aa69f2dba4ec 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -5251,21 +5251,10 @@ IonBuilder::makeCall(JSFunction *target, CallInfo &callInfo, bool cloneAtCallsit
 
     types::TemporaryTypeSet *types = bytecodeTypes(pc);
 
-    bool barrier = true;
-    MDefinition *replace = call;
-    if (call->isDOMFunction()) {
-        JSFunction* target = call->getSingleTarget();
-        JS_ASSERT(target && target->isNative() && target->jitInfo());
-        const JSJitInfo *jitinfo = target->jitInfo();
-        barrier = DOMCallNeedsBarrier(jitinfo, types);
-        replace = ensureDefiniteType(call, jitinfo->returnType);
-        if (replace != call) {
-            current->pop();
-            current->push(replace);
-        }
-    }
+    if (call->isDOMFunction())
+        return pushDOMTypeBarrier(call, types, call->getSingleTarget());
 
-    return pushTypeBarrier(replace, types, barrier);
+    return pushTypeBarrier(call, types, true);
 }
 
 bool
@@ -6147,6 +6136,38 @@ IonBuilder::pushTypeBarrier(MDefinition *def, types::TemporaryTypeSet *observed,
     return true;
 }
 
+bool
+IonBuilder::pushDOMTypeBarrier(MInstruction *ins, types::TemporaryTypeSet *observed, JSFunction* func)
+{
+    JS_ASSERT(func && func->isNative() && func->jitInfo());
+
+    const JSJitInfo *jitinfo = func->jitInfo();
+    bool barrier = DOMCallNeedsBarrier(jitinfo, observed);
+    // Need to be a bit careful: if jitinfo->returnType is JSVAL_TYPE_DOUBLE but
+    // types->getKnownTypeTag() is JSVAL_TYPE_INT32, then don't unconditionally
+    // unbox as a double.  Instead, go ahead and barrier on having an int type,
+    // since we know we need a barrier anyway due to the type mismatch.  This is
+    // the only situation in which TI actually has more information about the
+    // JSValueType than codegen can, short of jitinfo->returnType just being
+    // JSVAL_TYPE_UNKNOWN.
+    MDefinition* replace = ins;
+    if (jitinfo->returnType != JSVAL_TYPE_DOUBLE ||
+        observed->getKnownTypeTag() != JSVAL_TYPE_INT32) {
+        JS_ASSERT(jitinfo->returnType == JSVAL_TYPE_UNKNOWN ||
+                  observed->getKnownTypeTag() == JSVAL_TYPE_UNKNOWN ||
+                  jitinfo->returnType == observed->getKnownTypeTag());
+        replace = ensureDefiniteType(ins, jitinfo->returnType);
+        if (replace != ins) {
+            current->pop();
+            current->push(replace);
+        }
+    } else {
+        JS_ASSERT(barrier);
+    }
+
+    return pushTypeBarrier(replace, observed, barrier);
+}
+
 MDefinition *
 IonBuilder::ensureDefiniteType(MDefinition *def, JSValueType definiteType)
 {
@@ -6512,15 +6533,19 @@ IonBuilder::getElemTryTypedObject(bool *emitted, MDefinition *obj, MDefinition *
         return true;
 
     switch (elemTypeReprs.kind()) {
-    case TypeRepresentation::Struct:
-    case TypeRepresentation::Array:
+      case TypeRepresentation::X4:
+        // FIXME (bug 894104): load into a MIRType_float32x4 etc
+        return true;
+
+      case TypeRepresentation::Struct:
+      case TypeRepresentation::Array:
         return getElemTryComplexElemOfTypedObject(emitted,
                                                   obj,
                                                   index,
                                                   objTypeReprs,
                                                   elemTypeReprs,
                                                   elemSize);
-    case TypeRepresentation::Scalar:
+      case TypeRepresentation::Scalar:
         return getElemTryScalarElemOfTypedObject(emitted,
                                                  obj,
                                                  index,
@@ -8187,6 +8212,10 @@ IonBuilder::getPropTryTypedObject(bool *emitted, PropertyName *name,
       case TypeRepresentation::Reference:
         return true;
 
+      case TypeRepresentation::X4:
+        // FIXME (bug 894104): load into a MIRType_float32x4 etc
+        return true;
+
       case TypeRepresentation::Struct:
       case TypeRepresentation::Array:
         return getPropTryComplexPropOfTypedObject(emitted,
@@ -8341,13 +8370,8 @@ IonBuilder::getPropTryCommonGetter(bool *emitted, PropertyName *name,
 
         if (get->isEffectful() && !resumeAfter(get))
             return false;
-        bool barrier = DOMCallNeedsBarrier(jitinfo, types);
-        MDefinition *replace = ensureDefiniteType(get, jitinfo->returnType);
-        if (replace != get) {
-            current->pop();
-            current->push(replace);
-        }
-        if (!pushTypeBarrier(replace, types, barrier))
+
+        if (!pushDOMTypeBarrier(get, types, commonGetter))
             return false;
 
         *emitted = true;
@@ -8725,6 +8749,10 @@ IonBuilder::setPropTryTypedObject(bool *emitted, MDefinition *obj,
         return true;
 
     switch (fieldTypeReprs.kind()) {
+      case TypeRepresentation::X4:
+        // FIXME (bug 894104): store into a MIRType_float32x4 etc
+        return true;
+
       case TypeRepresentation::Reference:
       case TypeRepresentation::Struct:
       case TypeRepresentation::Array:
diff --git a/js/src/jit/IonBuilder.h b/js/src/jit/IonBuilder.h
index df6a2c1e50fb..7c44639f0504 100644
--- a/js/src/jit/IonBuilder.h
+++ b/js/src/jit/IonBuilder.h
@@ -334,6 +334,11 @@ class IonBuilder : public MIRGenerator
     // generated code correspond to the observed types for the bytecode.
     bool pushTypeBarrier(MDefinition *def, types::TemporaryTypeSet *observed, bool needBarrier);
 
+    // As pushTypeBarrier, but will compute the needBarrier boolean itself based
+    // on observed and the JSFunction that we're planning to call. The
+    // JSFunction must be a DOM method or getter.
+    bool pushDOMTypeBarrier(MInstruction *ins, types::TemporaryTypeSet *observed, JSFunction* func);
+
     // If definiteType is not known or def already has the right type, just
     // returns def.  Otherwise, returns an MInstruction that has that definite
     // type, infallibly unboxing ins as needed.  The new instruction will be
diff --git a/js/src/jit/IonMacroAssembler.cpp b/js/src/jit/IonMacroAssembler.cpp
index 8f2985905891..ef0eb8ae9673 100644
--- a/js/src/jit/IonMacroAssembler.cpp
+++ b/js/src/jit/IonMacroAssembler.cpp
@@ -1627,7 +1627,7 @@ MacroAssembler::convertValueToInt(JSContext *cx, const Value &v, Register output
             break;
           }
           case IntConversion_Truncate:
-            move32(Imm32(ToInt32(d)), output);
+            move32(Imm32(js::ToInt32(d)), output);
             break;
           case IntConversion_ClampToUint8:
             move32(Imm32(ClampDoubleToUint8(d)), output);
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index 849a65716207..25b8ca986bbc 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -2373,6 +2373,11 @@ class MUnbox : public MUnaryInstruction, public BoxInputsPolicy
         return AliasSet::None();
     }
     void printOpcode(FILE *fp) const;
+    void makeInfallible() {
+        // Should only be called if we're already Infallible or TypeBarrier
+        JS_ASSERT(mode() != Fallible);
+        mode_ = Infallible;
+    }
 };
 
 class MGuardObject : public MUnaryInstruction, public SingleObjectPolicy
diff --git a/js/src/jit/RegisterSets.h b/js/src/jit/RegisterSets.h
index 12078fc427b7..1cc5c064e58f 100644
--- a/js/src/jit/RegisterSets.h
+++ b/js/src/jit/RegisterSets.h
@@ -397,6 +397,15 @@ class TypedRegisterSet
         takeUnchecked(value.valueReg());
 #else
 #error "Bad architecture"
+#endif
+    }
+    ValueOperand takeValueOperand() {
+#if defined(JS_NUNBOX32)
+        return ValueOperand(takeAny(), takeAny());
+#elif defined(JS_PUNBOX64)
+        return ValueOperand(takeAny());
+#else
+#error "Bad architecture"
 #endif
     }
     T getAny() const {
@@ -407,6 +416,17 @@ class TypedRegisterSet
         // EAX on x86).
         return getFirst();
     }
+    T getAnyExcluding(T preclude) {
+        JS_ASSERT(!empty());
+        if (!has(preclude))
+            return getAny();
+
+        take(preclude);
+        JS_ASSERT(!empty());
+        T result = getAny();
+        add(preclude);
+        return result;
+    }
     T getFirst() const {
         JS_ASSERT(!empty());
         return T::FromCode(mozilla::CountTrailingZeroes32(bits_));
@@ -423,13 +443,9 @@ class TypedRegisterSet
         return reg;
     }
     T takeAnyExcluding(T preclude) {
-        if (!has(preclude))
-            return takeAny();
-
-        take(preclude);
-        T result = takeAny();
-        add(preclude);
-        return result;
+        T reg = getAnyExcluding(preclude);
+        take(reg);
+        return reg;
     }
     ValueOperand takeAnyValue() {
 #if defined(JS_NUNBOX32)
diff --git a/js/src/jit/arm/CodeGenerator-arm.cpp b/js/src/jit/arm/CodeGenerator-arm.cpp
index 5543a94d2ac3..7a9f64cda1fa 100644
--- a/js/src/jit/arm/CodeGenerator-arm.cpp
+++ b/js/src/jit/arm/CodeGenerator-arm.cpp
@@ -722,7 +722,7 @@ CodeGeneratorARM::visitModI(LModI *ins)
     Register lhs = ToRegister(ins->lhs());
     Register rhs = ToRegister(ins->rhs());
     Register output = ToRegister(ins->output());
-    Register callTemp = ToRegister(ins->getTemp(0));
+    Register callTemp = ToRegister(ins->callTemp());
     MMod *mir = ins->mir();
 
     // save the lhs in case we end up with a 0 that should be a -0.0 because lhs < 0.
@@ -758,9 +758,10 @@ CodeGeneratorARM::visitSoftModI(LSoftModI *ins)
     Register lhs = ToRegister(ins->lhs());
     Register rhs = ToRegister(ins->rhs());
     Register output = ToRegister(ins->output());
-    Register callTemp = ToRegister(ins->getTemp(2));
+    Register callTemp = ToRegister(ins->callTemp());
     MMod *mir = ins->mir();
     Label done;
+
     // save the lhs in case we end up with a 0 that should be a -0.0 because lhs < 0.
     JS_ASSERT(callTemp.code() > r3.code() && callTemp.code() < r12.code());
     masm.ma_mov(lhs, callTemp);
diff --git a/js/src/jit/arm/LIR-arm.h b/js/src/jit/arm/LIR-arm.h
index faa1385ef3be..5bf6b90dae4a 100644
--- a/js/src/jit/arm/LIR-arm.h
+++ b/js/src/jit/arm/LIR-arm.h
@@ -139,25 +139,27 @@ class LDivI : public LBinaryMath<1>
 // LSoftDivI is a software divide for ARM cores that don't support a hardware
 // divide instruction.
 //
-// It is implemented as a proper C function so it trashes r0, r1, r2 and r3.  The
-// call also trashes lr, and has the ability to trash ip. The function also
+// It is implemented as a proper C function so it trashes r0, r1, r2 and r3.
+// The call also trashes lr, and has the ability to trash ip. The function also
 // takes two arguments (dividend in r0, divisor in r1). The LInstruction gets
 // encoded such that the divisor and dividend are passed in their apropriate
-// registers, and are marked as copy so we can modify them (and the function
-// will).  The other thre registers that can be trashed are marked as such. For
-// the time being, the link register is not marked as trashed because we never
-// allocate to the link register.
-class LSoftDivI : public LBinaryMath<2>
+// registers and end their life at the start of the instruction by the use of
+// useFixedAtStart.  The result is returned in r0 and the other three registers
+// that can be trashed are marked as temps.  For the time being, the link
+// register is not marked as trashed because we never allocate to the link
+// register.  The FP registers are not trashed.
+class LSoftDivI : public LBinaryMath<3>
 {
   public:
     LIR_HEADER(SoftDivI);
 
     LSoftDivI(const LAllocation &lhs, const LAllocation &rhs,
-              const LDefinition &temp1, const LDefinition &temp2) {
+              const LDefinition &temp1, const LDefinition &temp2, const LDefinition &temp3) {
         setOperand(0, lhs);
         setOperand(1, rhs);
         setTemp(0, temp1);
         setTemp(1, temp2);
+        setTemp(2, temp3);
     }
 
     MDiv *mir() const {
@@ -204,25 +206,34 @@ class LModI : public LBinaryMath<1>
         setTemp(0, callTemp);
     }
 
+    const LDefinition *callTemp() {
+        return getTemp(0);
+    }
+
     MMod *mir() const {
         return mir_->toMod();
     }
 };
 
-class LSoftModI : public LBinaryMath<3>
+class LSoftModI : public LBinaryMath<4>
 {
   public:
     LIR_HEADER(SoftModI);
 
     LSoftModI(const LAllocation &lhs, const LAllocation &rhs,
-              const LDefinition &temp1, const LDefinition &temp2,
+              const LDefinition &temp1, const LDefinition &temp2, const LDefinition &temp3,
               const LDefinition &callTemp)
     {
         setOperand(0, lhs);
         setOperand(1, rhs);
         setTemp(0, temp1);
         setTemp(1, temp2);
-        setTemp(2, callTemp);
+        setTemp(2, temp3);
+        setTemp(3, callTemp);
+    }
+
+    const LDefinition *callTemp() {
+        return getTemp(3);
     }
 
     MMod *mir() const {
@@ -414,20 +425,18 @@ class LUMod : public LBinaryMath<0>
 
 // This class performs a simple x86 'div', yielding either a quotient or remainder depending on
 // whether this instruction is defined to output eax (quotient) or edx (remainder).
-class LSoftUDivOrMod : public LBinaryMath<2>
+class LSoftUDivOrMod : public LBinaryMath<3>
 {
   public:
     LIR_HEADER(SoftUDivOrMod);
 
-    LSoftUDivOrMod(const LAllocation &lhs, const LAllocation &rhs, const LDefinition &temp1, const LDefinition &temp2) {
+    LSoftUDivOrMod(const LAllocation &lhs, const LAllocation &rhs, const LDefinition &temp1,
+                   const LDefinition &temp2, const LDefinition &temp3) {
         setOperand(0, lhs);
         setOperand(1, rhs);
         setTemp(0, temp1);
         setTemp(1, temp2);
-    }
-    // this is incorrect, it is returned in r1, getTemp(0) is r2.
-    const LDefinition *remainder() {
-        return getTemp(0);
+        setTemp(2, temp3);
     }
 };
 
diff --git a/js/src/jit/arm/Lowering-arm.cpp b/js/src/jit/arm/Lowering-arm.cpp
index 9bf9092a0f3f..e236138be5bd 100644
--- a/js/src/jit/arm/Lowering-arm.cpp
+++ b/js/src/jit/arm/Lowering-arm.cpp
@@ -290,8 +290,8 @@ LIRGeneratorARM::lowerDivI(MDiv *div)
         return define(lir, div);
     }
 
-    LSoftDivI *lir = new LSoftDivI(useFixed(div->lhs(), r0), use(div->rhs(), r1),
-                                   tempFixed(r2), tempFixed(r3));
+    LSoftDivI *lir = new LSoftDivI(useFixedAtStart(div->lhs(), r0), useFixedAtStart(div->rhs(), r1),
+                                   tempFixed(r1), tempFixed(r2), tempFixed(r3));
     if (div->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
         return false;
     return defineFixed(lir, div, LAllocation(AnyRegister(r0)));
@@ -335,8 +335,8 @@ LIRGeneratorARM::lowerModI(MMod *mod)
         return define(lir, mod);
     }
 
-    LSoftModI *lir = new LSoftModI(useFixed(mod->lhs(), r0), use(mod->rhs(), r1),
-                                   tempFixed(r2), tempFixed(r3), temp(LDefinition::GENERAL));
+    LSoftModI *lir = new LSoftModI(useFixedAtStart(mod->lhs(), r0), useFixedAtStart(mod->rhs(), r1),
+                                   tempFixed(r0), tempFixed(r2), tempFixed(r3), temp(LDefinition::GENERAL));
     if (mod->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
         return false;
     return defineFixed(lir, mod, LAllocation(AnyRegister(r1)));
@@ -427,8 +427,8 @@ LIRGeneratorARM::lowerUDiv(MInstruction *div)
         lir->setOperand(1, useRegister(rhs));
         return define(lir, div);
     } else {
-        LSoftUDivOrMod *lir = new LSoftUDivOrMod(useFixed(lhs, r0), useFixed(rhs, r1),
-                                                 tempFixed(r2), tempFixed(r3));
+        LSoftUDivOrMod *lir = new LSoftUDivOrMod(useFixedAtStart(lhs, r0), useFixedAtStart(rhs, r1),
+                                                 tempFixed(r1), tempFixed(r2), tempFixed(r3));
         return defineFixed(lir, div, LAllocation(AnyRegister(r0)));
     }
 }
@@ -451,8 +451,8 @@ LIRGeneratorARM::lowerUMod(MInstruction *mod)
         lir->setOperand(1, useRegister(rhs));
         return define(lir, mod);
     } else {
-        LSoftUDivOrMod *lir = new LSoftUDivOrMod(useFixed(lhs, r0), useFixed(rhs, r1),
-                                                 tempFixed(r2), tempFixed(r3));
+        LSoftUDivOrMod *lir = new LSoftUDivOrMod(useFixedAtStart(lhs, r0), useFixedAtStart(rhs, r1),
+                                                 tempFixed(r0), tempFixed(r2), tempFixed(r3));
         return defineFixed(lir, mod, LAllocation(AnyRegister(r1)));
     }
 }
diff --git a/js/src/jit/shared/Lowering-x86-shared.cpp b/js/src/jit/shared/Lowering-x86-shared.cpp
index 4f081e647f0c..2e8aca0e2234 100644
--- a/js/src/jit/shared/Lowering-x86-shared.cpp
+++ b/js/src/jit/shared/Lowering-x86-shared.cpp
@@ -209,7 +209,13 @@ LIRGeneratorX86Shared::visitAsmJSNeg(MAsmJSNeg *ins)
 bool
 LIRGeneratorX86Shared::lowerUDiv(MInstruction *div)
 {
-    LUDivOrMod *lir = new LUDivOrMod(useFixed(div->getOperand(0), eax),
+    // Optimize x/x. The comments in lowerDivI apply here as well.
+    if (div->getOperand(0) == div->getOperand(1)) {
+        LDivSelfI *lir = new LDivSelfI(useRegisterAtStart(div->getOperand(0)));
+        return define(lir, div);
+    }
+
+    LUDivOrMod *lir = new LUDivOrMod(useFixedAtStart(div->getOperand(0), eax),
                                      useRegister(div->getOperand(1)),
                                      tempFixed(edx));
     return defineFixed(lir, div, LAllocation(AnyRegister(eax)));
diff --git a/js/src/jit/x64/Assembler-x64.cpp b/js/src/jit/x64/Assembler-x64.cpp
index a016d35d7b23..eb80b1cd0fd2 100644
--- a/js/src/jit/x64/Assembler-x64.cpp
+++ b/js/src/jit/x64/Assembler-x64.cpp
@@ -160,9 +160,14 @@ Assembler::finish()
 #ifdef DEBUG
         size_t oldSize = masm.size();
 #endif
-        masm.jmp_rip(0);
+        masm.jmp_rip(2);
+        JS_ASSERT(masm.size() - oldSize == 6);
+        // Following an indirect branch with ud2 hints to the hardware that
+        // there's no fall-through. This also aligns the 64-bit immediate.
+        masm.ud2();
+        JS_ASSERT(masm.size() - oldSize == 8);
         masm.immediate64(0);
-        masm.align(SizeOfJumpTableEntry);
+        JS_ASSERT(masm.size() - oldSize == SizeOfExtendedJump);
         JS_ASSERT(masm.size() - oldSize == SizeOfJumpTableEntry);
     }
 }
diff --git a/js/src/jit/x64/Assembler-x64.h b/js/src/jit/x64/Assembler-x64.h
index abd8694c5c50..aadcc2f7efca 100644
--- a/js/src/jit/x64/Assembler-x64.h
+++ b/js/src/jit/x64/Assembler-x64.h
@@ -195,15 +195,16 @@ class Assembler : public AssemblerX86Shared
     // The start of the relocation table contains the offset from the code
     // buffer to the start of the extended jump table.
     //
-    // Each entry in this table is a jmp [rip], where the next eight bytes
-    // contain an immediate address. This comes out to 14 bytes, which we pad
-    // to 16.
+    // Each entry in this table is a jmp [rip], followed by a ud2 to hint to the
+    // hardware branch predictor that there is no fallthrough, followed by the
+    // eight bytes containing an immediate address. This comes out to 16 bytes.
     //    +1 byte for opcode
     //    +1 byte for mod r/m
-    //    +4 bytes for rip-relative offset (0)
+    //    +4 bytes for rip-relative offset (2)
+    //    +2 bytes for ud2 instruction
     //    +8 bytes for 64-bit address
     //
-    static const uint32_t SizeOfExtendedJump = 1 + 1 + 4 + 8;
+    static const uint32_t SizeOfExtendedJump = 1 + 1 + 4 + 2 + 8;
     static const uint32_t SizeOfJumpTableEntry = 16;
 
     uint32_t extendedJumpTable_;
diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index ae3364209d99..c6f99bd722a8 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -3085,10 +3085,10 @@ DefineProperty(JSContext *cx, HandleObject obj, const char *name, const Value &v
     RootedValue value(cx, value_);
     AutoRooterGetterSetter gsRoot(cx, attrs, const_cast<JSPropertyOp *>(&getter.op),
                                   const_cast<JSStrictPropertyOp *>(&setter.op));
-    RootedId id(cx);
 
+    RootedId id(cx);
     if (attrs & JSPROP_INDEX) {
-        id = INT_TO_JSID(intptr_t(name));
+        id.set(INT_TO_JSID(intptr_t(name)));
         attrs &= ~JSPROP_INDEX;
     } else {
         JSAtom *atom = Atomize(cx, name, strlen(name));
@@ -3100,6 +3100,57 @@ DefineProperty(JSContext *cx, HandleObject obj, const char *name, const Value &v
     return DefinePropertyById(cx, obj, id, value, getter, setter, attrs, flags, tinyid);
 }
 
+
+static bool
+DefineSelfHostedProperty(JSContext *cx,
+                         HandleObject obj,
+                         const char *name,
+                         const char *getterName,
+                         const char *setterName,
+                         unsigned attrs,
+                         unsigned flags,
+                         int tinyid)
+{
+    RootedAtom nameAtom(cx, Atomize(cx, name, strlen(name)));
+    if (!nameAtom)
+        return false;
+
+    RootedAtom getterNameAtom(cx, Atomize(cx, getterName, strlen(getterName)));
+    if (!getterNameAtom)
+        return false;
+
+    RootedValue getterValue(cx);
+    if (!cx->global()->getSelfHostedFunction(cx, getterNameAtom, nameAtom,
+                                             0, &getterValue))
+    {
+        return false;
+    }
+    JS_ASSERT(getterValue.isObject() && getterValue.toObject().is<JSFunction>());
+    RootedFunction getterFunc(cx, &getterValue.toObject().as<JSFunction>());
+    JSPropertyOp getterOp = JS_DATA_TO_FUNC_PTR(PropertyOp, getterFunc.get());
+
+    RootedFunction setterFunc(cx);
+    if (setterName) {
+        RootedAtom setterNameAtom(cx, Atomize(cx, setterName, strlen(setterName)));
+        if (!setterNameAtom)
+            return false;
+
+        RootedValue setterValue(cx);
+        if (!cx->global()->getSelfHostedFunction(cx, setterNameAtom, nameAtom,
+                                                 0, &setterValue))
+        {
+            return false;
+        }
+        JS_ASSERT(setterValue.isObject() && setterValue.toObject().is<JSFunction>());
+        setterFunc = &getterValue.toObject().as<JSFunction>();
+    }
+    JSStrictPropertyOp setterOp = JS_DATA_TO_FUNC_PTR(StrictPropertyOp, setterFunc.get());
+
+    return DefineProperty(cx, obj, name, UndefinedValue(),
+                          GetterWrapper(getterOp), SetterWrapper(setterOp),
+                          attrs, flags, tinyid);
+}
+
 JS_PUBLIC_API(bool)
 JS_DefineProperty(JSContext *cx, JSObject *objArg, const char *name, jsval valueArg,
                   PropertyOp getter, JSStrictPropertyOp setter, unsigned attrs)
@@ -3224,8 +3275,25 @@ JS_DefineProperties(JSContext *cx, JSObject *objArg, const JSPropertySpec *ps)
     RootedObject obj(cx, objArg);
     bool ok;
     for (ok = true; ps->name; ps++) {
-        ok = DefineProperty(cx, obj, ps->name, UndefinedValue(), ps->getter, ps->setter,
-                            ps->flags, Shape::HAS_SHORTID, ps->tinyid);
+        if (ps->selfHostedGetter) {
+            // If you have self-hosted getter/setter, you can't have a
+            // native one.
+            JS_ASSERT(!ps->getter.op && !ps->setter.op);
+
+            ok = DefineSelfHostedProperty(cx, obj, ps->name,
+                                          ps->selfHostedGetter,
+                                          ps->selfHostedSetter,
+                                          ps->flags, Shape::HAS_SHORTID,
+                                          ps->tinyid);
+        } else {
+            // If you do not have a self-hosted getter, you should
+            // have a native getter; and you should not have a
+            // self-hosted setter.
+            JS_ASSERT(ps->getter.op && !ps->selfHostedSetter);
+
+            ok = DefineProperty(cx, obj, ps->name, UndefinedValue(), ps->getter, ps->setter,
+                                ps->flags, Shape::HAS_SHORTID, ps->tinyid);
+        }
         if (!ok)
             break;
     }
diff --git a/js/src/jsapi.h b/js/src/jsapi.h
index bee0b4f9abc3..0802ac9b562e 100644
--- a/js/src/jsapi.h
+++ b/js/src/jsapi.h
@@ -2406,6 +2406,8 @@ struct JSPropertySpec {
     uint8_t                     flags;
     JSPropertyOpWrapper         getter;
     JSStrictPropertyOpWrapper   setter;
+    const char                 *selfHostedGetter;
+    const char                 *selfHostedSetter;
 };
 
 namespace JS {
@@ -2436,13 +2438,23 @@ inline int CheckIsNative(JSNative native);
     {name, 0, \
      uint8_t(JS_CHECK_ACCESSOR_FLAGS(flags) | JSPROP_SHARED | JSPROP_NATIVE_ACCESSORS), \
      JSOP_WRAPPER(JS_CAST_NATIVE_TO(getter, JSPropertyOp)), \
-     JSOP_NULLWRAPPER}
+     JSOP_NULLWRAPPER, nullptr, nullptr}
 #define JS_PSGS(name, getter, setter, flags) \
     {name, 0, \
      uint8_t(JS_CHECK_ACCESSOR_FLAGS(flags) | JSPROP_SHARED | JSPROP_NATIVE_ACCESSORS), \
      JSOP_WRAPPER(JS_CAST_NATIVE_TO(getter, JSPropertyOp)), \
-     JSOP_WRAPPER(JS_CAST_NATIVE_TO(setter, JSStrictPropertyOp))}
-#define JS_PS_END {0, 0, 0, JSOP_NULLWRAPPER, JSOP_NULLWRAPPER}
+     JSOP_WRAPPER(JS_CAST_NATIVE_TO(setter, JSStrictPropertyOp)), \
+     nullptr, nullptr}
+#define JS_SELF_HOSTED_GET(name, getterName, flags) \
+    {name, 0, \
+     uint8_t(JS_CHECK_ACCESSOR_FLAGS(flags) | JSPROP_SHARED | JSPROP_GETTER), \
+     JSOP_NULLWRAPPER, JSOP_NULLWRAPPER, getterName, nullptr}
+#define JS_SELF_HOSTED_GETSET(name, getterName, setterName, flags) \
+    {name, 0, \
+     uint8_t(JS_CHECK_ACCESSOR_FLAGS(flags) | JSPROP_SHARED | JSPROP_GETTER | JSPROP_SETTER), \
+     JSOP_NULLWRAPPER, JSOP_NULLWRAPPER, getterName, setterName}
+#define JS_PS_END {0, 0, 0, JSOP_NULLWRAPPER, JSOP_NULLWRAPPER, \
+                   nullptr, nullptr}
 
 /*
  * To define a native function, set call to a JSNativeWrapper. To define a
diff --git a/js/src/jsfun.cpp b/js/src/jsfun.cpp
index 65eeb42153e4..f29a1a632172 100644
--- a/js/src/jsfun.cpp
+++ b/js/src/jsfun.cpp
@@ -1119,14 +1119,15 @@ JSFunction::createScriptForLazilyInterpretedFunction(JSContext *cx, HandleFuncti
         if (cx->zone()->needsBarrier())
             LazyScript::writeBarrierPre(lazy);
 
-        // Suppress GC when lazily compiling functions, to preserve source
-        // character buffers.
+        // Suppress GC for now although we should be able to remove this by
+        // making 'lazy' a Rooted<LazyScript*> (which requires adding a
+        // THING_ROOT_LAZY_SCRIPT).
         AutoSuppressGC suppressGC(cx);
 
         fun->flags &= ~INTERPRETED_LAZY;
         fun->flags |= INTERPRETED;
 
-        JSScript *script = lazy->maybeScript();
+        RootedScript script(cx, lazy->maybeScript());
 
         if (script) {
             fun->initScript(script);
@@ -1155,13 +1156,12 @@ JSFunction::createScriptForLazilyInterpretedFunction(JSContext *cx, HandleFuncti
         // has started.
         if (!lazy->numInnerFunctions() && !JS::IsIncrementalGCInProgress(cx->runtime())) {
             LazyScriptCache::Lookup lookup(cx, lazy);
-            cx->runtime()->lazyScriptCache.lookup(lookup, &script);
+            cx->runtime()->lazyScriptCache.lookup(lookup, script.address());
         }
 
         if (script) {
             RootedObject enclosingScope(cx, lazy->enclosingScope());
-            RootedScript scriptRoot(cx, script);
-            RootedScript clonedScript(cx, CloneScript(cx, enclosingScope, fun, scriptRoot));
+            RootedScript clonedScript(cx, CloneScript(cx, enclosingScope, fun, script));
             if (!clonedScript) {
                 fun->initLazyScript(lazy);
                 return false;
@@ -1182,7 +1182,8 @@ JSFunction::createScriptForLazilyInterpretedFunction(JSContext *cx, HandleFuncti
         JS_ASSERT(lazy->source()->hasSourceData());
 
         // Parse and compile the script from source.
-        const jschar *chars = lazy->source()->chars(cx);
+        SourceDataCache::AutoSuppressPurge asp(cx);
+        const jschar *chars = lazy->source()->chars(cx, asp);
         if (!chars) {
             fun->initLazyScript(lazy);
             return false;
diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp
index fffdd8040f7c..d7b80e5730cc 100644
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -1560,7 +1560,7 @@ ArenaLists::refillFreeList(ThreadSafeContext *cx, AllocKind thingKind)
                 cx->asJSContext()->runtime()->gcHelperThread.waitBackgroundSweepEnd();
             }
         } else {
-#ifdef JS_THREADSAFE
+#ifdef JS_WORKER_THREADS
             /*
              * If we're off the main thread, we try to allocate once and return
              * whatever value we get. First, though, we need to ensure the main
@@ -1800,10 +1800,9 @@ GCMarker::markDelayedChildren(ArenaHeader *aheader)
 bool
 GCMarker::markDelayedChildren(SliceBudget &budget)
 {
-    gcstats::Phase phase = runtime->gcIncrementalState == MARK
-                         ? gcstats::PHASE_MARK_DELAYED
-                         : gcstats::PHASE_SWEEP_MARK_DELAYED;
-    gcstats::AutoPhase ap(runtime->gcStats, phase);
+    gcstats::MaybeAutoPhase ap;
+    if (runtime->gcIncrementalState == MARK)
+        ap.construct(runtime->gcStats, gcstats::PHASE_MARK_DELAYED);
 
     JS_ASSERT(unmarkedArenaStackTop);
     do {
@@ -3177,10 +3176,14 @@ js::gc::MarkingValidator::nonIncrementalMark()
         MarkRuntime(gcmarker, true);
     }
 
-    SliceBudget budget;
-    runtime->gcIncrementalState = MARK;
-    runtime->gcMarker.drainMarkStack(budget);
+    {
+        gcstats::AutoPhase ap1(runtime->gcStats, gcstats::PHASE_MARK);
+        SliceBudget budget;
+        runtime->gcIncrementalState = MARK;
+        runtime->gcMarker.drainMarkStack(budget);
+    }
 
+    runtime->gcIncrementalState = SWEEP;
     {
         gcstats::AutoPhase ap(runtime->gcStats, gcstats::PHASE_SWEEP);
         MarkAllWeakReferences(runtime, gcstats::PHASE_SWEEP_MARK_WEAK);
@@ -4149,7 +4152,7 @@ AutoTraceSession::AutoTraceSession(JSRuntime *rt, js::HeapState heapState)
     if (rt->exclusiveThreadsPresent()) {
         // Lock the worker thread state when changing the heap state in the
         // presence of exclusive threads, to avoid racing with refillFreeList.
-#ifdef JS_THREADSAFE
+#ifdef JS_WORKER_THREADS
         AutoLockWorkerThreadState lock(*rt->workerThreadState);
         rt->heapState = heapState;
 #else
@@ -4165,7 +4168,7 @@ AutoTraceSession::~AutoTraceSession()
     JS_ASSERT(runtime->isHeapBusy());
 
     if (runtime->exclusiveThreadsPresent()) {
-#ifdef JS_THREADSAFE
+#ifdef JS_WORKER_THREADS
         AutoLockWorkerThreadState lock(*runtime->workerThreadState);
         runtime->heapState = prevState;
 
diff --git a/js/src/jsinfer.cpp b/js/src/jsinfer.cpp
index de5874f003ad..5c7f9e34d611 100644
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -603,9 +603,11 @@ class types::CompilerConstraintList
 
   public:
     CompilerConstraintList(jit::TempAllocator &alloc)
-      : constraints(alloc),
-        frozenScripts(alloc),
-        failed_(false)
+      : failed_(false)
+#ifdef JS_ION
+      , constraints(alloc)
+      , frozenScripts(alloc)
+#endif
     {}
 
     void add(CompilerConstraint *constraint) {
diff --git a/js/src/jsprototypes.h b/js/src/jsprototypes.h
index b0fee8c468fa..00401a0fbe8a 100644
--- a/js/src/jsprototypes.h
+++ b/js/src/jsprototypes.h
@@ -54,7 +54,7 @@
     macro(DataView,              35,     js_InitTypedArrayClasses) \
     macro(ParallelArray,         36,     js_InitParallelArrayClass) \
     macro(Intl,                  37,     js_InitIntlClass) \
-    macro(TypedObject,           38,     js_InitTypedObjectDummy) \
+    macro(TypedObject,           38,     js_InitTypedObjectClass) \
     macro(GeneratorFunction,     39,     js_InitIteratorClasses) \
 
 #endif /* jsprototypes_h */
diff --git a/js/src/jsscript.cpp b/js/src/jsscript.cpp
index c83216d75330..1ee0a6f8061d 100644
--- a/js/src/jsscript.cpp
+++ b/js/src/jsscript.cpp
@@ -1032,9 +1032,22 @@ JSScript::sourceData(JSContext *cx)
     return scriptSource()->substring(cx, sourceStart, sourceEnd);
 }
 
-JSStableString *
-SourceDataCache::lookup(ScriptSource *ss)
+SourceDataCache::AutoSuppressPurge::AutoSuppressPurge(JSContext *cx)
+ : cache_(cx->runtime()->sourceDataCache)
 {
+    oldValue_ = cache_.numSuppressPurges_++;
+}
+
+SourceDataCache::AutoSuppressPurge::~AutoSuppressPurge()
+{
+    cache_.numSuppressPurges_--;
+    JS_ASSERT(cache_.numSuppressPurges_ == oldValue_);
+}
+
+const jschar *
+SourceDataCache::lookup(ScriptSource *ss, const AutoSuppressPurge &asp)
+{
+    JS_ASSERT(this == &asp.cache());
     if (!map_)
         return nullptr;
     if (Map::Ptr p = map_->lookup(ss))
@@ -1042,31 +1055,41 @@ SourceDataCache::lookup(ScriptSource *ss)
     return nullptr;
 }
 
-void
-SourceDataCache::put(ScriptSource *ss, JSStableString *str)
+bool
+SourceDataCache::put(ScriptSource *ss, const jschar *str, const AutoSuppressPurge &asp)
 {
+    JS_ASSERT(this == &asp.cache());
+
     if (!map_) {
         map_ = js_new<Map>();
         if (!map_)
-            return;
+            return false;
+
         if (!map_->init()) {
-            purge();
-            return;
+            js_delete(map_);
+            map_ = nullptr;
+            return false;
         }
     }
 
-    (void) map_->put(ss, str);
+    return map_->put(ss, str);
 }
 
 void
 SourceDataCache::purge()
 {
+    if (!map_ || numSuppressPurges_ > 0)
+        return;
+
+    for (Map::Range r = map_->all(); !r.empty(); r.popFront())
+        js_delete(const_cast<jschar*>(r.front().value));
+
     js_delete(map_);
     map_ = nullptr;
 }
 
 const jschar *
-ScriptSource::chars(JSContext *cx)
+ScriptSource::chars(JSContext *cx, const SourceDataCache::AutoSuppressPurge &asp)
 {
     if (const jschar *chars = getOffThreadCompressionChars(cx))
         return chars;
@@ -1074,27 +1097,30 @@ ScriptSource::chars(JSContext *cx)
 
 #ifdef USE_ZLIB
     if (compressed()) {
-        JSStableString *cached = cx->runtime()->sourceDataCache.lookup(this);
-        if (!cached) {
-            const size_t nbytes = sizeof(jschar) * (length_ + 1);
-            jschar *decompressed = static_cast<jschar *>(js_malloc(nbytes));
-            if (!decompressed)
-                return nullptr;
-            if (!DecompressString(data.compressed, compressedLength_,
-                                  reinterpret_cast<unsigned char *>(decompressed), nbytes)) {
-                JS_ReportOutOfMemory(cx);
-                js_free(decompressed);
-                return nullptr;
-            }
-            decompressed[length_] = 0;
-            cached = js_NewString<CanGC>(cx, decompressed, length_);
-            if (!cached) {
-                js_free(decompressed);
-                return nullptr;
-            }
-            cx->runtime()->sourceDataCache.put(this, cached);
+        if (const jschar *decompressed = cx->runtime()->sourceDataCache.lookup(this, asp))
+            return decompressed;
+      
+        const size_t nbytes = sizeof(jschar) * (length_ + 1);
+        jschar *decompressed = static_cast<jschar *>(js_malloc(nbytes));
+        if (!decompressed)
+            return nullptr;
+
+        if (!DecompressString(data.compressed, compressedLength_,
+                              reinterpret_cast<unsigned char *>(decompressed), nbytes)) {
+            JS_ReportOutOfMemory(cx);
+            js_free(decompressed);
+            return nullptr;
         }
-        return cached->chars().get();
+
+        decompressed[length_] = 0;
+
+        if (!cx->runtime()->sourceDataCache.put(this, decompressed, asp)) {
+            JS_ReportOutOfMemory(cx);
+            js_free(decompressed);
+            return nullptr;
+        }
+
+        return decompressed;
     }
 #endif
     return data.source;
@@ -1104,7 +1130,8 @@ JSStableString *
 ScriptSource::substring(JSContext *cx, uint32_t start, uint32_t stop)
 {
     JS_ASSERT(start <= stop);
-    const jschar *chars = this->chars(cx);
+    SourceDataCache::AutoSuppressPurge asp(cx);
+    const jschar *chars = this->chars(cx, asp);
     if (!chars)
         return nullptr;
     JSFlatString *flatStr = js_NewStringCopyN<CanGC>(cx, chars + start, stop - start);
@@ -3139,14 +3166,13 @@ LazyScriptHashPolicy::match(JSScript *script, const Lookup &lookup)
         return false;
     }
 
-    // GC activity may destroy the character pointers being compared below.
-    AutoSuppressGC suppress(cx);
+    SourceDataCache::AutoSuppressPurge asp(cx);
 
-    const jschar *scriptChars = script->scriptSource()->chars(cx);
+    const jschar *scriptChars = script->scriptSource()->chars(cx, asp);
     if (!scriptChars)
         return false;
 
-    const jschar *lazyChars = lazy->source()->chars(cx);
+    const jschar *lazyChars = lazy->source()->chars(cx, asp);
     if (!lazyChars)
         return false;
 
diff --git a/js/src/jsscript.h b/js/src/jsscript.h
index 21e00a1af318..3809069e4c0a 100644
--- a/js/src/jsscript.h
+++ b/js/src/jsscript.h
@@ -297,6 +297,36 @@ typedef HashMap<JSScript *,
                 DefaultHasher<JSScript *>,
                 SystemAllocPolicy> DebugScriptMap;
 
+class ScriptSource;
+
+class SourceDataCache
+{
+    typedef HashMap<ScriptSource *,
+                    const jschar *,
+                    DefaultHasher<ScriptSource *>,
+                    SystemAllocPolicy> Map;
+    Map *map_;
+    size_t numSuppressPurges_;
+
+  public:
+    SourceDataCache() : map_(nullptr), numSuppressPurges_(0) {}
+
+    class AutoSuppressPurge
+    {
+        SourceDataCache &cache_;
+        mozilla::DebugOnly<size_t> oldValue_;
+      public:
+        explicit AutoSuppressPurge(JSContext *cx);
+        ~AutoSuppressPurge();
+        SourceDataCache &cache() const { return cache_; }
+    };
+
+    const jschar *lookup(ScriptSource *ss, const AutoSuppressPurge &asp);
+    bool put(ScriptSource *ss, const jschar *chars, const AutoSuppressPurge &asp);
+
+    void purge();
+};
+
 class ScriptSource
 {
     friend class SourceCompressionTask;
@@ -369,7 +399,7 @@ class ScriptSource
         JS_ASSERT(hasSourceData());
         return argumentsNotIncluded_;
     }
-    const jschar *chars(JSContext *cx);
+    const jschar *chars(JSContext *cx, const SourceDataCache::AutoSuppressPurge &asp);
     JSStableString *substring(JSContext *cx, uint32_t start, uint32_t stop);
     size_t sizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf);
 
diff --git a/js/src/jsutil.cpp b/js/src/jsutil.cpp
index 5c3ef97aed92..2dcb8a2922ed 100644
--- a/js/src/jsutil.cpp
+++ b/js/src/jsutil.cpp
@@ -161,6 +161,49 @@ JS_Assert(const char *s, const char *file, int ln)
     MOZ_CRASH();
 }
 
+#ifdef __linux__
+
+#include <malloc.h>
+#include <stdlib.h>
+
+namespace js {
+
+// This function calls all the vanilla heap allocation functions.  It is never
+// called, and exists purely to help config/check_vanilla_allocations.py.  See
+// that script for more details.
+extern void
+AllTheNonBasicVanillaNewAllocations()
+{
+    // posix_memalign and aligned_alloc aren't available on all Linux
+    // configurations.
+    //char *q;
+    //posix_memalign((void**)&q, 16, 16);
+
+    intptr_t p =
+        intptr_t(malloc(16)) +
+        intptr_t(calloc(1, 16)) +
+        intptr_t(realloc(nullptr, 16)) +
+        intptr_t(new char) +
+        intptr_t(new char) +
+        intptr_t(new char) +
+        intptr_t(new char[16]) +
+        intptr_t(memalign(16, 16)) +
+        //intptr_t(q) +
+        //intptr_t(aligned_alloc(16, 16)) +
+        intptr_t(valloc(4096)) +
+        intptr_t(strdup("dummy"));
+
+    printf("%u\n", uint32_t(p));  // make sure |p| is not optimized away
+
+    free((int*)p);      // this would crash if ever actually called
+
+    MOZ_CRASH();
+}
+
+} // namespace js
+
+#endif // __linux__
+
 #ifdef JS_BASIC_STATS
 
 #include <math.h>
diff --git a/js/src/moz.build b/js/src/moz.build
index ab5ee30d951f..ac6144978db1 100644
--- a/js/src/moz.build
+++ b/js/src/moz.build
@@ -210,7 +210,7 @@ if CONFIG['ENABLE_TRACE_LOGGING']:
     ]
 
 if CONFIG['ENABLE_ION']:
-    SOURCES += [
+    UNIFIED_SOURCES += [
         'jit/AliasAnalysis.cpp',
         'jit/AsmJS.cpp',
         'jit/AsmJSLink.cpp',
@@ -267,7 +267,7 @@ if CONFIG['ENABLE_ION']:
         'jit/VMFunctions.cpp',
     ]
     if CONFIG['TARGET_CPU'].find('86') != -1:
-        SOURCES += [
+        UNIFIED_SOURCES += [
             'jit/shared/Assembler-x86-shared.cpp',
             'jit/shared/BaselineCompiler-x86-shared.cpp',
             'jit/shared/BaselineIC-x86-shared.cpp',
@@ -277,7 +277,7 @@ if CONFIG['ENABLE_ION']:
             'jit/shared/MoveEmitter-x86-shared.cpp',
         ]
         if CONFIG['TARGET_CPU'] == 'x86_64':
-            SOURCES += [
+            UNIFIED_SOURCES += [
                 'jit/x64/Assembler-x64.cpp',
                 'jit/x64/Bailouts-x64.cpp',
                 'jit/x64/BaselineCompiler-x64.cpp',
@@ -288,7 +288,7 @@ if CONFIG['ENABLE_ION']:
                 'jit/x64/Trampoline-x64.cpp',
             ]
         else:
-            SOURCES += [
+            UNIFIED_SOURCES += [
                 'jit/x86/Assembler-x86.cpp',
                 'jit/x86/Bailouts-x86.cpp',
                 'jit/x86/BaselineCompiler-x86.cpp',
@@ -299,7 +299,7 @@ if CONFIG['ENABLE_ION']:
                 'jit/x86/Trampoline-x86.cpp',
             ]
     elif CONFIG['TARGET_CPU'].find('arm') != -1:
-        SOURCES += [
+        UNIFIED_SOURCES += [
             'jit/arm/Architecture-arm.cpp',
             'jit/arm/Assembler-arm.cpp',
             'jit/arm/Bailouts-arm.cpp',
diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
index 9d64c2575ccc..36a581a8a9e8 100644
--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -3604,7 +3604,7 @@ NestedShell(JSContext *cx, unsigned argc, jsval *vp)
 
         // As a special case, if the caller passes "--js-cache", replace that
         // with "--js-cache=$(jsCacheDir)"
-        if (!strcmp(argv.back(), "--js-cache")) {
+        if (!strcmp(argv.back(), "--js-cache") && jsCacheDir) {
             char *newArg = JS_smprintf("--js-cache=%s", jsCacheDir);
             if (!newArg)
                 return false;
diff --git a/js/src/tests/ecma_6/TypedObject/objecttype.js b/js/src/tests/ecma_6/TypedObject/objecttype.js
new file mode 100644
index 000000000000..7a8f0a1f7118
--- /dev/null
+++ b/js/src/tests/ecma_6/TypedObject/objecttype.js
@@ -0,0 +1,38 @@
+// |reftest| skip-if(!this.hasOwnProperty("TypedObject"))
+var BUGNUMBER = 917454;
+var summary = 'objecttype';
+
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+var T = TypedObject;
+
+function runTests() {
+  var Point = new T.ArrayType(T.float32, 3);
+  var Line = new T.StructType({from: Point, to: Point});
+  var Lines = new T.ArrayType(Line, 3);
+
+  var lines = new Lines([
+    {from: [1, 2, 3], to: [4, 5, 6]},
+    {from: [7, 8, 9], to: [10, 11, 12]},
+    {from: [13, 14, 15], to: [16, 17, 18]}
+  ]);
+
+  assertEq(T.objectType(lines), Lines);
+  assertEq(T.objectType(lines[0]), Line);
+  assertEq(T.objectType(lines[0].from[0]), T.float64);
+  assertEq(T.objectType(""), T.String);
+  assertEq(T.objectType({}), T.Object);
+  assertEq(T.objectType([]), T.Object);
+  assertEq(T.objectType(function() { }), T.Object);
+  assertEq(T.objectType(undefined), T.Any);
+
+  reportCompare(true, true);
+  print("Tests complete");
+}
+
+runTests();
+
+
diff --git a/js/src/tests/ecma_6/TypedObject/referencetypetrace.js b/js/src/tests/ecma_6/TypedObject/referencetypetrace.js
index e1b90399d8cb..e0fa221716ec 100644
--- a/js/src/tests/ecma_6/TypedObject/referencetypetrace.js
+++ b/js/src/tests/ecma_6/TypedObject/referencetypetrace.js
@@ -4,6 +4,11 @@ var summary = 'TypedObjects reference type trace';
 var actual = '';
 var expect = '';
 
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
 var ArrayType = TypedObject.ArrayType;
 var StructType = TypedObject.StructType;
 var Any = TypedObject.Any;
diff --git a/js/src/tests/ecma_6/TypedObject/simd/float32x4alignment.js b/js/src/tests/ecma_6/TypedObject/simd/float32x4alignment.js
new file mode 100644
index 000000000000..6fa650e57f8f
--- /dev/null
+++ b/js/src/tests/ecma_6/TypedObject/simd/float32x4alignment.js
@@ -0,0 +1,30 @@
+// |reftest| skip-if(!this.hasOwnProperty("TypedObject"))
+var BUGNUMBER = 938728;
+var summary = 'float32x4 alignment';
+
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+var StructType = TypedObject.StructType;
+var uint8 = TypedObject.uint8;
+var float32x4 = TypedObject.float32x4;
+
+function test() {
+  print(BUGNUMBER + ": " + summary);
+
+  assertEq(float32x4.byteLength, 16);
+  assertEq(float32x4.byteAlignment, 16);
+
+  var Compound = new StructType({c: uint8, d: uint8, f: float32x4});
+  assertEq(Compound.fieldOffsets["c"], 0);
+  assertEq(Compound.fieldOffsets["d"], 1);
+  assertEq(Compound.fieldOffsets["f"], 16);
+
+  if (typeof reportCompare === "function")
+    reportCompare(true, true);
+  print("Tests complete");
+}
+
+test();
diff --git a/js/src/tests/ecma_6/TypedObject/simd/float32x4getters.js b/js/src/tests/ecma_6/TypedObject/simd/float32x4getters.js
new file mode 100644
index 000000000000..51b69837465e
--- /dev/null
+++ b/js/src/tests/ecma_6/TypedObject/simd/float32x4getters.js
@@ -0,0 +1,51 @@
+// |reftest| skip-if(!this.hasOwnProperty("TypedObject"))
+var BUGNUMBER = 938728;
+var summary = 'float32x4 getters';
+
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+var float32x4 = TypedObject.float32x4;
+
+function test() {
+  print(BUGNUMBER + ": " + summary);
+
+  // Create a float32x4 and check that the getters work:
+  var f = float32x4(11, 22, 33, 44);
+  assertEq(f.x, 11);
+  assertEq(f.y, 22);
+  assertEq(f.z, 33);
+  assertEq(f.w, 44);
+
+  // Test that the getters work when called reflectively:
+  var g = f.__lookupGetter__("x");
+  assertEq(g.call(f), 11);
+
+  // Test that getters cannot be applied to various incorrect things:
+  assertThrowsInstanceOf(function() {
+    g.call({})
+  }, TypeError, "Getter applicable to random objects");
+  assertThrowsInstanceOf(function() {
+    g.call(0xDEADBEEF)
+  }, TypeError, "Getter applicable to integers");
+  assertThrowsInstanceOf(function() {
+    var T = new TypedObject.StructType({x: TypedObject.float32,
+                                        y: TypedObject.float32,
+                                        z: TypedObject.float32,
+                                        w: TypedObject.float32});
+    var v = new T({x: 11, y: 22, z: 33, w: 44});
+    g.call(v)
+  }, TypeError, "Getter applicable to structs");
+  assertThrowsInstanceOf(function() {
+    var t = new TypedObject.int32x4(1, 2, 3, 4);
+    g.call(t)
+  }, TypeError, "Getter applicable to int32x4");
+
+  if (typeof reportCompare === "function")
+    reportCompare(true, true);
+  print("Tests complete");
+}
+
+test();
diff --git a/js/src/tests/ecma_6/TypedObject/simd/float32x4handle.js b/js/src/tests/ecma_6/TypedObject/simd/float32x4handle.js
new file mode 100644
index 000000000000..5f5cfc5f3c54
--- /dev/null
+++ b/js/src/tests/ecma_6/TypedObject/simd/float32x4handle.js
@@ -0,0 +1,49 @@
+// |reftest| skip-if(!this.hasOwnProperty("TypedObject"))
+var BUGNUMBER = 938728;
+var summary = 'float32x4 handles';
+
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+var ArrayType = TypedObject.ArrayType;
+var float32x4 = TypedObject.float32x4;
+var float32 = TypedObject.float32;
+var Handle = TypedObject.Handle;
+
+function test() {
+  print(BUGNUMBER + ": " + summary);
+
+  var Array = new ArrayType(float32x4, 3);
+  var array = new Array([float32x4(1, 2, 3, 4),
+                         float32x4(5, 6, 7, 8),
+                         float32x4(9, 10, 11, 12)]);
+
+  // Test that trying to create handle into the interior of a
+  // float32x4 fails.
+
+  assertThrowsInstanceOf(function() {
+    var h = float32.handle(array, 1, "w");
+  }, TypeError, "Creating a float32 handle to prop via ctor");
+
+  assertThrowsInstanceOf(function() {
+    var h = float32.handle();
+    Handle.move(h, array, 1, "w");
+  }, TypeError, "Creating a float32 handle to prop via move");
+
+  assertThrowsInstanceOf(function() {
+    var h = float32.handle(array, 1, 0);
+  }, TypeError, "Creating a float32 handle to elem via ctor");
+
+  assertThrowsInstanceOf(function() {
+    var h = float32.handle();
+    Handle.move(h, array, 1, 0);
+  }, TypeError, "Creating a float32 handle to elem via move");
+
+  if (typeof reportCompare === "function")
+    reportCompare(true, true);
+  print("Tests complete");
+}
+
+test();
diff --git a/js/src/tests/ecma_6/TypedObject/simd/float32x4reify.js b/js/src/tests/ecma_6/TypedObject/simd/float32x4reify.js
new file mode 100644
index 000000000000..e33813d24e75
--- /dev/null
+++ b/js/src/tests/ecma_6/TypedObject/simd/float32x4reify.js
@@ -0,0 +1,36 @@
+// |reftest| skip-if(!this.hasOwnProperty("TypedObject"))
+var BUGNUMBER = 938728;
+var summary = 'float32x4 reify';
+
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+var ArrayType = TypedObject.ArrayType;
+var float32x4 = TypedObject.float32x4;
+
+function test() {
+  print(BUGNUMBER + ": " + summary);
+
+  var Array = new ArrayType(float32x4, 3);
+  var array = new Array([float32x4(1, 2, 3, 4),
+                         float32x4(5, 6, 7, 8),
+                         float32x4(9, 10, 11, 12)]);
+
+  // Test that reading array[1] produces a *copy* of float32x4, not an
+  // alias into the array.
+
+  var f = array[1];
+  assertEq(f.w, 8);
+  assertEq(array[1].w, 8);
+  array[1] = float32x4(15, 16, 17, 18);
+  assertEq(f.w, 8);
+  assertEq(array[1].w, 18);
+
+  if (typeof reportCompare === "function")
+    reportCompare(true, true);
+  print("Tests complete");
+}
+
+test();
diff --git a/js/src/tests/ecma_6/TypedObject/simd/float32x4setter.js b/js/src/tests/ecma_6/TypedObject/simd/float32x4setter.js
new file mode 100644
index 000000000000..0867c18be9fc
--- /dev/null
+++ b/js/src/tests/ecma_6/TypedObject/simd/float32x4setter.js
@@ -0,0 +1,45 @@
+// |reftest| skip-if(!this.hasOwnProperty("TypedObject"))
+var BUGNUMBER = 938728;
+var summary = 'float32x4 setting';
+
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+var ArrayType = TypedObject.ArrayType;
+var float32x4 = TypedObject.float32x4;
+
+function test() {
+  print(BUGNUMBER + ": " + summary);
+
+  var Array = new ArrayType(float32x4, 3);
+  var array = new Array([float32x4(1, 2, 3, 4),
+                         float32x4(5, 6, 7, 8),
+                         float32x4(9, 10, 11, 12)]);
+  assertEq(array[1].w, 8);
+
+  // Test that we are allowed to write float32x4 values into array,
+  // but not other things.
+
+  array[1] = float32x4(15, 16, 17, 18);
+  assertEq(array[1].w, 18);
+
+  assertThrowsInstanceOf(function() {
+    array[1] = {x: 15, y: 16, z: 17, w: 18};
+  }, TypeError, "Setting float32x4 from an object");
+
+  assertThrowsInstanceOf(function() {
+    array[1] = [15, 16, 17, 18];
+  }, TypeError, "Setting float32x4 from an array");
+
+  assertThrowsInstanceOf(function() {
+    array[1] = 22;
+  }, TypeError, "Setting float32x4 from a number");
+
+  if (typeof reportCompare === "function")
+    reportCompare(true, true);
+  print("Tests complete");
+}
+
+test();
diff --git a/js/src/tests/ecma_6/TypedObject/simd/int32x4alignment.js b/js/src/tests/ecma_6/TypedObject/simd/int32x4alignment.js
new file mode 100644
index 000000000000..7a427cf10d72
--- /dev/null
+++ b/js/src/tests/ecma_6/TypedObject/simd/int32x4alignment.js
@@ -0,0 +1,30 @@
+// |reftest| skip-if(!this.hasOwnProperty("TypedObject"))
+var BUGNUMBER = 938728;
+var summary = 'int32x4 alignment';
+
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+var StructType = TypedObject.StructType;
+var uint8 = TypedObject.uint8;
+var int32x4 = TypedObject.int32x4;
+
+function test() {
+  print(BUGNUMBER + ": " + summary);
+
+  assertEq(int32x4.byteLength, 16);
+  assertEq(int32x4.byteAlignment, 16);
+
+  var Compound = new StructType({c: uint8, d: uint8, f: int32x4});
+  assertEq(Compound.fieldOffsets["c"], 0);
+  assertEq(Compound.fieldOffsets["d"], 1);
+  assertEq(Compound.fieldOffsets["f"], 16);
+
+  if (typeof reportCompare === "function")
+    reportCompare(true, true);
+  print("Tests complete");
+}
+
+test();
diff --git a/js/src/tests/ecma_6/TypedObject/simd/int32x4getters.js b/js/src/tests/ecma_6/TypedObject/simd/int32x4getters.js
new file mode 100644
index 000000000000..4b99f13761a6
--- /dev/null
+++ b/js/src/tests/ecma_6/TypedObject/simd/int32x4getters.js
@@ -0,0 +1,51 @@
+// |reftest| skip-if(!this.hasOwnProperty("TypedObject"))
+var BUGNUMBER = 938728;
+var summary = 'int32x4 getters';
+
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+var int32x4 = TypedObject.int32x4;
+
+function test() {
+  print(BUGNUMBER + ": " + summary);
+
+  // Create a int32x4 and check that the getters work:
+  var f = int32x4(11, 22, 33, 44);
+  assertEq(f.x, 11);
+  assertEq(f.y, 22);
+  assertEq(f.z, 33);
+  assertEq(f.w, 44);
+
+  // Test that the getters work when called reflectively:
+  var g = f.__lookupGetter__("x");
+  assertEq(g.call(f), 11);
+
+  // Test that getters cannot be applied to various incorrect things:
+  assertThrowsInstanceOf(function() {
+    g.call({})
+  }, TypeError, "Getter applicable to random objects");
+  assertThrowsInstanceOf(function() {
+    g.call(0xDEADBEEF)
+  }, TypeError, "Getter applicable to integers");
+  assertThrowsInstanceOf(function() {
+    var T = new TypedObject.StructType({x: TypedObject.int32,
+                                        y: TypedObject.int32,
+                                        z: TypedObject.int32,
+                                        w: TypedObject.int32});
+    var v = new T({x: 11, y: 22, z: 33, w: 44});
+    g.call(v)
+  }, TypeError, "Getter applicable to structs");
+  assertThrowsInstanceOf(function() {
+    var t = new TypedObject.float32x4(1, 2, 3, 4);
+    g.call(t)
+  }, TypeError, "Getter applicable to float32x4");
+
+  if (typeof reportCompare === "function")
+    reportCompare(true, true);
+  print("Tests complete");
+}
+
+test();
diff --git a/js/src/tests/ecma_6/TypedObject/simd/int32x4handle.js b/js/src/tests/ecma_6/TypedObject/simd/int32x4handle.js
new file mode 100644
index 000000000000..bb64c14390c1
--- /dev/null
+++ b/js/src/tests/ecma_6/TypedObject/simd/int32x4handle.js
@@ -0,0 +1,49 @@
+// |reftest| skip-if(!this.hasOwnProperty("TypedObject"))
+var BUGNUMBER = 938728;
+var summary = 'int32x4 handles';
+
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+var ArrayType = TypedObject.ArrayType;
+var int32x4 = TypedObject.int32x4;
+var int32 = TypedObject.int32;
+var Handle = TypedObject.Handle;
+
+function test() {
+  print(BUGNUMBER + ": " + summary);
+
+  var Array = new ArrayType(int32x4, 3);
+  var array = new Array([int32x4(1, 2, 3, 4),
+                         int32x4(5, 6, 7, 8),
+                         int32x4(9, 10, 11, 12)]);
+
+  // Test that trying to create handle into the interior of a
+  // int32x4 fails.
+
+  assertThrowsInstanceOf(function() {
+    var h = int32.handle(array, 1, "w");
+  }, TypeError, "Creating a int32 handle to prop via ctor");
+
+  assertThrowsInstanceOf(function() {
+    var h = int32.handle();
+    Handle.move(h, array, 1, "w");
+  }, TypeError, "Creating a int32 handle to prop via move");
+
+  assertThrowsInstanceOf(function() {
+    var h = int32.handle(array, 1, 0);
+  }, TypeError, "Creating a int32 handle to elem via ctor");
+
+  assertThrowsInstanceOf(function() {
+    var h = int32.handle();
+    Handle.move(h, array, 1, 0);
+  }, TypeError, "Creating a int32 handle to elem via move");
+
+  if (typeof reportCompare === "function")
+    reportCompare(true, true);
+  print("Tests complete");
+}
+
+test();
diff --git a/js/src/tests/ecma_6/TypedObject/simd/int32x4reify.js b/js/src/tests/ecma_6/TypedObject/simd/int32x4reify.js
new file mode 100644
index 000000000000..a7854c8578f5
--- /dev/null
+++ b/js/src/tests/ecma_6/TypedObject/simd/int32x4reify.js
@@ -0,0 +1,36 @@
+// |reftest| skip-if(!this.hasOwnProperty("TypedObject"))
+var BUGNUMBER = 938728;
+var summary = 'int32x4 reify';
+
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+var ArrayType = TypedObject.ArrayType;
+var int32x4 = TypedObject.int32x4;
+
+function test() {
+  print(BUGNUMBER + ": " + summary);
+
+  var Array = new ArrayType(int32x4, 3);
+  var array = new Array([int32x4(1, 2, 3, 4),
+                         int32x4(5, 6, 7, 8),
+                         int32x4(9, 10, 11, 12)]);
+
+  // Test that reading array[1] produces a *copy* of int32x4, not an
+  // alias into the array.
+
+  var f = array[1];
+  assertEq(f.w, 8);
+  assertEq(array[1].w, 8);
+  array[1] = int32x4(15, 16, 17, 18);
+  assertEq(f.w, 8);
+  assertEq(array[1].w, 18);
+
+  if (typeof reportCompare === "function")
+    reportCompare(true, true);
+  print("Tests complete");
+}
+
+test();
diff --git a/js/src/tests/ecma_6/TypedObject/simd/int32x4setter.js b/js/src/tests/ecma_6/TypedObject/simd/int32x4setter.js
new file mode 100644
index 000000000000..18bdf79d4edb
--- /dev/null
+++ b/js/src/tests/ecma_6/TypedObject/simd/int32x4setter.js
@@ -0,0 +1,45 @@
+// |reftest| skip-if(!this.hasOwnProperty("TypedObject"))
+var BUGNUMBER = 938728;
+var summary = 'int32x4 setting';
+
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+var ArrayType = TypedObject.ArrayType;
+var int32x4 = TypedObject.int32x4;
+
+function test() {
+  print(BUGNUMBER + ": " + summary);
+
+  var Array = new ArrayType(int32x4, 3);
+  var array = new Array([int32x4(1, 2, 3, 4),
+                         int32x4(5, 6, 7, 8),
+                         int32x4(9, 10, 11, 12)]);
+  assertEq(array[1].w, 8);
+
+  // Test that we are allowed to write int32x4 values into array,
+  // but not other things.
+
+  array[1] = int32x4(15, 16, 17, 18);
+  assertEq(array[1].w, 18);
+
+  assertThrowsInstanceOf(function() {
+    array[1] = {x: 15, y: 16, z: 17, w: 18};
+  }, TypeError, "Setting int32x4 from an object");
+
+  assertThrowsInstanceOf(function() {
+    array[1] = [15, 16, 17, 18];
+  }, TypeError, "Setting int32x4 from an array");
+
+  assertThrowsInstanceOf(function() {
+    array[1] = 22;
+  }, TypeError, "Setting int32x4 from a number");
+
+  if (typeof reportCompare === "function")
+    reportCompare(true, true);
+  print("Tests complete");
+}
+
+test();
diff --git a/js/src/tests/ecma_6/TypedObject/simd/shell.js b/js/src/tests/ecma_6/TypedObject/simd/shell.js
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/js/src/tests/lib/jittests.py b/js/src/tests/lib/jittests.py
index fd10c5c5c768..f7ddcb4d0095 100755
--- a/js/src/tests/lib/jittests.py
+++ b/js/src/tests/lib/jittests.py
@@ -659,7 +659,7 @@ def run_tests_remote(tests, prefix, options):
     dm.chmodDir(options.remote_test_root)
 
     Test.CacheDir = posixpath.join(options.remote_test_root, '.js-cache')
-    dm.mkDirs(Test.CacheDir)
+    dm.mkDir(Test.CacheDir)
 
     dm.pushDir(ECMA6_DIR, posixpath.join(jit_tests_dir, 'tests', 'ecma_6'), timeout=600)
     dm.pushDir(os.path.dirname(TEST_DIR), options.remote_test_root, timeout=600)
diff --git a/js/src/vm/CommonPropertyNames.h b/js/src/vm/CommonPropertyNames.h
index 2bf8c7c0e94f..d1fbd61086d7 100644
--- a/js/src/vm/CommonPropertyNames.h
+++ b/js/src/vm/CommonPropertyNames.h
@@ -69,6 +69,7 @@
     macro(FillTypedArrayWithValue, FillTypedArrayWithValue, "FillTypedArrayWithValue") \
     macro(fix, fix, "fix") \
     macro(float32, float32, "float32") \
+    macro(float32x4, float32x4, "float32x4") \
     macro(float64, float64, "float64") \
     macro(format, format, "format") \
     macro(from, from, "from") \
@@ -90,6 +91,7 @@
     macro(InitializeNumberFormat, InitializeNumberFormat, "InitializeNumberFormat") \
     macro(innermost, innermost, "innermost") \
     macro(input, input, "input") \
+    macro(int32x4, int32x4, "int32x4") \
     macro(isFinite, isFinite, "isFinite") \
     macro(isNaN, isNaN, "isNaN") \
     macro(isPrototypeOf, isPrototypeOf, "isPrototypeOf") \
@@ -177,7 +179,11 @@
     macro(void0, void0, "(void 0)") \
     macro(watch, watch, "watch") \
     macro(writable, writable, "writable") \
+    macro(w, w, "w") \
+    macro(x, x, "x") \
+    macro(y, y, "y") \
     macro(yield, yield, "yield") \
+    macro(z, z, "z") \
     /* Type names must be contiguous and ordered; see js::TypeName. */ \
     macro(undefined, undefined, "undefined") \
     macro(object, object, "object") \
diff --git a/js/src/vm/GlobalObject.h b/js/src/vm/GlobalObject.h
index cbe9ee03d224..6cebb57bd068 100644
--- a/js/src/vm/GlobalObject.h
+++ b/js/src/vm/GlobalObject.h
@@ -418,6 +418,13 @@ class GlobalObject : public JSObject
         return getOrCreateObject(cx, APPLICATION_SLOTS + JSProto_Intl, initIntlObject);
     }
 
+    JSObject &getTypedObject() {
+        Value v = getConstructor(JSProto_TypedObject);
+        // only gets called from contexts where TypedObject must be initialized
+        JS_ASSERT(v.isObject());
+        return v.toObject();
+    }
+
     JSObject *getIteratorPrototype() {
         return &getPrototype(JSProto_Iterator).toObject();
     }
diff --git a/js/src/vm/MemoryMetrics.cpp b/js/src/vm/MemoryMetrics.cpp
index 8b2301cea0fb..3175beeb9949 100644
--- a/js/src/vm/MemoryMetrics.cpp
+++ b/js/src/vm/MemoryMetrics.cpp
@@ -94,14 +94,13 @@ InefficientNonFlatteningStringHashPolicy::match(const JSString *const &k, const
 namespace JS {
 
 NotableStringInfo::NotableStringInfo()
-  : bufferSize(0),
-    buffer(0)
+  : buffer(0)
 {}
 
 NotableStringInfo::NotableStringInfo(JSString *str, const StringInfo &info)
   : StringInfo(info)
 {
-    bufferSize = Min(str->length() + 1, size_t(4096));
+    size_t bufferSize = Min(str->length() + 1, size_t(4096));
     buffer = js_pod_malloc<char>(bufferSize);
     if (!buffer) {
         MOZ_CRASH("oom");
@@ -123,17 +122,6 @@ NotableStringInfo::NotableStringInfo(JSString *str, const StringInfo &info)
     PutEscapedString(buffer, bufferSize, chars, str->length(), /* quote */ 0);
 }
 
-NotableStringInfo::NotableStringInfo(const NotableStringInfo& info)
-  : StringInfo(info),
-    bufferSize(info.bufferSize)
-{
-    buffer = js_pod_malloc<char>(bufferSize);
-    if (!buffer)
-        MOZ_CRASH("oom");
-
-    strcpy(buffer, info.buffer);
-}
-
 NotableStringInfo::NotableStringInfo(NotableStringInfo &&info)
   : StringInfo(Move(info))
 {
diff --git a/js/src/vm/Runtime.cpp b/js/src/vm/Runtime.cpp
index 64b294ea9026..0d5c6e6a44b5 100644
--- a/js/src/vm/Runtime.cpp
+++ b/js/src/vm/Runtime.cpp
@@ -591,6 +591,14 @@ JSRuntime::addSizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf, JS::Runtim
         rtSizes->scriptData += mallocSizeOf(r.front());
 }
 
+static bool
+SignalBasedTriggersDisabled()
+{
+  // Don't bother trying to cache the getenv lookup; this should be called
+  // infrequently.
+  return !!getenv("JS_DISABLE_SLOW_SCRIPT_SIGNALS");
+}
+
 void
 JSRuntime::triggerOperationCallback(OperationCallbackTrigger trigger)
 {
@@ -611,8 +619,10 @@ JSRuntime::triggerOperationCallback(OperationCallbackTrigger trigger)
      * asm.js and, optionally, normal Ion code use memory protection and signal
      * handlers to halt running code.
      */
-    TriggerOperationCallbackForAsmJSCode(this);
-    jit::TriggerOperationCallbackForIonCode(this, trigger);
+    if (!SignalBasedTriggersDisabled()) {
+        TriggerOperationCallbackForAsmJSCode(this);
+        jit::TriggerOperationCallbackForIonCode(this, trigger);
+    }
 #endif
 }
 
@@ -847,7 +857,7 @@ js::CurrentThreadCanAccessZone(Zone *zone)
 void
 JSRuntime::assertCanLock(RuntimeLock which)
 {
-#ifdef JS_THREADSAFE
+#ifdef JS_WORKER_THREADS
     // In the switch below, each case falls through to the one below it. None
     // of the runtime locks are reentrant, and when multiple locks are acquired
     // it must be done in the order below.
diff --git a/js/src/vm/Runtime.h b/js/src/vm/Runtime.h
index eb76993eb61e..f1ae76a8cd1b 100644
--- a/js/src/vm/Runtime.h
+++ b/js/src/vm/Runtime.h
@@ -167,21 +167,6 @@ struct ConservativeGCData
     }
 };
 
-class SourceDataCache
-{
-    typedef HashMap<ScriptSource *,
-                    JSStableString *,
-                    DefaultHasher<ScriptSource *>,
-                    SystemAllocPolicy> Map;
-    Map *map_;
-
-  public:
-    SourceDataCache() : map_(nullptr) {}
-    JSStableString *lookup(ScriptSource *ss);
-    void put(ScriptSource *ss, JSStableString *);
-    void purge();
-};
-
 struct EvalCacheEntry
 {
     JSScript *script;
diff --git a/js/src/vm/SelfHosting.cpp b/js/src/vm/SelfHosting.cpp
index d5122bb506c4..48a2f44546e9 100644
--- a/js/src/vm/SelfHosting.cpp
+++ b/js/src/vm/SelfHosting.cpp
@@ -658,6 +658,9 @@ static const JSFunctionSpec intrinsic_functions[] = {
     JS_FNINFO("Memcpy",
               JSNativeThreadSafeWrapper<js::Memcpy>,
               &js::MemcpyJitInfo, 5, 0),
+    JS_FN("StandardTypeObjectDescriptors",
+          js::StandardTypeObjectDescriptors,
+          0, 0),
 
 #define LOAD_AND_STORE_SCALAR_FN_DECLS(_constant, _type, _name)               \
     JS_FNINFO("Store_" #_name,                                                \
diff --git a/js/src/vm/Shape.cpp b/js/src/vm/Shape.cpp
index 6b2313b74623..a86e483727de 100644
--- a/js/src/vm/Shape.cpp
+++ b/js/src/vm/Shape.cpp
@@ -393,6 +393,7 @@ JSObject::getChildPropertyOnDictionary(ThreadSafeContext *cx, JS::HandleObject o
 JSObject::getChildProperty(ExclusiveContext *cx,
                            HandleObject obj, HandleShape parent, StackShape &child)
 {
+    StackShape::AutoRooter childRoot(cx, &child);
     RootedShape shape(cx, getChildPropertyOnDictionary(cx, obj, parent, child));
 
     if (!shape) {
@@ -412,6 +413,7 @@ JSObject::getChildProperty(ExclusiveContext *cx,
 JSObject::lookupChildProperty(ThreadSafeContext *cx,
                               HandleObject obj, HandleShape parent, StackShape &child)
 {
+    StackShape::AutoRooter childRoot(cx, &child);
     JS_ASSERT(cx->isThreadLocal(obj));
 
     RootedShape shape(cx, getChildPropertyOnDictionary(cx, obj, parent, child));
diff --git a/js/src/vm/TypedArrayObject.cpp b/js/src/vm/TypedArrayObject.cpp
index e67cce905ac0..7977ad388844 100644
--- a/js/src/vm/TypedArrayObject.cpp
+++ b/js/src/vm/TypedArrayObject.cpp
@@ -335,7 +335,9 @@ bool
 ArrayBufferObject::neuterViews(JSContext *cx)
 {
     ArrayBufferViewObject *view;
+    size_t numViews = 0;
     for (view = GetViewList(this); view; view = view->nextView()) {
+        numViews++;
         view->neuter();
 
         // Notify compiled jit code that the base pointer has moved.
@@ -349,6 +351,25 @@ ArrayBufferObject::neuterViews(JSContext *cx)
             return false;
     }
 
+    // Remove buffer from the list of buffers with > 1 view.
+    if (numViews > 1 && GetViewList(this)->bufferLink() != UNSET_BUFFER_LINK) {
+        ArrayBufferObject *prev = compartment()->gcLiveArrayBuffers;
+        if (prev == this) {
+            compartment()->gcLiveArrayBuffers = GetViewList(prev)->bufferLink();
+        } else {
+            for (ArrayBufferObject *buf = GetViewList(prev)->bufferLink();
+                 buf;
+                 buf = GetViewList(buf)->bufferLink())
+            {
+                if (buf == this) {
+                    GetViewList(prev)->setBufferLink(GetViewList(buf)->bufferLink());
+                    break;
+                }
+                prev = buf;
+            }
+        }
+    }
+
     return true;
 }
 
diff --git a/js/xpconnect/idl/nsIXPConnect.idl b/js/xpconnect/idl/nsIXPConnect.idl
index f30e1fb4656d..4b476725baca 100644
--- a/js/xpconnect/idl/nsIXPConnect.idl
+++ b/js/xpconnect/idl/nsIXPConnect.idl
@@ -273,6 +273,7 @@ interface nsIXPCFunctionThisTranslator : nsISupports
 
 /***************************************************************************/
 
+
 %{ C++
 // For use with the service manager
 // {CB6593E0-F9B2-11d2-BDD6-000064657374}
@@ -281,7 +282,7 @@ interface nsIXPCFunctionThisTranslator : nsISupports
     { 0xbd, 0xd6, 0x0, 0x0, 0x64, 0x65, 0x73, 0x74 } }
 %}
 
-[uuid(c4d0187c-6a78-4bdf-9cd9-d218644b715a)]
+[uuid(880be309-88a1-4e98-8621-7f7e42681b20)]
 interface nsIXPConnect : nsISupports
 {
 %{ C++
@@ -446,6 +447,7 @@ interface nsIXPConnect : nsISupports
 
 
     [noscript,notxpcom,nostdcall] JSContextPtr getCurrentJSContext();
+    [noscript,notxpcom,nostdcall] JSContextPtr initSafeJSContext();
     [noscript,notxpcom,nostdcall] JSContextPtr getSafeJSContext();
 
     readonly attribute nsIStackFrame                CurrentJSStack;
diff --git a/js/xpconnect/src/XPCComponents.cpp b/js/xpconnect/src/XPCComponents.cpp
index 16f0aaf52bcb..59616b7b004a 100644
--- a/js/xpconnect/src/XPCComponents.cpp
+++ b/js/xpconnect/src/XPCComponents.cpp
@@ -3381,8 +3381,8 @@ nsXPCComponents_Utils::BlockScriptForGlobal(const JS::Value &globalArg,
                                             JSContext *cx)
 {
     NS_ENSURE_TRUE(globalArg.isObject(), NS_ERROR_INVALID_ARG);
-    JSObject *global = UncheckedUnwrap(&globalArg.toObject(),
-                                       /* stopAtOuter = */ false);
+    RootedObject global(cx, UncheckedUnwrap(&globalArg.toObject(),
+                                            /* stopAtOuter = */ false));
     NS_ENSURE_TRUE(JS_IsGlobalObject(global), NS_ERROR_INVALID_ARG);
     if (nsContentUtils::IsSystemPrincipal(GetObjectPrincipal(global))) {
         JS_ReportError(cx, "Script may not be disabled for system globals");
@@ -3397,8 +3397,8 @@ nsXPCComponents_Utils::UnblockScriptForGlobal(const JS::Value &globalArg,
                                               JSContext *cx)
 {
     NS_ENSURE_TRUE(globalArg.isObject(), NS_ERROR_INVALID_ARG);
-    JSObject *global = UncheckedUnwrap(&globalArg.toObject(),
-                                       /* stopAtOuter = */ false);
+    RootedObject global(cx, UncheckedUnwrap(&globalArg.toObject(),
+                                            /* stopAtOuter = */ false));
     NS_ENSURE_TRUE(JS_IsGlobalObject(global), NS_ERROR_INVALID_ARG);
     if (nsContentUtils::IsSystemPrincipal(GetObjectPrincipal(global))) {
         JS_ReportError(cx, "Script may not be disabled for system globals");
diff --git a/js/xpconnect/src/XPCJSContextStack.cpp b/js/xpconnect/src/XPCJSContextStack.cpp
index 7171c37c0198..22ae79ee956b 100644
--- a/js/xpconnect/src/XPCJSContextStack.cpp
+++ b/js/xpconnect/src/XPCJSContextStack.cpp
@@ -134,8 +134,14 @@ const JSClass xpc::SafeJSContextGlobalClass = {
 JSContext*
 XPCJSContextStack::GetSafeJSContext()
 {
-    if (mSafeJSContext)
-        return mSafeJSContext;
+    MOZ_ASSERT(mSafeJSContext);
+    return mSafeJSContext;
+}
+
+JSContext*
+XPCJSContextStack::InitSafeJSContext()
+{
+    MOZ_ASSERT(!mSafeJSContext);
 
     // Start by getting the principal holder and principal for this
     // context.  If we can't manage that, don't bother with the rest.
diff --git a/js/xpconnect/src/XPCJSRuntime.cpp b/js/xpconnect/src/XPCJSRuntime.cpp
index 5513a149f495..e3a610287380 100644
--- a/js/xpconnect/src/XPCJSRuntime.cpp
+++ b/js/xpconnect/src/XPCJSRuntime.cpp
@@ -37,6 +37,7 @@
 #include "mozilla/dom/GeneratedAtomList.h"
 #include "mozilla/dom/BindingUtils.h"
 #include "mozilla/dom/Element.h"
+#include "mozilla/dom/WindowBinding.h"
 #include "mozilla/Attributes.h"
 #include "AccessCheck.h"
 #include "nsGlobalWindow.h"
@@ -384,6 +385,20 @@ EnsureCompartmentPrivate(JSCompartment *c)
     return priv;
 }
 
+XPCWrappedNativeScope*
+MaybeGetObjectScope(JSObject *obj)
+{
+    MOZ_ASSERT(obj);
+    JSCompartment *compartment = js::GetObjectCompartment(obj);
+
+    MOZ_ASSERT(compartment);
+    CompartmentPrivate *priv = GetCompartmentPrivate(compartment);
+    if (!priv)
+        return nullptr;
+
+    return priv->scope;
+}
+
 static bool
 PrincipalImmuneToScriptPolicy(nsIPrincipal* aPrincipal)
 {
@@ -566,6 +581,28 @@ GetJunkScopeGlobal()
     return GetNativeForGlobal(junkScope);
 }
 
+nsGlobalWindow*
+WindowGlobalOrNull(JSObject *aObj)
+{
+    MOZ_ASSERT(aObj);
+    JSObject *glob = js::GetGlobalForObjectCrossCompartment(aObj);
+    MOZ_ASSERT(glob);
+
+    // This will always return null until we have Window on WebIDL bindings,
+    // at which point it will do the right thing.
+    if (!IS_WN_CLASS(js::GetObjectClass(glob))) {
+        nsGlobalWindow* win = nullptr;
+        UNWRAP_OBJECT(Window, nullptr, glob, win);
+        return win;
+    }
+
+    nsISupports* supports = XPCWrappedNative::Get(glob)->GetIdentityObject();
+    nsCOMPtr<nsPIDOMWindow> piWin = do_QueryInterface(supports);
+    if (!piWin)
+        return nullptr;
+    return static_cast<nsGlobalWindow*>(piWin.get());
+}
+
 }
 
 static void
@@ -711,14 +748,22 @@ XPCJSRuntime::PrepareForForgetSkippable()
 }
 
 void
-XPCJSRuntime::PrepareForCollection()
+XPCJSRuntime::BeginCycleCollectionCallback()
 {
+    nsJSContext::BeginCycleCollectionCallback();
+
     nsCOMPtr<nsIObserverService> obs = mozilla::services::GetObserverService();
     if (obs) {
         obs->NotifyObservers(nullptr, "cycle-collector-begin", nullptr);
     }
 }
 
+void
+XPCJSRuntime::EndCycleCollectionCallback(CycleCollectorResults &aResults)
+{
+    nsJSContext::EndCycleCollectionCallback(aResults);
+}
+
 void
 XPCJSRuntime::DispatchDeferredDeletion(bool aContinuation)
 {
diff --git a/js/xpconnect/src/XPCMaps.h b/js/xpconnect/src/XPCMaps.h
index 77bb18f3f947..0cc7c358eaea 100644
--- a/js/xpconnect/src/XPCMaps.h
+++ b/js/xpconnect/src/XPCMaps.h
@@ -646,7 +646,7 @@ public:
             return p->value;
         if (!mTable.add(p, key, value))
             return nullptr;
-        MOZ_ASSERT(xpc::GetObjectScope(key)->mWaiverWrapperMap == this);
+        MOZ_ASSERT(xpc::GetCompartmentPrivate(key)->scope->mWaiverWrapperMap == this);
         JS_StoreObjectPostBarrierCallback(cx, KeyMarkCallback, key, this);
         return value;
     }
diff --git a/js/xpconnect/src/nsCxPusher.cpp b/js/xpconnect/src/nsCxPusher.cpp
index 83db41ac962a..2215a2a5f489 100644
--- a/js/xpconnect/src/nsCxPusher.cpp
+++ b/js/xpconnect/src/nsCxPusher.cpp
@@ -177,6 +177,7 @@ AutoJSContext::AutoJSContext(bool aSafe MOZ_GUARD_OBJECT_NOTIFIER_PARAM_IN_IMPL)
 void
 AutoJSContext::Init(bool aSafe MOZ_GUARD_OBJECT_NOTIFIER_PARAM_IN_IMPL)
 {
+  JS::AutoAssertNoGC nogc;
   MOZ_ASSERT(!mCx, "mCx should not be initialized!");
 
   MOZ_GUARD_OBJECT_NOTIFIER_INIT;
diff --git a/js/xpconnect/src/nsXPConnect.cpp b/js/xpconnect/src/nsXPConnect.cpp
index f730f7e2fea0..675fe6e8709b 100644
--- a/js/xpconnect/src/nsXPConnect.cpp
+++ b/js/xpconnect/src/nsXPConnect.cpp
@@ -1280,6 +1280,13 @@ nsXPConnect::GetCurrentJSContext()
     return GetRuntime()->GetJSContextStack()->Peek();
 }
 
+/* virtual */
+JSContext*
+nsXPConnect::InitSafeJSContext()
+{
+    return GetRuntime()->GetJSContextStack()->InitSafeJSContext();
+}
+
 /* virtual */
 JSContext*
 nsXPConnect::GetSafeJSContext()
diff --git a/js/xpconnect/src/xpc.msg b/js/xpconnect/src/xpc.msg
index eab596ffae17..734f3e1f4cdd 100644
--- a/js/xpconnect/src/xpc.msg
+++ b/js/xpconnect/src/xpc.msg
@@ -73,13 +73,13 @@ XPC_MSG_DEF(NS_ERROR_ALREADY_INITIALIZED           , "Component already initiali
 XPC_MSG_DEF(NS_ERROR_NOT_IMPLEMENTED               , "Method not implemented")
 XPC_MSG_DEF(NS_NOINTERFACE                         , "Component does not have requested interface")
 XPC_MSG_DEF(NS_ERROR_NO_INTERFACE                  , "Component does not have requested interface")
+XPC_MSG_DEF(NS_ERROR_ILLEGAL_VALUE                 , "Illegal value")
 XPC_MSG_DEF(NS_ERROR_INVALID_POINTER               , "Invalid pointer")
 XPC_MSG_DEF(NS_ERROR_NULL_POINTER                  , "Null pointer")
 XPC_MSG_DEF(NS_ERROR_ABORT                         , "Abort")
 XPC_MSG_DEF(NS_ERROR_FAILURE                       , "Failure")
 XPC_MSG_DEF(NS_ERROR_UNEXPECTED                    , "Unexpected error")
 XPC_MSG_DEF(NS_ERROR_OUT_OF_MEMORY                 , "Out of Memory")
-XPC_MSG_DEF(NS_ERROR_ILLEGAL_VALUE                 , "Illegal value")
 XPC_MSG_DEF(NS_ERROR_INVALID_ARG                   , "Invalid argument")
 XPC_MSG_DEF(NS_ERROR_NO_AGGREGATION                , "Component does not support aggregation")
 XPC_MSG_DEF(NS_ERROR_NOT_AVAILABLE                 , "Component is not available")
diff --git a/js/xpconnect/src/xpcprivate.h b/js/xpconnect/src/xpcprivate.h
index 4985bc16ac57..ecc1adb8f0ed 100644
--- a/js/xpconnect/src/xpcprivate.h
+++ b/js/xpconnect/src/xpcprivate.h
@@ -676,7 +676,8 @@ public:
     void TraverseAdditionalNativeRoots(nsCycleCollectionNoteRootCallback& cb) MOZ_OVERRIDE;
     void UnmarkSkippableJSHolders();
     void PrepareForForgetSkippable() MOZ_OVERRIDE;
-    void PrepareForCollection() MOZ_OVERRIDE;
+    void BeginCycleCollectionCallback() MOZ_OVERRIDE;
+    void EndCycleCollectionCallback(mozilla::CycleCollectorResults &aResults) MOZ_OVERRIDE;
     void DispatchDeferredDeletion(bool continuation) MOZ_OVERRIDE;
 
     void CustomGCCallback(JSGCStatus status) MOZ_OVERRIDE;
@@ -3033,6 +3034,7 @@ public:
         return mStack.IsEmpty() ? nullptr : mStack[mStack.Length() - 1].cx;
     }
 
+    JSContext *InitSafeJSContext();
     JSContext *GetSafeJSContext();
     bool HasJSContext(JSContext *cx);
 
@@ -3786,6 +3788,9 @@ GetObjectScope(JSObject *obj)
     return EnsureCompartmentPrivate(obj)->scope;
 }
 
+// This returns null if a scope doesn't already exist.
+XPCWrappedNativeScope* MaybeGetObjectScope(JSObject *obj);
+
 extern bool gDebugMode;
 extern bool gDesiredDebugMode;
 
diff --git a/js/xpconnect/src/xpcpublic.h b/js/xpconnect/src/xpcpublic.h
index 5b279f05976b..9b43aa7dbaeb 100644
--- a/js/xpconnect/src/xpcpublic.h
+++ b/js/xpconnect/src/xpcpublic.h
@@ -404,6 +404,13 @@ GetJunkScope();
 nsIGlobalObject *
 GetJunkScopeGlobal();
 
+/**
+ * If |aObj| has a window for a global, returns the associated nsGlobalWindow.
+ * Otherwise, returns null.
+ */
+nsGlobalWindow*
+WindowGlobalOrNull(JSObject *aObj);
+
 // Error reporter used when there is no associated DOM window on to which to
 // report errors and warnings.
 void
diff --git a/js/xpconnect/tests/chrome/chrome.ini b/js/xpconnect/tests/chrome/chrome.ini
index 7c909ea8be6d..6279ae989a67 100644
--- a/js/xpconnect/tests/chrome/chrome.ini
+++ b/js/xpconnect/tests/chrome/chrome.ini
@@ -46,7 +46,9 @@ support-files =
 [test_bug812415.xul]
 [test_bug853283.xul]
 [test_bug853571.xul]
+[test_bug858101.xul]
 [test_bug860494.xul]
+[test_bug866823.xul]
 [test_bug895340.xul]
 [test_chrometoSource.xul]
 [test_cows.xul]
diff --git a/js/xpconnect/tests/chrome/test_bug858101.xul b/js/xpconnect/tests/chrome/test_bug858101.xul
new file mode 100644
index 000000000000..fc1dde056b32
--- /dev/null
+++ b/js/xpconnect/tests/chrome/test_bug858101.xul
@@ -0,0 +1,55 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/css" href="chrome://global/skin"?>
+<?xml-stylesheet type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css"?>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=858101
+-->
+<window title="Mozilla Bug 858101"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"/>
+
+  <!-- test results are displayed in the html:body -->
+  <body xmlns="http://www.w3.org/1999/xhtml">
+  <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=858101"
+     target="_blank">Mozilla Bug 858101</a>
+  </body>
+
+  <!-- test code goes here -->
+  <script type="application/javascript">
+  <![CDATA[
+
+  /** Test for [[DefaultValue]] on XrayWrappers. **/
+  SimpleTest.waitForExplicitFinish();
+
+  function muckWithToString() {
+    function tricky() { return "hah"; };
+
+    window.toString = document.toString = document.body.toString = tricky;
+    window.valueOf = document.valueOf = document.body.valueOf = tricky;
+
+    Window.prototype.toString = Window.prototype.valueOf = tricky;
+    Document.prototype.toString = Document.prototype.valueOf = tricky;
+    HTMLBodyElement.toString = HTMLBodyElement.valueOf = tricky;
+  }
+
+  function go() {
+    var iwin = $('ifr').contentWindow;
+    iwin.wrappedJSObject.eval('(' + muckWithToString.toSource() + ')()');
+
+    // Check behavior with vanilla CCWs.
+    ok(!!/hah/.exec(iwin.wrappedJSObject + ""), "Waivers should get content-defined window stringification");
+    ok(!!/hah/.exec(iwin.document.wrappedJSObject + ""), "Waivers should get content-defined document stringification");
+    ok(!!/hah/.exec(iwin.document.body.wrappedJSObject + ""), "Waivers should get content-defined body stringification");
+
+    // Check Xray behavior.
+    ok(!/hah/.exec(iwin + ""), "Xrays should not get content-defined window stringification");
+    ok(!/hah/.exec(iwin.document + ""), "Xrays should not get content-defined document stringification");
+    ok(!/hah/.exec(iwin.document.body + ""), "Xrays should not get content-defined body stringification");
+
+    SimpleTest.finish();
+  }
+
+  ]]>
+  </script>
+  <iframe id="ifr" onload="go();" type="content" src="http://example.org/tests/js/xpconnect/tests/mochitest/file_empty.html" />
+</window>
diff --git a/js/xpconnect/tests/chrome/test_bug866823.xul b/js/xpconnect/tests/chrome/test_bug866823.xul
new file mode 100644
index 000000000000..1ee8772cff3f
--- /dev/null
+++ b/js/xpconnect/tests/chrome/test_bug866823.xul
@@ -0,0 +1,52 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/css" href="chrome://global/skin"?>
+<?xml-stylesheet type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css"?>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=866823
+-->
+<window title="Mozilla Bug 866823"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"/>
+
+  <!-- test results are displayed in the html:body -->
+  <body xmlns="http://www.w3.org/1999/xhtml">
+  <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=866823"
+     target="_blank">Mozilla Bug 866823</a>
+  </body>
+
+  <!-- test code goes here -->
+  <script type="application/javascript">
+  <![CDATA[
+  /** Test for Bug 866823 **/
+  SimpleTest.waitForExplicitFinish();
+  const Cu = Components.utils;
+
+  function go() {
+    var iwin = $('ifr').contentWindow;
+
+    // Make sure that Xray waivers can't be transitively extended onto objects
+    // for whom the extender may not waive.
+    var sb = new Cu.Sandbox(iwin, { wantXrays: true });
+    sb.iwin = iwin;
+    ok(Cu.evalInSandbox('iwin.wrappedJSObject.top == iwin.top', sb), "Waiver does not propagate");
+    Cu.evalInSandbox('iwin.wrappedJSObject.waiver = iwin.wrappedJSObject', sb);
+    ok(iwin.wrappedJSObject.eval('waiver == window'), "Waivers disappear same-compartment");
+
+    // Make sure that COW prototype always happens.
+    sb.arrayProto = Array.prototype;
+    ok(Cu.evalInSandbox('arrayProto == Array.prototype', sb),
+                        "Prototype remapping should happen even when the object isn't used as a prototype");
+
+    // Make sure that prototype remapping happens even for nsEP.
+    var sbEP = new Cu.Sandbox(['http://example.org']);
+    sb.epArrayProto = sbEP.Array.prototype;
+    ok(Cu.evalInSandbox('epArrayProto == Array.prototype', sb),
+                        "Prototype remapping should happen for all non-subsuming access");
+
+    SimpleTest.finish();
+  }
+
+  ]]>
+  </script>
+  <iframe id="ifr" onload="go();" type="content" src="http://example.org/tests/js/xpconnect/tests/mochitest/file_empty.html" />
+</window>
diff --git a/js/xpconnect/tests/mochitest/mochitest.ini b/js/xpconnect/tests/mochitest/mochitest.ini
index bdc7e14af654..b5fea37b91ec 100644
--- a/js/xpconnect/tests/mochitest/mochitest.ini
+++ b/js/xpconnect/tests/mochitest/mochitest.ini
@@ -89,6 +89,7 @@ skip-if = os == 'android'
 [test_bug912322.html]
 [test_bug916945.html]
 [test_bug92773.html]
+[test_bug940783.html]
 [test_crosscompartment_weakmap.html]
 [test_frameWrapping.html]
 [test_nac.xhtml]
diff --git a/js/xpconnect/tests/mochitest/test_bug940783.html b/js/xpconnect/tests/mochitest/test_bug940783.html
new file mode 100644
index 000000000000..9e9e4908423d
--- /dev/null
+++ b/js/xpconnect/tests/mochitest/test_bug940783.html
@@ -0,0 +1,62 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=940783
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 940783</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+  <script type="application/javascript">
+
+  /** Test for Bug 940783 **/
+  SimpleTest.waitForExplicitFinish();
+
+  function checkHistoryThrows(hist) {
+    checkThrows(function() { hist.length; });
+    checkThrows(function() { hist.state; });
+    checkThrows(function() { hist.go(); });
+    checkThrows(function() { hist.back(); });
+    checkThrows(function() { hist.forward(); });
+    checkThrows(function() { hist.pushState({}, "foo"); });
+    checkThrows(function() { hist.replaceState({}, "foo"); });
+
+  }
+
+  window.gLoads = 0;
+  function load() {
+    var iwin = $('ifr').contentWindow;
+    ++gLoads;
+    if (gLoads == 1) {
+      window.gHist = iwin.history;
+      iwin.location = "file_empty.html";
+    } else if (gLoads == 2) {
+      checkHistoryThrows(gHist);
+      window.gHist = iwin.history;
+      iwin.location = "http://example.org/tests/js/xpconnect/tests/mochitest/file_empty.html";
+    } else {
+      checkHistoryThrows(gHist);
+      $('ifr').setAttribute('onload', null);
+      SimpleTest.finish();
+    }
+  }
+
+  function checkThrows(fn) {
+    try { fn(); ok(false, "Should have thrown: " + fn.toSource()); }
+    catch (e) { ok(!!/denied|insecure/.exec(e), "Threw correctly: " + e); }
+  }
+
+  </script>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=940783">Mozilla Bug 940783</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+<iframe id="ifr" onload="load();" src="file_empty.html"></iframe>
+
+</div>
+<pre id="test">
+</pre>
+</body>
+</html>
diff --git a/layout/base/moz.build b/layout/base/moz.build
index 2c6544c1b2e9..2ed43247b728 100644
--- a/layout/base/moz.build
+++ b/layout/base/moz.build
@@ -111,4 +111,7 @@ MSVC_ENABLE_PGO = True
 
 include('/ipc/chromium/chromium-config.mozbuild')
 
+LOCAL_INCLUDES += [
+    '/docshell/base',
+]
 FINAL_LIBRARY = 'gklayout'
diff --git a/layout/base/nsDocumentViewer.cpp b/layout/base/nsDocumentViewer.cpp
index 0035a2f0c665..50a8976ba882 100644
--- a/layout/base/nsDocumentViewer.cpp
+++ b/layout/base/nsDocumentViewer.cpp
@@ -36,6 +36,7 @@
 #include "mozilla/BasicEvents.h"
 #include "mozilla/Preferences.h"
 #include "mozilla/dom/EncodingUtils.h"
+#include "mozilla/WeakPtr.h"
 
 #include "nsViewManager.h"
 #include "nsView.h"
@@ -48,7 +49,7 @@
 #include "nsIMarkupDocumentViewer.h"
 #include "nsIInterfaceRequestor.h"
 #include "nsIInterfaceRequestorUtils.h"
-#include "nsIDocShell.h"
+#include "nsDocShell.h"
 #include "nsIBaseWindow.h"
 #include "nsILayoutHistoryState.h"
 #include "nsCharsetSource.h"
@@ -348,7 +349,7 @@ protected:
   // (ie, non owning) references. If you add any members to this
   // class, please make the ownership explicit (pinkerton, scc).
 
-  nsWeakPtr mContainer; // it owns me!
+  WeakPtr<nsDocShell> mContainer; // it owns me!
   nsWeakPtr mTopContainerWhilePrinting;
   nsRefPtr<nsDeviceContext> mDeviceContext;  // We create and own this baby
 
@@ -576,7 +577,7 @@ nsDocumentViewer::LoadStart(nsISupports *aDoc)
 nsresult
 nsDocumentViewer::SyncParentSubDocMap()
 {
-  nsCOMPtr<nsIDocShellTreeItem> item(do_QueryReferent(mContainer));
+  nsCOMPtr<nsIDocShellTreeItem> item(mContainer);
   nsCOMPtr<nsPIDOMWindow> pwin(do_GetInterface(item));
   nsCOMPtr<nsIContent> content;
 
@@ -610,9 +611,9 @@ nsDocumentViewer::SyncParentSubDocMap()
 }
 
 NS_IMETHODIMP
-nsDocumentViewer::SetContainer(nsISupports* aContainer)
+nsDocumentViewer::SetContainer(nsIDocShell* aContainer)
 {
-  mContainer = do_GetWeakReference(aContainer);
+  mContainer = static_cast<nsDocShell*>(aContainer)->asWeakPtr();
   if (mPresContext) {
     mPresContext->SetContainer(aContainer);
   }
@@ -625,12 +626,11 @@ nsDocumentViewer::SetContainer(nsISupports* aContainer)
 }
 
 NS_IMETHODIMP
-nsDocumentViewer::GetContainer(nsISupports** aResult)
+nsDocumentViewer::GetContainer(nsIDocShell** aResult)
 {
    NS_ENSURE_ARG_POINTER(aResult);
 
-   *aResult = nullptr;
-   nsCOMPtr<nsISupports> container = do_QueryReferent(mContainer);
+   nsCOMPtr<nsIDocShell> container(mContainer);
    container.swap(*aResult);
    return NS_OK;
 }
@@ -873,7 +873,7 @@ nsDocumentViewer::InitInternal(nsIWidget* aParentWidget,
     }
   }
 
-  nsCOMPtr<nsIInterfaceRequestor> requestor(do_QueryReferent(mContainer));
+  nsCOMPtr<nsIInterfaceRequestor> requestor(mContainer);
   if (requestor) {
     if (mPresContext) {
       nsCOMPtr<nsILinkHandler> linkHandler;
@@ -1094,7 +1094,7 @@ nsDocumentViewer::PermitUnload(bool aCallerClosesWindow, bool *aPermitUnload)
 
     // Never permit dialogs from the beforeunload handler
     nsCOMPtr<nsIDOMWindowUtils> utils = do_GetInterface(window);
-    bool dialogsWereEnabled;
+    bool dialogsWereEnabled = false;
     utils->AreDialogsEnabled(&dialogsWereEnabled);
     utils->DisableDialogs();
 
@@ -1107,7 +1107,7 @@ nsDocumentViewer::PermitUnload(bool aCallerClosesWindow, bool *aPermitUnload)
     }
   }
 
-  nsCOMPtr<nsIDocShellTreeNode> docShellNode(do_QueryReferent(mContainer));
+  nsCOMPtr<nsIDocShellTreeNode> docShellNode(mContainer);
   nsAutoString text;
   beforeUnload->GetReturnValue(text);
   if (event->GetInternalNSEvent()->mFlags.mDefaultPrevented ||
@@ -1198,7 +1198,7 @@ nsDocumentViewer::ResetCloseWindow()
 {
   mCallerIsClosingWindow = false;
 
-  nsCOMPtr<nsIDocShellTreeNode> docShellNode(do_QueryReferent(mContainer));
+  nsCOMPtr<nsIDocShellTreeNode> docShellNode(mContainer);
   if (docShellNode) {
     int32_t childCount;
     docShellNode->GetChildCount(&childCount);
@@ -1286,7 +1286,7 @@ AttachContainerRecurse(nsIDocShell* aShell)
   if (viewer) {
     nsIDocument* doc = viewer->GetDocument();
     if (doc) {
-      doc->SetContainer(aShell);
+      doc->SetContainer(static_cast<nsDocShell*>(aShell));
     }
     nsRefPtr<nsPresContext> pc;
     viewer->GetPresContext(getter_AddRefs(pc));
@@ -1317,7 +1317,7 @@ nsDocumentViewer::Open(nsISupports *aState, nsISHEntry *aSHEntry)
   NS_ENSURE_TRUE(mPresShell, NS_ERROR_NOT_INITIALIZED);
 
   if (mDocument)
-    mDocument->SetContainer(nsCOMPtr<nsISupports>(do_QueryReferent(mContainer)));
+    mDocument->SetContainer(mContainer);
 
   nsresult rv = InitInternal(mParentWidget, aState, mBounds, false);
   NS_ENSURE_SUCCESS(rv, rv);
@@ -1561,8 +1561,11 @@ nsDocumentViewer::Destroy()
       mPresContext->SetLinkHandler(nullptr);
       mPresContext->SetContainer(nullptr);
     }
-    if (mPresShell)
-      mPresShell->SetForwardingContainer(mContainer);
+    if (mPresShell) {
+      nsWeakPtr container =
+        do_GetWeakReference(static_cast<nsIDocShell*>(mContainer));
+      mPresShell->SetForwardingContainer(container);
+    }
 
     // Do the same for our children.  Note that we need to get the child
     // docshells from the SHEntry now; the docshell will have cleared them.
@@ -1620,7 +1623,7 @@ nsDocumentViewer::Destroy()
 
   mWindow = nullptr;
   mViewManager = nullptr;
-  mContainer = nullptr;
+  mContainer = WeakPtr<nsDocShell>();
 
   return NS_OK;
 }
@@ -1691,8 +1694,7 @@ nsDocumentViewer::SetDocumentInternal(nsIDocument* aDocument,
   MOZ_ASSERT(aDocument);
 
   // Set new container
-  nsCOMPtr<nsISupports> container = do_QueryReferent(mContainer);
-  aDocument->SetContainer(container);
+  aDocument->SetContainer(mContainer);
 
   if (mDocument != aDocument) {
     if (mDocument->IsStaticDocument()) {
@@ -1704,7 +1706,8 @@ nsDocumentViewer::SetDocumentInternal(nsIDocument* aDocument,
     mDocument = aDocument;
 
     // Set the script global object on the new document
-    nsCOMPtr<nsPIDOMWindow> window = do_GetInterface(container);
+    nsCOMPtr<nsPIDOMWindow> window =
+      do_GetInterface(static_cast<nsIDocShell*>(mContainer.get()));
     if (window) {
       window->SetNewDocument(aDocument, nullptr, aForceReuseInnerWindow);
     }
@@ -1712,7 +1715,7 @@ nsDocumentViewer::SetDocumentInternal(nsIDocument* aDocument,
     // Clear the list of old child docshells. Child docshells for the new
     // document will be constructed as frames are created.
     if (!aDocument->IsStaticDocument()) {
-      nsCOMPtr<nsIDocShellTreeNode> node = do_QueryInterface(container);
+      nsCOMPtr<nsIDocShellTreeNode> node(mContainer);
       if (node) {
         int32_t count;
         node->GetChildCount(&count);
@@ -1888,7 +1891,7 @@ nsDocumentViewer::Show(void)
     prevViewer->Destroy();
 
     // Make sure we don't have too many cached ContentViewers
-    nsCOMPtr<nsIDocShellTreeItem> treeItem = do_QueryReferent(mContainer);
+    nsCOMPtr<nsIDocShellTreeItem> treeItem(mContainer);
     if (treeItem) {
       // We need to find the root DocShell since only that object has an
       // SHistory and we need the SHistory to evict content viewers
@@ -1924,7 +1927,7 @@ nsDocumentViewer::Show(void)
   if (mDocument && !mPresShell) {
     NS_ASSERTION(!mWindow, "Window already created but no presshell?");
 
-    nsCOMPtr<nsIBaseWindow> base_win(do_QueryReferent(mContainer));
+    nsCOMPtr<nsIBaseWindow> base_win(mContainer);
     if (base_win) {
       base_win->GetParentWidget(&mParentWidget);
       if (mParentWidget) {
@@ -2014,7 +2017,7 @@ nsDocumentViewer::Hide(void)
     return NS_OK;
   }
 
-  nsCOMPtr<nsIDocShell> docShell(do_QueryReferent(mContainer));
+  nsCOMPtr<nsIDocShell> docShell(mContainer);
   if (docShell) {
     nsCOMPtr<nsILayoutHistoryState> layoutState;
     mPresShell->CaptureHistoryState(getter_AddRefs(layoutState));
@@ -2029,7 +2032,7 @@ nsDocumentViewer::Hide(void)
   mDeviceContext = nullptr;
   mParentWidget  = nullptr;
 
-  nsCOMPtr<nsIBaseWindow> base_win(do_QueryReferent(mContainer));
+  nsCOMPtr<nsIBaseWindow> base_win(mContainer);
 
   if (base_win && !mAttachedToParent) {
     base_win->SetParentWidget(nullptr);
@@ -2114,7 +2117,7 @@ nsDocumentViewer::CreateStyleSet(nsIDocument* aDocument,
   bool shouldOverride = false;
   // We don't want a docshell here for external resource docs, so just
   // look at mContainer.
-  nsCOMPtr<nsIDocShell> ds(do_QueryReferent(mContainer));
+  nsCOMPtr<nsIDocShell> ds(mContainer);
   nsCOMPtr<nsIDOMEventTarget> chromeHandler;
   nsCOMPtr<nsIURI> uri;
   nsRefPtr<nsCSSStyleSheet> csssheet;
@@ -2303,7 +2306,7 @@ nsDocumentViewer::FindContainerView()
   nsView* containerView = nullptr;
 
   if (mContainer) {
-    nsCOMPtr<nsIDocShellTreeItem> docShellItem = do_QueryReferent(mContainer);
+    nsCOMPtr<nsIDocShellTreeItem> docShellItem(mContainer);
     nsCOMPtr<nsPIDOMWindow> pwin(do_GetInterface(docShellItem));
     if (pwin) {
       nsCOMPtr<nsIContent> containerElement = do_QueryInterface(pwin->GetFrameElementInternal());
@@ -2500,7 +2503,7 @@ NS_IMETHODIMP nsDocumentViewer::CopyImage(int32_t aCopyFlags)
   // make noise if we're not in an image
   NS_ENSURE_TRUE(node, NS_ERROR_FAILURE);
 
-  nsCOMPtr<nsILoadContext> loadContext(do_QueryReferent(mContainer));
+  nsCOMPtr<nsILoadContext> loadContext(mContainer);
   return nsCopySupport::ImageCopy(node, loadContext, aCopyFlags);
 }
 
@@ -2632,7 +2635,7 @@ NS_IMETHODIMP nsDocumentViewer::ScrollToNode(nsIDOMNode* aNode)
 void
 nsDocumentViewer::CallChildren(CallChildFunc aFunc, void* aClosure)
 {
-  nsCOMPtr<nsIDocShellTreeNode> docShellNode(do_QueryReferent(mContainer));
+  nsCOMPtr<nsIDocShellTreeNode> docShellNode(mContainer);
   if (docShellNode)
   {
     int32_t i;
@@ -3226,7 +3229,7 @@ nsDocumentViewer::GetContentSize(int32_t* aWidth, int32_t* aHeight)
    NS_ENSURE_TRUE(mDocument, NS_ERROR_NOT_AVAILABLE);
 
    // Skip doing this on docshell-less documents for now
-   nsCOMPtr<nsIDocShellTreeItem> docShellAsItem(do_QueryReferent(mContainer));
+   nsCOMPtr<nsIDocShellTreeItem> docShellAsItem(mContainer);
    NS_ENSURE_TRUE(docShellAsItem, NS_ERROR_NOT_AVAILABLE);
    
    nsCOMPtr<nsIDocShellTreeItem> docShellParent;
@@ -3554,7 +3557,7 @@ nsDocumentViewer::Print(nsIPrintSettings*       aPrintSettings,
     return NS_ERROR_FAILURE;
   }
 
-  nsCOMPtr<nsIDocShell> docShell(do_QueryReferent(mContainer));
+  nsCOMPtr<nsIDocShell> docShell(mContainer);
   NS_ENSURE_STATE(docShell);
 
   // Check to see if this document is still busy
@@ -3664,7 +3667,7 @@ nsDocumentViewer::PrintPreview(nsIPrintSettings* aPrintSettings,
   }
 #endif
 
-  nsCOMPtr<nsIDocShell> docShell(do_QueryReferent(mContainer));
+  nsCOMPtr<nsIDocShell> docShell(mContainer);
   if (!docShell || !mDeviceContext) {
     PR_PL(("Can't Print Preview without device context and docshell"));
     return NS_ERROR_FAILURE;
@@ -4030,7 +4033,7 @@ nsDocumentViewer::ShouldAttachToTopLevel()
   if (!mParentWidget)
     return false;
 
-  nsCOMPtr<nsIDocShellTreeItem> containerItem = do_QueryReferent(mContainer);
+  nsCOMPtr<nsIDocShellTreeItem> containerItem(mContainer);
   if (!containerItem)
     return false;
 
@@ -4098,7 +4101,7 @@ nsDocumentViewer::SetIsPrinting(bool aIsPrinting)
 #ifdef NS_PRINTING
   // Set all the docShells in the docshell tree to be printing.
   // that way if anyone of them tries to "navigate" it can't
-  nsCOMPtr<nsIDocShellTreeNode> docShellTreeNode(do_QueryReferent(mContainer));
+  nsCOMPtr<nsIDocShellTreeNode> docShellTreeNode(mContainer);
   if (docShellTreeNode || !aIsPrinting) {
     SetIsPrintingInDocShellTree(docShellTreeNode, aIsPrinting, true);
   } else {
@@ -4134,7 +4137,7 @@ nsDocumentViewer::SetIsPrintPreview(bool aIsPrintPreview)
 #ifdef NS_PRINTING
   // Set all the docShells in the docshell tree to be printing.
   // that way if anyone of them tries to "navigate" it can't
-  nsCOMPtr<nsIDocShellTreeNode> docShellTreeNode(do_QueryReferent(mContainer));
+  nsCOMPtr<nsIDocShellTreeNode> docShellTreeNode(mContainer);
   if (docShellTreeNode || !aIsPrintPreview) {
     SetIsPrintingInDocShellTree(docShellTreeNode, aIsPrintPreview, true);
   }
@@ -4208,7 +4211,7 @@ nsDocumentViewer::ReturnToGalleyPresentation()
   mPrintEngine->Destroy();
   mPrintEngine = nullptr;
 
-  nsCOMPtr<nsIDocShell> docShell(do_QueryReferent(mContainer));
+  nsCOMPtr<nsIDocShell> docShell(mContainer);
   ResetFocusState(docShell);
 
   SetTextZoom(mTextZoom);
@@ -4247,8 +4250,8 @@ nsDocumentViewer::OnDonePrinting()
     // We are done printing, now cleanup 
     if (mDeferredWindowClose) {
       mDeferredWindowClose = false;
-      nsCOMPtr<nsISupports> container = do_QueryReferent(mContainer);
-      nsCOMPtr<nsIDOMWindow> win = do_GetInterface(container);
+      nsCOMPtr<nsIDOMWindow> win =
+        do_GetInterface(static_cast<nsIDocShell*>(mContainer));
       if (win)
         win->Close();
     } else if (mClosingWhilePrinting) {
diff --git a/layout/base/nsLayoutUtils.cpp b/layout/base/nsLayoutUtils.cpp
index 82dfe56b5f47..07416d35f6c6 100644
--- a/layout/base/nsLayoutUtils.cpp
+++ b/layout/base/nsLayoutUtils.cpp
@@ -1469,6 +1469,7 @@ nsLayoutUtils::GetEventCoordinatesRelativeTo(const WidgetEvent* aEvent,
                   aEvent->eventStructType != NS_WHEEL_EVENT &&
                   aEvent->eventStructType != NS_DRAG_EVENT &&
                   aEvent->eventStructType != NS_SIMPLE_GESTURE_EVENT &&
+                  aEvent->eventStructType != NS_POINTER_EVENT &&
                   aEvent->eventStructType != NS_GESTURENOTIFY_EVENT &&
                   aEvent->eventStructType != NS_TOUCH_EVENT &&
                   aEvent->eventStructType != NS_QUERY_CONTENT_EVENT))
diff --git a/layout/base/nsPresContext.cpp b/layout/base/nsPresContext.cpp
index 2b54fe89ffd2..4b9ce74c275a 100644
--- a/layout/base/nsPresContext.cpp
+++ b/layout/base/nsPresContext.cpp
@@ -958,9 +958,7 @@ nsPresContext::Init(nsDeviceContext* aDeviceContext)
                    "How did we get a presshell?");
 
       // We don't have our container set yet at this point
-      nsCOMPtr<nsISupports> ourContainer = mDocument->GetContainer();
-
-      nsCOMPtr<nsIDocShellTreeItem> ourItem = do_QueryInterface(ourContainer);
+      nsCOMPtr<nsIDocShellTreeItem> ourItem = mDocument->GetDocShell();
       if (ourItem) {
         nsCOMPtr<nsIDocShellTreeItem> parentItem;
         ourItem->GetSameTypeParent(getter_AddRefs(parentItem));
diff --git a/layout/build/moz.build b/layout/build/moz.build
index b0ba967db33a..89deba84c765 100644
--- a/layout/build/moz.build
+++ b/layout/build/moz.build
@@ -29,4 +29,7 @@ LIBRARY_NAME = 'gklayout'
 
 include('/ipc/chromium/chromium-config.mozbuild')
 
+LOCAL_INCLUDES += [
+    '/docshell/base',
+]
 FINAL_LIBRARY = 'xul'
diff --git a/layout/build/nsContentDLF.cpp b/layout/build/nsContentDLF.cpp
index b2e58c46e10e..02c866ce8efc 100644
--- a/layout/build/nsContentDLF.cpp
+++ b/layout/build/nsContentDLF.cpp
@@ -5,6 +5,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 #include "nsCOMPtr.h"
 #include "nsContentDLF.h"
+#include "nsDocShell.h"
 #include "nsGenericHTMLElement.h"
 #include "nsGkAtoms.h"
 #include "nsIComponentManager.h"
@@ -135,7 +136,7 @@ nsContentDLF::CreateInstance(const char* aCommand,
                              nsIChannel* aChannel,
                              nsILoadGroup* aLoadGroup,
                              const char* aContentType, 
-                             nsISupports* aContainer,
+                             nsIDocShell* aContainer,
                              nsISupports* aExtraInfo,
                              nsIStreamListener** aDocListener,
                              nsIContentViewer** aDocViewer)
@@ -370,7 +371,7 @@ nsresult
 nsContentDLF::CreateDocument(const char* aCommand,
                              nsIChannel* aChannel,
                              nsILoadGroup* aLoadGroup,
-                             nsISupports* aContainer,
+                             nsIDocShell* aContainer,
                              const nsCID& aDocumentCID,
                              nsIStreamListener** aDocListener,
                              nsIContentViewer** aContentViewer)
@@ -399,7 +400,7 @@ nsContentDLF::CreateDocument(const char* aCommand,
   rv = NS_NewContentViewer(getter_AddRefs(contentViewer));
   NS_ENSURE_SUCCESS(rv, rv);
 
-  doc->SetContainer(aContainer);
+  doc->SetContainer(static_cast<nsDocShell*>(aContainer));
 
   // Initialize the document to begin loading the data.  An
   // nsIStreamListener connected to the parser is returned in
@@ -418,7 +419,7 @@ nsContentDLF::CreateXULDocument(const char* aCommand,
                                 nsIChannel* aChannel,
                                 nsILoadGroup* aLoadGroup,
                                 const char* aContentType,
-                                nsISupports* aContainer,
+                                nsIDocShell* aContainer,
                                 nsISupports* aExtraInfo,
                                 nsIStreamListener** aDocListener,
                                 nsIContentViewer** aContentViewer)
@@ -442,7 +443,7 @@ nsContentDLF::CreateXULDocument(const char* aCommand,
    * aDocListener.
    */
 
-  doc->SetContainer(aContainer);
+  doc->SetContainer(static_cast<nsDocShell*>(aContainer));
 
   rv = doc->StartDocumentLoad(aCommand, aChannel, aLoadGroup, aContainer, aDocListener, true);
   if (NS_FAILED(rv)) return rv;
diff --git a/layout/build/nsContentDLF.h b/layout/build/nsContentDLF.h
index 327915cc7c35..e44d6b948d53 100644
--- a/layout/build/nsContentDLF.h
+++ b/layout/build/nsContentDLF.h
@@ -33,7 +33,7 @@ public:
   nsresult CreateDocument(const char* aCommand,
                           nsIChannel* aChannel,
                           nsILoadGroup* aLoadGroup,
-                          nsISupports* aContainer,
+                          nsIDocShell* aContainer,
                           const nsCID& aDocumentCID,
                           nsIStreamListener** aDocListener,
                           nsIContentViewer** aContentViewer);
@@ -42,7 +42,7 @@ public:
                              nsIChannel* aChannel,
                              nsILoadGroup* aLoadGroup,
                              const char* aContentType,
-                             nsISupports* aContainer,
+                             nsIDocShell* aContainer,
                              nsISupports* aExtraInfo,
                              nsIStreamListener** aDocListener,
                              nsIContentViewer** aContentViewer);
diff --git a/layout/generic/nsSubDocumentFrame.cpp b/layout/generic/nsSubDocumentFrame.cpp
index d75992b0a1a4..3dfa4c59e59f 100644
--- a/layout/generic/nsSubDocumentFrame.cpp
+++ b/layout/generic/nsSubDocumentFrame.cpp
@@ -981,8 +981,7 @@ EndSwapDocShellsForDocument(nsIDocument* aDocument, void*)
   // Our docshell and view trees have been updated for the new hierarchy.
   // Now also update all nsDeviceContext::mWidget to that of the
   // container view in the new hierarchy.
-  nsCOMPtr<nsISupports> container = aDocument->GetContainer();
-  nsCOMPtr<nsIDocShell> ds = do_QueryInterface(container);
+  nsCOMPtr<nsIDocShell> ds = aDocument->GetDocShell();
   if (ds) {
     nsCOMPtr<nsIContentViewer> cv;
     ds->GetContentViewer(getter_AddRefs(cv));
diff --git a/layout/inspector/tests/test_bug462787.html b/layout/inspector/tests/test_bug462787.html
index 7f5ccd099a62..88c5c466f64a 100644
--- a/layout/inspector/tests/test_bug462787.html
+++ b/layout/inspector/tests/test_bug462787.html
@@ -20,7 +20,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=462787
 /** Test for Bug 462787 **/
 
 function do_test() {
-  const INVALID_POINTER = 0x80004003;
+  const INVALID_POINTER = SpecialPowers.Cr.NS_ERROR_INVALID_POINTER;
 
   var utils = SpecialPowers.Cc["@mozilla.org/inspector/dom-utils;1"]
                              .getService(SpecialPowers.Ci.inIDOMUtils);
diff --git a/layout/ipc/RenderFrameParent.h b/layout/ipc/RenderFrameParent.h
index c5dd72de166b..f06ee52fba2f 100644
--- a/layout/ipc/RenderFrameParent.h
+++ b/layout/ipc/RenderFrameParent.h
@@ -221,6 +221,12 @@ public:
 
   NS_DISPLAY_DECL_NAME("Remote", TYPE_REMOTE)
 
+  virtual nsRegion GetOpaqueRegion(nsDisplayListBuilder* aBuilder,
+                                   bool* aSnap)
+  {
+    return GetBounds(aBuilder, aSnap);
+  }
+
 private:
   RenderFrameParent* mRemoteFrame;
 };
diff --git a/layout/printing/nsPrintEngine.cpp b/layout/printing/nsPrintEngine.cpp
index f789c0f38785..31445e87face 100644
--- a/layout/printing/nsPrintEngine.cpp
+++ b/layout/printing/nsPrintEngine.cpp
@@ -293,7 +293,7 @@ void nsPrintEngine::DestroyPrintingData()
 
 //--------------------------------------------------------
 nsresult nsPrintEngine::Initialize(nsIDocumentViewerPrint* aDocViewerPrint, 
-                                   nsIWeakReference*       aContainer,
+                                   nsIDocShell*            aContainer,
                                    nsIDocument*            aDocument,
                                    float                   aScreenDPI,
                                    FILE*                   aDebugFile)
@@ -303,7 +303,7 @@ nsresult nsPrintEngine::Initialize(nsIDocumentViewerPrint* aDocViewerPrint,
   NS_ENSURE_ARG_POINTER(aDocument);
 
   mDocViewerPrint = aDocViewerPrint;
-  mContainer      = aContainer;
+  mContainer      = do_GetWeakReference(aContainer);
   mDocument       = aDocument;
   mScreenDPI      = aScreenDPI;
 
@@ -1335,8 +1335,7 @@ nsPrintEngine::MapContentForPO(nsPrintObject*   aPO,
   nsIDocument* subDoc = doc->GetSubDocumentFor(aContent);
 
   if (subDoc) {
-    nsCOMPtr<nsISupports> container = subDoc->GetContainer();
-    nsCOMPtr<nsIDocShell> docShell(do_QueryInterface(container));
+    nsCOMPtr<nsIDocShell> docShell(subDoc->GetDocShell());
 
     if (docShell) {
       nsPrintObject * po = nullptr;
diff --git a/layout/printing/nsPrintEngine.h b/layout/printing/nsPrintEngine.h
index 14e1680477ee..ec1b5c5daec8 100644
--- a/layout/printing/nsPrintEngine.h
+++ b/layout/printing/nsPrintEngine.h
@@ -82,7 +82,7 @@ public:
   void DestroyPrintingData();
 
   nsresult Initialize(nsIDocumentViewerPrint* aDocViewerPrint, 
-                      nsIWeakReference*       aContainer,
+                      nsIDocShell*            aContainer,
                       nsIDocument*            aDocument,
                       float                   aScreenDPI,
                       FILE*                   aDebugFile);
diff --git a/layout/reftests/bugs/935056-1-ref.html b/layout/reftests/bugs/935056-1-ref.html
deleted file mode 100644
index 94cacf33bfc7..000000000000
--- a/layout/reftests/bugs/935056-1-ref.html
+++ /dev/null
@@ -1,10 +0,0 @@
-<!DOCTYPE html>
-<meta charset=utf-8>
-<style>
-p { font: 32px serif; }
-text { font: 16px serif; }
-</style>
-<p>This text should be affected by the minimum font size.</p>
-<svg width="800" height="40">
-  <text x="10" y="20">This text should not be affected by the minimum font size.</text>
-</svg>
diff --git a/layout/reftests/bugs/935056-1.html b/layout/reftests/bugs/935056-1.html
deleted file mode 100644
index 940624deda6c..000000000000
--- a/layout/reftests/bugs/935056-1.html
+++ /dev/null
@@ -1,9 +0,0 @@
-<!DOCTYPE html>
-<meta charset=utf-8>
-<style>
-p, text { font: 16px serif; }
-</style>
-<p>This text should be affected by the minimum font size.</p>
-<svg width="800" height="40">
-  <text x="10" y="20">This text should not be affected by the minimum font size.</text>
-</svg>
diff --git a/layout/reftests/bugs/reftest.list b/layout/reftests/bugs/reftest.list
index b1a108dcf8b3..c3d7a62e454c 100644
--- a/layout/reftests/bugs/reftest.list
+++ b/layout/reftests/bugs/reftest.list
@@ -1780,7 +1780,6 @@ fuzzy(1,10000) fuzzy-if(Android&&AndroidVersion>=15,5,10000) == 902330-1.html 90
 fuzzy-if(Android,8,400) == 906199-1.html 906199-1-ref.html
 == 921716-1.html 921716-1-ref.html
 fuzzy-if(cocoaWidget,1,40) == 928607-1.html 928607-1-ref.html
-test-pref(font.minimum-size.x-western,32) == 935056-1.html 935056-1-ref.html
 == 936670-1.svg 936670-1-ref.svg
 == 931853.html 931853-ref.html
 == 931853-quirks.html 931853-quirks-ref.html
diff --git a/layout/style/Loader.cpp b/layout/style/Loader.cpp
index b16afe4751e3..7e4de5d0972c 100644
--- a/layout/style/Loader.cpp
+++ b/layout/style/Loader.cpp
@@ -48,6 +48,7 @@
 #include "nsIThreadInternal.h"
 #include "nsCrossSiteListenerProxy.h"
 #include "nsINetworkSeer.h"
+#include "mozilla/dom/URL.h"
 
 #ifdef MOZ_XUL
 #include "nsXULPrototypeCache.h"
@@ -942,16 +943,6 @@ SheetLoadData::OnStreamComplete(nsIUnicharStreamLoader* aLoader,
   return result;
 }
 
-#ifdef MOZ_XUL
-static bool IsChromeURI(nsIURI* aURI)
-{
-  NS_ASSERTION(aURI, "Have to pass in a URI");
-  bool isChrome = false;
-  aURI->SchemeIs("chrome", &isChrome);
-  return isChrome;
-}
-#endif
-
 bool
 Loader::IsAlternate(const nsAString& aTitle, bool aHasAlternateRel)
 {
diff --git a/layout/style/nsCSSParser.cpp b/layout/style/nsCSSParser.cpp
index 6ee5359d85c9..92227cd7ab57 100644
--- a/layout/style/nsCSSParser.cpp
+++ b/layout/style/nsCSSParser.cpp
@@ -8525,6 +8525,16 @@ CSSParserImpl::ParseCounterData(nsCSSProperty aPropID)
 
     nsCSSValuePairList *cur = value.SetPairListValue();
     for (;;) {
+      // check for "none", "default" and the CSS-wide keywords,
+      // which can't be used as counter names
+      nsCSSKeyword keyword = nsCSSKeywords::LookupKeyword(mToken.mIdent);
+      if (keyword == eCSSKeyword_inherit ||
+          keyword == eCSSKeyword_default ||
+          keyword == eCSSKeyword_none ||
+          keyword == eCSSKeyword_unset ||
+          keyword == eCSSKeyword_initial) {
+        return false;
+      }
       cur->mXValue.SetStringValue(mToken.mIdent, eCSSUnit_Ident);
       if (!GetToken(true)) {
         break;
diff --git a/layout/style/nsComputedDOMStyle.cpp b/layout/style/nsComputedDOMStyle.cpp
index 8ccf84b82c17..5a121ece5a2b 100644
--- a/layout/style/nsComputedDOMStyle.cpp
+++ b/layout/style/nsComputedDOMStyle.cpp
@@ -672,10 +672,15 @@ nsComputedDOMStyle::GetPropertyCSSValue(const nsAString& aPropertyName, ErrorRes
       while (topWithPseudoElementData->GetParent()->HasPseudoElementData()) {
         topWithPseudoElementData = topWithPseudoElementData->GetParent();
       }
-      NS_ASSERTION(nsCSSPseudoElements::PseudoElementContainsElements(
-                     topWithPseudoElementData->GetPseudoType()),
-                   "we should be in a pseudo-element that is expected to "
-                   "contain elements");
+      nsCSSPseudoElements::Type pseudo =
+        topWithPseudoElementData->GetPseudoType();
+      nsIAtom* pseudoAtom = nsCSSPseudoElements::GetPseudoAtom(pseudo);
+      nsAutoString assertMsg(
+        NS_LITERAL_STRING("we should be in a pseudo-element that is expected to contain elements ("));
+      assertMsg.Append(nsDependentString(pseudoAtom->GetUTF16String()));
+      assertMsg.Append(NS_LITERAL_STRING(")"));
+      NS_ASSERTION(nsCSSPseudoElements::PseudoElementContainsElements(pseudo),
+                   NS_LossyConvertUTF16toASCII(assertMsg).get());
     }
 #endif
     // Need to resolve a style context
diff --git a/layout/style/nsFontFaceLoader.cpp b/layout/style/nsFontFaceLoader.cpp
index a5a043c09acf..bbd7ddbdf805 100644
--- a/layout/style/nsFontFaceLoader.cpp
+++ b/layout/style/nsFontFaceLoader.cpp
@@ -876,15 +876,13 @@ nsUserFontSet::CheckFontLoad(const gfxFontFaceSrc* aFontFaceSrc,
   }
 
   *aBypassCache = false;
-  nsCOMPtr<nsISupports> container = ps->GetDocument()->GetContainer();
-  if (container) {
-    nsCOMPtr<nsIDocShell> docShell = do_QueryInterface(container);
-    if (docShell) {
-      uint32_t loadType;
-      if (NS_SUCCEEDED(docShell->GetLoadType(&loadType))) {
-        if ((loadType >> 16) & nsIWebNavigation::LOAD_FLAGS_BYPASS_CACHE) {
-          *aBypassCache = true;
-        }
+
+  nsCOMPtr<nsIDocShell> docShell = ps->GetDocument()->GetDocShell();
+  if (docShell) {
+    uint32_t loadType;
+    if (NS_SUCCEEDED(docShell->GetLoadType(&loadType))) {
+      if ((loadType >> 16) & nsIWebNavigation::LOAD_FLAGS_BYPASS_CACHE) {
+        *aBypassCache = true;
       }
     }
   }
@@ -982,11 +980,6 @@ nsUserFontSet::GetPrivateBrowsing()
     return false;
   }
 
-  nsCOMPtr<nsISupports> container = ps->GetDocument()->GetContainer();
-  if (!container) {
-    return false;
-  }
-
-  nsCOMPtr<nsILoadContext> loadContext = do_QueryInterface(container);
+  nsCOMPtr<nsILoadContext> loadContext = ps->GetDocument()->GetLoadContext();
   return loadContext && loadContext->UsePrivateBrowsing();
 }
diff --git a/layout/style/nsROCSSPrimitiveValue.cpp b/layout/style/nsROCSSPrimitiveValue.cpp
index ec5dc4df2db2..1380eb6b3399 100644
--- a/layout/style/nsROCSSPrimitiveValue.cpp
+++ b/layout/style/nsROCSSPrimitiveValue.cpp
@@ -89,7 +89,7 @@ nsROCSSPrimitiveValue::GetCssText(nsAString& aCssText)
     case CSS_PX :
       {
         float val = nsPresContext::AppUnitsToFloatCSSPixels(mValue.mAppUnits);
-        tmpStr.AppendFloat(val);
+        nsStyleUtil::AppendCSSNumber(val, tmpStr);
         tmpStr.AppendLiteral("px");
         break;
       }
@@ -133,36 +133,36 @@ nsROCSSPrimitiveValue::GetCssText(nsAString& aCssText)
       }
     case CSS_PERCENTAGE :
       {
-        tmpStr.AppendFloat(mValue.mFloat * 100);
+        nsStyleUtil::AppendCSSNumber(mValue.mFloat * 100, tmpStr);
         tmpStr.Append(PRUnichar('%'));
         break;
       }
     case CSS_NUMBER :
       {
-        tmpStr.AppendFloat(mValue.mFloat);
+        nsStyleUtil::AppendCSSNumber(mValue.mFloat, tmpStr);
         break;
       }
     case CSS_DEG :
       {
-        tmpStr.AppendFloat(mValue.mFloat);
+        nsStyleUtil::AppendCSSNumber(mValue.mFloat, tmpStr);
         tmpStr.AppendLiteral("deg");
         break;
       }
     case CSS_GRAD :
       {
-        tmpStr.AppendFloat(mValue.mFloat);
+        nsStyleUtil::AppendCSSNumber(mValue.mFloat, tmpStr);
         tmpStr.AppendLiteral("grad");
         break;
       }
     case CSS_RAD :
       {
-        tmpStr.AppendFloat(mValue.mFloat);
+        nsStyleUtil::AppendCSSNumber(mValue.mFloat, tmpStr);
         tmpStr.AppendLiteral("rad");
         break;
       }
     case CSS_TURN :
       {
-        tmpStr.AppendFloat(mValue.mFloat);
+        nsStyleUtil::AppendCSSNumber(mValue.mFloat, tmpStr);
         tmpStr.AppendLiteral("turn");
         break;
       }
@@ -250,7 +250,7 @@ nsROCSSPrimitiveValue::GetCssText(nsAString& aCssText)
       }
     case CSS_S :
       {
-        tmpStr.AppendFloat(mValue.mFloat);
+        nsStyleUtil::AppendCSSNumber(mValue.mFloat, tmpStr);
         tmpStr.AppendLiteral("s");
         break;
       }
diff --git a/layout/style/nsRuleNode.cpp b/layout/style/nsRuleNode.cpp
index 9d95887bd0c9..9734ab94918a 100644
--- a/layout/style/nsRuleNode.cpp
+++ b/layout/style/nsRuleNode.cpp
@@ -3554,15 +3554,9 @@ nsRuleNode::SetFont(nsPresContext* aPresContext, nsStyleContext* aContext,
 
   nscoord fontSize = aFont->mSize;
 
-  // Enforce the user's specified minimum font-size on the value that we
-  // expose (but don't change font-size:0, since that would unhide hidden
-  // text).
-  //
-  // We don't do this for SVG text, which we can tell from the value of
-  // -x-text-zoom.  It's safe to look at mAllowZoom on this style struct
-  // we're computing, since we know -x-text-zoom is only ever specified
-  // on an <svg:text> element and is inherited otherwise.
-  if (fontSize > 0 && aFont->mAllowZoom) {
+  // enforce the user' specified minimum font-size on the value that we expose
+  // (but don't change font-size:0, since that would unhide hidden text)
+  if (fontSize > 0) {
     nscoord minFontSize = aPresContext->MinFontSize(aFont->mLanguage);
     if (minFontSize < 0) {
       minFontSize = 0;
diff --git a/layout/style/nsStyleUtil.cpp b/layout/style/nsStyleUtil.cpp
index faa268f238fe..a3045156871c 100644
--- a/layout/style/nsStyleUtil.cpp
+++ b/layout/style/nsStyleUtil.cpp
@@ -163,13 +163,8 @@ nsStyleUtil::AppendAngleValue(const nsStyleCoord& aAngle, nsAString& aResult)
 {
   MOZ_ASSERT(aAngle.IsAngleValue(), "Should have angle value");
 
-  nsROCSSPrimitiveValue tmpVal;
-  nsAutoString tokenString;
-
   // Append number.
-  tmpVal.SetNumber(aAngle.GetAngleValue());
-  tmpVal.GetCssText(tokenString);
-  aResult.Append(tokenString);
+  AppendCSSNumber(aAngle.GetAngleValue(), aResult);
 
   // Append unit.
   switch (aAngle.GetUnit()) {
diff --git a/layout/style/nsStyleUtil.h b/layout/style/nsStyleUtil.h
index 8e0aa3b3b02f..ebf172ce5fbb 100644
--- a/layout/style/nsStyleUtil.h
+++ b/layout/style/nsStyleUtil.h
@@ -57,6 +57,11 @@ public:
   static void AppendFontFeatureSettings(const nsCSSValue& src,
                                         nsAString& aResult);
 
+  static void AppendCSSNumber(float aNumber, nsAString& aResult)
+  {
+    aResult.AppendFloat(aNumber);
+  }
+
   // convert bitmask value to keyword name for a functional alternate
   static void GetFunctionalAlternatesName(int32_t aFeature,
                                           nsAString& aFeatureName);
diff --git a/layout/style/test/property_database.js b/layout/style/test/property_database.js
index 91d8e897ebb3..97de06a1964c 100644
--- a/layout/style/test/property_database.js
+++ b/layout/style/test/property_database.js
@@ -2321,7 +2321,7 @@ var gCSSProperties = {
 		type: CSS_TYPE_LONGHAND,
 		initial_values: [ "none" ],
 		other_values: [ "foo 1", "bar", "foo 3 bar baz 2", "\\32  1", "-\\32  1", "-c 1", "\\32 1", "-\\32 1", "\\2  1", "-\\2  1", "-c 1", "\\2 1", "-\\2 1", "-\\7f \\9e 1" ],
-		invalid_values: []
+		invalid_values: [ "none foo", "none foo 3", "foo none", "foo 3 none" ]
 	},
 	"counter-reset": {
 		domProp: "counterReset",
@@ -2329,7 +2329,7 @@ var gCSSProperties = {
 		type: CSS_TYPE_LONGHAND,
 		initial_values: [ "none" ],
 		other_values: [ "foo 1", "bar", "foo 3 bar baz 2", "\\32  1", "-\\32  1", "-c 1", "\\32 1", "-\\32 1", "\\2  1", "-\\2  1", "-c 1", "\\2 1", "-\\2 1", "-\\7f \\9e 1" ],
-		invalid_values: []
+		invalid_values: [ "none foo", "none foo 3", "foo none", "foo 3 none" ]
 	},
 	"cursor": {
 		domProp: "cursor",
diff --git a/layout/xul/base/src/nsContainerBoxObject.cpp b/layout/xul/base/src/nsContainerBoxObject.cpp
index 2e5e1aa43870..9bcac0236ff0 100644
--- a/layout/xul/base/src/nsContainerBoxObject.cpp
+++ b/layout/xul/base/src/nsContainerBoxObject.cpp
@@ -80,13 +80,8 @@ NS_IMETHODIMP nsContainerBoxObject::GetDocShell(nsIDocShell** aResult)
     return NS_OK;
   }
 
-  nsCOMPtr<nsISupports> container = sub_doc->GetContainer();
-
-  if (!container) {
-    return NS_OK;
-  }
-
-  return CallQueryInterface(container, aResult);
+  NS_IF_ADDREF(*aResult = sub_doc->GetDocShell());
+  return NS_OK;
 }
 
 nsresult
diff --git a/layout/xul/base/src/nsXULPopupManager.cpp b/layout/xul/base/src/nsXULPopupManager.cpp
index 919e7711c535..e666547c46d3 100644
--- a/layout/xul/base/src/nsXULPopupManager.cpp
+++ b/layout/xul/base/src/nsXULPopupManager.cpp
@@ -1061,8 +1061,7 @@ nsXULPopupManager::HidePopupsInList(const nsTArray<nsMenuPopupFrame *> &aFrames,
 bool
 nsXULPopupManager::IsChildOfDocShell(nsIDocument* aDoc, nsIDocShellTreeItem* aExpected)
 {
-  nsCOMPtr<nsISupports> doc = aDoc->GetContainer();
-  nsCOMPtr<nsIDocShellTreeItem> docShellItem(do_QueryInterface(doc));
+  nsCOMPtr<nsIDocShellTreeItem> docShellItem(aDoc->GetDocShell());
   while(docShellItem) {
     if (docShellItem == aExpected)
       return true;
diff --git a/media/libcubeb/README_MOZILLA b/media/libcubeb/README_MOZILLA
index 1ce67e883d8b..28678f96ed46 100644
--- a/media/libcubeb/README_MOZILLA
+++ b/media/libcubeb/README_MOZILLA
@@ -5,4 +5,4 @@ Makefile.in build files for the Mozilla build system.
 
 The cubeb git repository is: git://github.com/kinetiknz/cubeb.git
 
-The git commit ID used was 93e51e70e978420c745ec22503fa8e121cbb7aa5.
+The git commit ID used was 8c78a282aa0320e997436d6832024efe1527ca1c.
diff --git a/media/libcubeb/src/cubeb_pulse.c b/media/libcubeb/src/cubeb_pulse.c
index f02b235704d2..217e13be2e05 100644
--- a/media/libcubeb/src/cubeb_pulse.c
+++ b/media/libcubeb/src/cubeb_pulse.c
@@ -452,7 +452,6 @@ pulse_stream_init(cubeb * context, cubeb_stream ** stream, char const * stream_n
   cubeb_stream * stm;
   pa_operation * o;
   pa_buffer_attr battr;
-  pa_channel_map map;
   int r;
 
   assert(context);
@@ -479,9 +478,6 @@ pulse_stream_init(cubeb * context, cubeb_stream ** stream, char const * stream_n
   ss.rate = stream_params.rate;
   ss.channels = stream_params.channels;
 
-  /* XXX check that this does the right thing for Vorbis and WaveEx */
-  WRAP(pa_channel_map_init_auto)(&map, ss.channels, PA_CHANNEL_MAP_DEFAULT);
-
   stm = calloc(1, sizeof(*stm));
   assert(stm);
 
@@ -500,7 +496,11 @@ pulse_stream_init(cubeb * context, cubeb_stream ** stream, char const * stream_n
   battr.fragsize = -1;
 
   WRAP(pa_threaded_mainloop_lock)(stm->context->mainloop);
-  stm->stream = WRAP(pa_stream_new)(stm->context->context, stream_name, &ss, &map);
+  stm->stream = WRAP(pa_stream_new)(stm->context->context, stream_name, &ss, NULL);
+  if (!stm->stream) {
+    pulse_stream_destroy(stm);
+    return CUBEB_ERROR;
+  }
   WRAP(pa_stream_set_state_callback)(stm->stream, stream_state_callback, stm);
   WRAP(pa_stream_set_write_callback)(stm->stream, stream_request_callback, stm);
   WRAP(pa_stream_connect_playback)(stm->stream, NULL, &battr,
diff --git a/media/libnestegg/README_MOZILLA b/media/libnestegg/README_MOZILLA
index ecfdfe06cc44..17dafbb5a27f 100644
--- a/media/libnestegg/README_MOZILLA
+++ b/media/libnestegg/README_MOZILLA
@@ -5,4 +5,4 @@ Makefile.in build files for the Mozilla build system.
 
 The nestegg git repository is: git://github.com/kinetiknz/nestegg.git
 
-The git commit ID used was 26d262114af191b6654cbd5d24ec02e4b6bdb1cd.
+The git commit ID used was 0851279ab11f5b2e9e8154ce7880b687b564c760.
diff --git a/media/libnestegg/include/nestegg.h b/media/libnestegg/include/nestegg.h
index 6f307aa398bf..ff13728f32a3 100644
--- a/media/libnestegg/include/nestegg.h
+++ b/media/libnestegg/include/nestegg.h
@@ -140,6 +140,8 @@ typedef struct {
   double rate;           /**< Sampling rate in Hz. */
   unsigned int channels; /**< Number of audio channels. */
   unsigned int depth;    /**< Bits per sample. */
+  uint64_t  codec_delay; /**< Nanoseconds that must be discarded from the start. */
+  uint64_t  seek_preroll;/**< Nanoseconds that must be discarded after a seek. */
 } nestegg_audio_params;
 
 /** Logging callback function pointer. */
@@ -321,6 +323,14 @@ int nestegg_packet_count(nestegg_packet * packet, unsigned int * count);
 int nestegg_packet_data(nestegg_packet * packet, unsigned int item,
                         unsigned char ** data, size_t * length);
 
+/** Returns discard_padding for given packet
+    @param packet  Packet initialized by #nestegg_read_packet.
+    @param discard_padding pointer to store discard padding in.
+    @retval  0 Success.
+    @retval -1 Error. */
+int nestegg_packet_discard_padding(nestegg_packet * packet,
+                                   int64_t * discard_padding);
+
 /** Query the presence of cues.
     @param context  Stream context initialized by #nestegg_init.
     @retval 0 The media has no cues.
diff --git a/media/libnestegg/src/nestegg.c b/media/libnestegg/src/nestegg.c
index b3bc9cb6dd0c..cd609c9e7b62 100644
--- a/media/libnestegg/src/nestegg.c
+++ b/media/libnestegg/src/nestegg.c
@@ -49,6 +49,7 @@
 #define ID_BLOCK                0xa1
 #define ID_BLOCK_DURATION       0x9b
 #define ID_REFERENCE_BLOCK      0xfb
+#define ID_DISCARD_PADDING      0x75a2
 
 /* Tracks Elements */
 #define ID_TRACKS               0x1654ae6b
@@ -63,6 +64,8 @@
 #define ID_LANGUAGE             0x22b59c
 #define ID_CODEC_ID             0x86
 #define ID_CODEC_PRIVATE        0x63a2
+#define ID_CODEC_DELAY          0x56aa
+#define ID_SEEK_PREROLL         0x56bb
 
 /* Video Elements */
 #define ID_VIDEO                0xe0
@@ -194,6 +197,7 @@ struct info {
 struct block_group {
   struct ebml_type duration;
   struct ebml_type reference_block;
+  struct ebml_type discard_padding;
 };
 
 struct cluster {
@@ -230,6 +234,8 @@ struct track_entry {
   struct ebml_type language;
   struct ebml_type codec_id;
   struct ebml_type codec_private;
+  struct ebml_type codec_delay;
+  struct ebml_type seek_preroll;
   struct video video;
   struct audio audio;
 };
@@ -305,6 +311,7 @@ struct nestegg_packet {
   uint64_t track;
   uint64_t timecode;
   struct frame * frame;
+  int64_t discard_padding;
 };
 
 /* Element Descriptor */
@@ -368,6 +375,7 @@ static struct ebml_element_desc ne_block_group_elements[] = {
   E_SUSPEND(ID_BLOCK, TYPE_BINARY),
   E_FIELD(ID_BLOCK_DURATION, TYPE_UINT, struct block_group, duration),
   E_FIELD(ID_REFERENCE_BLOCK, TYPE_INT, struct block_group, reference_block),
+  E_FIELD(ID_DISCARD_PADDING, TYPE_INT, struct block_group, discard_padding),
   E_LAST
 };
 
@@ -409,6 +417,8 @@ static struct ebml_element_desc ne_track_entry_elements[] = {
   E_FIELD(ID_LANGUAGE, TYPE_STRING, struct track_entry, language),
   E_FIELD(ID_CODEC_ID, TYPE_STRING, struct track_entry, codec_id),
   E_FIELD(ID_CODEC_PRIVATE, TYPE_BINARY, struct track_entry, codec_private),
+  E_FIELD(ID_CODEC_DELAY, TYPE_UINT, struct track_entry, codec_delay),
+  E_FIELD(ID_SEEK_PREROLL, TYPE_UINT, struct track_entry, seek_preroll),
   E_SINGLE_MASTER(ID_VIDEO, TYPE_MASTER, struct track_entry, video),
   E_SINGLE_MASTER(ID_AUDIO, TYPE_MASTER, struct track_entry, audio),
   E_LAST
@@ -1365,6 +1375,35 @@ ne_read_block(nestegg * ctx, uint64_t block_id, uint64_t block_size, nestegg_pac
   return 1;
 }
 
+static int
+ne_read_discard_padding(nestegg * ctx, nestegg_packet * pkt)
+{
+  int r;
+  uint64_t id, size;
+  struct ebml_element_desc * element;
+  struct ebml_type * storage;
+
+  r = ne_peek_element(ctx, &id, &size);
+  if (r != 1)
+    return r;
+
+  if (id != ID_DISCARD_PADDING)
+    return 1;
+
+  element = ne_find_element(id, ctx->ancestor->node);
+  if (!element)
+    return 1;
+
+  r = ne_read_simple(ctx, element, size);
+  if (r != 1)
+    return r;
+  storage = (struct ebml_type *) (ctx->ancestor->data + element->offset);
+  pkt->discard_padding = storage->v.i;
+
+  return 1;
+}
+
+
 static uint64_t
 ne_buf_read_id(unsigned char const * p, size_t length)
 {
@@ -1994,34 +2033,40 @@ nestegg_track_codec_data(nestegg * ctx, unsigned int track, unsigned int item,
   if (!entry)
     return -1;
 
-  if (nestegg_track_codec_id(ctx, track) != NESTEGG_CODEC_VORBIS)
+  if (nestegg_track_codec_id(ctx, track) != NESTEGG_CODEC_VORBIS
+    && nestegg_track_codec_id(ctx, track) != NESTEGG_CODEC_OPUS)
     return -1;
 
   if (ne_get_binary(entry->codec_private, &codec_private) != 0)
     return -1;
 
-  p = codec_private.data;
-  count = *p++ + 1;
+  if (nestegg_track_codec_id(ctx, track) == NESTEGG_CODEC_VORBIS) {
+      p = codec_private.data;
+      count = *p++ + 1;
 
-  if (count > 3)
-    return -1;
+      if (count > 3)
+        return -1;
 
-  i = 0;
-  total = 0;
-  while (--count) {
-    sizes[i] = ne_xiph_lace_value(&p);
-    total += sizes[i];
-    i += 1;
+      i = 0;
+      total = 0;
+      while (--count) {
+        sizes[i] = ne_xiph_lace_value(&p);
+        total += sizes[i];
+        i += 1;
+      }
+      sizes[i] = codec_private.length - total - (p - codec_private.data);
+
+      for (i = 0; i < item; ++i) {
+        if (sizes[i] > LIMIT_FRAME)
+          return -1;
+        p += sizes[i];
+      }
+      *data = p;
+      *length = sizes[item];
+  } else {
+    *data = codec_private.data;
+    *length = codec_private.length;
   }
-  sizes[i] = codec_private.length - total - (p - codec_private.data);
-
-  for (i = 0; i < item; ++i) {
-    if (sizes[i] > LIMIT_FRAME)
-      return -1;
-    p += sizes[i];
-  }
-  *data = p;
-  *length = sizes[item];
 
   return 0;
 }
@@ -2110,6 +2155,14 @@ nestegg_track_audio_params(nestegg * ctx, unsigned int track,
   ne_get_uint(entry->audio.bit_depth, &value);
   params->depth = value;
 
+  value = 0;
+  ne_get_uint(entry->codec_delay, &value);
+  params->codec_delay = value;
+
+  value = 0;
+  ne_get_uint(entry->seek_preroll, &value);
+  params->seek_preroll = value;
+
   return 0;
 }
 
@@ -2135,6 +2188,13 @@ nestegg_read_packet(nestegg * ctx, nestegg_packet ** pkt)
       /* The only DESC_FLAG_SUSPEND fields are Blocks and SimpleBlocks, which we
          handle directly. */
       r = ne_read_block(ctx, id, size, pkt);
+      if (r != 1)
+        return r;
+
+      r = ne_read_discard_padding(ctx, *pkt);
+      if (r != 1)
+        return r;
+
       return r;
     }
 
@@ -2175,6 +2235,13 @@ nestegg_packet_tstamp(nestegg_packet * pkt, uint64_t * tstamp)
   return 0;
 }
 
+int
+nestegg_packet_discard_padding(nestegg_packet * pkt, int64_t * discard_padding)
+{
+  *discard_padding = pkt->discard_padding;
+  return 0;
+}
+
 int
 nestegg_packet_count(nestegg_packet * pkt, unsigned int * count)
 {
diff --git a/media/mtransport/nricectx.cpp b/media/mtransport/nricectx.cpp
index 6efdb175c633..e3bb621110d5 100644
--- a/media/mtransport/nricectx.cpp
+++ b/media/mtransport/nricectx.cpp
@@ -675,7 +675,7 @@ void NrIceCtx::SetState(State state) {
   if (state == state_)
     return;
 
-  MOZ_MTLOG(ML_DEBUG, "NrIceCtx(" << name_ << "): state " <<
+  MOZ_MTLOG(ML_INFO, "NrIceCtx(" << name_ << "): state " <<
             state_ << "->" << state);
   state_ = state;
 
diff --git a/memory/build/moz.build b/memory/build/moz.build
index f933a886a9c4..034f261adfef 100644
--- a/memory/build/moz.build
+++ b/memory/build/moz.build
@@ -14,18 +14,18 @@ if CONFIG['MOZ_REPLACE_MALLOC']:
         'malloc_decls.h',
         'replace_malloc.h',
     ]
-SOURCES += [
+UNIFIED_SOURCES += [
     'jemalloc_config.c',
     'mozmemory_wrap.c',
 ]
 
 if CONFIG['MOZ_JEMALLOC3']:
-    SOURCES += [
+    UNIFIED_SOURCES += [
         'mozjemalloc_compat.c',
     ]
 
 if CONFIG['MOZ_REPLACE_MALLOC']:
-    SOURCES += [
+    UNIFIED_SOURCES += [
         'replace_malloc.c',
     ]
 
diff --git a/memory/jemalloc/moz.build b/memory/jemalloc/moz.build
index b40f981b4506..3e246c9fa326 100644
--- a/memory/jemalloc/moz.build
+++ b/memory/jemalloc/moz.build
@@ -4,7 +4,7 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'src/src/arena.c',
     'src/src/atomic.c',
     'src/src/base.c',
@@ -32,7 +32,7 @@ SOURCES += [
 # Only OSX needs the zone allocation implementation,
 # but only if replace-malloc is not enabled.
 if CONFIG['OS_TARGET'] == 'Darwin' and not CONFIG['MOZ_REPLACE_MALLOC']:
-    SOURCES += [
+    UNIFIED_SOURCES += [
         'src/src/zone.c',
     ]
 
diff --git a/memory/mozalloc/moz.build b/memory/mozalloc/moz.build
index 0f20f6d51ace..99cfff9630aa 100644
--- a/memory/mozalloc/moz.build
+++ b/memory/mozalloc/moz.build
@@ -32,7 +32,7 @@ if CONFIG['WRAP_STL_INCLUDES']:
                 'msvc_throw_wrapper.cpp',
             ]
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'mozalloc.cpp',
     'mozalloc_abort.cpp',
     'mozalloc_oom.cpp',
diff --git a/mobile/android/base/ANRReporter.java b/mobile/android/base/ANRReporter.java
index 8eaf69fa2654..05a87eec5ca1 100644
--- a/mobile/android/base/ANRReporter.java
+++ b/mobile/android/base/ANRReporter.java
@@ -29,8 +29,6 @@ import java.io.InputStreamReader;
 import java.io.OutputStream;
 import java.io.Reader;
 import java.io.StringReader;
-import java.security.GeneralSecurityException;
-import java.security.MessageDigest;
 import java.util.UUID;
 import java.util.regex.Pattern;
 
@@ -48,12 +46,8 @@ public final class ANRReporter extends BroadcastReceiver
     private static final int TRACES_LINE_SIZE = 100;
     // Size of block to use when processing traces.txt
     private static final int TRACES_BLOCK_SIZE = 2000;
-    // we use us-ascii here because when telemetry calculates checksum
-    // for the ping file, it lossily converts utf-16 to ascii. therefore,
-    // we have to treat characters in the traces file as ascii rather than
-    // say utf-8. otherwise, we will get a wrong checksum
-    private static final String TRACES_CHARSET = "us-ascii";
-    private static final String PING_CHARSET = "us-ascii";
+    private static final String TRACES_CHARSET = "utf-8";
+    private static final String PING_CHARSET = "utf-8";
 
     private static final ANRReporter sInstance = new ANRReporter();
     private static int sRegisteredCount;
@@ -266,11 +260,11 @@ public final class ANRReporter extends BroadcastReceiver
     /*
         a saved telemetry ping file consists of JSON in the following format,
             {
+                "reason": "android-anr-report",
                 "slug": "<uuid-string>",
-                "payload": "<escaped-json-data-string>",
-                "checksum": "<base64-sha-256-string>"
+                "payload": <json-object>
             }
-        for Android ANR, our unescaped JSON payload should look like,
+        for Android ANR, our JSON payload should look like,
             {
                 "ver": 1,
                 "simpleMeasurements": {
@@ -287,32 +281,27 @@ public final class ANRReporter extends BroadcastReceiver
     */
 
     private static int writePingPayload(OutputStream ping,
-                                        MessageDigest checksum,
                                         String payload) throws IOException {
-
         byte [] data = payload.getBytes(PING_CHARSET);
-        checksum.update(data);
-
-        data = JSONObject.quote(payload).getBytes(PING_CHARSET);
-        // first and last bytes are quotes inserted by JSONObject.quote; discard them
-        ping.write(data, 1, data.length - 2);
-        return data.length - 2;
+        ping.write(data);
+        return data.length;
     }
 
-    private static void fillPingHeader(OutputStream ping, MessageDigest checksum, String slug)
+    private static void fillPingHeader(OutputStream ping, String slug)
             throws IOException {
 
         // ping file header
         byte [] data = ("{" +
+            "\"reason\":\"android-anr-report\"," +
             "\"slug\":" + JSONObject.quote(slug) + "," +
-            "\"payload\":\"").getBytes(PING_CHARSET);
+            "\"payload\":").getBytes(PING_CHARSET);
         ping.write(data);
         if (DEBUG) {
             Log.d(LOGTAG, "wrote ping header, size = " + String.valueOf(data.length));
         }
 
         // payload start
-        int size = writePingPayload(ping, checksum, ("{" +
+        int size = writePingPayload(ping, ("{" +
             "\"ver\":1," +
             "\"simpleMeasurements\":{" +
                 "\"uptime\":" + String.valueOf(getUptimeMins()) +
@@ -392,9 +381,9 @@ public final class ANRReporter extends BroadcastReceiver
         return 0;
     }
 
-    // Copy the content of reader to ping and update checksum;
+    // Copy the content of reader to ping;
     // copying stops when endPattern is found in the input stream
-    private static int fillPingBlock(OutputStream ping, MessageDigest checksum,
+    private static int fillPingBlock(OutputStream ping,
                                      Reader reader, String endPattern)
             throws IOException {
 
@@ -409,7 +398,7 @@ public final class ANRReporter extends BroadcastReceiver
                 stringBlock = stringBlock.substring(0, endIndex);
             }
             String quoted = JSONObject.quote(stringBlock);
-            total += writePingPayload(ping, checksum, quoted.substring(1, quoted.length() - 1));
+            total += writePingPayload(ping, quoted.substring(1, quoted.length() - 1));
             if (endIndex > 0) {
                 // End pattern already found; return now
                 break;
@@ -418,13 +407,13 @@ public final class ANRReporter extends BroadcastReceiver
         return total;
     }
 
-    private static void fillPingFooter(OutputStream ping, MessageDigest checksum,
+    private static void fillPingFooter(OutputStream ping,
                                        boolean haveNativeStack)
             throws IOException {
 
         // We are at the end of ANR data
 
-        int total = writePingPayload(ping, checksum, ("\"," +
+        int total = writePingPayload(ping, ("\"," +
                 "\"androidLogcat\":\""));
 
         try {
@@ -435,7 +424,7 @@ public final class ANRReporter extends BroadcastReceiver
                 .start();
             try {
                 Reader procOut = new InputStreamReader(proc.getInputStream(), TRACES_CHARSET);
-                int size = fillPingBlock(ping, checksum, procOut, null);
+                int size = fillPingBlock(ping, procOut, null);
                 if (DEBUG) {
                     Log.d(LOGTAG, "wrote logcat, size = " + String.valueOf(size));
                 }
@@ -448,25 +437,20 @@ public final class ANRReporter extends BroadcastReceiver
         }
 
         if (haveNativeStack) {
-            total += writePingPayload(ping, checksum, ("\"," +
-                    "\"androidNativeStack\":\""));
+            total += writePingPayload(ping, ("\"," +
+                    "\"androidNativeStack\":"));
 
             String nativeStack = String.valueOf(getNativeStack());
-            int size = fillPingBlock(ping, checksum, new StringReader(nativeStack), null);
+            int size = writePingPayload(ping, nativeStack);
             if (DEBUG) {
                 Log.d(LOGTAG, "wrote native stack, size = " + String.valueOf(size));
             }
+            total += size + writePingPayload(ping, "}");
+        } else {
+            total += writePingPayload(ping, "\"}");
         }
 
-        total += writePingPayload(ping, checksum, "\"}");
-
-        String base64Checksum = Base64.encodeToString(checksum.digest(), Base64.NO_WRAP);
-        if (DEBUG) {
-            Log.d(LOGTAG, "checksum: " + base64Checksum);
-        }
         byte [] data = (
-                "\"," +
-                "\"checksum\":" + JSONObject.quote(base64Checksum) +
             "}").getBytes(PING_CHARSET);
         ping.write(data);
         if (DEBUG) {
@@ -481,8 +465,7 @@ public final class ANRReporter extends BroadcastReceiver
             OutputStream ping = new BufferedOutputStream(
                 new FileOutputStream(pingFile), TRACES_BLOCK_SIZE);
             try {
-                MessageDigest checksum = MessageDigest.getInstance("SHA-256");
-                fillPingHeader(ping, checksum, pingFile.getName());
+                fillPingHeader(ping, pingFile.getName());
                 // Traces file has the format
                 //    ----- pid xxx at xxx -----
                 //    Cmd line: org.mozilla.xxx
@@ -494,11 +477,11 @@ public final class ANRReporter extends BroadcastReceiver
                 //    ...
                 // If we end the stack dump at the first end marker,
                 // only Fennec stacks will be dumped
-                int size = fillPingBlock(ping, checksum, traces, "\n----- end");
+                int size = fillPingBlock(ping, traces, "\n----- end");
                 if (DEBUG) {
                     Log.d(LOGTAG, "wrote traces, size = " + String.valueOf(size));
                 }
-                fillPingFooter(ping, checksum, haveNativeStack);
+                fillPingFooter(ping, haveNativeStack);
                 if (DEBUG) {
                     Log.d(LOGTAG, "finished creating ping file");
                 }
@@ -509,8 +492,6 @@ public final class ANRReporter extends BroadcastReceiver
                     releaseNativeStack();
                 }
             }
-        } catch (GeneralSecurityException e) {
-            Log.w(LOGTAG, e);
         } catch (IOException e) {
             Log.w(LOGTAG, e);
         }
diff --git a/mobile/android/base/gfx/GLController.java b/mobile/android/base/gfx/GLController.java
index 274a98fe0fa7..780faa6d3244 100644
--- a/mobile/android/base/gfx/GLController.java
+++ b/mobile/android/base/gfx/GLController.java
@@ -153,6 +153,10 @@ public class GLController {
         return mServerSurfaceValid;
     }
 
+    public boolean isCompositorCreated() {
+        return mCompositorCreated;
+    }
+
     private void initEGL() {
         if (mEGL != null) {
             return;
diff --git a/mobile/android/base/gfx/LayerView.java b/mobile/android/base/gfx/LayerView.java
index cc4c7c3b7452..862c48f44cc8 100644
--- a/mobile/android/base/gfx/LayerView.java
+++ b/mobile/android/base/gfx/LayerView.java
@@ -520,8 +520,13 @@ public class LayerView extends FrameLayout implements Tabs.OnTabsChangedListener
      * TextureView instead of a SurfaceView, the first phase is skipped.
      */
     private void onSizeChanged(int width, int height) {
-        if (!mGLController.isServerSurfaceValid() || mSurfaceView == null) {
-            surfaceChanged(width, height);
+        if (!mGLController.isCompositorCreated()) {
+            return;
+        }
+
+        surfaceChanged(width, height);
+
+        if (mSurfaceView == null) {
             return;
         }
 
diff --git a/modules/libpref/src/init/all.js b/modules/libpref/src/init/all.js
index a410fdde3a65..cc4b791c6bbb 100644
--- a/modules/libpref/src/init/all.js
+++ b/modules/libpref/src/init/all.js
@@ -196,6 +196,17 @@ pref("media.windows-media-foundation.play-stand-alone", true);
 #ifdef MOZ_DIRECTSHOW
 pref("media.directshow.enabled", true);
 #endif
+#ifdef MOZ_FMP4
+pref("media.fragmented-mp4.enabled", true);
+// Denotes that the fragmented MP4 parser can be created by <video> elements.
+// This is for testing, since the parser can't yet handle non-fragmented MP4,
+// so it will fail to play most MP4 files.
+pref("media.fragmented-mp4.exposed", false);
+// Specifies whether the fragmented MP4 parser uses a test decoder that
+// just outputs blank frames/audio instead of actually decoding. The blank
+// decoder works on all platforms.
+pref("media.fragmented-mp4.use-blank-decoder", false);
+#endif
 #ifdef MOZ_RAW
 pref("media.raw.enabled", true);
 #endif
@@ -3407,8 +3418,8 @@ pref("font.alias-list", "sans,sans-serif,serif,monospace");
 // ar
 
 pref("font.name.serif.el", "Droid Serif");
-pref("font.name.sans-serif.el", "Fira Sans OT");
-pref("font.name.monospace.el", "Fira Mono OT");
+pref("font.name.sans-serif.el", "Roboto"); // To be updated once the Greek letters in Fira are revised
+pref("font.name.monospace.el", "Droid Sans Mono");
 
 pref("font.name.serif.he", "Charis SIL Compact");
 pref("font.name.sans-serif.he", "Fira Sans OT");
@@ -4374,6 +4385,9 @@ pref("dom.mozPermissionSettings.enabled", false);
 pref("dom.w3c_touch_events.enabled", 2);
 #endif
 
+// W3C draft pointer events
+pref("dom.w3c_pointer_events.enabled", false);
+
 // enable JS dump() function.
 pref("browser.dom.window.dump.enabled", false);
 
diff --git a/netwerk/base/src/Dashboard.cpp b/netwerk/base/src/Dashboard.cpp
index a482d1ab941a..fb4ecb0b229b 100644
--- a/netwerk/base/src/Dashboard.cpp
+++ b/netwerk/base/src/Dashboard.cpp
@@ -74,26 +74,14 @@ Dashboard::GetSockets()
     AutoSafeJSContext cx;
 
     mozilla::dom::SocketsDict dict;
-    dict.mHost.Construct();
-    dict.mPort.Construct();
-    dict.mActive.Construct();
-    dict.mTcp.Construct();
-    dict.mSocksent.Construct();
-    dict.mSockreceived.Construct();
+    dict.mSockets.Construct();
     dict.mSent = 0;
     dict.mReceived = 0;
 
-    Sequence<uint32_t> &ports = dict.mPort.Value();
-    Sequence<nsString> &hosts = dict.mHost.Value();
-    Sequence<bool> &active = dict.mActive.Value();
-    Sequence<uint32_t> &tcp = dict.mTcp.Value();
-    Sequence<double> &sent = dict.mSocksent.Value();
-    Sequence<double> &received = dict.mSockreceived.Value();
+    Sequence<mozilla::dom::SocketElement> &sockets = dict.mSockets.Value();
 
     uint32_t length = mSock.data.Length();
-    if (!ports.SetCapacity(length) || !hosts.SetCapacity(length) ||
-        !active.SetCapacity(length) || !tcp.SetCapacity(length) ||
-        !sent.SetCapacity(length) || !received.SetCapacity(length)) {
+    if (!sockets.SetCapacity(length)) {
             mSock.cb = nullptr;
             mSock.data.Clear();
             JS_ReportOutOfMemory(cx);
@@ -101,19 +89,19 @@ Dashboard::GetSockets()
     }
 
     for (uint32_t i = 0; i < mSock.data.Length(); i++) {
-        CopyASCIItoUTF16(mSock.data[i].host, *hosts.AppendElement());
-        *ports.AppendElement() = mSock.data[i].port;
-        *active.AppendElement() = mSock.data[i].active;
-        *tcp.AppendElement() = mSock.data[i].tcp;
-        *sent.AppendElement() = (double) mSock.data[i].sent;
-        *received.AppendElement() = (double) mSock.data[i].received;
+        mozilla::dom::SocketElement &socket = *sockets.AppendElement();
+        CopyASCIItoUTF16(mSock.data[i].host, socket.mHost);
+        socket.mPort = mSock.data[i].port;
+        socket.mActive = mSock.data[i].active;
+        socket.mTcp = mSock.data[i].tcp;
+        socket.mSent = (double) mSock.data[i].sent;
+        socket.mReceived = (double) mSock.data[i].received;
         dict.mSent += mSock.data[i].sent;
         dict.mReceived += mSock.data[i].received;
     }
 
     dict.mSent += mSock.totalSent;
     dict.mReceived += mSock.totalRecv;
-
     JS::RootedValue val(cx);
     if (!dict.ToObject(cx, JS::NullPtr(), &val)) {
         mSock.cb = nullptr;
@@ -155,29 +143,15 @@ Dashboard::GetHttpConnections()
     AutoSafeJSContext cx;
 
     mozilla::dom::HttpConnDict dict;
-    dict.mActive.Construct();
-    dict.mHost.Construct();
-    dict.mIdle.Construct();
-    dict.mPort.Construct();
-    dict.mSpdy.Construct();
-    dict.mSsl.Construct();
-    dict.mHalfOpens.Construct();
+    dict.mConnections.Construct();
 
-    using mozilla::dom::HttpConnInfoDict;
     using mozilla::dom::HalfOpenInfoDict;
-    Sequence<HttpConnInfoDict> &active = dict.mActive.Value();
-    Sequence<nsString> &hosts = dict.mHost.Value();
-    Sequence<HttpConnInfoDict> &idle = dict.mIdle.Value();
-    Sequence<HalfOpenInfoDict> &halfOpens = dict.mHalfOpens.Value();
-    Sequence<uint32_t> &ports = dict.mPort.Value();
-    Sequence<bool> &spdy = dict.mSpdy.Value();
-    Sequence<bool> &ssl = dict.mSsl.Value();
+    using mozilla::dom::HttpConnectionElement;
+    using mozilla::dom::HttpConnInfo;
+    Sequence<HttpConnectionElement> &connections = dict.mConnections.Value();
 
     uint32_t length = mHttp.data.Length();
-    if (!active.SetCapacity(length) || !hosts.SetCapacity(length) ||
-        !idle.SetCapacity(length) || !ports.SetCapacity(length) ||
-        !spdy.SetCapacity(length) || !ssl.SetCapacity(length) ||
-        !halfOpens.SetCapacity(length)) {
+    if (!connections.SetCapacity(length)) {
             mHttp.cb = nullptr;
             mHttp.data.Clear();
             JS_ReportOutOfMemory(cx);
@@ -185,64 +159,47 @@ Dashboard::GetHttpConnections()
     }
 
     for (uint32_t i = 0; i < mHttp.data.Length(); i++) {
-        CopyASCIItoUTF16(mHttp.data[i].host,*hosts.AppendElement());
-        *ports.AppendElement() = mHttp.data[i].port;
-        *spdy.AppendElement() = mHttp.data[i].spdy;
-        *ssl.AppendElement() = mHttp.data[i].ssl;
-        HttpConnInfoDict &activeInfo = *active.AppendElement();
-        activeInfo.mRtt.Construct();
-        activeInfo.mTtl.Construct();
-        activeInfo.mProtocolVersion.Construct();
-        Sequence<uint32_t> &active_rtt = activeInfo.mRtt.Value();
-        Sequence<uint32_t> &active_ttl = activeInfo.mTtl.Value();
-        Sequence<nsString> &active_protocolVersion = activeInfo.mProtocolVersion.Value();
-        if (!active_rtt.SetCapacity(mHttp.data[i].active.Length()) ||
-            !active_ttl.SetCapacity(mHttp.data[i].active.Length()) ||
-            !active_protocolVersion.SetCapacity(mHttp.data[i].active.Length())) {
+        HttpConnectionElement &connection = *connections.AppendElement();
+
+        CopyASCIItoUTF16(mHttp.data[i].host, connection.mHost);
+        connection.mPort = mHttp.data[i].port;
+        connection.mSpdy = mHttp.data[i].spdy;
+        connection.mSsl = mHttp.data[i].ssl;
+
+        connection.mActive.Construct();
+        connection.mIdle.Construct();
+        connection.mHalfOpens.Construct();
+
+        Sequence<HttpConnInfo> &active = connection.mActive.Value();
+        Sequence<HttpConnInfo> &idle = connection.mIdle.Value();
+        Sequence<HalfOpenInfoDict> &halfOpens = connection.mHalfOpens.Value();
+
+        if (!active.SetCapacity(mHttp.data[i].active.Length()) ||
+            !idle.SetCapacity(mHttp.data[i].idle.Length()) ||
+            !halfOpens.SetCapacity(mHttp.data[i].halfOpens.Length())) {
                 mHttp.cb = nullptr;
                 mHttp.data.Clear();
                 JS_ReportOutOfMemory(cx);
                 return NS_ERROR_OUT_OF_MEMORY;
         }
+
         for (uint32_t j = 0; j < mHttp.data[i].active.Length(); j++) {
-            *active_rtt.AppendElement() = mHttp.data[i].active[j].rtt;
-            *active_ttl.AppendElement() = mHttp.data[i].active[j].ttl;
-            *active_protocolVersion.AppendElement() = mHttp.data[i].active[j].protocolVersion;
+            HttpConnInfo &info = *active.AppendElement();
+            info.mRtt = mHttp.data[i].active[j].rtt;
+            info.mTtl = mHttp.data[i].active[j].ttl;
+            info.mProtocolVersion = mHttp.data[i].active[j].protocolVersion;
         }
 
-        HttpConnInfoDict &idleInfo = *idle.AppendElement();
-        idleInfo.mRtt.Construct();
-        idleInfo.mTtl.Construct();
-        idleInfo.mProtocolVersion.Construct();
-        Sequence<uint32_t> &idle_rtt = idleInfo.mRtt.Value();
-        Sequence<uint32_t> &idle_ttl = idleInfo.mTtl.Value();
-        Sequence<nsString> &idle_protocolVersion = idleInfo.mProtocolVersion.Value();
-        if (!idle_rtt.SetCapacity(mHttp.data[i].idle.Length()) ||
-            !idle_ttl.SetCapacity(mHttp.data[i].idle.Length()) ||
-            !idle_protocolVersion.SetCapacity(mHttp.data[i].idle.Length())) {
-                mHttp.cb = nullptr;
-                mHttp.data.Clear();
-                JS_ReportOutOfMemory(cx);
-                return NS_ERROR_OUT_OF_MEMORY;
-        }
         for (uint32_t j = 0; j < mHttp.data[i].idle.Length(); j++) {
-            *idle_rtt.AppendElement() = mHttp.data[i].idle[j].rtt;
-            *idle_ttl.AppendElement() = mHttp.data[i].idle[j].ttl;
-            *idle_protocolVersion.AppendElement() = mHttp.data[i].idle[j].protocolVersion;
+            HttpConnInfo &info = *idle.AppendElement();
+            info.mRtt = mHttp.data[i].idle[j].rtt;
+            info.mTtl = mHttp.data[i].idle[j].ttl;
+            info.mProtocolVersion = mHttp.data[i].idle[j].protocolVersion;
         }
 
-        HalfOpenInfoDict &allHalfOpens = *halfOpens.AppendElement();
-        allHalfOpens.mSpeculative.Construct();
-        Sequence<bool> allHalfOpens_speculative;
-        if(!allHalfOpens_speculative.SetCapacity(mHttp.data[i].halfOpens.Length())) {
-                mHttp.cb = nullptr;
-                mHttp.data.Clear();
-                JS_ReportOutOfMemory(cx);
-                return NS_ERROR_OUT_OF_MEMORY;
-        }
-        allHalfOpens_speculative = allHalfOpens.mSpeculative.Value();
-        for(uint32_t j = 0; j < mHttp.data[i].halfOpens.Length(); j++) {
-            *allHalfOpens_speculative.AppendElement() = mHttp.data[i].halfOpens[j].speculative;
+        for (uint32_t j = 0; j < mHttp.data[i].halfOpens.Length(); j++) {
+            HalfOpenInfoDict &info = *halfOpens.AppendElement();
+            info.mSpeculative = mHttp.data[i].halfOpens[j].speculative;
         }
     }
 
@@ -351,38 +308,26 @@ Dashboard::GetWebSocketConnections()
     AutoSafeJSContext cx;
 
     mozilla::dom::WebSocketDict dict;
-    dict.mEncrypted.Construct();
-    dict.mHostport.Construct();
-    dict.mMsgreceived.Construct();
-    dict.mMsgsent.Construct();
-    dict.mReceivedsize.Construct();
-    dict.mSentsize.Construct();
-
-    Sequence<bool> &encrypted = dict.mEncrypted.Value();
-    Sequence<nsString> &hostport = dict.mHostport.Value();
-    Sequence<uint32_t> &received = dict.mMsgreceived.Value();
-    Sequence<uint32_t> &sent = dict.mMsgsent.Value();
-    Sequence<double> &receivedSize = dict.mReceivedsize.Value();
-    Sequence<double> &sentSize = dict.mSentsize.Value();
-
-    uint32_t length = mWs.data.Length();
-    if (!encrypted.SetCapacity(length) || !hostport.SetCapacity(length) ||
-        !received.SetCapacity(length) || !sent.SetCapacity(length) ||
-        !receivedSize.SetCapacity(length) || !sentSize.SetCapacity(length)) {
-            mWs.cb = nullptr;
-            mWs.data.Clear();
-            JS_ReportOutOfMemory(cx);
-            return NS_ERROR_OUT_OF_MEMORY;
-    }
+    dict.mWebsockets.Construct();
+    Sequence<mozilla::dom::WebSocketElement> &websockets = dict.mWebsockets.Value();
 
     mozilla::MutexAutoLock lock(mWs.lock);
+    uint32_t length = mWs.data.Length();
+    if (!websockets.SetCapacity(length)) {
+        mWs.cb = nullptr;
+        mWs.data.Clear();
+        JS_ReportOutOfMemory(cx);
+        return NS_ERROR_OUT_OF_MEMORY;
+    }
+
     for (uint32_t i = 0; i < mWs.data.Length(); i++) {
-        CopyASCIItoUTF16(mWs.data[i].mHost, *hostport.AppendElement());
-        *sent.AppendElement() = mWs.data[i].mMsgSent;
-        *received.AppendElement() = mWs.data[i].mMsgReceived;
-        *receivedSize.AppendElement() = mWs.data[i].mSizeSent;
-        *sentSize.AppendElement() = mWs.data[i].mSizeReceived;
-        *encrypted.AppendElement() = mWs.data[i].mEncrypted;
+        mozilla::dom::WebSocketElement &websocket = *websockets.AppendElement();
+        CopyASCIItoUTF16(mWs.data[i].mHost, websocket.mHostport);
+        websocket.mMsgsent = mWs.data[i].mMsgSent;
+        websocket.mMsgreceived = mWs.data[i].mMsgReceived;
+        websocket.mSentsize = mWs.data[i].mSizeSent;
+        websocket.mReceivedsize = mWs.data[i].mSizeReceived;
+        websocket.mEncrypted = mWs.data[i].mEncrypted;
     }
 
     JS::RootedValue val(cx);
@@ -433,44 +378,40 @@ Dashboard::GetDNSCacheEntries()
     AutoSafeJSContext cx;
 
     mozilla::dom::DNSCacheDict dict;
-    dict.mExpiration.Construct();
-    dict.mFamily.Construct();
-    dict.mHostaddr.Construct();
-    dict.mHostname.Construct();
-
-    Sequence<double> &expiration = dict.mExpiration.Value();
-    Sequence<nsString> &family = dict.mFamily.Value();
-    Sequence<Sequence<nsString> > &hostaddr = dict.mHostaddr.Value();
-    Sequence<nsString> &hostname = dict.mHostname.Value();
+    dict.mEntries.Construct();
+    Sequence<mozilla::dom::DnsCacheEntry> &entries = dict.mEntries.Value();
 
     uint32_t length = mDns.data.Length();
-    if (!expiration.SetCapacity(length) || !family.SetCapacity(length) ||
-        !hostaddr.SetCapacity(length) || !hostname.SetCapacity(length)) {
-            mDns.cb = nullptr;
-            mDns.data.Clear();
-            JS_ReportOutOfMemory(cx);
-            return NS_ERROR_OUT_OF_MEMORY;
+    if (!entries.SetCapacity(length)) {
+        mDns.cb = nullptr;
+        mDns.data.Clear();
+        JS_ReportOutOfMemory(cx);
+        return NS_ERROR_OUT_OF_MEMORY;
     }
 
     for (uint32_t i = 0; i < mDns.data.Length(); i++) {
-        CopyASCIItoUTF16(mDns.data[i].hostname, *hostname.AppendElement());
-        *expiration.AppendElement() = mDns.data[i].expiration;
+        mozilla::dom::DnsCacheEntry &entry = *entries.AppendElement();
+        entry.mHostaddr.Construct();
 
-        Sequence<nsString> &addrs = *hostaddr.AppendElement();
+        Sequence<nsString> &addrs = entry.mHostaddr.Value();
         if (!addrs.SetCapacity(mDns.data[i].hostaddr.Length())) {
             mDns.cb = nullptr;
             mDns.data.Clear();
             JS_ReportOutOfMemory(cx);
             return NS_ERROR_OUT_OF_MEMORY;
         }
+
+        CopyASCIItoUTF16(mDns.data[i].hostname, entry.mHostname);
+        entry.mExpiration = mDns.data[i].expiration;
+
         for (uint32_t j = 0; j < mDns.data[i].hostaddr.Length(); j++) {
             CopyASCIItoUTF16(mDns.data[i].hostaddr[j], *addrs.AppendElement());
         }
 
         if (mDns.data[i].family == PR_AF_INET6)
-            CopyASCIItoUTF16("ipv6", *family.AppendElement());
+            CopyASCIItoUTF16("ipv6", entry.mFamily);
         else
-            CopyASCIItoUTF16("ipv4", *family.AppendElement());
+            CopyASCIItoUTF16("ipv4", entry.mFamily);
     }
 
     JS::RootedValue val(cx);
@@ -518,15 +459,11 @@ Dashboard::OnLookupComplete(nsICancelable *aRequest, nsIDNSRecord *aRecord, nsre
 
     mozilla::dom::DNSLookupDict dict;
     dict.mAddress.Construct();
-    dict.mError.Construct();
-    dict.mAnswer.Construct();
 
     Sequence<nsString> &addresses = dict.mAddress.Value();
-    nsString &error = dict.mError.Value();
-    bool &answer = dict.mAnswer.Value();
 
     if (NS_SUCCEEDED(aStatus)) {
-        answer = true;
+        dict.mAnswer = true;
         bool hasMore;
         aRecord->HasMore(&hasMore);
         while(hasMore) {
@@ -536,8 +473,8 @@ Dashboard::OnLookupComplete(nsICancelable *aRequest, nsIDNSRecord *aRecord, nsre
            aRecord->HasMore(&hasMore);
         }
     } else {
-        answer = false;
-        CopyASCIItoUTF16(GetErrorString(aStatus), error);
+        dict.mAnswer = false;
+        CopyASCIItoUTF16(GetErrorString(aStatus), dict.mError);
     }
 
     JS::RootedValue val(cx);
@@ -608,9 +545,7 @@ Dashboard::GetConnectionStatus(ConnStatus aStatus)
     AutoSafeJSContext cx;
 
     mozilla::dom::ConnStatusDict dict;
-    dict.mStatus.Construct();
-    nsString &status = dict.mStatus.Value();
-    status = aStatus.creationSts;
+    dict.mStatus = aStatus.creationSts;
 
     JS::RootedValue val(cx);
     if (!dict.ToObject(cx, JS::NullPtr(), &val)) {
diff --git a/netwerk/base/src/moz.build b/netwerk/base/src/moz.build
index cb8a49f67d3b..b2df724cdb11 100644
--- a/netwerk/base/src/moz.build
+++ b/netwerk/base/src/moz.build
@@ -16,7 +16,7 @@ EXPORTS.mozilla.net += [
     'DashboardTypes.h',
 ]
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'ArrayBufferInputStream.cpp',
     'BackgroundFileSaver.cpp',
     'Dashboard.cpp',
diff --git a/netwerk/base/src/nsAsyncRedirectVerifyHelper.cpp b/netwerk/base/src/nsAsyncRedirectVerifyHelper.cpp
index edc34d6b80c7..b4cfc7ba0e30 100644
--- a/netwerk/base/src/nsAsyncRedirectVerifyHelper.cpp
+++ b/netwerk/base/src/nsAsyncRedirectVerifyHelper.cpp
@@ -17,6 +17,7 @@
 #include "nsIHttpChannelInternal.h"
 #include "nsIAsyncVerifyRedirectCallback.h"
 
+#undef LOG
 #ifdef PR_LOGGING
 static PRLogModuleInfo *
 GetRedirectLog()
diff --git a/netwerk/base/src/nsAsyncStreamCopier.cpp b/netwerk/base/src/nsAsyncStreamCopier.cpp
index 70a68584452e..977704481128 100644
--- a/netwerk/base/src/nsAsyncStreamCopier.cpp
+++ b/netwerk/base/src/nsAsyncStreamCopier.cpp
@@ -11,6 +11,7 @@
 
 using namespace mozilla;
 
+#undef LOG
 #if defined(PR_LOGGING)
 //
 // NSPR_LOG_MODULES=nsStreamCopier:5
diff --git a/netwerk/base/src/nsAutodialWin.cpp b/netwerk/base/src/nsAutodialWin.cpp
index 7ef07e83374b..6050a05d9e66 100644
--- a/netwerk/base/src/nsAutodialWin.cpp
+++ b/netwerk/base/src/nsAutodialWin.cpp
@@ -33,6 +33,8 @@
 static PRLogModuleInfo* gLog = nullptr;
 #endif
 
+#undef LOGD
+#undef LOGE
 #define LOGD(args) PR_LOG(gLog, PR_LOG_DEBUG, args)
 #define LOGE(args) PR_LOG(gLog, PR_LOG_ERROR, args)
 
diff --git a/netwerk/base/src/nsChannelClassifier.cpp b/netwerk/base/src/nsChannelClassifier.cpp
index 4a2e6db23d36..f1c59b3ddd0c 100644
--- a/netwerk/base/src/nsChannelClassifier.cpp
+++ b/netwerk/base/src/nsChannelClassifier.cpp
@@ -18,6 +18,7 @@
 //
 static PRLogModuleInfo *gChannelClassifierLog;
 #endif
+#undef LOG
 #define LOG(args)     PR_LOG(gChannelClassifierLog, PR_LOG_DEBUG, args)
 
 NS_IMPL_ISUPPORTS1(nsChannelClassifier,
diff --git a/netwerk/base/src/nsInputStreamPump.cpp b/netwerk/base/src/nsInputStreamPump.cpp
index 02e23d2229fe..6df1266f4084 100644
--- a/netwerk/base/src/nsInputStreamPump.cpp
+++ b/netwerk/base/src/nsInputStreamPump.cpp
@@ -27,6 +27,7 @@ static NS_DEFINE_CID(kStreamTransportServiceCID, NS_STREAMTRANSPORTSERVICE_CID);
 //
 static PRLogModuleInfo *gStreamPumpLog = nullptr;
 #endif
+#undef LOG
 #define LOG(args) PR_LOG(gStreamPumpLog, PR_LOG_DEBUG, args)
 
 //-----------------------------------------------------------------------------
diff --git a/netwerk/base/src/nsLoadGroup.cpp b/netwerk/base/src/nsLoadGroup.cpp
index cc7b95a4ea65..036b3f75a8d2 100644
--- a/netwerk/base/src/nsLoadGroup.cpp
+++ b/netwerk/base/src/nsLoadGroup.cpp
@@ -42,6 +42,7 @@ using namespace mozilla::net;
 static PRLogModuleInfo* gLoadGroupLog = nullptr;
 #endif
 
+#undef LOG
 #define LOG(args) PR_LOG(gLoadGroupLog, PR_LOG_DEBUG, args)
 
 ////////////////////////////////////////////////////////////////////////////////
diff --git a/netwerk/base/src/nsPACMan.cpp b/netwerk/base/src/nsPACMan.cpp
index 2ff015bde561..3b739701b0e8 100644
--- a/netwerk/base/src/nsPACMan.cpp
+++ b/netwerk/base/src/nsPACMan.cpp
@@ -19,17 +19,9 @@
 using namespace mozilla;
 using namespace mozilla::net;
 
-#include "prlog.h"
 #if defined(PR_LOGGING)
-static PRLogModuleInfo *
-GetProxyLog()
-{
-    static PRLogModuleInfo *sLog;
-    if (!sLog)
-        sLog = PR_NewLogModule("proxy");
-    return sLog;
-}
 #endif
+#undef LOG
 #define LOG(args) PR_LOG(GetProxyLog(), PR_LOG_DEBUG, args)
 
 // The PAC thread does evaluations of both PAC files and
@@ -699,3 +691,18 @@ nsPACMan::Init(nsISystemProxySettings *systemProxySettings)
 
   return NS_OK;
 }
+
+namespace mozilla {
+namespace net {
+
+PRLogModuleInfo*
+GetProxyLog()
+{
+    static PRLogModuleInfo *sLog;
+    if (!sLog)
+        sLog = PR_NewLogModule("proxy");
+    return sLog;
+}
+
+}
+}
diff --git a/netwerk/base/src/nsPACMan.h b/netwerk/base/src/nsPACMan.h
index 969b10657d98..f2a64ac2271e 100644
--- a/netwerk/base/src/nsPACMan.h
+++ b/netwerk/base/src/nsPACMan.h
@@ -19,6 +19,7 @@
 #include "mozilla/LinkedList.h"
 #include "nsAutoPtr.h"
 #include "mozilla/TimeStamp.h"
+#include "prlog.h"
 
 class nsPACMan;
 class nsISystemProxySettings;
@@ -222,4 +223,10 @@ private:
   bool                         mInProgress;
 };
 
+namespace mozilla {
+namespace net {
+PRLogModuleInfo* GetProxyLog();
+}
+}
+
 #endif  // nsPACMan_h__
diff --git a/netwerk/base/src/nsProtocolProxyService.cpp b/netwerk/base/src/nsProtocolProxyService.cpp
index 6f7de63b7837..a3b6b42e90f0 100644
--- a/netwerk/base/src/nsProtocolProxyService.cpp
+++ b/netwerk/base/src/nsProtocolProxyService.cpp
@@ -36,16 +36,9 @@ using namespace mozilla;
 
 #include "prlog.h"
 #if defined(PR_LOGGING)
-static PRLogModuleInfo *
-GetProxyLog()
-{
-    static PRLogModuleInfo *sLog;
-    if (!sLog)
-        sLog = PR_NewLogModule("proxy");
-    return sLog;
-}
 #endif
-#define LOG(args) PR_LOG(GetProxyLog(), PR_LOG_DEBUG, args)
+#undef LOG
+#define LOG(args) PR_LOG(net::GetProxyLog(), PR_LOG_DEBUG, args)
 
 //----------------------------------------------------------------------------
 
diff --git a/netwerk/base/src/nsRequestObserverProxy.cpp b/netwerk/base/src/nsRequestObserverProxy.cpp
index 1fd0151595e6..f2328bc33228 100644
--- a/netwerk/base/src/nsRequestObserverProxy.cpp
+++ b/netwerk/base/src/nsRequestObserverProxy.cpp
@@ -17,6 +17,7 @@ using namespace mozilla;
 static PRLogModuleInfo *gRequestObserverProxyLog;
 #endif
 
+#undef LOG
 #define LOG(args) PR_LOG(gRequestObserverProxyLog, PR_LOG_DEBUG, args)
 
 //-----------------------------------------------------------------------------
diff --git a/netwerk/base/src/nsSimpleURI.cpp b/netwerk/base/src/nsSimpleURI.cpp
index b6113ec9ac1a..c8aef29ac84c 100644
--- a/netwerk/base/src/nsSimpleURI.cpp
+++ b/netwerk/base/src/nsSimpleURI.cpp
@@ -5,6 +5,7 @@
 
 #include "mozilla/DebugOnly.h"
 
+#undef LOG
 #include "IPCMessageUtils.h"
 
 #include "nsSimpleURI.h"
diff --git a/netwerk/base/src/nsSocketTransport2.cpp b/netwerk/base/src/nsSocketTransport2.cpp
index cefd1c5fc0e8..bbdcd96bd4bd 100644
--- a/netwerk/base/src/nsSocketTransport2.cpp
+++ b/netwerk/base/src/nsSocketTransport2.cpp
@@ -1637,8 +1637,9 @@ nsSocketTransport::OnSocketEvent(uint32_t type, nsresult status, nsISupports *pa
 #endif
                 mCondition = ResolveHost();
 
-        } else
+        } else {
             SOCKET_LOG(("  ignoring redundant event\n"));
+        }
         break;
 
     case MSG_DNS_LOOKUP_COMPLETE:
diff --git a/netwerk/base/src/nsStandardURL.cpp b/netwerk/base/src/nsStandardURL.cpp
index d2a0683539c5..809d6e3860aa 100644
--- a/netwerk/base/src/nsStandardURL.cpp
+++ b/netwerk/base/src/nsStandardURL.cpp
@@ -46,6 +46,7 @@ static PRLogModuleInfo *gStandardURLLog;
 // The Chromium code defines its own LOG macro which we don't want
 #undef LOG
 #define LOG(args)     PR_LOG(gStandardURLLog, PR_LOG_DEBUG, args)
+#undef LOG_ENABLED
 #define LOG_ENABLED() PR_LOG_TEST(gStandardURLLog, PR_LOG_DEBUG)
 
 //----------------------------------------------------------------------------
diff --git a/netwerk/build/nsNetModule.cpp b/netwerk/build/nsNetModule.cpp
index 5edab6ae6fec..2dedec0b4eb4 100644
--- a/netwerk/build/nsNetModule.cpp
+++ b/netwerk/build/nsNetModule.cpp
@@ -269,7 +269,7 @@ NS_GENERIC_FACTORY_CONSTRUCTOR(nsViewSourceHandler)
 
 #ifdef NECKO_PROTOCOL_wyciwyg
 #include "nsWyciwygProtocolHandler.h"
-NS_GENERIC_FACTORY_CONSTRUCTOR_INIT(nsWyciwygProtocolHandler, Init)
+NS_GENERIC_FACTORY_CONSTRUCTOR(nsWyciwygProtocolHandler)
 #endif
 
 #ifdef NECKO_PROTOCOL_websocket
diff --git a/netwerk/cache2/AppCacheStorage.cpp b/netwerk/cache2/AppCacheStorage.cpp
index a8b46878f033..f951fa6120f7 100644
--- a/netwerk/cache2/AppCacheStorage.cpp
+++ b/netwerk/cache2/AppCacheStorage.cpp
@@ -71,8 +71,12 @@ NS_IMETHODIMP AppCacheStorage::AsyncOpenURI(nsIURI *aURI,
   rv = noRefURI->GetAsciiSpec(cacheKey);
   NS_ENSURE_SUCCESS(rv, rv);
 
+  nsAutoCString scheme;
+  rv = noRefURI->GetScheme(scheme);
+  NS_ENSURE_SUCCESS(rv, rv);
+
   nsRefPtr<_OldCacheLoad> appCacheLoad =
-    new _OldCacheLoad(cacheKey, aCallback, appCache,
+    new _OldCacheLoad(scheme, cacheKey, aCallback, appCache,
                       LoadInfo(), WriteToDisk(), aFlags);
   rv = appCacheLoad->Start();
   NS_ENSURE_SUCCESS(rv, rv);
diff --git a/netwerk/cache2/CacheEntry.cpp b/netwerk/cache2/CacheEntry.cpp
index 8655890756c1..f641d5679f81 100644
--- a/netwerk/cache2/CacheEntry.cpp
+++ b/netwerk/cache2/CacheEntry.cpp
@@ -30,6 +30,8 @@ namespace net {
 
 static uint32_t const ENTRY_WANTED =
   nsICacheEntryOpenCallback::ENTRY_WANTED;
+static uint32_t const RECHECK_AFTER_WRITE_FINISHED =
+  nsICacheEntryOpenCallback::RECHECK_AFTER_WRITE_FINISHED;
 static uint32_t const ENTRY_NEEDS_REVALIDATION =
   nsICacheEntryOpenCallback::ENTRY_NEEDS_REVALIDATION;
 static uint32_t const ENTRY_NOT_WANTED =
@@ -54,6 +56,53 @@ CacheEntry::Handle::~Handle()
   MOZ_COUNT_DTOR(CacheEntry::Handle);
 }
 
+// CacheEntry::Callback
+
+CacheEntry::Callback::Callback(nsICacheEntryOpenCallback *aCallback,
+                               bool aReadOnly, bool aCheckOnAnyThread)
+: mCallback(aCallback)
+, mTargetThread(do_GetCurrentThread())
+, mReadOnly(aReadOnly)
+, mCheckOnAnyThread(aCheckOnAnyThread)
+, mRecheckAfterWrite(false)
+, mNotWanted(false)
+{
+  MOZ_COUNT_CTOR(CacheEntry::Callback);
+}
+
+CacheEntry::Callback::Callback(CacheEntry::Callback const &aThat)
+: mCallback(aThat.mCallback)
+, mTargetThread(aThat.mTargetThread)
+, mReadOnly(aThat.mReadOnly)
+, mCheckOnAnyThread(aThat.mCheckOnAnyThread)
+, mRecheckAfterWrite(aThat.mRecheckAfterWrite)
+, mNotWanted(aThat.mNotWanted)
+{
+  MOZ_COUNT_CTOR(CacheEntry::Callback);
+}
+
+CacheEntry::Callback::~Callback()
+{
+  MOZ_COUNT_DTOR(CacheEntry::Callback);
+}
+
+nsresult CacheEntry::Callback::OnCheckThread(bool *aOnCheckThread) const
+{
+  if (!mCheckOnAnyThread) {
+    // Check we are on the target
+    return mTargetThread->IsOnCurrentThread(aOnCheckThread);
+  }
+
+  // We can invoke check anywhere
+  *aOnCheckThread = true;
+  return NS_OK;
+}
+
+nsresult CacheEntry::Callback::OnAvailThread(bool *aOnAvailThread) const
+{
+  return mTargetThread->IsOnCurrentThread(aOnAvailThread);
+}
+
 // CacheEntry
 
 NS_IMPL_ISUPPORTS3(CacheEntry,
@@ -76,13 +125,13 @@ CacheEntry::CacheEntry(const nsACString& aStorageID,
 , mIsDoomed(false)
 , mSecurityInfoLoaded(false)
 , mPreventCallbacks(false)
-, mHasMainThreadOnlyCallback(false)
 , mHasData(false)
 , mState(NOTLOADED)
 , mRegistration(NEVERREGISTERED)
 , mWriter(nullptr)
 , mPredictedDataSize(0)
 , mDataSize(0)
+, mReleaseThread(NS_GetCurrentThread())
 {
   MOZ_COUNT_CTOR(CacheEntry);
 
@@ -94,7 +143,7 @@ CacheEntry::CacheEntry(const nsACString& aStorageID,
 
 CacheEntry::~CacheEntry()
 {
-  ProxyReleaseMainThread(mURI);
+  ProxyRelease(mURI, mReleaseThread);
 
   LOG(("CacheEntry::~CacheEntry [this=%p]", this));
   MOZ_COUNT_DTOR(CacheEntry);
@@ -166,27 +215,24 @@ void CacheEntry::AsyncOpen(nsICacheEntryOpenCallback* aCallback, uint32_t aFlags
   bool readonly = aFlags & nsICacheStorage::OPEN_READONLY;
   bool truncate = aFlags & nsICacheStorage::OPEN_TRUNCATE;
   bool priority = aFlags & nsICacheStorage::OPEN_PRIORITY;
-
-  bool mainThreadOnly;
-  if (aCallback && NS_FAILED(aCallback->GetMainThreadOnly(&mainThreadOnly)))
-    mainThreadOnly = true; // rather play safe...
+  bool multithread = aFlags & nsICacheStorage::CHECK_MULTITHREADED;
 
   MOZ_ASSERT(!readonly || !truncate, "Bad flags combination");
   MOZ_ASSERT(!(truncate && mState > LOADING), "Must not call truncate on already loaded entry");
 
+  Callback callback(aCallback, readonly, multithread);
+
   mozilla::MutexAutoLock lock(mLock);
 
-  if (Load(truncate, priority) ||
-      PendingCallbacks() ||
-      !InvokeCallback(aCallback, readonly)) {
-    // Load in progress or callback bypassed...
-    if (mainThreadOnly) {
-      LOG(("  callback is main-thread only"));
-      mHasMainThreadOnlyCallback = true;
-    }
+  RememberCallback(callback);
 
-    RememberCallback(aCallback, readonly);
+  // Load() opens the lock
+  if (Load(truncate, priority)) {
+    // Loading is in progress...
+    return;
   }
+
+  InvokeCallbacks();
 }
 
 bool CacheEntry::Load(bool aTruncate, bool aPriority)
@@ -205,44 +251,48 @@ bool CacheEntry::Load(bool aTruncate, bool aPriority)
     return true;
   }
 
+  mState = LOADING;
+
   MOZ_ASSERT(!mFile);
 
   bool directLoad = aTruncate || !mUseDisk;
-  if (directLoad) {
-    // Just fake the load has already been done as "new".
-    mState = EMPTY;
+  if (directLoad)
     mFileStatus = NS_OK;
-  }
-  else {
-    mState = LOADING;
+  else
     mLoadStart = TimeStamp::Now();
-  }
 
   mFile = new CacheFile();
 
   BackgroundOp(Ops::REGISTER);
 
-  mozilla::MutexAutoUnlock unlock(mLock);
+  {
+    mozilla::MutexAutoUnlock unlock(mLock);
 
-  nsresult rv;
+    nsresult rv;
 
-  nsAutoCString fileKey;
-  rv = HashingKeyWithStorage(fileKey);
+    nsAutoCString fileKey;
+    rv = HashingKeyWithStorage(fileKey);
 
-  LOG(("  performing load, file=%p", mFile.get()));
-  if (NS_SUCCEEDED(rv)) {
-    rv = mFile->Init(fileKey,
-                     aTruncate,
-                     !mUseDisk,
-                     aPriority,
-                     false /* key is not a hash */,
-                     directLoad ? nullptr : this);
+    LOG(("  performing load, file=%p", mFile.get()));
+    if (NS_SUCCEEDED(rv)) {
+      rv = mFile->Init(fileKey,
+                       aTruncate,
+                       !mUseDisk,
+                       aPriority,
+                       false /* key is not a hash */,
+                       directLoad ? nullptr : this);
+    }
+
+    if (NS_FAILED(rv)) {
+      mFileStatus = rv;
+      AsyncDoom(nullptr);
+      return false;
+    }
   }
 
-  if (NS_FAILED(rv)) {
-    mFileStatus = rv;
-    AsyncDoom(nullptr);
-    return false;
+  if (directLoad) {
+    // Just fake the load has already been done as "new".
+    mState = EMPTY;
   }
 
   return mState == LOADING;
@@ -338,52 +388,36 @@ already_AddRefed<CacheEntry> CacheEntry::ReopenTruncated(nsICacheEntryOpenCallba
 
   newEntry->TransferCallbacks(*this);
   mCallbacks.Clear();
-  mReadOnlyCallbacks.Clear();
-  mHasMainThreadOnlyCallback = false;
 
   return newEntry.forget();
 }
 
-void CacheEntry::TransferCallbacks(CacheEntry const& aFromEntry)
+void CacheEntry::TransferCallbacks(CacheEntry & aFromEntry)
 {
   mozilla::MutexAutoLock lock(mLock);
 
   LOG(("CacheEntry::TransferCallbacks [entry=%p, from=%p]",
     this, &aFromEntry));
 
-  mCallbacks.AppendObjects(aFromEntry.mCallbacks);
-  mReadOnlyCallbacks.AppendObjects(aFromEntry.mReadOnlyCallbacks);
-  if (aFromEntry.mHasMainThreadOnlyCallback)
-    mHasMainThreadOnlyCallback = true;
+  if (!mCallbacks.Length())
+    mCallbacks.SwapElements(aFromEntry.mCallbacks);
+  else
+    mCallbacks.AppendElements(aFromEntry.mCallbacks);
 
-  if (mCallbacks.Length() || mReadOnlyCallbacks.Length())
+  if (mCallbacks.Length())
     BackgroundOp(Ops::CALLBACKS, true);
 }
 
-void CacheEntry::RememberCallback(nsICacheEntryOpenCallback* aCallback,
-                                  bool aReadOnly)
+void CacheEntry::RememberCallback(Callback const& aCallback)
 {
-  // AsyncOpen can be called w/o a callback reference (when this is a new/truncated entry)
-  if (!aCallback)
-    return;
-
-  LOG(("CacheEntry::RememberCallback [this=%p, cb=%p]", this, aCallback));
+  LOG(("CacheEntry::RememberCallback [this=%p, cb=%p]", this, aCallback.mCallback.get()));
 
   mLock.AssertCurrentThreadOwns();
 
-  if (!aReadOnly)
-    mCallbacks.AppendObject(aCallback);
-  else
-    mReadOnlyCallbacks.AppendObject(aCallback);
+  mCallbacks.AppendElement(aCallback);
 }
 
-bool CacheEntry::PendingCallbacks()
-{
-  mLock.AssertCurrentThreadOwns();
-  return mCallbacks.Length() || mReadOnlyCallbacks.Length();
-}
-
-void CacheEntry::InvokeCallbacksMainThread()
+void CacheEntry::InvokeCallbacksLock()
 {
   mozilla::MutexAutoLock lock(mLock);
   InvokeCallbacks();
@@ -391,80 +425,84 @@ void CacheEntry::InvokeCallbacksMainThread()
 
 void CacheEntry::InvokeCallbacks()
 {
-  LOG(("CacheEntry::InvokeCallbacks BEGIN [this=%p]", this));
-
   mLock.AssertCurrentThreadOwns();
 
-  do {
-    if (mPreventCallbacks) {
-      LOG(("CacheEntry::InvokeCallbacks END [this=%p] callbacks prevented!", this));
-      return;
-    }
+  LOG(("CacheEntry::InvokeCallbacks BEGIN [this=%p]", this));
 
-    if (!mCallbacks.Count()) {
-      LOG(("  no r/w callbacks"));
-      break;
-    }
-
-    if (mHasMainThreadOnlyCallback && !NS_IsMainThread()) {
-      nsRefPtr<nsRunnableMethod<CacheEntry> > event =
-        NS_NewRunnableMethod(this, &CacheEntry::InvokeCallbacksMainThread);
-      NS_DispatchToMainThread(event);
-      LOG(("CacheEntry::InvokeCallbacks END [this=%p] dispatching to maintread", this));
-      return;
-    }
-
-    nsCOMPtr<nsICacheEntryOpenCallback> callback = mCallbacks[0];
-    mCallbacks.RemoveElementAt(0);
-
-    if (!InvokeCallback(callback, false)) {
-      mCallbacks.InsertElementAt(0, callback);
-      LOG(("CacheEntry::InvokeCallbacks END [this=%p] callback bypassed", this));
-      return;
-    }
-  } while (true);
-
-  while (mReadOnlyCallbacks.Count()) {
-    if (mHasMainThreadOnlyCallback && !NS_IsMainThread()) {
-      nsRefPtr<nsRunnableMethod<CacheEntry> > event =
-        NS_NewRunnableMethod(this, &CacheEntry::InvokeCallbacksMainThread);
-      NS_DispatchToMainThread(event);
-      LOG(("CacheEntry::InvokeCallbacks END [this=%p] dispatching to maintread", this));
-      return;
-    }
-
-    nsCOMPtr<nsICacheEntryOpenCallback> callback = mReadOnlyCallbacks[0];
-    mReadOnlyCallbacks.RemoveElementAt(0);
-
-    if (!InvokeCallback(callback, true)) {
-      // Didn't trigger, so we must stop
-      mReadOnlyCallbacks.InsertElementAt(0, callback);
-      break;
-    }
-  }
-
-  if (!mCallbacks.Count() && !mReadOnlyCallbacks.Count())
-    mHasMainThreadOnlyCallback = false;
+  // Invoke first all r/w callbacks, then all r/o callbacks.
+  if (InvokeCallbacks(false))
+    InvokeCallbacks(true);
 
   LOG(("CacheEntry::InvokeCallbacks END [this=%p]", this));
 }
 
-bool CacheEntry::InvokeCallback(nsICacheEntryOpenCallback* aCallback,
-                                bool aReadOnly)
+bool CacheEntry::InvokeCallbacks(bool aReadOnly)
+{
+  mLock.AssertCurrentThreadOwns();
+
+  uint32_t i = 0;
+  while (i < mCallbacks.Length()) {
+    if (mPreventCallbacks) {
+      LOG(("  callbacks prevented!"));
+      return false;
+    }
+
+    if (!mIsDoomed && (mState == WRITING || mState == REVALIDATING)) {
+      LOG(("  entry is being written/revalidated"));
+      return false;
+    }
+
+    if (mCallbacks[i].mReadOnly != aReadOnly) {
+      // Callback is not r/w or r/o, go to another one in line
+      ++i;
+      continue;
+    }
+
+    bool onCheckThread;
+    nsresult rv = mCallbacks[i].OnCheckThread(&onCheckThread);
+
+    if (NS_SUCCEEDED(rv) && !onCheckThread) {
+      // Redispatch to the target thread
+      nsRefPtr<nsRunnableMethod<CacheEntry> > event =
+        NS_NewRunnableMethod(this, &CacheEntry::InvokeCallbacksLock);
+
+      rv = mCallbacks[i].mTargetThread->Dispatch(event, nsIEventTarget::DISPATCH_NORMAL);
+      if (NS_SUCCEEDED(rv)) {
+        LOG(("  re-dispatching to target thread"));
+        return false;
+      }
+    }
+
+    Callback callback = mCallbacks[i];
+    mCallbacks.RemoveElementAt(i);
+
+    if (NS_SUCCEEDED(rv) && !InvokeCallback(callback)) {
+      // Callback didn't fire, put it back and go to another one in line.
+      // Only reason InvokeCallback returns false is that onCacheEntryCheck
+      // returns RECHECK_AFTER_WRITE_FINISHED.  If we would stop the loop, other
+      // readers or potential writers would be unnecessarily kept from being
+      // invoked.
+      mCallbacks.InsertElementAt(i, callback);
+      ++i;
+    }
+  }
+
+  return true;
+}
+
+bool CacheEntry::InvokeCallback(Callback & aCallback)
 {
   LOG(("CacheEntry::InvokeCallback [this=%p, state=%s, cb=%p]",
-    this, StateString(mState), aCallback));
+    this, StateString(mState), aCallback.mCallback.get()));
 
   mLock.AssertCurrentThreadOwns();
 
-  bool notWanted = false;
-
+  // When this entry is doomed we want to notify the callback any time
   if (!mIsDoomed) {
     // When we are here, the entry must be loaded from disk
     MOZ_ASSERT(mState > LOADING);
 
-    if (mState == WRITING ||
-        mState == REVALIDATING) {
+    if (mState == WRITING || mState == REVALIDATING) {
       // Prevent invoking other callbacks since one of them is now writing
       // or revalidating this entry.  No consumers should get this entry
       // until metadata are filled with values downloaded from the server
@@ -473,7 +511,10 @@ bool CacheEntry::InvokeCallback(nsICacheEntryOpenCallback* aCallback,
       return false;
     }
 
-    if (!aReadOnly) {
+    // mRecheckAfterWrite flag already set means the callback has already passed
+    // the onCacheEntryCheck call. Until the current write is not finished this
+    // callback will be bypassed.
+    if (!aCallback.mReadOnly && !aCallback.mRecheckAfterWrite) {
       if (mState == EMPTY) {
         // Advance to writing state, we expect to invoke the callback and let
         // it fill content of this entry.  Must set and check the state here
@@ -482,7 +523,7 @@ bool CacheEntry::InvokeCallback(nsICacheEntryOpenCallback* aCallback,
         LOG(("  advancing to WRITING state"));
       }
 
-      if (!aCallback) {
+      if (!aCallback.mCallback) {
         // We can be given no callback only in case of recreate, it is ok
         // to advance to WRITING state since the caller of recreate is expected
         // to write this entry now.
@@ -496,11 +537,12 @@ bool CacheEntry::InvokeCallback(nsICacheEntryOpenCallback* aCallback,
           // mayhemer: TODO check and solve any potential races of concurent OnCacheEntryCheck
           mozilla::MutexAutoUnlock unlock(mLock);
 
-          nsresult rv = aCallback->OnCacheEntryCheck(this, nullptr, &checkResult);
+          nsresult rv = aCallback.mCallback->OnCacheEntryCheck(
+            this, nullptr, &checkResult);
           LOG(("  OnCacheEntryCheck: rv=0x%08x, result=%d", rv, checkResult));
 
           if (NS_FAILED(rv))
-            checkResult = ENTRY_WANTED;
+            checkResult = ENTRY_NOT_WANTED;
         }
 
         switch (checkResult) {
@@ -510,6 +552,12 @@ bool CacheEntry::InvokeCallback(nsICacheEntryOpenCallback* aCallback,
           // Proceed to callback...
           break;
 
+        case RECHECK_AFTER_WRITE_FINISHED:
+          LOG(("  consumer will check on the entry again after write is done"));
+          // The consumer wants the entry to complete first.
+          aCallback.mRecheckAfterWrite = true;
+          break;
+
         case ENTRY_NEEDS_REVALIDATION:
           LOG(("  will be holding callbacks until entry is revalidated"));
           // State is READY now and from that state entry cannot transit to any other
@@ -521,46 +569,73 @@ bool CacheEntry::InvokeCallback(nsICacheEntryOpenCallback* aCallback,
         case ENTRY_NOT_WANTED:
           LOG(("  consumer not interested in the entry"));
           // Do not give this entry to the consumer, it is not interested in us.
-          notWanted = true;
+          aCallback.mNotWanted = true;
           break;
         }
       }
     }
   }
 
-  if (aCallback) {
+  if (aCallback.mCallback) {
+    if (!mIsDoomed && aCallback.mRecheckAfterWrite) {
+      // If we don't have data and the callback wants a complete entry,
+      // don't invoke now.
+      bool bypass = !mHasData;
+      if (!bypass) {
+        int64_t _unused;
+        bypass = !mFile->DataSize(&_unused);
+      }
+
+      if (bypass) {
+        LOG(("  bypassing, entry data still being written"));
+        return false;
+      }
+
+      // Entry is complete now, do the check+avail call again
+      aCallback.mRecheckAfterWrite = false;
+      return InvokeCallback(aCallback);
+    }
+
     mozilla::MutexAutoUnlock unlock(mLock);
-    InvokeAvailableCallback(aCallback, aReadOnly, notWanted);
+    InvokeAvailableCallback(aCallback);
   }
 
   return true;
 }
 
-void CacheEntry::InvokeAvailableCallback(nsICacheEntryOpenCallback* aCallback,
-                                         bool aReadOnly,
-                                         bool aNotWanted)
+void CacheEntry::InvokeAvailableCallback(Callback const & aCallback)
 {
   LOG(("CacheEntry::InvokeAvailableCallback [this=%p, state=%s, cb=%p, r/o=%d, n/w=%d]",
-    this, StateString(mState), aCallback, aReadOnly, aNotWanted));
+    this, StateString(mState), aCallback.mCallback.get(), aCallback.mReadOnly, aCallback.mNotWanted));
+
+  nsresult rv;
 
   uint32_t const state = mState;
 
   // When we are here, the entry must be loaded from disk
   MOZ_ASSERT(state > LOADING || mIsDoomed);
 
-  if (!NS_IsMainThread()) {
-    // Must happen on the main thread :(
-    nsRefPtr<AvailableCallbackRunnable> event =
-      new AvailableCallbackRunnable(this, aCallback, aReadOnly, aNotWanted);
-    NS_DispatchToMainThread(event);
+  bool onAvailThread;
+  rv = aCallback.OnAvailThread(&onAvailThread);
+  if (NS_FAILED(rv)) {
+    LOG(("  target thread dead?"));
     return;
   }
 
-  // This happens only on the main thread / :( /
+  if (!onAvailThread) {
+    // Dispatch to the right thread
+    nsRefPtr<AvailableCallbackRunnable> event =
+      new AvailableCallbackRunnable(this, aCallback);
 
-  if (mIsDoomed || aNotWanted) {
+    rv = aCallback.mTargetThread->Dispatch(event, nsIEventTarget::DISPATCH_NORMAL);
+    LOG(("  redispatched, (rv = 0x%08x)", rv));
+    return;
+  }
+
+  if (mIsDoomed || aCallback.mNotWanted) {
     LOG(("  doomed or not wanted, notifying OCEA with NS_ERROR_CACHE_KEY_NOT_FOUND"));
-    aCallback->OnCacheEntryAvailable(nullptr, false, nullptr, NS_ERROR_CACHE_KEY_NOT_FOUND);
+    aCallback.mCallback->OnCacheEntryAvailable(
+      nullptr, false, nullptr, NS_ERROR_CACHE_KEY_NOT_FOUND);
     return;
   }
 
@@ -571,13 +646,15 @@ void CacheEntry::InvokeAvailableCallback(nsICacheEntryOpenCallback* aCallback,
       BackgroundOp(Ops::FRECENCYUPDATE);
     }
 
-    aCallback->OnCacheEntryAvailable(this, false, nullptr, NS_OK);
+    aCallback.mCallback->OnCacheEntryAvailable(
+      this, false, nullptr, NS_OK);
     return;
   }
 
-  if (aReadOnly) {
+  if (aCallback.mReadOnly) {
     LOG(("  r/o and not ready, notifying OCEA with NS_ERROR_CACHE_KEY_NOT_FOUND"));
-    aCallback->OnCacheEntryAvailable(nullptr, false, nullptr, NS_ERROR_CACHE_KEY_NOT_FOUND);
+    aCallback.mCallback->OnCacheEntryAvailable(
+      nullptr, false, nullptr, NS_ERROR_CACHE_KEY_NOT_FOUND);
     return;
   }
 
@@ -589,7 +666,8 @@ void CacheEntry::InvokeAvailableCallback(nsICacheEntryOpenCallback* aCallback,
   // Consumer will be responsible to fill or validate the entry metadata and data.
 
   nsRefPtr<Handle> handle = NewWriteHandle();
-  nsresult rv = aCallback->OnCacheEntryAvailable(handle, state == WRITING, nullptr, NS_OK);
+  rv = aCallback.mCallback->OnCacheEntryAvailable(
+    handle, state == WRITING, nullptr, NS_OK);
 
   if (NS_FAILED(rv)) {
     LOG(("  writing/revalidating failed (0x%08x)", rv));
@@ -652,6 +730,15 @@ void CacheEntry::OnWriterClosed(Handle const* aHandle)
   }
 }
 
+void CacheEntry::OnOutputClosed()
+{
+  // Called when the file's output stream is closed.  Invoke any callbacks
+  // waiting for complete entry.
+
+  mozilla::MutexAutoLock lock(mLock);
+  InvokeCallbacks();
+}
+
 bool CacheEntry::UsingDisk() const
 {
   CacheStorageService::Self()->Lock().AssertCurrentThreadOwns();
@@ -841,9 +928,6 @@ nsresult CacheEntry::OpenOutputStreamInternal(int64_t offset, nsIOutputStream *
 
   MOZ_ASSERT(mState > LOADING);
 
-  if (!mFile)
-    return NS_ERROR_NOT_AVAILABLE;
-
   nsresult rv;
 
   // No need to sync on mUseDisk here, we don't need to be consistent
@@ -853,8 +937,11 @@ nsresult CacheEntry::OpenOutputStreamInternal(int64_t offset, nsIOutputStream *
     NS_ENSURE_SUCCESS(rv, rv);
   }
 
+  nsRefPtr<CacheOutputCloseListener> listener =
+    new CacheOutputCloseListener(this);
+
   nsCOMPtr<nsIOutputStream> stream;
-  rv = mFile->OpenOutputStream(getter_AddRefs(stream));
+  rv = mFile->OpenOutputStream(listener, getter_AddRefs(stream));
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsCOMPtr<nsISeekableStream> seekable =
@@ -924,17 +1011,11 @@ NS_IMETHODIMP CacheEntry::SetSecurityInfo(nsISupports *aSecurityInfo)
 
   NS_ENSURE_SUCCESS(mFileStatus, mFileStatus);
 
-  nsRefPtr<CacheFile> file;
   {
     mozilla::MutexAutoLock lock(mLock);
 
     mSecurityInfo = aSecurityInfo;
     mSecurityInfoLoaded = true;
-
-    if (!mFile)
-      return NS_ERROR_NOT_AVAILABLE;
-
-    file = mFile;
   }
 
   nsCOMPtr<nsISerializable> serializable =
@@ -1271,7 +1352,7 @@ void CacheEntry::DoomAlreadyRemoved()
   {
     mozilla::MutexAutoLock lock(mLock);
 
-    if (mCallbacks.Length() || mReadOnlyCallbacks.Length()) {
+    if (mCallbacks.Length()) {
       // Must force post here since may be indirectly called from
       // InvokeCallbacks of this entry and we don't want reentrancy here.
       BackgroundOp(Ops::CALLBACKS, true);
@@ -1348,5 +1429,32 @@ void CacheEntry::BackgroundOp(uint32_t aOperations, bool aForceAsync)
   }
 }
 
+// CacheOutputCloseListener
+
+CacheOutputCloseListener::CacheOutputCloseListener(CacheEntry* aEntry)
+: mEntry(aEntry)
+{
+  MOZ_COUNT_CTOR(CacheOutputCloseListener);
+}
+
+CacheOutputCloseListener::~CacheOutputCloseListener()
+{
+  MOZ_COUNT_DTOR(CacheOutputCloseListener);
+}
+
+void CacheOutputCloseListener::OnOutputClosed()
+{
+  // We need this class and to redispatch since this callback is invoked
+  // under the file's lock and to do the job we need to enter the entry's
+  // lock too.  That would lead to potential deadlocks.
+  NS_DispatchToCurrentThread(this);
+}
+
+NS_IMETHODIMP CacheOutputCloseListener::Run()
+{
+  mEntry->OnOutputClosed();
+  return NS_OK;
+}
+
 } // net
 } // mozilla
diff --git a/netwerk/cache2/CacheEntry.h b/netwerk/cache2/CacheEntry.h
index 2b65dfbe18ac..747d7e3bf617 100644
--- a/netwerk/cache2/CacheEntry.h
+++ b/netwerk/cache2/CacheEntry.h
@@ -35,19 +35,15 @@ PRTimeToSeconds(PRTime t_usec)
 class nsIStorageStream;
 class nsIOutputStream;
 class nsIURI;
+class nsIThread;
 
 namespace mozilla {
 namespace net {
 
 class CacheStorageService;
 class CacheStorage;
-
-namespace {
-class FrecencyComparator;
-class ExpirationComparator;
-class EvictionRunnable;
-class WalkRunnable;
-}
+class CacheFileOutputStream;
+class CacheOutputCloseListener;
 
 class CacheEntry : public nsICacheEntry
                  , public nsIRunnable
@@ -129,29 +125,45 @@ private:
     nsRefPtr<CacheEntry> mEntry;
   };
 
+  class Callback
+  {
+  public:
+    Callback(nsICacheEntryOpenCallback *aCallback,
+             bool aReadOnly, bool aCheckOnAnyThread);
+    Callback(Callback const &aThat);
+    ~Callback();
+
+    nsCOMPtr<nsICacheEntryOpenCallback> mCallback;
+    nsCOMPtr<nsIThread> mTargetThread;
+    bool mReadOnly : 1;
+    bool mCheckOnAnyThread : 1;
+    bool mRecheckAfterWrite : 1;
+    bool mNotWanted : 1;
+
+    nsresult OnCheckThread(bool *aOnCheckThread) const;
+    nsresult OnAvailThread(bool *aOnAvailThread) const;
+  };
+
   // Since OnCacheEntryAvailable must be invoked on the main thread
   // we need a runnable for it...
   class AvailableCallbackRunnable : public nsRunnable
   {
   public:
     AvailableCallbackRunnable(CacheEntry* aEntry,
-                              nsICacheEntryOpenCallback* aCallback,
-                              bool aReadOnly,
-                              bool aNotWanted)
-      : mEntry(aEntry), mCallback(aCallback)
-      , mReadOnly(aReadOnly), mNotWanted(aNotWanted) {}
+                              Callback const &aCallback)
+      : mEntry(aEntry)
+      , mCallback(aCallback)
+    {}
 
   private:
     NS_IMETHOD Run()
     {
-      mEntry->InvokeAvailableCallback(mCallback, mReadOnly, mNotWanted);
+      mEntry->InvokeAvailableCallback(mCallback);
       return NS_OK;
     }
 
     nsRefPtr<CacheEntry> mEntry;
-    nsCOMPtr<nsICacheEntryOpenCallback> mCallback;
-    bool mReadOnly : 1;
-    bool mNotWanted : 1;
+    Callback mCallback;
   };
 
   // Since OnCacheEntryDoomed must be invoked on the main thread
@@ -184,12 +196,12 @@ private:
   bool Load(bool aTruncate, bool aPriority);
   void OnLoaded();
 
-  void RememberCallback(nsICacheEntryOpenCallback* aCallback, bool aReadOnly);
-  bool PendingCallbacks();
+  void RememberCallback(Callback const & aCallback);
+  void InvokeCallbacksLock();
   void InvokeCallbacks();
-  bool InvokeCallback(nsICacheEntryOpenCallback* aCallback, bool aReadOnly);
-  void InvokeAvailableCallback(nsICacheEntryOpenCallback* aCallback, bool aReadOnly, bool aNotWanted);
-  void InvokeCallbacksMainThread();
+  bool InvokeCallbacks(bool aReadOnly);
+  bool InvokeCallback(Callback & aCallback);
+  void InvokeAvailableCallback(Callback const & aCallback);
 
   nsresult OpenOutputStreamInternal(int64_t offset, nsIOutputStream * *_retval);
 
@@ -198,17 +210,21 @@ private:
   Handle* NewWriteHandle();
   void OnWriterClosed(Handle const* aHandle);
 
+private:
+  friend class CacheOutputCloseListener;
+  void OnOutputClosed();
+
   // Schedules a background operation on the management thread.
   // When executed on the management thread directly, the operation(s)
   // is (are) executed immediately.
   void BackgroundOp(uint32_t aOperation, bool aForceAsync = false);
 
   already_AddRefed<CacheEntry> ReopenTruncated(nsICacheEntryOpenCallback* aCallback);
-  void TransferCallbacks(CacheEntry const& aFromEntry);
+  void TransferCallbacks(CacheEntry & aFromEntry);
 
   mozilla::Mutex mLock;
 
-  nsCOMArray<nsICacheEntryOpenCallback> mCallbacks, mReadOnlyCallbacks;
+  nsTArray<Callback> mCallbacks;
   nsCOMPtr<nsICacheEntryDoomCallback> mDoomCallback;
 
   nsRefPtr<CacheFile> mFile;
@@ -232,8 +248,6 @@ private:
   bool mSecurityInfoLoaded : 1;
   // Prevents any callback invocation
   bool mPreventCallbacks : 1;
-  // Way around when having a callback that cannot be invoked on non-main thread
-  bool mHasMainThreadOnlyCallback : 1;
   // true: after load and an existing file, or after output stream has been opened.
   //       note - when opening an input stream, and this flag is false, output stream
   //       is open along ; this makes input streams on new entries behave correctly
@@ -301,6 +315,24 @@ private:
   uint32_t mDataSize; // ???
 
   mozilla::TimeStamp mLoadStart;
+
+  nsCOMPtr<nsIThread> mReleaseThread;
+};
+
+class CacheOutputCloseListener : public nsRunnable
+{
+public:
+  void OnOutputClosed();
+  virtual ~CacheOutputCloseListener();
+
+private:
+  friend class CacheEntry;
+
+  NS_DECL_NSIRUNNABLE
+  CacheOutputCloseListener(CacheEntry* aEntry);
+
+private:
+  nsRefPtr<CacheEntry> mEntry;
 };
 
 } // net
diff --git a/netwerk/cache2/CacheFile.cpp b/netwerk/cache2/CacheFile.cpp
index e474a9e86f19..659b7fce1fb6 100644
--- a/netwerk/cache2/CacheFile.cpp
+++ b/netwerk/cache2/CacheFile.cpp
@@ -807,7 +807,7 @@ CacheFile::OpenInputStream(nsIInputStream **_retval)
 }
 
 nsresult
-CacheFile::OpenOutputStream(nsIOutputStream **_retval)
+CacheFile::OpenOutputStream(CacheOutputCloseListener *aCloseListener, nsIOutputStream **_retval)
 {
   CacheFileAutoLock lock(this);
 
@@ -827,7 +827,7 @@ CacheFile::OpenOutputStream(nsIOutputStream **_retval)
     return NS_ERROR_NOT_AVAILABLE;
   }
 
-  mOutput = new CacheFileOutputStream(this);
+  mOutput = new CacheFileOutputStream(this, aCloseListener);
 
   LOG(("CacheFile::OpenOutputStream() - Creating new output stream %p "
        "[this=%p]", mOutput, this));
@@ -1338,6 +1338,9 @@ CacheFile::RemoveOutput(CacheFileOutputStream *aOutput)
   if (!mMemoryOnly)
     WriteMetadataIfNeeded();
 
+  // Notify close listener as the last action
+  aOutput->NotifyCloseListener();
+
   return NS_OK;
 }
 
diff --git a/netwerk/cache2/CacheFile.h b/netwerk/cache2/CacheFile.h
index cbc1c57f11e6..97cb7d448f91 100644
--- a/netwerk/cache2/CacheFile.h
+++ b/netwerk/cache2/CacheFile.h
@@ -21,6 +21,7 @@ namespace net {
 
 class CacheFileInputStream;
 class CacheFileOutputStream;
+class CacheOutputCloseListener;
 class MetadataWriteTimer;
 
 #define CACHEFILELISTENER_IID \
@@ -77,7 +78,7 @@ public:
   NS_IMETHOD OnMetadataWritten(nsresult aResult);
 
   NS_IMETHOD OpenInputStream(nsIInputStream **_retval);
-  NS_IMETHOD OpenOutputStream(nsIOutputStream **_retval);
+  NS_IMETHOD OpenOutputStream(CacheOutputCloseListener *aCloseListener, nsIOutputStream **_retval);
   NS_IMETHOD SetMemoryOnly();
   NS_IMETHOD Doom(CacheFileListener *aCallback);
 
diff --git a/netwerk/cache2/CacheFileOutputStream.cpp b/netwerk/cache2/CacheFileOutputStream.cpp
index f33d2e227d2d..b3abf11e5945 100644
--- a/netwerk/cache2/CacheFileOutputStream.cpp
+++ b/netwerk/cache2/CacheFileOutputStream.cpp
@@ -6,6 +6,7 @@
 #include "CacheFileOutputStream.h"
 
 #include "CacheFile.h"
+#include "CacheEntry.h"
 #include "nsStreamUtils.h"
 #include "nsThreadUtils.h"
 #include "mozilla/DebugOnly.h"
@@ -43,8 +44,10 @@ NS_INTERFACE_MAP_BEGIN(CacheFileOutputStream)
   NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIOutputStream)
 NS_INTERFACE_MAP_END_THREADSAFE
 
-CacheFileOutputStream::CacheFileOutputStream(CacheFile *aFile)
+CacheFileOutputStream::CacheFileOutputStream(CacheFile *aFile,
+                                             CacheOutputCloseListener *aCloseListener)
   : mFile(aFile)
+  , mCloseListener(aCloseListener)
   , mPos(0)
   , mClosed(false)
   , mStatus(NS_OK)
@@ -294,6 +297,16 @@ CacheFileOutputStream::OnChunkUpdated(CacheFileChunk *aChunk)
   return NS_ERROR_UNEXPECTED;
 }
 
+void CacheFileOutputStream::NotifyCloseListener()
+{
+  nsRefPtr<CacheOutputCloseListener> listener;
+  listener.swap(mCloseListener);
+  if (!listener)
+    return;
+
+  listener->OnOutputClosed();
+}
+
 void
 CacheFileOutputStream::ReleaseChunk()
 {
diff --git a/netwerk/cache2/CacheFileOutputStream.h b/netwerk/cache2/CacheFileOutputStream.h
index 62fdf994f235..4bf572bd76c4 100644
--- a/netwerk/cache2/CacheFileOutputStream.h
+++ b/netwerk/cache2/CacheFileOutputStream.h
@@ -16,6 +16,7 @@ namespace mozilla {
 namespace net {
 
 class CacheFile;
+class CacheOutputCloseListener;
 
 class CacheFileOutputStream : public nsIAsyncOutputStream
                             , public nsISeekableStream
@@ -27,7 +28,7 @@ class CacheFileOutputStream : public nsIAsyncOutputStream
   NS_DECL_NSISEEKABLESTREAM
 
 public:
-  CacheFileOutputStream(CacheFile *aFile);
+  CacheFileOutputStream(CacheFile *aFile, CacheOutputCloseListener *aCloseListener);
 
   NS_IMETHOD OnChunkRead(nsresult aResult, CacheFileChunk *aChunk);
   NS_IMETHOD OnChunkWritten(nsresult aResult, CacheFileChunk *aChunk);
@@ -35,6 +36,8 @@ public:
                               CacheFileChunk *aChunk);
   NS_IMETHOD OnChunkUpdated(CacheFileChunk *aChunk);
 
+  void NotifyCloseListener();
+
 private:
   virtual ~CacheFileOutputStream();
 
@@ -45,6 +48,7 @@ private:
 
   nsRefPtr<CacheFile>      mFile;
   nsRefPtr<CacheFileChunk> mChunk;
+  nsRefPtr<CacheOutputCloseListener> mCloseListener;
   int64_t                  mPos;
   bool                     mClosed;
   nsresult                 mStatus;
diff --git a/netwerk/cache2/CacheIOThread.cpp b/netwerk/cache2/CacheIOThread.cpp
index 2058d1ffdf1d..ebc1c8ce1a4a 100644
--- a/netwerk/cache2/CacheIOThread.cpp
+++ b/netwerk/cache2/CacheIOThread.cpp
@@ -160,12 +160,12 @@ loopStart:
       }
 
       if (EventsPending())
-        continue;
+        goto loopStart;
 
       lock.Wait(waitTime);
 
       if (EventsPending())
-        continue;
+        goto loopStart;
 
     } while (!mShutdown);
 
diff --git a/netwerk/cache2/CacheObserver.cpp b/netwerk/cache2/CacheObserver.cpp
index 9df5cfb6da8c..6a4926ba65ef 100644
--- a/netwerk/cache2/CacheObserver.cpp
+++ b/netwerk/cache2/CacheObserver.cpp
@@ -6,7 +6,10 @@
 
 #include "CacheStorageService.h"
 #include "CacheFileIOManager.h"
+#include "LoadContextInfo.h"
+#include "nsICacheStorage.h"
 #include "nsIObserverService.h"
+#include "mozIApplicationClearPrivateDataParams.h"
 #include "mozilla/Services.h"
 #include "mozilla/Preferences.h"
 #include "nsServiceManagerUtils.h"
@@ -46,6 +49,7 @@ CacheObserver::Init()
   obs->AddObserver(sSelf, "profile-before-change", true);
   obs->AddObserver(sSelf, "xpcom-shutdown", true);
   obs->AddObserver(sSelf, "last-pb-context-exited", true);
+  obs->AddObserver(sSelf, "webapps-clear-data", true);
   obs->AddObserver(sSelf, "memory-pressure", true);
 
   return NS_OK;
@@ -91,6 +95,83 @@ bool const CacheObserver::UseNewCache()
   return true;
 }
 
+namespace { // anon
+
+class CacheStorageEvictHelper
+{
+public:
+  nsresult Run(mozIApplicationClearPrivateDataParams* aParams);
+
+private:
+  uint32_t mAppId;
+  nsresult ClearStorage(bool const aPrivate,
+                        bool const aInBrowser,
+                        bool const aAnonymous);
+};
+
+nsresult
+CacheStorageEvictHelper::Run(mozIApplicationClearPrivateDataParams* aParams)
+{
+  nsresult rv;
+
+  rv = aParams->GetAppId(&mAppId);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  bool aBrowserOnly;
+  rv = aParams->GetBrowserOnly(&aBrowserOnly);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  MOZ_ASSERT(mAppId != nsILoadContextInfo::UNKNOWN_APP_ID);
+
+  // Clear all [private X anonymous] combinations
+  rv = ClearStorage(false, aBrowserOnly, false);
+  NS_ENSURE_SUCCESS(rv, rv);
+  rv = ClearStorage(false, aBrowserOnly, true);
+  NS_ENSURE_SUCCESS(rv, rv);
+  rv = ClearStorage(true, aBrowserOnly, false);
+  NS_ENSURE_SUCCESS(rv, rv);
+  rv = ClearStorage(true, aBrowserOnly, true);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  return NS_OK;
+}
+
+nsresult
+CacheStorageEvictHelper::ClearStorage(bool const aPrivate,
+                                      bool const aInBrowser,
+                                      bool const aAnonymous)
+{
+  nsresult rv;
+
+  nsRefPtr<LoadContextInfo> info = GetLoadContextInfo(
+    aPrivate, mAppId, aInBrowser, aAnonymous);
+
+  nsCOMPtr<nsICacheStorage> storage;
+  nsRefPtr<CacheStorageService> service = CacheStorageService::Self();
+  NS_ENSURE_TRUE(service, NS_ERROR_FAILURE);
+
+  // Clear disk storage
+  rv = service->DiskCacheStorage(info, false, getter_AddRefs(storage));
+  NS_ENSURE_SUCCESS(rv, rv);
+  rv = storage->AsyncEvictStorage(nullptr);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  // Clear memory storage
+  rv = service->MemoryCacheStorage(info, getter_AddRefs(storage));
+  NS_ENSURE_SUCCESS(rv, rv);
+  rv = storage->AsyncEvictStorage(nullptr);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  if (!aInBrowser) {
+    rv = ClearStorage(aPrivate, true, aAnonymous);
+    NS_ENSURE_SUCCESS(rv, rv);
+  }
+
+  return NS_OK;
+}
+
+} // anon
+
 NS_IMETHODIMP
 CacheObserver::Observe(nsISupports* aSubject,
                        const char* aTopic,
@@ -133,6 +214,21 @@ CacheObserver::Observe(nsISupports* aSubject,
     return NS_OK;
   }
 
+  if (!strcmp(aTopic, "webapps-clear-data")) {
+    nsCOMPtr<mozIApplicationClearPrivateDataParams> params =
+            do_QueryInterface(aSubject);
+    if (!params) {
+      NS_ERROR("'webapps-clear-data' notification's subject should be a mozIApplicationClearPrivateDataParams");
+      return NS_ERROR_UNEXPECTED;
+    }
+
+    CacheStorageEvictHelper helper;
+    nsresult rv = helper.Run(params);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    return NS_OK;
+  }
+
   if (!strcmp(aTopic, "memory-pressure")) {
     nsRefPtr<CacheStorageService> service = CacheStorageService::Self();
     if (service)
diff --git a/netwerk/cache2/CacheStorage.cpp b/netwerk/cache2/CacheStorage.cpp
index 29b4e04e16c7..d659d14a0ade 100644
--- a/netwerk/cache2/CacheStorage.cpp
+++ b/netwerk/cache2/CacheStorage.cpp
@@ -67,8 +67,12 @@ NS_IMETHODIMP CacheStorage::AsyncOpenURI(nsIURI *aURI,
     rv = noRefURI->GetAsciiSpec(cacheKey);
     NS_ENSURE_SUCCESS(rv, rv);
 
+    nsAutoCString scheme;
+    rv = noRefURI->GetScheme(scheme);
+    NS_ENSURE_SUCCESS(rv, rv);
+
     nsRefPtr<_OldCacheLoad> appCacheLoad =
-      new _OldCacheLoad(cacheKey, aCallback, appCache,
+      new _OldCacheLoad(scheme, cacheKey, aCallback, appCache,
                         LoadInfo(), WriteToDisk(), aFlags);
     rv = appCacheLoad->Start();
     NS_ENSURE_SUCCESS(rv, rv);
diff --git a/netwerk/cache2/CacheStorageService.h b/netwerk/cache2/CacheStorageService.h
index f7f46f895670..8d2f8482526d 100644
--- a/netwerk/cache2/CacheStorageService.h
+++ b/netwerk/cache2/CacheStorageService.h
@@ -199,14 +199,19 @@ private:
 };
 
 template<class T>
-void ProxyReleaseMainThread(nsCOMPtr<T> &object)
+void ProxyRelease(nsCOMPtr<T> &object, nsIThread* thread)
 {
   T* release;
   object.forget(&release);
 
-  nsCOMPtr<nsIThread> mainThread;
-  NS_GetMainThread(getter_AddRefs(mainThread));
-  NS_ProxyRelease(mainThread, release);
+  NS_ProxyRelease(thread, release);
+}
+
+template<class T>
+void ProxyReleaseMainThread(nsCOMPtr<T> &object)
+{
+  nsCOMPtr<nsIThread> mainThread = do_GetMainThread();
+  ProxyRelease(object, mainThread);
 }
 
 } // net
diff --git a/netwerk/cache2/OldWrappers.cpp b/netwerk/cache2/OldWrappers.cpp
index 02405e4bbf87..f92c49f5b905 100644
--- a/netwerk/cache2/OldWrappers.cpp
+++ b/netwerk/cache2/OldWrappers.cpp
@@ -25,6 +25,8 @@
 static NS_DEFINE_CID(kStreamTransportServiceCID,
                      NS_STREAMTRANSPORTSERVICE_CID);
 
+static uint32_t const CHECK_MULTITHREADED = nsICacheStorage::CHECK_MULTITHREADED;
+
 namespace mozilla {
 namespace net {
 
@@ -361,8 +363,9 @@ NS_IMETHODIMP _OldCacheEntryWrapper::HasWriteAccess(bool aWriteAllowed_unused, b
 
 namespace { // anon
 
-void
+nsresult
 GetCacheSessionNameForStoragePolicy(
+        nsCSubstring const &scheme,
         nsCacheStoragePolicy storagePolicy,
         bool isPrivate,
         uint32_t appId,
@@ -371,27 +374,67 @@ GetCacheSessionNameForStoragePolicy(
 {
   MOZ_ASSERT(!isPrivate || storagePolicy == nsICache::STORE_IN_MEMORY);
 
-  switch (storagePolicy) {
+  // HTTP
+  if (scheme.Equals(NS_LITERAL_CSTRING("http")) ||
+      scheme.Equals(NS_LITERAL_CSTRING("https"))) {
+    switch (storagePolicy) {
     case nsICache::STORE_IN_MEMORY:
-      sessionName.AssignASCII(isPrivate ? "HTTP-memory-only-PB" : "HTTP-memory-only");
+      if (isPrivate)
+        sessionName.Assign(NS_LITERAL_CSTRING("HTTP-memory-only-PB"));
+      else
+        sessionName.Assign(NS_LITERAL_CSTRING("HTTP-memory-only"));
       break;
     case nsICache::STORE_OFFLINE:
-      sessionName.AssignLiteral("HTTP-offline");
+      // XXX This is actually never used, only added to prevent
+      // any compatibility damage.
+      sessionName.Assign(NS_LITERAL_CSTRING("HTTP-offline"));
       break;
     default:
-      sessionName.AssignLiteral("HTTP");
+      sessionName.Assign(NS_LITERAL_CSTRING("HTTP"));
       break;
+    }
   }
+  // WYCIWYG
+  else if (scheme.Equals(NS_LITERAL_CSTRING("wyciwyg"))) {
+    if (isPrivate)
+      sessionName.Assign(NS_LITERAL_CSTRING("wyciwyg-private"));
+    else
+      sessionName.Assign(NS_LITERAL_CSTRING("wyciwyg"));
+  }
+  // FTP
+  else if (scheme.Equals(NS_LITERAL_CSTRING("ftp"))) {
+    if (isPrivate)
+      sessionName.Assign(NS_LITERAL_CSTRING("FTP-private"));
+    else
+      sessionName.Assign(NS_LITERAL_CSTRING("FTP"));
+  }
+  // all remaining URL scheme
+  else {
+    // Since with the new API a consumer cannot specify its own session name
+    // and partitioning of the cache is handled stricly only by the cache
+    // back-end internally, we will use a separate session name to pretend
+    // functionality of the new API wrapping the Darin's cache for all other
+    // URL schemes.
+    // Deliberately omitting |anonymous| since other session types don't
+    // recognize it too.
+    sessionName.Assign(NS_LITERAL_CSTRING("other"));
+    if (isPrivate)
+      sessionName.Append(NS_LITERAL_CSTRING("-private"));
+  }
+
   if (appId != nsILoadContextInfo::NO_APP_ID || inBrowser) {
     sessionName.Append('~');
     sessionName.AppendInt(appId);
     sessionName.Append('~');
     sessionName.AppendInt(inBrowser);
   }
+
+  return NS_OK;
 }
 
 nsresult
-GetCacheSession(bool aWriteToDisk,
+GetCacheSession(nsCSubstring const &aScheme,
+                bool aWriteToDisk,
                 nsILoadContextInfo* aLoadInfo,
                 nsIApplicationCache* aAppCache,
                 nsICacheSession** _result)
@@ -411,12 +454,14 @@ GetCacheSession(bool aWriteToDisk,
     aAppCache->GetClientID(clientId);
   }
   else {
-    GetCacheSessionNameForStoragePolicy(
+    rv = GetCacheSessionNameForStoragePolicy(
+      aScheme,
       storagePolicy,
       aLoadInfo->IsPrivate(),
       aLoadInfo->AppId(),
       aLoadInfo->IsInBrowserElement(),
       clientId);
+    NS_ENSURE_SUCCESS(rv, rv);
   }
 
   LOG(("  GetCacheSession for client=%s, policy=%d", clientId.get(), storagePolicy));
@@ -455,19 +500,22 @@ GetCacheSession(bool aWriteToDisk,
 
 NS_IMPL_ISUPPORTS_INHERITED1(_OldCacheLoad, nsRunnable, nsICacheListener)
 
-_OldCacheLoad::_OldCacheLoad(nsCSubstring const& aCacheKey,
+_OldCacheLoad::_OldCacheLoad(nsCSubstring const& aScheme,
+                             nsCSubstring const& aCacheKey,
                              nsICacheEntryOpenCallback* aCallback,
                              nsIApplicationCache* aAppCache,
                              nsILoadContextInfo* aLoadInfo,
                              bool aWriteToDisk,
                              uint32_t aFlags)
-  : mCacheKey(aCacheKey)
+  : mScheme(aScheme)
+  , mCacheKey(aCacheKey)
   , mCallback(aCallback)
   , mLoadInfo(GetLoadContextInfo(aLoadInfo))
   , mFlags(aFlags)
   , mWriteToDisk(aWriteToDisk)
-  , mMainThreadOnly(true)
   , mNew(true)
+  , mOpening(true)
+  , mSync(false)
   , mStatus(NS_ERROR_UNEXPECTED)
   , mRunCount(0)
   , mAppCache(aAppCache)
@@ -484,26 +532,22 @@ _OldCacheLoad::~_OldCacheLoad()
 nsresult _OldCacheLoad::Start()
 {
   LOG(("_OldCacheLoad::Start [this=%p, key=%s]", this, mCacheKey.get()));
-  MOZ_ASSERT(NS_IsMainThread());
 
   mLoadStart = mozilla::TimeStamp::Now();
 
-  bool mainThreadOnly;
-  if (mCallback && (
-      NS_SUCCEEDED(mCallback->GetMainThreadOnly(&mainThreadOnly)) &&
-      !mainThreadOnly)) {
-    mMainThreadOnly = false;
-  }
-
   nsresult rv;
 
+  // Consumers that can invoke this code as first and off the main thread
+  // are responsible for initiating these two services on the main thread.
+  // Currently this is only nsWyciwygChannel.
+
   // XXX: Start the cache service; otherwise DispatchToCacheIOThread will
   // fail.
   nsCOMPtr<nsICacheService> service =
     do_GetService(NS_CACHESERVICE_CONTRACTID, &rv);
 
   // Ensure the stream transport service gets initialized on the main thread
-  if (NS_SUCCEEDED(rv)) {
+  if (NS_SUCCEEDED(rv) && NS_IsMainThread()) {
     nsCOMPtr<nsIStreamTransportService> sts =
       do_GetService(kStreamTransportServiceCID, &rv);
   }
@@ -513,7 +557,20 @@ nsresult _OldCacheLoad::Start()
   }
 
   if (NS_SUCCEEDED(rv)) {
-    rv = mCacheThread->Dispatch(this, NS_DISPATCH_NORMAL);
+    bool onCacheTarget;
+    rv = mCacheThread->IsOnCurrentThread(&onCacheTarget);
+    if (NS_SUCCEEDED(rv) && onCacheTarget) {
+      mSync = true;
+    }
+  }
+
+  if (NS_SUCCEEDED(rv)) {
+    if (mSync) {
+      rv = Run();
+    }
+    else {
+      rv = mCacheThread->Dispatch(this, NS_DISPATCH_NORMAL);
+    }
   }
 
   return rv;
@@ -526,9 +583,11 @@ _OldCacheLoad::Run()
 
   nsresult rv;
 
-  if (!NS_IsMainThread()) {
+  if (mOpening) {
+    mOpening = false;
     nsCOMPtr<nsICacheSession> session;
-    rv = GetCacheSession(mWriteToDisk, mLoadInfo, mAppCache, getter_AddRefs(session));
+    rv = GetCacheSession(mScheme, mWriteToDisk, mLoadInfo, mAppCache,
+                         getter_AddRefs(session));
     if (NS_SUCCEEDED(rv)) {
       // AsyncOpenCacheEntry isn't really async when its called on the
       // cache service thread.
@@ -544,8 +603,21 @@ _OldCacheLoad::Run()
       LOG(("  session->AsyncOpenCacheEntry with access=%d", cacheAccess));
 
       bool bypassBusy = mFlags & nsICacheStorage::OPEN_BYPASS_IF_BUSY;
-      rv = session->AsyncOpenCacheEntry(mCacheKey, cacheAccess, this, bypassBusy);
 
+      if (mSync && cacheAccess == nsICache::ACCESS_WRITE) {
+        nsCOMPtr<nsICacheEntryDescriptor> entry;
+        rv = session->OpenCacheEntry(mCacheKey, cacheAccess, bypassBusy,
+          getter_AddRefs(entry));
+
+        nsCacheAccessMode grantedAccess = 0;
+        if (NS_SUCCEEDED(rv)) {
+          entry->GetAccessGranted(&grantedAccess);
+        }
+
+        return OnCacheEntryAvailable(entry, grantedAccess, rv);
+      }
+
+      rv = session->AsyncOpenCacheEntry(mCacheKey, cacheAccess, this, bypassBusy);
       if (NS_SUCCEEDED(rv))
         return NS_OK;
     }
@@ -579,7 +651,7 @@ _OldCacheLoad::Run()
       }
     }
 
-    if (mMainThreadOnly)
+    if (!(mFlags & CHECK_MULTITHREADED))
       Check();
 
     // break cycles
@@ -620,9 +692,12 @@ _OldCacheLoad::OnCacheEntryAvailable(nsICacheEntryDescriptor *entry,
   mStatus = status;
   mNew = access == nsICache::ACCESS_WRITE;
 
-  if (!mMainThreadOnly)
+  if (mFlags & CHECK_MULTITHREADED)
     Check();
 
+  if (mSync)
+    return Run();
+
   return NS_DispatchToMainThread(this);
 }
 
@@ -697,8 +772,8 @@ NS_IMETHODIMP _OldStorage::AsyncOpenURI(nsIURI *aURI,
 
   nsresult rv;
 
-  nsAutoCString cacheKey;
-  rv = AssembleCacheKey(aURI, aIdExtension, cacheKey);
+  nsAutoCString cacheKey, scheme;
+  rv = AssembleCacheKey(aURI, aIdExtension, cacheKey, scheme);
   NS_ENSURE_SUCCESS(rv, rv);
 
   if (!mAppCache && (mLookupAppCache || mOfflineStorage)) {
@@ -712,7 +787,7 @@ NS_IMETHODIMP _OldStorage::AsyncOpenURI(nsIURI *aURI,
   }
 
   nsRefPtr<_OldCacheLoad> cacheLoad =
-    new _OldCacheLoad(cacheKey, aCallback, mAppCache,
+    new _OldCacheLoad(scheme, cacheKey, aCallback, mAppCache,
                       mLoadInfo, mWriteToDisk, aFlags);
 
   rv = cacheLoad->Start();
@@ -728,12 +803,13 @@ NS_IMETHODIMP _OldStorage::AsyncDoomURI(nsIURI *aURI, const nsACString & aIdExte
 
   nsresult rv;
 
-  nsAutoCString cacheKey;
-  rv = AssembleCacheKey(aURI, aIdExtension, cacheKey);
+  nsAutoCString cacheKey, scheme;
+  rv = AssembleCacheKey(aURI, aIdExtension, cacheKey, scheme);
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsCOMPtr<nsICacheSession> session;
-  rv = GetCacheSession(mWriteToDisk, mLoadInfo, mAppCache, getter_AddRefs(session));
+  rv = GetCacheSession(scheme, mWriteToDisk, mLoadInfo, mAppCache,
+                       getter_AddRefs(session));
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsRefPtr<DoomCallbackWrapper> cb = aCallback
@@ -776,12 +852,44 @@ NS_IMETHODIMP _OldStorage::AsyncEvictStorage(nsICacheEntryDoomCallback* aCallbac
     }
   }
   else {
-    nsCOMPtr<nsICacheSession> session;
-    rv = GetCacheSession(mWriteToDisk, mLoadInfo, mAppCache, getter_AddRefs(session));
-    NS_ENSURE_SUCCESS(rv, rv);
+    if (mAppCache) {
+      nsCOMPtr<nsICacheSession> session;
+      rv = GetCacheSession(EmptyCString(),
+                           mWriteToDisk, mLoadInfo, mAppCache,
+                           getter_AddRefs(session));
+      NS_ENSURE_SUCCESS(rv, rv);
 
-    rv = session->EvictEntries();
-    NS_ENSURE_SUCCESS(rv, rv);
+      rv = session->EvictEntries();
+      NS_ENSURE_SUCCESS(rv, rv);
+    }
+    else {
+      // Oh, I'll be so happy when session names are gone...
+      nsCOMPtr<nsICacheSession> session;
+      rv = GetCacheSession(NS_LITERAL_CSTRING("http"),
+                           mWriteToDisk, mLoadInfo, mAppCache,
+                           getter_AddRefs(session));
+      NS_ENSURE_SUCCESS(rv, rv);
+
+      rv = session->EvictEntries();
+      NS_ENSURE_SUCCESS(rv, rv);
+
+      rv = GetCacheSession(NS_LITERAL_CSTRING("wyciwyg"),
+                           mWriteToDisk, mLoadInfo, mAppCache,
+                           getter_AddRefs(session));
+      NS_ENSURE_SUCCESS(rv, rv);
+
+      rv = session->EvictEntries();
+      NS_ENSURE_SUCCESS(rv, rv);
+
+      // This clears any data from scheme other then http, wyciwyg or ftp
+      rv = GetCacheSession(EmptyCString(),
+                           mWriteToDisk, mLoadInfo, mAppCache,
+                           getter_AddRefs(session));
+      NS_ENSURE_SUCCESS(rv, rv);
+
+      rv = session->EvictEntries();
+      NS_ENSURE_SUCCESS(rv, rv);
+    }
   }
 
   if (aCallback) {
@@ -841,33 +949,49 @@ NS_IMETHODIMP _OldStorage::AsyncVisitStorage(nsICacheStorageVisitor* aVisitor,
 
 nsresult _OldStorage::AssembleCacheKey(nsIURI *aURI,
                                        nsACString const & aIdExtension,
-                                       nsACString & aCacheKey)
+                                       nsACString & aCacheKey,
+                                       nsACString & aScheme)
 {
   // Copied from nsHttpChannel::AssembleCacheKey
 
   aCacheKey.Truncate();
 
-  if (mLoadInfo->IsAnonymous()) {
-    aCacheKey.AssignLiteral("anon&");
-  }
-
-  if (!aIdExtension.IsEmpty()) {
-    aCacheKey.AppendPrintf("id=%s&", aIdExtension.BeginReading());
-  }
-
   nsresult rv;
 
-  nsCOMPtr<nsIURI> noRefURI;
-  rv = aURI->CloneIgnoringRef(getter_AddRefs(noRefURI));
+  rv = aURI->GetScheme(aScheme);
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsAutoCString uriSpec;
-  rv = noRefURI->GetAsciiSpec(uriSpec);
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (aScheme.Equals(NS_LITERAL_CSTRING("http")) ||
+      aScheme.Equals(NS_LITERAL_CSTRING("https"))) {
+    if (mLoadInfo->IsAnonymous()) {
+      aCacheKey.AssignLiteral("anon&");
+    }
 
-  if (!aCacheKey.IsEmpty()) {
-    aCacheKey.AppendLiteral("uri=");
+    if (!aIdExtension.IsEmpty()) {
+      aCacheKey.AppendPrintf("id=%s&", aIdExtension.BeginReading());
+    }
+
+    nsCOMPtr<nsIURI> noRefURI;
+    rv = aURI->CloneIgnoringRef(getter_AddRefs(noRefURI));
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    rv = noRefURI->GetAsciiSpec(uriSpec);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    if (!aCacheKey.IsEmpty()) {
+      aCacheKey.AppendLiteral("uri=");
+    }
   }
+  else if (aScheme.Equals(NS_LITERAL_CSTRING("wyciwyg"))) {
+    rv = aURI->GetSpec(uriSpec);
+    NS_ENSURE_SUCCESS(rv, rv);
+  }
+  else {
+    rv = aURI->GetAsciiSpec(uriSpec);
+    NS_ENSURE_SUCCESS(rv, rv);
+  }
+
   aCacheKey.Append(uriSpec);
 
   return NS_OK;
diff --git a/netwerk/cache2/OldWrappers.h b/netwerk/cache2/OldWrappers.h
index 8b1eb4416bf2..c7f94f088dd2 100644
--- a/netwerk/cache2/OldWrappers.h
+++ b/netwerk/cache2/OldWrappers.h
@@ -61,7 +61,8 @@ public:
   NS_DECL_NSIRUNNABLE
   NS_DECL_NSICACHELISTENER
 
-  _OldCacheLoad(nsCSubstring const& aCacheKey,
+  _OldCacheLoad(nsCSubstring const& aScheme,
+                nsCSubstring const& aCacheKey,
                 nsICacheEntryOpenCallback* aCallback,
                 nsIApplicationCache* aAppCache,
                 nsILoadContextInfo* aLoadInfo,
@@ -76,14 +77,16 @@ private:
 
   nsCOMPtr<nsIEventTarget> mCacheThread;
 
-  nsCString mCacheKey;
+  nsCString const mScheme;
+  nsCString const mCacheKey;
   nsCOMPtr<nsICacheEntryOpenCallback> mCallback;
   nsCOMPtr<nsILoadContextInfo> mLoadInfo;
-  uint32_t mFlags;
+  uint32_t const mFlags;
 
   bool const mWriteToDisk : 1;
-  bool mMainThreadOnly : 1;
   bool mNew : 1;
+  bool mOpening : 1;
+  bool mSync : 1;
 
   nsCOMPtr<nsICacheEntry> mCacheEntry;
   nsresult mStatus;
@@ -108,7 +111,8 @@ public:
 
 private:
   virtual ~_OldStorage();
-  nsresult AssembleCacheKey(nsIURI *aURI, nsACString const & aIdExtension, nsACString & _result);
+  nsresult AssembleCacheKey(nsIURI *aURI, nsACString const & aIdExtension,
+                            nsACString & aCacheKey, nsACString & aScheme);
   nsresult ChooseApplicationCache(nsCSubstring const &cacheKey, nsIApplicationCache** aCache);
 
   nsCOMPtr<nsILoadContextInfo> mLoadInfo;
diff --git a/netwerk/cache2/moz.build b/netwerk/cache2/moz.build
index a1983a4de769..acf93e81f909 100644
--- a/netwerk/cache2/moz.build
+++ b/netwerk/cache2/moz.build
@@ -20,7 +20,7 @@ EXPORTS += [
     'CacheStorageService.h',
 ]
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'AppCacheStorage.cpp',
     'CacheEntriesEnumerator.cpp',
     'CacheEntry.cpp',
diff --git a/netwerk/cache2/nsICacheEntryOpenCallback.idl b/netwerk/cache2/nsICacheEntryOpenCallback.idl
index 984cfbb04dca..68409bb7ebe2 100644
--- a/netwerk/cache2/nsICacheEntryOpenCallback.idl
+++ b/netwerk/cache2/nsICacheEntryOpenCallback.idl
@@ -7,13 +7,17 @@
 interface nsICacheEntry;
 interface nsIApplicationCache;
 
-[scriptable, uuid(cdd8b9be-71f0-4b0a-a7f4-626fbb3d2e9b)]
+[scriptable, uuid(1fc9fe11-c6ac-4748-94bd-8555a5a12b94)]
 interface nsICacheEntryOpenCallback : nsISupports
 {
   /**
    * State of the entry determined by onCacheEntryCheck.
    *
    * ENTRY_WANTED - the consumer is interested in the entry, we will pass it.
+   * RECHECK_AFTER_WRITE_FINISHED - the consumer cannot use the entry while data is
+   *    still being written and wants to check it again after the current write is
+   *    finished. This actually prevents concurrent read/write and is used with
+   *    non-resumable HTTP responses.
    * ENTRY_NEEDS_REVALIDATION - entry needs to be revalidated first with origin server,
    *    this means the loading channel will decide whether to use the entry content
    *    as is after it gets a positive response from the server about validity of the
@@ -23,12 +27,22 @@ interface nsICacheEntryOpenCallback : nsISupports
    * ENTRY_NOT_WANTED - the consumer is not interested in the entry, we will not pass it.
    */
   const unsigned long ENTRY_WANTED = 0;
-  const unsigned long ENTRY_NEEDS_REVALIDATION = 1;
-  const unsigned long ENTRY_NOT_WANTED = 2;
+  const unsigned long RECHECK_AFTER_WRITE_FINISHED = 1;
+  const unsigned long ENTRY_NEEDS_REVALIDATION = 2;
+  const unsigned long ENTRY_NOT_WANTED = 3;
 
   /**
    * Callback to perform any validity checks before the entry should be used.
-   * Called before onCacheEntryAvailable callback.
+   * Called before onCacheEntryAvailable callback, depending on the result it
+   * may be called more then one time.
+   *
+   * This callback is ensured to be called on the same thread on which asyncOpenURI
+   * has been called, unless nsICacheStorage.CHECK_MULTITHREADED flag has been specified.
+   * In that case this callback can be invoked on any thread, usually it is the cache I/O
+   * or cache management thread.
+   *
+   * IMPORTANT NOTE: 
+   * This callback may be invoked sooner then respective asyncOpenURI call exits.
    *
    * @param aEntry
    *    An entry to examine.  Consumer has a chance to decide whether the
@@ -37,15 +51,18 @@ interface nsICacheEntryOpenCallback : nsISupports
    *    Optional, application cache the entry has been found in, if any.
    * @return
    *    State of the entry, see the constants just above.
-   *
-   * NOTE: This callback is invoked on the cache background thread.
    */
   unsigned long onCacheEntryCheck(in nsICacheEntry aEntry,
                                   in nsIApplicationCache aApplicationCache);
 
   /**
-   * Callback implemented by consumers of nsICacheStorage fetching
-   * result of the cache async open request.
+   * Callback giving actual result of asyncOpenURI.  It may give consumer the cache 
+   * entry or a failure result when it's not possible to open it from some reason.
+   * This callback is ensured to be called on the same thread on which asyncOpenURI
+   * has been called.
+   *
+   * IMPORTANT NOTE: 
+   * This callback may be invoked sooner then respective asyncOpenURI call exits.
    *
    * @param aEntry
    *    The entry bound to the originally requested URI.  May be null when
@@ -60,24 +77,15 @@ interface nsICacheEntryOpenCallback : nsISupports
    *    given application cache.  It should be associated with the loading
    *    channel.
    * @param aResult
-   *    Result of request.  This may be a failure only when one of these
+   *    Result of the request.  This may be a failure only when one of these
    *    issues occur:
    *    - the cache storage service could not be started due to some unexpected
    *      faulure
    *    - there is not enough disk space to create new entries
    *    - cache entry was not found in a given application cache
-   *
-   * NOTE: In the current implementation this callback is invoked on the main thread
-   *       however, we would like to call this on a different thread in the future.
    */
   void onCacheEntryAvailable(in nsICacheEntry aEntry,
                              in boolean aNew,
                              in nsIApplicationCache aApplicationCache,
                              in nsresult aResult);
-
-  /**
-   * Whether this callback can be invoked on any thread, or just on the main thread
-   * when the consumer is e.g. a JS.
-   */
-  readonly attribute boolean mainThreadOnly;
 };
diff --git a/netwerk/cache2/nsICacheStorage.idl b/netwerk/cache2/nsICacheStorage.idl
index 21a326fe9661..ca6f948b085a 100644
--- a/netwerk/cache2/nsICacheStorage.idl
+++ b/netwerk/cache2/nsICacheStorage.idl
@@ -38,13 +38,17 @@ interface nsICacheStorage : nsISupports
   const uint32_t OPEN_PRIORITY = 1 << 2;
 
   /**
-   * BACKWARD COMPATIBILITY ONLY
-   *
-   * Reflects LOAD_BYPASS_LOCAL_CACHE_IF_BUSY.  Only used for the old
-   * backend compatibility.  Doesn't have any mening in the new
-   * implementation.
+   * Bypass the cache load when write is still in progress.
    */
-  const uint32_t OPEN_BYPASS_IF_BUSY = 1 << 31;
+  const uint32_t OPEN_BYPASS_IF_BUSY = 1 << 3;
+
+  /**
+   * Perform the cache entry check (onCacheEntryCheck invocation) on any thread 
+   * for optimal perfomance optimization.  If this flag is not specified it is
+   * ensured that onCacheEntryCheck is called on the same thread as respective 
+   * asyncOpen has been called.
+   */
+  const uint32_t CHECK_MULTITHREADED = 1 << 4;
 
   /**
    * Asynchronously opens a cache entry for the specified URI.
@@ -63,6 +67,8 @@ interface nsICacheStorage : nsISupports
    *    OPEN_READONLY - don't create an entry if there is none
    *    OPEN_PRIORITY - give this request a priority over others
    *    OPEN_BYPASS_IF_BUSY - backward compatibility only, LOAD_BYPASS_LOCAL_CACHE_IF_BUSY
+   *    CHECK_MULTITHREADED - onCacheEntryCheck may be called on any thread, consumer 
+   *                          implementation is thread-safe
    * @param aCallback
    *    The consumer that receives the result.
    *    IMPORTANT: The callback may be called sooner the method returns.
diff --git a/netwerk/protocol/ftp/moz.build b/netwerk/protocol/ftp/moz.build
index 366b32a6dfa4..566e08849c1a 100644
--- a/netwerk/protocol/ftp/moz.build
+++ b/netwerk/protocol/ftp/moz.build
@@ -19,7 +19,7 @@ EXPORTS.mozilla.net += [
     'FTPChannelParent.h',
 ]
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'FTPChannelChild.cpp',
     'FTPChannelParent.cpp',
     'nsFTPChannel.cpp',
diff --git a/netwerk/protocol/ftp/nsFtpConnectionThread.cpp b/netwerk/protocol/ftp/nsFtpConnectionThread.cpp
index 61c043c0ef3e..715392c4ebc1 100644
--- a/netwerk/protocol/ftp/nsFtpConnectionThread.cpp
+++ b/netwerk/protocol/ftp/nsFtpConnectionThread.cpp
@@ -1556,12 +1556,12 @@ nsFtpState::R_pasv() {
 // nsIRequest methods:
 
 static inline
-uint32_t NowInSeconds()
+uint32_t GetFtpTime()
 {
     return uint32_t(PR_Now() / PR_USEC_PER_SEC);
 }
 
-uint32_t nsFtpState::mSessionStartTime = NowInSeconds();
+uint32_t nsFtpState::mSessionStartTime = GetFtpTime();
 
 /* Is this cache entry valid to use for reading?
  * Since we make up an expiration time for ftp, use the following rules:
@@ -1620,7 +1620,7 @@ nsFtpState::CanReadCacheEntry()
     if (NS_FAILED(rv))
         return false;
 
-    return (NowInSeconds() <= time);
+    return (GetFtpTime() <= time);
 }
 
 nsresult
diff --git a/netwerk/protocol/ftp/nsFtpControlConnection.cpp b/netwerk/protocol/ftp/nsFtpControlConnection.cpp
index ffaa555bed45..b9923c3a7d37 100644
--- a/netwerk/protocol/ftp/nsFtpControlConnection.cpp
+++ b/netwerk/protocol/ftp/nsFtpControlConnection.cpp
@@ -34,7 +34,7 @@ nsFtpControlConnection::OnInputStreamReady(nsIAsyncInputStream *stream)
 
     // Consume data whether we have a listener or not.
     uint64_t avail64;
-    uint32_t avail;
+    uint32_t avail = 0;
     nsresult rv = stream->Available(&avail64);
     if (NS_SUCCEEDED(rv)) {
         avail = (uint32_t)std::min(avail64, (uint64_t)sizeof(data));
diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp
index 37d1ab7a690a..fa79410bd837 100644
--- a/netwerk/protocol/http/nsHttpChannel.cpp
+++ b/netwerk/protocol/http/nsHttpChannel.cpp
@@ -891,7 +891,12 @@ nsHttpChannel::CallOnStartRequest()
     // if this channel is for a download, close off access to the cache.
     if (mCacheEntry && mChannelIsForDownload) {
         mCacheEntry->AsyncDoom(nullptr);
-        CloseCacheEntry(false);
+
+        // We must keep the cache entry in case of partial request.
+        // Concurrent access is the same, we need the entry in
+        // OnStopRequest.
+        if (!mCachedContentIsPartial && !mConcurentCacheAccess)
+            CloseCacheEntry(false);
     }
 
     if (!mCanceled) {
@@ -2003,32 +2008,38 @@ nsHttpChannel::EnsureAssocReq()
 // nsHttpChannel <byte-range>
 //-----------------------------------------------------------------------------
 
-nsresult
-nsHttpChannel::MaybeSetupByteRangeRequest(int64_t partialLen, int64_t contentLength)
+bool
+nsHttpChannel::IsResumable(int64_t partialLen, int64_t contentLength,
+                           bool ignoreMissingPartialLen) const
 {
-    nsresult rv = NS_OK;
-
     bool hasContentEncoding =
         mCachedResponseHead->PeekHeader(nsHttp::Content_Encoding)
         != nullptr;
 
+    return (partialLen < contentLength) &&
+           (partialLen > 0 || ignoreMissingPartialLen) &&
+           !hasContentEncoding &&
+           mCachedResponseHead->IsResumable() &&
+           !mCustomConditionalRequest &&
+           !mCachedResponseHead->NoStore();
+}
+
+nsresult
+nsHttpChannel::MaybeSetupByteRangeRequest(int64_t partialLen, int64_t contentLength)
+{
     // Be pesimistic
     mIsPartialRequest = false;
 
-    if ((partialLen < contentLength) &&
-         partialLen > 0 &&
-         !hasContentEncoding &&
-         mCachedResponseHead->IsResumable() &&
-         !mCustomConditionalRequest &&
-         !mCachedResponseHead->NoStore()) {
-        // looks like a partial entry we can reuse; add If-Range
-        // and Range headers.
-        rv = SetupByteRangeRequest(partialLen);
-        if (NS_FAILED(rv)) {
-            // Make the request unconditional again.
-            mRequestHead.ClearHeader(nsHttp::Range);
-            mRequestHead.ClearHeader(nsHttp::If_Range);
-        }
+    if (!IsResumable(partialLen, contentLength))
+      return NS_OK;
+
+    // looks like a partial entry we can reuse; add If-Range
+    // and Range headers.
+    nsresult rv = SetupByteRangeRequest(partialLen);
+    if (NS_FAILED(rv)) {
+        // Make the request unconditional again.
+        mRequestHead.ClearHeader(nsHttp::Range);
+        mRequestHead.ClearHeader(nsHttp::If_Range);
     }
 
     return rv;
@@ -2538,7 +2549,8 @@ nsHttpChannel::OpenCacheEntry(bool usingSSL)
         cacheEntryOpenFlags = nsICacheStorage::OPEN_TRUNCATE;
     }
     else {
-        cacheEntryOpenFlags = nsICacheStorage::OPEN_NORMALLY;
+        cacheEntryOpenFlags = nsICacheStorage::OPEN_NORMALLY
+                            | nsICacheStorage::CHECK_MULTITHREADED;
     }
 
     if (mApplicationCache) {
@@ -2717,6 +2729,8 @@ nsHttpChannel::OnCacheEntryCheck(nsICacheEntry* entry, nsIApplicationCache* appC
         return rv;
     }
 
+    bool wantCompleteEntry = false;
+
     if (method != nsHttp::Head && !isCachedRedirect) {
         // If the cached content-length is set and it does not match the data
         // size of the cached content, then the cached response is partial...
@@ -2735,11 +2749,21 @@ nsHttpChannel::OnCacheEntryCheck(nsICacheEntry* entry, nsIApplicationCache* appC
             if (mLoadFlags & LOAD_BYPASS_LOCAL_CACHE_IF_BUSY) {
                 LOG(("  not interested in the entry, "
                      "LOAD_BYPASS_LOCAL_CACHE_IF_BUSY specified"));
+
                 *aResult = ENTRY_NOT_WANTED;
                 return NS_OK;
             }
 
-            mConcurentCacheAccess = 1;
+            // Ignore !(size > 0) from the resumability condition
+            if (!IsResumable(size, contentLength, true)) {
+                LOG(("  wait for entry completion, "
+                     "response is not resumable"));
+
+                wantCompleteEntry = true;
+            }
+            else {
+                mConcurentCacheAccess = 1;
+            }
         }
         else if (contentLength != int64_t(-1) && contentLength != size) {
             LOG(("Cached data size does not match the Content-Length header "
@@ -2946,6 +2970,8 @@ nsHttpChannel::OnCacheEntryCheck(nsICacheEntry* entry, nsIApplicationCache* appC
 
     if (mDidReval)
         *aResult = ENTRY_NEEDS_REVALIDATION;
+    else if (wantCompleteEntry)
+        *aResult = RECHECK_AFTER_WRITE_FINISHED;
     else
         *aResult = ENTRY_WANTED;
 
@@ -3041,10 +3067,16 @@ nsHttpChannel::OnNormalCacheEntryAvailable(nsICacheEntry *aEntry,
 {
     mCacheEntriesToWaitFor &= ~WAIT_FOR_CACHE_ENTRY;
 
-    if ((mLoadFlags & LOAD_ONLY_FROM_CACHE) && (NS_FAILED(aEntryStatus) || aNew)) {
-        // if this channel is only allowed to pull from the cache, then
-        // we must fail if we were unable to open a cache entry for read.
-        return NS_ERROR_DOCUMENT_NOT_CACHED;
+    if (NS_FAILED(aEntryStatus) || aNew) {
+        // Make sure this flag is dropped.  It may happen the entry is doomed
+        // between OnCacheEntryCheck and OnCacheEntryAvailable.
+        mCachedContentIsValid = false;
+
+        if (mLoadFlags & LOAD_ONLY_FROM_CACHE) {
+            // if this channel is only allowed to pull from the cache, then
+            // we must fail if we were unable to open a cache entry for read.
+            return NS_ERROR_DOCUMENT_NOT_CACHED;
+        }
     }
 
     if (NS_SUCCEEDED(aEntryStatus)) {
@@ -3144,16 +3176,6 @@ nsHttpChannel::OnOfflineCacheEntryForWritingAvailable(nsICacheEntry *aEntry,
     return aEntryStatus;
 }
 
-NS_IMETHODIMP
-nsHttpChannel::GetMainThreadOnly(bool *aMainThreadOnly)
-{
-    NS_ENSURE_ARG(aMainThreadOnly);
-
-    // This implementation accepts callbacks on any thread
-    *aMainThreadOnly = false;
-    return NS_OK;
-}
-
 // Generates the proper cache-key for this instance of nsHttpChannel
 nsresult
 nsHttpChannel::GenerateCacheKey(uint32_t postID, nsACString &cacheKey)
diff --git a/netwerk/protocol/http/nsHttpChannel.h b/netwerk/protocol/http/nsHttpChannel.h
index fa5d40376fa7..2fa3bf555883 100644
--- a/netwerk/protocol/http/nsHttpChannel.h
+++ b/netwerk/protocol/http/nsHttpChannel.h
@@ -314,6 +314,8 @@ private:
     static bool HasQueryString(nsHttpAtom method, nsIURI * uri);
     bool ResponseWouldVary(nsICacheEntry* entry) const;
     bool MustValidateBasedOnQueryUrl() const;
+    bool IsResumable(int64_t partialLen, int64_t contentLength,
+                     bool ignoreMissingPartialLen = false) const;
     nsresult MaybeSetupByteRangeRequest(int64_t partialLen, int64_t contentLength);
     nsresult SetupByteRangeRequest(int64_t partialLen);
     nsresult OpenCacheInputStream(nsICacheEntry* cacheEntry, bool startBuffering);
diff --git a/netwerk/protocol/http/nsHttpHandler.cpp b/netwerk/protocol/http/nsHttpHandler.cpp
index 6a8c8f207130..f7d2608591f7 100644
--- a/netwerk/protocol/http/nsHttpHandler.cpp
+++ b/netwerk/protocol/http/nsHttpHandler.cpp
@@ -20,8 +20,6 @@
 #include "nsIHttpChannel.h"
 #include "nsIStandardURL.h"
 #include "LoadContextInfo.h"
-#include "nsICacheStorageService.h"
-#include "nsICacheStorage.h"
 #include "nsCategoryManagerUtils.h"
 #include "nsIPrefService.h"
 #include "nsIPrefBranch.h"
@@ -357,7 +355,6 @@ nsHttpHandler::Init()
         mObserverService->AddObserver(this, "net:prune-dead-connections", true);
         mObserverService->AddObserver(this, "net:failed-to-process-uri-content", true);
         mObserverService->AddObserver(this, "last-pb-context-exited", true);
-        mObserverService->AddObserver(this, "webapps-clear-data", true);
     }
 
     MakeNewRequestTokenBucket();
@@ -1748,84 +1745,6 @@ nsHttpHandler::GetCacheSessionNameForStoragePolicy(
 // nsHttpHandler::nsIObserver
 //-----------------------------------------------------------------------------
 
-namespace { // anon
-
-class CacheStorageEvictHelper
-{
-public:
-    CacheStorageEvictHelper(uint32_t appId, bool browserOnly)
-      : mAppId(appId), mBrowserOnly(browserOnly) { }
-
-    nsresult Run();
-
-private:
-    nsCOMPtr<nsICacheStorageService> mCacheStorageService;
-    uint32_t mAppId;
-    bool mBrowserOnly;
-
-    nsresult ClearStorage(bool const aPrivate,
-                          bool const aInBrowser,
-                          bool const aAnonymous);
-};
-
-nsresult
-CacheStorageEvictHelper::Run()
-{
-    nsresult rv;
-
-    mCacheStorageService = do_GetService(
-        "@mozilla.org/netwerk/cache-storage-service;1", &rv);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    // Clear all [private X anonymous] combinations
-    rv = ClearStorage(false, mBrowserOnly, false);
-    NS_ENSURE_SUCCESS(rv, rv);
-    rv = ClearStorage(false, mBrowserOnly, true);
-    NS_ENSURE_SUCCESS(rv, rv);
-    rv = ClearStorage(true, mBrowserOnly, false);
-    NS_ENSURE_SUCCESS(rv, rv);
-    rv = ClearStorage(true, mBrowserOnly, true);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    return NS_OK;
-}
-
-nsresult
-CacheStorageEvictHelper::ClearStorage(bool const aPrivate,
-                                      bool const aInBrowser,
-                                      bool const aAnonymous)
-{
-    nsresult rv;
-
-    nsRefPtr<LoadContextInfo> info = GetLoadContextInfo(
-        aPrivate, mAppId, aInBrowser, aAnonymous);
-
-    nsCOMPtr<nsICacheStorage> storage;
-
-    // Clear disk storage
-    rv = mCacheStorageService->DiskCacheStorage(info, false,
-        getter_AddRefs(storage));
-    NS_ENSURE_SUCCESS(rv, rv);
-    rv = storage->AsyncEvictStorage(nullptr);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    // Clear memory storage
-    rv = mCacheStorageService->MemoryCacheStorage(info,
-        getter_AddRefs(storage));
-    NS_ENSURE_SUCCESS(rv, rv);
-    rv = storage->AsyncEvictStorage(nullptr);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    if (!aInBrowser) {
-        rv = ClearStorage(aPrivate, true, aAnonymous);
-        NS_ENSURE_SUCCESS(rv, rv);
-    }
-
-    return NS_OK;
-}
-
-} // anon
-
 NS_IMETHODIMP
 nsHttpHandler::Observe(nsISupports *subject,
                        const char *topic,
@@ -1878,27 +1797,6 @@ nsHttpHandler::Observe(nsISupports *subject,
     else if (strcmp(topic, "last-pb-context-exited") == 0) {
         mPrivateAuthCache.ClearAll();
     }
-    else if (strcmp(topic, "webapps-clear-data") == 0) {
-        nsCOMPtr<mozIApplicationClearPrivateDataParams> params =
-                do_QueryInterface(subject);
-        if (!params) {
-            NS_ERROR("'webapps-clear-data' notification's subject should be a mozIApplicationClearPrivateDataParams");
-            return NS_ERROR_UNEXPECTED;
-        }
-
-        uint32_t appId;
-        bool browserOnly;
-        nsresult rv = params->GetAppId(&appId);
-        NS_ENSURE_SUCCESS(rv, rv);
-        rv = params->GetBrowserOnly(&browserOnly);
-        NS_ENSURE_SUCCESS(rv, rv);
-
-        MOZ_ASSERT(appId != NECKO_UNKNOWN_APP_ID);
-
-        CacheStorageEvictHelper helper(appId, browserOnly);
-        rv = helper.Run();
-        NS_ENSURE_SUCCESS(rv, rv);
-    }
 
     return NS_OK;
 }
diff --git a/netwerk/protocol/rtsp/controller/RtspController.cpp b/netwerk/protocol/rtsp/controller/RtspController.cpp
index dd9e01b32968..d8acf5d446af 100644
--- a/netwerk/protocol/rtsp/controller/RtspController.cpp
+++ b/netwerk/protocol/rtsp/controller/RtspController.cpp
@@ -84,7 +84,7 @@ RtspController::Play(void)
   }
 
   if (mState != CONNECTED) {
-    return NS_ERROR_UNEXPECTED;
+    return NS_ERROR_NOT_CONNECTED;
   }
 
   mRtspSource->play();
@@ -101,7 +101,7 @@ RtspController::Pause(void)
   }
 
   if (mState != CONNECTED) {
-    return NS_ERROR_UNEXPECTED;
+    return NS_ERROR_NOT_CONNECTED;
   }
 
   mRtspSource->pause();
@@ -118,7 +118,7 @@ RtspController::Resume(void)
   }
 
   if (mState != CONNECTED) {
-    return NS_ERROR_UNEXPECTED;
+    return NS_ERROR_NOT_CONNECTED;
   }
 
   mRtspSource->play();
@@ -135,7 +135,7 @@ RtspController::Suspend(void)
   }
 
   if (mState != CONNECTED) {
-    return NS_ERROR_UNEXPECTED;
+    return NS_ERROR_NOT_CONNECTED;
   }
 
   mRtspSource->pause();
@@ -152,7 +152,7 @@ RtspController::Seek(uint64_t seekTimeUs)
   }
 
   if (mState != CONNECTED) {
-    return NS_ERROR_UNEXPECTED;
+    return NS_ERROR_NOT_CONNECTED;
   }
 
   mRtspSource->seek(seekTimeUs);
diff --git a/netwerk/protocol/rtsp/controller/RtspControllerChild.cpp b/netwerk/protocol/rtsp/controller/RtspControllerChild.cpp
index d1f1e712ddd6..357a1ae6f45a 100644
--- a/netwerk/protocol/rtsp/controller/RtspControllerChild.cpp
+++ b/netwerk/protocol/rtsp/controller/RtspControllerChild.cpp
@@ -110,23 +110,20 @@ RtspControllerChild::RecvOnConnected(
                        const uint8_t& index,
                        const InfallibleTArray<RtspMetadataParam>& metaArray)
 {
-  uint32_t tracks;
-
   // Deserialize meta data.
   nsRefPtr<RtspMetaData> meta = new RtspMetaData();
   nsresult rv = meta->DeserializeRtspMetaData(metaArray);
   NS_ENSURE_SUCCESS(rv, true);
-  meta->GetTotalTracks(&tracks);
-  if (tracks <= 0) {
-    LOG(("RtspControllerChild::RecvOnConnected invalid tracks %d", tracks));
+  meta->GetTotalTracks(&mTotalTracks);
+  if (mTotalTracks <= 0) {
+    LOG(("RtspControllerChild::RecvOnConnected invalid tracks %d", mTotalTracks));
     // Set the default value.
-    tracks = kRtspTotalTracks;
+    mTotalTracks = kRtspTotalTracks;
   }
-  mTotalTracks = tracks;
   AddMetaData(meta.forget());
 
   // Notify the listener when meta data of tracks are available.
-  if ((index + 1) == tracks) {
+  if ((index + 1) == mTotalTracks) {
     // The controller provide |GetTrackMetaData| method for his client.
     if (mListener) {
       mListener->OnConnected(index, nullptr);
diff --git a/netwerk/protocol/rtsp/controller/RtspControllerParent.cpp b/netwerk/protocol/rtsp/controller/RtspControllerParent.cpp
index b5400e237051..23bd23b34bb9 100644
--- a/netwerk/protocol/rtsp/controller/RtspControllerParent.cpp
+++ b/netwerk/protocol/rtsp/controller/RtspControllerParent.cpp
@@ -19,6 +19,13 @@ PRLogModuleInfo* gRtspLog;
 #undef LOG
 #define LOG(args) PR_LOG(gRtspLog, PR_LOG_DEBUG, args)
 
+#define SEND_DISCONNECT_IF_ERROR(rv)                         \
+  if (NS_FAILED(rv) && mIPCOpen && mTotalTracks > 0) {       \
+    for (int i = 0; i < mTotalTracks; i++) {                 \
+      SendOnDisconnected(i, rv);                             \
+    }                                                        \
+  }
+
 using namespace mozilla::ipc;
 
 namespace mozilla {
@@ -30,6 +37,7 @@ NS_IMPL_ISUPPORTS2(RtspControllerParent,
 
 RtspControllerParent::RtspControllerParent()
   : mIPCOpen(true)
+  , mTotalTracks(0)
 {
 #if defined(PR_LOGGING)
   if (!gRtspLog)
@@ -75,7 +83,7 @@ RtspControllerParent::RecvPlay()
   NS_ENSURE_TRUE(mController, true);
 
   nsresult rv = mController->Play();
-  NS_ENSURE_SUCCESS(rv, true);
+  SEND_DISCONNECT_IF_ERROR(rv)
   return true;
 }
 
@@ -86,7 +94,7 @@ RtspControllerParent::RecvPause()
   NS_ENSURE_TRUE(mController, true);
 
   nsresult rv = mController->Pause();
-  NS_ENSURE_SUCCESS(rv, true);
+  SEND_DISCONNECT_IF_ERROR(rv)
   return true;
 }
 
@@ -97,7 +105,7 @@ RtspControllerParent::RecvResume()
   NS_ENSURE_TRUE(mController, true);
 
   nsresult rv = mController->Resume();
-  NS_ENSURE_SUCCESS(rv, true);
+  SEND_DISCONNECT_IF_ERROR(rv)
   return true;
 }
 
@@ -108,7 +116,7 @@ RtspControllerParent::RecvSuspend()
   NS_ENSURE_TRUE(mController, true);
 
   nsresult rv = mController->Suspend();
-  NS_ENSURE_SUCCESS(rv, true);
+  SEND_DISCONNECT_IF_ERROR(rv)
   return true;
 }
 
@@ -119,7 +127,7 @@ RtspControllerParent::RecvSeek(const uint64_t& offset)
   NS_ENSURE_TRUE(mController, true);
 
   nsresult rv = mController->Seek(offset);
-  NS_ENSURE_SUCCESS(rv, true);
+  SEND_DISCONNECT_IF_ERROR(rv)
   return true;
 }
 
@@ -183,9 +191,9 @@ RtspControllerParent::OnConnected(uint8_t index,
   InfallibleTArray<RtspMetadataParam> metaData;
   nsCString name;
   name.AssignLiteral("TRACKS");
-  nsresult rv = meta->GetTotalTracks(&int32Value);
+  nsresult rv = meta->GetTotalTracks(&mTotalTracks);
   NS_ENSURE_SUCCESS(rv, NS_ERROR_FAILURE);
-  metaData.AppendElement(RtspMetadataParam(name, int32Value));
+  metaData.AppendElement(RtspMetadataParam(name, mTotalTracks));
 
   name.AssignLiteral("MIMETYPE");
   nsCString mimeType;
diff --git a/netwerk/protocol/rtsp/controller/RtspControllerParent.h b/netwerk/protocol/rtsp/controller/RtspControllerParent.h
index 7135fe24b20f..1e0d01fa1658 100644
--- a/netwerk/protocol/rtsp/controller/RtspControllerParent.h
+++ b/netwerk/protocol/rtsp/controller/RtspControllerParent.h
@@ -48,6 +48,7 @@ class RtspControllerParent : public PRtspControllerParent
   nsCOMPtr<nsIURI> mURI;
   // The nsIStreamingProtocolController implementation.
   nsCOMPtr<nsIStreamingProtocolController> mController;
+  uint32_t mTotalTracks;
 };
 
 } // namespace net
diff --git a/netwerk/protocol/rtsp/moz.build b/netwerk/protocol/rtsp/moz.build
index 91b4bbd57bb6..6997b795eafd 100644
--- a/netwerk/protocol/rtsp/moz.build
+++ b/netwerk/protocol/rtsp/moz.build
@@ -15,11 +15,17 @@ EXPORTS.mozilla.net += [
     'RtspHandler.h',
 ]
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'controller/RtspController.cpp',
     'controller/RtspControllerChild.cpp',
     'controller/RtspControllerParent.cpp',
     'controller/RtspMetaData.cpp',
+    'RtspChannel.cpp',
+    'RtspHandler.cpp',
+]
+
+# Android sources
+SOURCES += [
     'rtsp/AAMRAssembler.cpp',
     'rtsp/AAVCAssembler.cpp',
     'rtsp/AH263Assembler.cpp',
@@ -34,8 +40,6 @@ SOURCES += [
     'rtsp/ARTSPConnection.cpp',
     'rtsp/ASessionDescription.cpp',
     'rtsp/RTSPSource.cpp',
-    'RtspChannel.cpp',
-    'RtspHandler.cpp',
 ]
 
 FAIL_ON_WARNINGS = True
diff --git a/netwerk/protocol/rtsp/rtsp/RTSPSource.cpp b/netwerk/protocol/rtsp/rtsp/RTSPSource.cpp
index a978feeb4bfa..c646532502d1 100644
--- a/netwerk/protocol/rtsp/rtsp/RTSPSource.cpp
+++ b/netwerk/protocol/rtsp/rtsp/RTSPSource.cpp
@@ -559,11 +559,12 @@ void RTSPSource::onDisconnected(const sp<AMessage> &msg) {
     }
     if (mListener) {
       // err is always set to UNKNOWN_ERROR from
-      // Android right now, rename err to NS_ERROR_NOT_CONNECTED.
-      mListener->OnDisconnected(0, NS_ERROR_NOT_CONNECTED);
+      // Android right now, rename err to NS_ERROR_NET_TIMEOUT.
+      mListener->OnDisconnected(0, NS_ERROR_NET_TIMEOUT);
     }
     mAudioTrack = NULL;
     mVideoTrack = NULL;
+    mTracks.clear();
 }
 
 void RTSPSource::finishDisconnectIfPossible() {
diff --git a/netwerk/protocol/wyciwyg/nsWyciwygProtocolHandler.cpp b/netwerk/protocol/wyciwyg/nsWyciwygProtocolHandler.cpp
index 74b04bcd628d..0d6610144c05 100644
--- a/netwerk/protocol/wyciwyg/nsWyciwygProtocolHandler.cpp
+++ b/netwerk/protocol/wyciwyg/nsWyciwygProtocolHandler.cpp
@@ -38,37 +38,6 @@ nsWyciwygProtocolHandler::~nsWyciwygProtocolHandler()
   LOG(("Deleting nsWyciwygProtocolHandler [this=%p]\n", this));
 }
 
-nsresult
-nsWyciwygProtocolHandler::Init()
-{
-  nsCOMPtr<nsIObserverService> obs = mozilla::services::GetObserverService();
-  if (obs) {
-    obs->AddObserver(this, "webapps-clear-data", true);
-  }
-  return NS_OK;
-}
-
-static void
-EvictCacheSession(uint32_t aAppId,
-                  bool aInBrowser,
-                  bool aPrivateBrowsing)
-{
-  nsAutoCString clientId;
-  nsWyciwygProtocolHandler::GetCacheSessionName(aAppId, aInBrowser,
-                                                aPrivateBrowsing,
-                                                clientId);
-  nsCOMPtr<nsICacheService> serv =
-      do_GetService(NS_CACHESERVICE_CONTRACTID);
-  nsCOMPtr<nsICacheSession> session;
-  nsresult rv = serv->CreateSession(clientId.get(),
-                                    nsICache::STORE_ANYWHERE,
-                                    nsICache::STREAM_BASED,
-                                    getter_AddRefs(session));
-  if (NS_SUCCEEDED(rv) && session) {
-    session->EvictEntries();
-  }
-}
-
 void
 nsWyciwygProtocolHandler::GetCacheSessionName(uint32_t aAppId,
                                               bool aInBrowser,
@@ -90,42 +59,8 @@ nsWyciwygProtocolHandler::GetCacheSessionName(uint32_t aAppId,
   aSessionName.AppendInt(aInBrowser);
 }
 
-NS_IMETHODIMP
-nsWyciwygProtocolHandler::Observe(nsISupports *subject,
-                                  const char *topic,
-                                  const PRUnichar *data)
-{
-  if (strcmp(topic, "webapps-clear-data") == 0) {
-    nsCOMPtr<mozIApplicationClearPrivateDataParams> params =
-        do_QueryInterface(subject);
-    if (!params) {
-      NS_ERROR("'webapps-clear-data' notification's subject should be a mozIApplicationClearPrivateDataParams");
-      return NS_ERROR_UNEXPECTED;
-    }
-
-    uint32_t appId;
-    bool browserOnly;
-    nsresult rv = params->GetAppId(&appId);
-    NS_ENSURE_SUCCESS(rv, rv);
-    rv = params->GetBrowserOnly(&browserOnly);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    MOZ_ASSERT(appId != NECKO_UNKNOWN_APP_ID);
-
-    EvictCacheSession(appId, browserOnly, false);
-    EvictCacheSession(appId, browserOnly, true);
-    if (!browserOnly) {
-      EvictCacheSession(appId, true, false);
-      EvictCacheSession(appId, true, true);
-    }
-  }
-  return NS_OK;
-}
-
-NS_IMPL_ISUPPORTS3(nsWyciwygProtocolHandler,
-                   nsIProtocolHandler,
-                   nsIObserver,
-                   nsISupportsWeakReference)
+NS_IMPL_ISUPPORTS1(nsWyciwygProtocolHandler,
+                   nsIProtocolHandler)
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsIProtocolHandler methods:
diff --git a/netwerk/protocol/wyciwyg/nsWyciwygProtocolHandler.h b/netwerk/protocol/wyciwyg/nsWyciwygProtocolHandler.h
index 1a402fa78525..4b79d694ed1d 100644
--- a/netwerk/protocol/wyciwyg/nsWyciwygProtocolHandler.h
+++ b/netwerk/protocol/wyciwyg/nsWyciwygProtocolHandler.h
@@ -8,17 +8,12 @@
 #define nsWyciwygProtocolHandler_h___
 
 #include "nsIProtocolHandler.h"
-#include "nsIObserver.h"
-#include "nsWeakReference.h"
             
 class nsWyciwygProtocolHandler : public nsIProtocolHandler
-                               , public nsIObserver
-                               , public nsSupportsWeakReference
 {
 public:
     NS_DECL_ISUPPORTS
     NS_DECL_NSIPROTOCOLHANDLER
-    NS_DECL_NSIOBSERVER
 
     nsWyciwygProtocolHandler();
     virtual ~nsWyciwygProtocolHandler();
diff --git a/netwerk/test/unit/head_cache.js b/netwerk/test/unit/head_cache.js
index 59b3949c1fab..cb93a3ed09b7 100644
--- a/netwerk/test/unit/head_cache.js
+++ b/netwerk/test/unit/head_cache.js
@@ -85,10 +85,6 @@ function asyncOpenCacheEntry(key, where, flags, lci, callback, appcache)
         callback(status, entry, appCache);
     },
 
-    get mainThreadOnly() {
-      return true;
-    },
-
     run: function () {
       var storage = getCacheStorage(where, lci, this._appCache);
       storage.asyncOpenURI(key, "", flags, this);
diff --git a/netwerk/test/unit/head_cache2.js b/netwerk/test/unit/head_cache2.js
index ab7041563189..36a1596d5453 100644
--- a/netwerk/test/unit/head_cache2.js
+++ b/netwerk/test/unit/head_cache2.js
@@ -41,6 +41,8 @@ const METAONLY =        1 << 9;
 const RECREATE =        1 << 10;
 // Do not give me the entry
 const NOTWANTED =       1 << 11;
+// Tell the cache to wait for the entry to be completely written first
+const COMPLETE =        1 << 12;
 
 var log_c2 = true;
 function LOG_C2(o, m)
@@ -117,10 +119,26 @@ OpenCallback.prototype =
     do_check_neq(this.behavior & (REVAL|PARTIAL), REVAL|PARTIAL);
 
     if (this.behavior & (REVAL|PARTIAL)) {
-      LOG_C2(this, "onCacheEntryCheck DONE, return REVAL");
+      LOG_C2(this, "onCacheEntryCheck DONE, return ENTRY_NEEDS_REVALIDATION");
       return Ci.nsICacheEntryOpenCallback.ENTRY_NEEDS_REVALIDATION;
     }
 
+    if (this.behavior & COMPLETE) {
+      LOG_C2(this, "onCacheEntryCheck DONE, return RECHECK_AFTER_WRITE_FINISHED");
+      if (newCacheBackEndUsed()) {
+        // Specific to the new backend because of concurrent read/write:
+        // when a consumer returns RECHECK_AFTER_WRITE_FINISHED from onCacheEntryCheck
+        // the cache calls this callback again after the entry write has finished.
+        // This gives the consumer a chance to recheck completeness of the entry
+        // again.
+        // Thus, we reset state as onCheck would have never been called.
+        this.onCheckPassed = false;
+        // Don't return RECHECK_AFTER_WRITE_FINISHED on second call of onCacheEntryCheck.
+        this.behavior &= ~COMPLETE;
+      }
+      return Ci.nsICacheEntryOpenCallback.RECHECK_AFTER_WRITE_FINISHED;
+    }
+
     LOG_C2(this, "onCacheEntryCheck DONE, return ENTRY_WANTED");
     return Ci.nsICacheEntryOpenCallback.ENTRY_WANTED;
   },
@@ -218,9 +236,6 @@ OpenCallback.prototype =
       });
     }
   },
-  get mainThreadOnly() {
-    return true;
-  },
   selfCheck: function()
   {
     LOG_C2(this, "selfCheck");
diff --git a/netwerk/test/unit/test_about_networking.js b/netwerk/test/unit/test_about_networking.js
index e751b0d6a653..d084d85b8e26 100644
--- a/netwerk/test/unit/test_about_networking.js
+++ b/netwerk/test/unit/test_about_networking.js
@@ -14,7 +14,14 @@ const gHttpServer = new HttpServer();
 
 add_test(function test_http() {
   gDashboard.requestHttpConnections(function(data) {
-    do_check_neq(data.host.indexOf("localhost"), -1);
+    let found = false;
+    for (let i = 0; i < data.connections.length; i++) {
+      if (data.connections[i].host == "localhost") {
+        found = true;
+        break;
+      }
+    }
+    do_check_eq(found, true);
 
     run_next_test();
   });
@@ -22,7 +29,14 @@ add_test(function test_http() {
 
 add_test(function test_dns() {
   gDashboard.requestDNSInfo(function(data) {
-    do_check_neq(data.hostname.indexOf("localhost"), -1);
+    let found = false;
+    for (let i = 0; i < data.entries.length; i++) {
+      if (data.entries[i].hostname == "localhost") {
+        found = true;
+        break;
+      }
+    }
+    do_check_eq(found, true);
 
     do_test_pending();
     gHttpServer.stop(do_test_finished);
@@ -43,8 +57,14 @@ add_test(function test_sockets() {
       if (aStatus == Ci.nsISocketTransport.STATUS_CONNECTED_TO) {
         gDashboard.requestSockets(function(data) {
           gServerSocket.close();
-
-          do_check_neq(data.host.indexOf("127.0.0.1"), -1);
+          let found = false;
+          for (let i = 0; i < data.sockets.length; i++) {
+            if (data.sockets[i].host == "127.0.0.1") {
+              found = true;
+              break;
+            }
+          }
+          do_check_eq(found, true);
 
           run_next_test();
         });
diff --git a/netwerk/test/unit/test_cache2-14b-concurent-readers-complete.js b/netwerk/test/unit/test_cache2-14b-concurent-readers-complete.js
new file mode 100644
index 000000000000..ba6f2192a11d
--- /dev/null
+++ b/netwerk/test/unit/test_cache2-14b-concurent-readers-complete.js
@@ -0,0 +1,39 @@
+function run_test()
+{
+  do_get_profile();
+
+  asyncOpenCacheEntry("http://x/", "disk", Ci.nsICacheStorage.OPEN_NORMALLY, null,
+    new OpenCallback(NEW, "x1m", "x1d", function(entry) {
+      // nothing to do here, we expect concurent callbacks to get
+      // all notified, then the test finishes
+    })
+  );
+
+  var mc = new MultipleCallbacks(3, finish_cache2_test);
+
+  var order = 0;
+
+  asyncOpenCacheEntry("http://x/", "disk", Ci.nsICacheStorage.OPEN_NORMALLY, null,
+    new OpenCallback(NORMAL|COMPLETE, "x1m", "x1d", function(entry) {
+      ++order;
+      do_check_eq(order, newCacheBackEndUsed() ? 3 : 1);
+      mc.fired();
+    })
+  );
+  asyncOpenCacheEntry("http://x/", "disk", Ci.nsICacheStorage.OPEN_NORMALLY, null,
+    new OpenCallback(NORMAL, "x1m", "x1d", function(entry) {
+      ++order;
+      do_check_eq(order, newCacheBackEndUsed() ? 1 : 2);
+      mc.fired();
+    })
+  );
+  asyncOpenCacheEntry("http://x/", "disk", Ci.nsICacheStorage.OPEN_NORMALLY, null,
+    new OpenCallback(NORMAL, "x1m", "x1d", function(entry) {
+      ++order;
+      do_check_eq(order, newCacheBackEndUsed() ? 2 : 3);
+      mc.fired();
+    })
+  );
+
+  do_test_pending();
+}
diff --git a/netwerk/test/unit/test_ping_aboutnetworking.js b/netwerk/test/unit/test_ping_aboutnetworking.js
index 89c5b1a91ff9..eb72c7b46c60 100644
--- a/netwerk/test/unit/test_ping_aboutnetworking.js
+++ b/netwerk/test/unit/test_ping_aboutnetworking.js
@@ -34,17 +34,30 @@ function run_test() {
     if (connInfo.status == "NS_NET_STATUS_CONNECTED_TO") {
       do_test_pending();
       gDashboard.requestDNSInfo(function(data) {
-        do_check_neq(data.hostname.indexOf("localhost"), -1);
+        let found = false;
+        for (let i = 0; i < data.entries.length; i++) {
+          if (data.entries[i].hostname == "localhost") {
+            found = true;
+            break;
+          }
+        }
+        do_check_eq(found, true);
 
         do_test_finished();
       });
 
       do_test_pending();
       gDashboard.requestSockets(function(data) {
-        let index = data.host.indexOf("127.0.0.1");
+        let index = -1;
+        for (let i = 0; i < data.sockets.length; i++) {
+          if (data.sockets[i].host == "127.0.0.1") {
+            index = i;
+            break;
+          }
+        }
         do_check_neq(index, -1);
-        do_check_eq(data.port[index], serverSocket.port);
-        do_check_eq(data.tcp[index], 1);
+        do_check_eq(data.sockets[index].port, serverSocket.port);
+        do_check_eq(data.sockets[index].tcp, 1);
 
         serverSocket.close();
 
diff --git a/netwerk/test/unit/test_psl.js b/netwerk/test/unit/test_psl.js
index 91124eaa0fdb..251ffa6210d6 100644
--- a/netwerk/test/unit/test_psl.js
+++ b/netwerk/test/unit/test_psl.js
@@ -4,6 +4,8 @@ var etld = Cc["@mozilla.org/network/effective-tld-service;1"]
 var idna = Cc["@mozilla.org/network/idn-service;1"]
            .getService(Ci.nsIIDNService);
 
+var Cr = Components.results;
+
 function run_test()
 {
   var file = do_get_file("data/test_psl.txt");
@@ -21,8 +23,8 @@ function checkPublicSuffix(host, expectedSuffix)
   var actualSuffix = null;
   try {
     actualSuffix = etld.getBaseDomainFromHost(host);
-  } catch (e if e.name == "NS_ERROR_INSUFFICIENT_DOMAIN_LEVELS" ||
-                e.name == "NS_ERROR_ILLEGAL_VALUE") {
+  } catch (e if e.result == Cr.NS_ERROR_INSUFFICIENT_DOMAIN_LEVELS ||
+                e.result == Cr.NS_ERROR_ILLEGAL_VALUE) {
   }
   // The EffectiveTLDService always gives back punycoded labels.
   // The test suite wants to get back what it put in.
diff --git a/netwerk/test/unit/xpcshell.ini b/netwerk/test/unit/xpcshell.ini
index 0b0d5072d1dc..eaef534a2dd0 100644
--- a/netwerk/test/unit/xpcshell.ini
+++ b/netwerk/test/unit/xpcshell.ini
@@ -39,6 +39,7 @@ skip-if = os == "android"
 [test_cache2-12-evict-disk.js]
 [test_cache2-13-evict-non-existing.js]
 [test_cache2-14-concurent-readers.js]
+[test_cache2-14b-concurent-readers-complete.js]
 [test_cache2-15-conditional-304.js]
 [test_cache2-16-conditional-200.js]
 [test_cache2-17-evict-all.js]
diff --git a/python/mozboot/mozboot/osx.py b/python/mozboot/mozboot/osx.py
index 9e53baf9e1f2..e3c4b2df08a9 100644
--- a/python/mozboot/mozboot/osx.py
+++ b/python/mozboot/mozboot/osx.py
@@ -150,10 +150,13 @@ before the path to your package manager's binaries (%s).
 This means that the package manager's binaries likely won't be
 detected properly.
 
-Please modify your shell's configuration (e.g. ~/.bash_profile) to
-have %s appear in $PATH before %s. e.g.
+Modify your shell's configuration (e.g. ~/.profile or
+~/.bash_profile) to have %s appear in $PATH before %s. e.g.
 
     export PATH=%s:$PATH
+
+Once this is done, start a new shell (likely Command+T) and run
+this bootstrap again.
 '''
 
 
diff --git a/python/mozbuild/mozbuild/mach_commands.py b/python/mozbuild/mozbuild/mach_commands.py
index 69b3ff5ff2da..daf67461a852 100644
--- a/python/mozbuild/mozbuild/mach_commands.py
+++ b/python/mozbuild/mozbuild/mach_commands.py
@@ -760,7 +760,14 @@ class DebugProgram(MachCommandBase):
         help='Do not pass the -foreground argument by default on Mac')
     @CommandArgument('+gdbparams', default=None, metavar='params', type=str,
         help='Command-line arguments to pass to GDB itself; split as the Bourne shell would.')
-    def debug(self, params, remote, background, gdbparams):
+    # Bug 933807 introduced JS_DISABLE_SLOW_SCRIPT_SIGNALS to avoid clever
+    # segfaults induced by the slow-script-detecting logic for Ion/Odin JITted
+    # code.  If we don't pass this, the user will need to periodically type
+    # "continue" to (safely) resume execution.  There are ways to implement
+    # automatic resuming; see the bug.
+    @CommandArgument('+slowscript', action='store_true',
+        help='Do not set the JS_DISABLE_SLOW_SCRIPT_SIGNALS env variable; when not set, recoverable but misleading SIGSEGV instances may occur in Ion/Odin JIT code')
+    def debug(self, params, remote, background, gdbparams, slowscript):
         import which
         try:
             debugger = which.which('gdb')
@@ -769,6 +776,7 @@ class DebugProgram(MachCommandBase):
             print(e)
             return 1
         args = [debugger]
+        extra_env = {}
         if gdbparams:
             import pymake.process
             (argv, badchar) = pymake.process.clinetoargv(gdbparams, os.getcwd())
@@ -790,8 +798,10 @@ class DebugProgram(MachCommandBase):
             args.append('-foreground')
         if params:
             args.extend(params)
-        return self.run_process(args=args, ensure_exit_code=False,
-            pass_thru=True)
+        if not slowscript:
+            extra_env['JS_DISABLE_SLOW_SCRIPT_SIGNALS'] = '1'
+        return self.run_process(args=args, append_env=extra_env,
+            ensure_exit_code=False, pass_thru=True)
 
 @CommandProvider
 class Buildsymbols(MachCommandBase):
diff --git a/security/manager/ssl/src/nsNSSCallbacks.cpp b/security/manager/ssl/src/nsNSSCallbacks.cpp
index 0205c7f8997f..b699402bac8d 100644
--- a/security/manager/ssl/src/nsNSSCallbacks.cpp
+++ b/security/manager/ssl/src/nsNSSCallbacks.cpp
@@ -20,6 +20,7 @@
 #include "ScopedNSSTypes.h"
 #include "nsContentUtils.h"
 #include "nsIHttpChannelInternal.h"
+#include "nsISupportsPriority.h"
 #include "nsNetUtil.h"
 #include "SharedSSLState.h"
 #include "ssl.h"
@@ -76,6 +77,13 @@ nsHTTPDownloadEvent::Run()
   ios->NewChannel(mRequestSession->mURL, nullptr, nullptr, getter_AddRefs(chan));
   NS_ENSURE_STATE(chan);
 
+  // Security operations scheduled through normal HTTP channels are given
+  // high priority to accommodate real time OCSP transactions. Background CRL
+  // fetches happen through a different path (CRLDownloadEvent).
+  nsCOMPtr<nsISupportsPriority> priorityChannel = do_QueryInterface(chan);
+  if (priorityChannel)
+    priorityChannel->AdjustPriority(nsISupportsPriority::PRIORITY_HIGHEST);
+
   chan->SetLoadFlags(nsIRequest::LOAD_ANONYMOUS);
 
   // Create a loadgroup for this new channel.  This way if the channel
diff --git a/security/nss/coreconf/coreconf.dep b/security/nss/coreconf/coreconf.dep
index 590d1bfaeee3..5182f75552c8 100644
--- a/security/nss/coreconf/coreconf.dep
+++ b/security/nss/coreconf/coreconf.dep
@@ -10,4 +10,3 @@
  */
 
 #error "Do not include this header file."
-
diff --git a/security/nss/lib/freebl/unix_rand.c b/security/nss/lib/freebl/unix_rand.c
index a85a8a37bdb0..9a0d053516c2 100644
--- a/security/nss/lib/freebl/unix_rand.c
+++ b/security/nss/lib/freebl/unix_rand.c
@@ -974,10 +974,6 @@ size_t RNG_FileUpdate(const char *fileName, size_t limit)
     
     file = fopen(fileName, "r");
     if (file != NULL) {
-	/* Set buffering mode to unbuffered I/O to avoid reading more bytes
-	 * than we need from /dev/urandom. Moreover, we read into a buffer
-	 * of size BUFSIZ, so buffered I/O has no performance advantage. */
-	setvbuf(file, NULL, _IONBF, 0);
 	while (limit > fileBytes) {
 	    bytes = PR_MIN(sizeof buffer, limit - fileBytes);
 	    bytes = fread(buffer, 1, bytes, file);
@@ -1138,9 +1134,6 @@ size_t RNG_SystemRNG(void *dest, size_t maxLen)
     if (file == NULL) {
 	return rng_systemFromNoise(dest, maxLen);
     }
-    /* Set buffering mode to unbuffered I/O to avoid reading more bytes
-     * than we need from /dev/urandom. */
-    setvbuf(file, NULL, _IONBF, 0);
     while (maxLen > fileBytes) {
 	bytes = maxLen - fileBytes;
 	bytes = fread(buffer, 1, bytes, file);
diff --git a/security/patches/README b/security/patches/README
index 0eb4e7e597f9..cc50569d6b69 100644
--- a/security/patches/README
+++ b/security/patches/README
@@ -1,6 +1,4 @@
 This directory contains patches that were added locally
 on top of the NSS release.
 
-bug-713933-false-start.patch: First iteration of false start. The patch will be
-                              further modified to make it work for Chromium and
-			      other projects before being checked in.
+bug-935831.patch Backout the fix for bug 927230.
diff --git a/security/patches/bug-713933-false-start.patch b/security/patches/bug-713933-false-start.patch
deleted file mode 100644
index 85257971c452..000000000000
--- a/security/patches/bug-713933-false-start.patch
+++ /dev/null
@@ -1,836 +0,0 @@
-# HG changeset patch
-# User Patrick McManus <mcmanus@ducksong.com>
-# Date 1372656196 25200
-# Node ID f6bc026a0c368178b4d327bf05de785305161d72
-# Parent  89a5e4356ad1f7bc9d9d24f6409c6d963dde3ca4
-Bug 713933: Make false start work with asynchronous certificate verification, r=bsmith
-
-diff --git a/security/nss/lib/ssl/ssl.def b/security/nss/lib/ssl/ssl.def
---- a/security/nss/lib/ssl/ssl.def
-+++ b/security/nss/lib/ssl/ssl.def
-@@ -158,8 +158,15 @@ SSL_SetSRTPCiphers;
- ;+};
- ;+NSS_3.15 {      # NSS 3.15 release
- ;+    global:
- SSL_PeerStapledOCSPResponses;
- SSL_SetStapledOCSPResponses;
- ;+    local:
- ;+*;
- ;+};
-+;+NSS_3.15.2 {    # NSS 3.15.2 release
-+;+    global:
-+SSL_SetCanFalseStartCallback;
-+SSL_DefaultCanFalseStart;
-+;+    local:
-+;+*;
-+;+};
-diff --git a/security/nss/lib/ssl/ssl.h b/security/nss/lib/ssl/ssl.h
---- a/security/nss/lib/ssl/ssl.h
-+++ b/security/nss/lib/ssl/ssl.h
-@@ -116,24 +116,32 @@ SSL_IMPORT PRFileDesc *DTLS_ImportFD(PRF
- #define SSL_REQUIRE_SAFE_NEGOTIATION   21 /* Peer must send Signaling       */
- 					  /* Cipher Suite Value (SCSV) or   */
-                                           /* Renegotiation  Info (RI)       */
- 					  /* extension in ALL handshakes.   */
-                                           /* default: off                   */
- #define SSL_ENABLE_FALSE_START         22 /* Enable SSL false start (off by */
-                                           /* default, applies only to       */
-                                           /* clients). False start is a     */
--/* mode where an SSL client will start sending application data before      */
--/* verifying the server's Finished message. This means that we could end up */
--/* sending data to an imposter. However, the data will be encrypted and     */
--/* only the true server can derive the session key. Thus, so long as the    */
--/* cipher isn't broken this is safe. Because of this, False Start will only */
--/* occur on RSA or DH ciphersuites where the cipher's key length is >= 80   */
--/* bits. The advantage of False Start is that it saves a round trip for     */
--/* client-speaks-first protocols when performing a full handshake.          */
-+/* mode where an SSL client will start sending application data before
-+ * verifying the server's Finished message. This means that we could end up
-+ * sending data to an imposter. However, the data will be encrypted and
-+ * only the true server can derive the session key. Thus, so long as the
-+ * cipher isn't broken this is safe. The advantage of false start is that
-+ * it saves a round trip for client-speaks-first protocols when performing a
-+ * full handshake.
-+ *
-+ * See SSL_DefaultCanFalseStart for the default criteria that NSS uses to
-+ * determine whether to false start or not. See SSL_SetCanFalseStartCallback
-+ * for how to change that criteria. In addition to those criteria, false start
-+ * will only be done when the server selects a cipher suite with an effective
-+ * key length of 80 bits or more (including RC4-128). Also, see
-+ * SSL_HandshakeCallback for a description on how false start affects when the
-+ * handshake callback gets called.
-+ */
- 
- /* For SSL 3.0 and TLS 1.0, by default we prevent chosen plaintext attacks
-  * on SSL CBC mode cipher suites (see RFC 4346 Section F.3) by splitting
-  * non-empty application_data records into two records; the first record has
-  * only the first byte of plaintext, and the second has the rest.
-  *
-  * This only prevents the attack in the sending direction; the connection may
-  * still be vulnerable to such attacks if the peer does not implement a similar
-@@ -648,24 +656,69 @@ SSL_IMPORT SECStatus SSL_SetMaxServerCac
- /* called in child to inherit SID Cache variables. 
-  * If envString is NULL, this function will use the value of the environment
-  * variable "SSL_INHERITANCE", otherwise the string value passed in will be 
-  * used.
-  */
- SSL_IMPORT SECStatus SSL_InheritMPServerSIDCache(const char * envString);
- 
- /*
--** Set the callback on a particular socket that gets called when we finish
--** performing a handshake.
-+** Set the callback that normally gets called when the TLS handshake
-+** is complete. If false start is not enabled, then the handshake callback is
-+** called after verifying the peer's Finished message and before sending
-+** outgoing application data and before processing incoming application data.
-+**
-+** If false start is enabled and there is a custom CanFalseStartCallback
-+** callback set, then the handshake callback gets called after the peer's
-+** Finished message has been verified, which may be after application data is
-+** sent.
-+**
-+** If false start is enabled and there is not a custom CanFalseStartCallback
-+** callback established with SSL_SetCanFalseStartCallback then the handshake
-+** callback gets called before any application data is sent, which may be
-+** before the peer's Finished message has been verified.
- */
- typedef void (PR_CALLBACK *SSLHandshakeCallback)(PRFileDesc *fd,
-                                                  void *client_data);
- SSL_IMPORT SECStatus SSL_HandshakeCallback(PRFileDesc *fd, 
- 			          SSLHandshakeCallback cb, void *client_data);
- 
-+/* Applications that wish to customize TLS false start should set this callback
-+** function. NSS will invoke the functon to determine if a particular
-+** connection should use false start or not. SECSuccess indicates that the
-+** callback completed successfully, and if so *canFalseStart indicates if false
-+** start can be used. If the callback does not return SECSuccess then the
-+** handshake will be canceled.
-+**
-+** Applications that do not set the callback will use an internal set of
-+** criteria to determine if the connection should false start. If
-+** the callback is set false start will never be used without invoking the
-+** callback function, but some connections (e.g. resumed connections) will
-+** never use false start and therefore will not invoke the callback.
-+**
-+** NSS's internal criteria for this connection can be evaluated by calling
-+** SSL_DefaultCanFalseStart() from the custom callback.
-+**
-+** See the description of SSL_HandshakeCallback for important information on
-+** how registering a custom false start callback affects when the handshake
-+** callback gets called.
-+**/
-+typedef SECStatus (PR_CALLBACK *SSLCanFalseStartCallback)(
-+    PRFileDesc *fd, void *arg, PRBool *canFalseStart);
-+
-+SSL_IMPORT SECStatus SSL_SetCanFalseStartCallback(
-+    PRFileDesc *fd, SSLCanFalseStartCallback callback, void *arg);
-+
-+/* A utility function that can be called from a custom CanFalseStartCallback
-+** function to determine what NSS would have done for this connection if the
-+** custom callback was not implemented.
-+**/
-+SSL_IMPORT SECStatus SSL_DefaultCanFalseStart(PRFileDesc *fd,
-+                                              PRBool *canFalseStart);
-+
- /*
- ** For the server, request a new handshake.  For the client, begin a new
- ** handshake.  If flushCache is non-zero, the SSL3 cache entry will be 
- ** flushed first, ensuring that a full SSL handshake will be done.
- ** If flushCache is zero, and an SSL connection is established, it will 
- ** do the much faster session restart handshake.  This will change the 
- ** session keys without doing another private key operation.
- */
-diff --git a/security/nss/lib/ssl/ssl3con.c b/security/nss/lib/ssl/ssl3con.c
---- a/security/nss/lib/ssl/ssl3con.c
-+++ b/security/nss/lib/ssl/ssl3con.c
-@@ -6664,45 +6664,61 @@ loser:
-     PORT_SetError(errCode);
-     rv = SECFailure;
- done:
-     if (arena != NULL)
-     	PORT_FreeArena(arena, PR_FALSE);
-     return rv;
- }
- 
--PRBool
--ssl3_CanFalseStart(sslSocket *ss) {
--    PRBool rv;
-+static SECStatus
-+ssl3_CheckFalseStart(sslSocket *ss)
-+{
-+    SECStatus rv;
-+    PRBool maybeFalseStart = PR_TRUE;
- 
-     PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );
--
--    /* XXX: does not take into account whether we are waiting for
--     * SSL_AuthCertificateComplete or SSL_RestartHandshakeAfterCertReq. If/when
--     * that is done, this function could return different results each time it
--     * would be called.
--     */
-+    PORT_Assert( !ss->ssl3.hs.authCertificatePending );
-+
-+    /* An attacker can control the selected ciphersuite so we only wish to
-+     * do False Start in the case that the selected ciphersuite is
-+     * sufficiently strong that the attack can gain no advantage.
-+     * Therefore we always require an 80-bit cipher. */
- 
-     ssl_GetSpecReadLock(ss);
--    rv = ss->opt.enableFalseStart &&
--	 !ss->sec.isServer &&
--	 !ss->ssl3.hs.isResuming &&
--	 ss->ssl3.cwSpec &&
--
--	 /* An attacker can control the selected ciphersuite so we only wish to
--	  * do False Start in the case that the selected ciphersuite is
--	  * sufficiently strong that the attack can gain no advantage.
--	  * Therefore we require an 80-bit cipher and a forward-secret key
--	  * exchange. */
--	 ss->ssl3.cwSpec->cipher_def->secret_key_size >= 10 &&
--	(ss->ssl3.hs.kea_def->kea == kea_dhe_dss ||
--	 ss->ssl3.hs.kea_def->kea == kea_dhe_rsa ||
--	 ss->ssl3.hs.kea_def->kea == kea_ecdhe_ecdsa ||
--	 ss->ssl3.hs.kea_def->kea == kea_ecdhe_rsa);
-+    if (ss->ssl3.cwSpec->cipher_def->secret_key_size < 10) {
-+	ss->ssl3.hs.canFalseStart = PR_FALSE;
-+	maybeFalseStart = PR_FALSE;
-+    }
-     ssl_ReleaseSpecReadLock(ss);
-+    if (!maybeFalseStart) {
-+	return SECSuccess;
-+    }
-+
-+    if (!ss->canFalseStartCallback) {
-+	rv = SSL_DefaultCanFalseStart(ss->fd, &ss->ssl3.hs.canFalseStart);
-+
-+	if (rv == SECSuccess &&
-+            ss->ssl3.hs.canFalseStart && ss->handshakeCallback) {
-+	    /* Call the handshake callback here for backwards compatibility
-+	     * with applications that were using false start before
-+	     * canFalseStartCallback was added.
-+	     */
-+	    (ss->handshakeCallback)(ss->fd, ss->handshakeCallbackData);
-+	}
-+    } else {
-+	rv = (ss->canFalseStartCallback)(ss->fd,
-+ 					 ss->canFalseStartCallbackData,
-+					 &ss->ssl3.hs.canFalseStart);
-+    }
-+
-+    if (rv != SECSuccess) {
-+	ss->ssl3.hs.canFalseStart = PR_FALSE;
-+    }
-+
-     return rv;
- }
- 
- static SECStatus ssl3_SendClientSecondRound(sslSocket *ss);
- 
- /* Called from ssl3_HandleHandshakeMessage() when it has deciphered a complete
-  * ssl3 Server Hello Done message.
-  * Caller must hold Handshake and RecvBuf locks.
-@@ -6722,16 +6738,17 @@ ssl3_HandleServerHelloDone(sslSocket *ss
-         ws != wait_server_cert &&
- 	ws != wait_server_key  &&
- 	ws != wait_cert_request) {
- 	SSL3_SendAlert(ss, alert_fatal, unexpected_message);
- 	PORT_SetError(SSL_ERROR_RX_UNEXPECTED_HELLO_DONE);
- 	return SECFailure;
-     }
- 
-+    ss->enoughFirstHsDone = PR_TRUE;
-     rv = ssl3_SendClientSecondRound(ss);
- 
-     return rv;
- }
- 
- /* Called from ssl3_HandleServerHelloDone and ssl3_AuthCertificateComplete.
-  *
-  * Caller must hold Handshake and RecvBuf locks.
-@@ -6820,35 +6837,47 @@ ssl3_SendClientSecondRound(sslSocket *ss
-     /* XXX: If the server's certificate hasn't been authenticated by this
-      * point, then we may be leaking this NPN message to an attacker.
-      */
-     if (!ss->firstHsDone) {
- 	rv = ssl3_SendNextProto(ss);
- 	if (rv != SECSuccess) {
- 	    goto loser;	/* err code was set. */
- 	}
-+
-+	if (ss->opt.enableFalseStart) {
-+	    if (!ss->ssl3.hs.authCertificatePending) {
-+		rv = ssl3_CheckFalseStart(ss);
-+		if (rv != SECSuccess) {
-+		    goto loser;
-+		}
-+	    } else {
-+		/* The certificate authentication and the server's Finished
-+		 * message are going to race each other. If the certificate
-+		 * authentication wins, then we will try to false start. If the
-+		 * server's Finished message wins, then ssl3_HandleFinished will
-+		 * reset restartTarget to ssl3_FinishHandshake.
-+		 */
-+		ss->ssl3.hs.restartTarget = ssl3_CheckFalseStart;
-+	    }
-+	}
-     }
- 
-     rv = ssl3_SendFinished(ss, 0);
-     if (rv != SECSuccess) {
- 	goto loser;	/* err code was set. */
-     }
- 
-     ssl_ReleaseXmitBufLock(ss);		/*******************************/
- 
-     if (ssl3_ExtensionNegotiated(ss, ssl_session_ticket_xtn))
- 	ss->ssl3.hs.ws = wait_new_session_ticket;
-     else
- 	ss->ssl3.hs.ws = wait_change_cipher;
- 
--    /* Do the handshake callback for sslv3 here, if we can false start. */
--    if (ss->handshakeCallback != NULL && ssl3_CanFalseStart(ss)) {
--	(ss->handshakeCallback)(ss->fd, ss->handshakeCallbackData);
--    }
--
-     return SECSuccess;
- 
- loser:
-     ssl_ReleaseXmitBufLock(ss);
-     return rv;
- }
- 
- /*
-@@ -9411,23 +9440,16 @@ ssl3_AuthCertificate(sslSocket *ss)
- 	    if (ss->sec.isServer) {
- 		errCode = SSL_ERROR_FEATURE_NOT_SUPPORTED_FOR_SERVERS;
- 		rv = SECFailure;
- 		goto loser;
- 	    }
- 
- 	    ss->ssl3.hs.authCertificatePending = PR_TRUE;
- 	    rv = SECSuccess;
--
--	    /* XXX: Async cert validation and False Start don't work together
--	     * safely yet; if we leave False Start enabled, we may end up false
--	     * starting (sending application data) before we
--	     * SSL_AuthCertificateComplete has been called.
--	     */
--	    ss->opt.enableFalseStart = PR_FALSE;
- 	}
- 
- 	if (rv != SECSuccess) {
- 	    ssl3_SendAlertForCertError(ss, errCode);
- 	    goto loser;
- 	}
-     }
- 
-@@ -10065,16 +10087,21 @@ xmit_loser:
- 	ssl_ReleaseSpecReadLock(ss);  /*************************************/
- 
- 	/* If the wrap failed, we don't cache the sid.
- 	 * The connection continues normally however.
- 	 */
- 	ss->ssl3.hs.cacheSID = rv == SECSuccess;
-     }
- 
-+    /* Cancel false start check since we already completed the handshake */
-+    if (ss->ssl3.hs.restartTarget == ssl3_CheckFalseStart) {
-+	ss->ssl3.hs.restartTarget = NULL;
-+    }
-+
-     if (ss->ssl3.hs.authCertificatePending) {
- 	if (ss->ssl3.hs.restartTarget) {
- 	    PR_NOT_REACHED("ssl3_HandleFinished: unexpected restartTarget");
- 	    PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
- 	    return SECFailure;
- 	}
- 
- 	ss->ssl3.hs.restartTarget = ssl3_FinishHandshake;
-@@ -10083,33 +10110,41 @@ xmit_loser:
- 
-     rv = ssl3_FinishHandshake(ss);
-     return rv;
- }
- 
- SECStatus
- ssl3_FinishHandshake(sslSocket * ss)
- {
-+    PRBool falseStarted;
-+
-     PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) );
-     PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );
-     PORT_Assert( ss->ssl3.hs.restartTarget == NULL );
- 
-     /* The first handshake is now completed. */
-     ss->handshake           = NULL;
-     ss->firstHsDone         = PR_TRUE;
-+    ss->enoughFirstHsDone   = PR_TRUE;
- 
-     if (ss->ssl3.hs.cacheSID) {
- 	(*ss->sec.cache)(ss->sec.ci.sid);
- 	ss->ssl3.hs.cacheSID = PR_FALSE;
-     }
- 
-     ss->ssl3.hs.ws = idle_handshake;
--
--    /* Do the handshake callback for sslv3 here, if we cannot false start. */
--    if (ss->handshakeCallback != NULL && !ssl3_CanFalseStart(ss)) {
-+    falseStarted = ss->ssl3.hs.canFalseStart;
-+    ss->ssl3.hs.canFalseStart = PR_FALSE; /* False Start phase is complete */
-+
-+    /* Call the handshake callback for sslv3 here, unless we called it already
-+     * for the case where false start was done without a canFalseStartCallback.
-+     */
-+    if (ss->handshakeCallback != NULL &&
-+	!(falseStarted && !ss->canFalseStartCallback)) {
- 	(ss->handshakeCallback)(ss->fd, ss->handshakeCallbackData);
-     }
- 
-     return SECSuccess;
- }
- 
- /* Called from ssl3_HandleHandshake() when it has gathered a complete ssl3
-  * hanshake message.
-diff --git a/security/nss/lib/ssl/ssl3gthr.c b/security/nss/lib/ssl/ssl3gthr.c
---- a/security/nss/lib/ssl/ssl3gthr.c
-+++ b/security/nss/lib/ssl/ssl3gthr.c
-@@ -369,19 +369,17 @@ ssl3_GatherCompleteHandshake(sslSocket *
- 	    return ss->recvdCloseNotify ? 0 : rv;
- 	}
- 
- 	/* If we kicked off a false start in ssl3_HandleServerHelloDone, break
- 	 * out of this loop early without finishing the handshake.
- 	 */
- 	if (ss->opt.enableFalseStart) {
- 	    ssl_GetSSL3HandshakeLock(ss);
--	    canFalseStart = (ss->ssl3.hs.ws == wait_change_cipher ||
--			     ss->ssl3.hs.ws == wait_new_session_ticket) &&
--		            ssl3_CanFalseStart(ss);
-+	    canFalseStart = ss->ssl3.hs.canFalseStart;
- 	    ssl_ReleaseSSL3HandshakeLock(ss);
- 	}
-     } while (ss->ssl3.hs.ws != idle_handshake &&
-              !canFalseStart &&
-              ss->gs.buf.len == 0);
- 
-     ss->gs.readOffset = 0;
-     ss->gs.writeOffset = ss->gs.buf.len;
-diff --git a/security/nss/lib/ssl/sslauth.c b/security/nss/lib/ssl/sslauth.c
---- a/security/nss/lib/ssl/sslauth.c
-+++ b/security/nss/lib/ssl/sslauth.c
-@@ -55,17 +55,16 @@ SSL_LocalCertificate(PRFileDesc *fd)
- /* NEED LOCKS IN HERE.  */
- SECStatus
- SSL_SecurityStatus(PRFileDesc *fd, int *op, char **cp, int *kp0, int *kp1,
- 		   char **ip, char **sp)
- {
-     sslSocket *ss;
-     const char *cipherName;
-     PRBool isDes = PR_FALSE;
--    PRBool enoughFirstHsDone = PR_FALSE;
- 
-     ss = ssl_FindSocket(fd);
-     if (!ss) {
- 	SSL_DBG(("%d: SSL[%d]: bad socket in SecurityStatus",
- 		 SSL_GETPID(), fd));
- 	return SECFailure;
-     }
- 
-@@ -73,24 +72,17 @@ SSL_SecurityStatus(PRFileDesc *fd, int *
-     if (kp0) *kp0 = 0;
-     if (kp1) *kp1 = 0;
-     if (ip) *ip = 0;
-     if (sp) *sp = 0;
-     if (op) {
- 	*op = SSL_SECURITY_STATUS_OFF;
-     }
- 
--    if (ss->firstHsDone) {
--	enoughFirstHsDone = PR_TRUE;
--    } else if (ss->version >= SSL_LIBRARY_VERSION_3_0 &&
--	       ssl3_CanFalseStart(ss)) {
--	enoughFirstHsDone = PR_TRUE;
--    }
--
--    if (ss->opt.useSecurity && enoughFirstHsDone) {
-+    if (ss->opt.useSecurity && ss->enoughFirstHsDone) {
- 	if (ss->version < SSL_LIBRARY_VERSION_3_0) {
- 	    cipherName = ssl_cipherName[ss->sec.cipherType];
- 	} else {
- 	    cipherName = ssl3_cipherName[ss->sec.cipherType];
- 	}
- 	PORT_Assert(cipherName);
- 	if (cipherName) {
-             if (PORT_Strstr(cipherName, "DES")) isDes = PR_TRUE;
-diff --git a/security/nss/lib/ssl/sslimpl.h b/security/nss/lib/ssl/sslimpl.h
---- a/security/nss/lib/ssl/sslimpl.h
-+++ b/security/nss/lib/ssl/sslimpl.h
-@@ -863,16 +863,18 @@ const ssl3CipherSuiteDef *suite_def;
- 					    * in progress. */
-     unsigned char         cookie[32];      /* The cookie */
-     unsigned char         cookieLen;       /* The length of the cookie */
-     PRIntervalTime        rtTimerStarted;  /* When the timer was started */
-     DTLSTimerCb           rtTimerCb;       /* The function to call on expiry */
-     PRUint32              rtTimeoutMs;     /* The length of the current timeout
- 					    * used for backoff (in ms) */
-     PRUint32              rtRetries;       /* The retry counter */
-+    PRBool                canFalseStart;   /* Can/did we False Start */
-+
- } SSL3HandshakeState;
- 
- 
- 
- /*
- ** This is the "ssl3" struct, as in "ss->ssl3".
- ** note:
- ** usually,   crSpec == cwSpec and prSpec == pwSpec.  
-@@ -1111,16 +1113,20 @@ struct sslSocketStr {
-     sslOptions       opt;
-     /* Enabled version range */
-     SSLVersionRange  vrange;
- 
-     /* State flags */
-     unsigned long    clientAuthRequested;
-     unsigned long    delayDisabled;       /* Nagle delay disabled */
-     unsigned long    firstHsDone;         /* first handshake is complete. */
-+    unsigned long    enoughFirstHsDone;   /* enough of the handshake is done
-+					   * for callbacks to be able to
-+					   * retrieve channel security
-+					   * parameters from callback functions. */
-     unsigned long    handshakeBegun;     
-     unsigned long    lastWriteBlocked;   
-     unsigned long    recvdCloseNotify;    /* received SSL EOF. */
-     unsigned long    TCPconnected;       
-     unsigned long    appDataBuffered;
-     unsigned long    peerRequestedProtection; /* from old renegotiation */
- 
-     /* version of the protocol to use */
-@@ -1151,16 +1157,18 @@ const unsigned char *  preferredCipher;
-     SSLGetClientAuthData      getClientAuthData;
-     void                     *getClientAuthDataArg;
-     SSLSNISocketConfig        sniSocketConfig;
-     void                     *sniSocketConfigArg;
-     SSLBadCertHandler         handleBadCert;
-     void                     *badCertArg;
-     SSLHandshakeCallback      handshakeCallback;
-     void                     *handshakeCallbackData;
-+    SSLCanFalseStartCallback  canFalseStartCallback;
-+    void                     *canFalseStartCallbackData;
-     void                     *pkcs11PinArg;
-     SSLNextProtoCallback      nextProtoCallback;
-     void                     *nextProtoArg;
- 
-     PRIntervalTime            rTimeout; /* timeout for NSPR I/O */
-     PRIntervalTime            wTimeout; /* timeout for NSPR I/O */
-     PRIntervalTime            cTimeout; /* timeout for NSPR I/O */
- 
-@@ -1353,17 +1361,16 @@ extern int       ssl3_SendApplicationDat
- extern PRBool    ssl_FdIsBlocking(PRFileDesc *fd);
- 
- extern PRBool    ssl_SocketIsBlocking(sslSocket *ss);
- 
- extern void      ssl3_SetAlwaysBlock(sslSocket *ss);
- 
- extern SECStatus ssl_EnableNagleDelay(sslSocket *ss, PRBool enabled);
- 
--extern PRBool    ssl3_CanFalseStart(sslSocket *ss);
- extern SECStatus
- ssl3_CompressMACEncryptRecord(ssl3CipherSpec *   cwSpec,
- 		              PRBool             isServer,
- 			      PRBool             isDTLS,
- 			      PRBool             capRecordVersion,
-                               SSL3ContentType    type,
- 		              const SSL3Opaque * pIn,
- 		              PRUint32           contentLen,
-diff --git a/security/nss/lib/ssl/sslinfo.c b/security/nss/lib/ssl/sslinfo.c
---- a/security/nss/lib/ssl/sslinfo.c
-+++ b/security/nss/lib/ssl/sslinfo.c
-@@ -21,41 +21,33 @@ ssl_GetCompressionMethodName(SSLCompress
- }
- 
- SECStatus 
- SSL_GetChannelInfo(PRFileDesc *fd, SSLChannelInfo *info, PRUintn len)
- {
-     sslSocket *      ss;
-     SSLChannelInfo   inf;
-     sslSessionID *   sid;
--    PRBool           enoughFirstHsDone = PR_FALSE;
- 
-     if (!info || len < sizeof inf.length) { 
- 	PORT_SetError(SEC_ERROR_INVALID_ARGS);
- 	return SECFailure;
-     }
- 
-     ss = ssl_FindSocket(fd);
-     if (!ss) {
- 	SSL_DBG(("%d: SSL[%d]: bad socket in SSL_GetChannelInfo",
- 		 SSL_GETPID(), fd));
- 	return SECFailure;
-     }
- 
-     memset(&inf, 0, sizeof inf);
-     inf.length = PR_MIN(sizeof inf, len);
- 
--    if (ss->firstHsDone) {
--	enoughFirstHsDone = PR_TRUE;
--    } else if (ss->version >= SSL_LIBRARY_VERSION_3_0 &&
--	       ssl3_CanFalseStart(ss)) {
--	enoughFirstHsDone = PR_TRUE;
--    }
--
--    if (ss->opt.useSecurity && enoughFirstHsDone) {
-+    if (ss->opt.useSecurity && ss->enoughFirstHsDone) {
-         sid = ss->sec.ci.sid;
- 	inf.protocolVersion  = ss->version;
- 	inf.authKeyBits      = ss->sec.authKeyBits;
- 	inf.keaKeyBits       = ss->sec.keaKeyBits;
- 	if (ss->version < SSL_LIBRARY_VERSION_3_0) { /* SSL2 */
- 	    inf.cipherSuite           = ss->sec.cipherType | 0xff00;
- 	    inf.compressionMethod     = ssl_compression_null;
- 	    inf.compressionMethodName = "N/A";
-diff --git a/security/nss/lib/ssl/sslreveal.c b/security/nss/lib/ssl/sslreveal.c
---- a/security/nss/lib/ssl/sslreveal.c
-+++ b/security/nss/lib/ssl/sslreveal.c
-@@ -72,40 +72,33 @@ SSL_RevealURL(PRFileDesc * fd)
- 
- SECStatus
- SSL_HandshakeNegotiatedExtension(PRFileDesc * socket, 
-                                  SSLExtensionType extId,
-                                  PRBool *pYes)
- {
-   /* some decisions derived from SSL_GetChannelInfo */
-   sslSocket * sslsocket = NULL;
--  PRBool enoughFirstHsDone = PR_FALSE;
- 
-   if (!pYes) {
-     PORT_SetError(SEC_ERROR_INVALID_ARGS);
-     return SECFailure;
-   }
- 
-   sslsocket = ssl_FindSocket(socket);
-   if (!sslsocket) {
-     SSL_DBG(("%d: SSL[%d]: bad socket in HandshakeNegotiatedExtension",
-              SSL_GETPID(), socket));
-     return SECFailure;
-   }
- 
-   *pYes = PR_FALSE;
- 
--  if (sslsocket->firstHsDone) {
--    enoughFirstHsDone = PR_TRUE;
--  } else if (sslsocket->ssl3.initialized && ssl3_CanFalseStart(sslsocket)) {
--    enoughFirstHsDone = PR_TRUE;
--  }
--
-   /* according to public API SSL_GetChannelInfo, this doesn't need a lock */
--  if (sslsocket->opt.useSecurity && enoughFirstHsDone) {
-+  if (sslsocket->opt.useSecurity && sslsocket->enoughFirstHsDone) {
-     if (sslsocket->ssl3.initialized) { /* SSL3 and TLS */
-       /* now we know this socket went through ssl3_InitState() and
-        * ss->xtnData got initialized, which is the only member accessed by
-        * ssl3_ExtensionNegotiated();
-        * Member xtnData appears to get accessed in functions that handle
-        * the handshake (hello messages and extension sending),
-        * therefore the handshake lock should be sufficient.
-        */
-diff --git a/security/nss/lib/ssl/sslsecur.c b/security/nss/lib/ssl/sslsecur.c
---- a/security/nss/lib/ssl/sslsecur.c
-+++ b/security/nss/lib/ssl/sslsecur.c
-@@ -103,20 +103,22 @@ ssl_Do1stHandshake(sslSocket *ss)
- 
- 	    SSL_TRC(3, ("%d: SSL[%d]: handshake is completed",
- 			SSL_GETPID(), ss->fd));
-             /* call handshake callback for ssl v2 */
- 	    /* for v3 this is done in ssl3_HandleFinished() */
- 	    if ((ss->handshakeCallback != NULL) && /* has callback */
- 		(!ss->firstHsDone) &&              /* only first time */
- 		(ss->version < SSL_LIBRARY_VERSION_3_0)) {  /* not ssl3 */
--		ss->firstHsDone     = PR_TRUE;
-+		ss->firstHsDone = PR_TRUE;
-+		ss->enoughFirstHsDone = PR_TRUE;
- 		(ss->handshakeCallback)(ss->fd, ss->handshakeCallbackData);
- 	    }
--	    ss->firstHsDone         = PR_TRUE;
-+	    ss->firstHsDone = PR_TRUE;
-+	    ss->enoughFirstHsDone = PR_TRUE;
- 	    ss->gs.writeOffset = 0;
- 	    ss->gs.readOffset  = 0;
- 	    break;
- 	}
- 	rv = (*ss->handshake)(ss);
- 	++loopCount;
-     /* This code must continue to loop on SECWouldBlock, 
-      * or any positive value.	See XXX_1 comments.
-@@ -201,31 +203,34 @@ SSL_ResetHandshake(PRFileDesc *s, PRBool
- 
-     SSL_LOCK_READER(ss);
-     SSL_LOCK_WRITER(ss);
- 
-     /* Reset handshake state */
-     ssl_Get1stHandshakeLock(ss);
- 
-     ss->firstHsDone = PR_FALSE;
-+    ss->enoughFirstHsDone = PR_FALSE;
-     if ( asServer ) {
- 	ss->handshake = ssl2_BeginServerHandshake;
- 	ss->handshaking = sslHandshakingAsServer;
-     } else {
- 	ss->handshake = ssl2_BeginClientHandshake;
- 	ss->handshaking = sslHandshakingAsClient;
-     }
-     ss->nextHandshake       = 0;
-     ss->securityHandshake   = 0;
- 
-     ssl_GetRecvBufLock(ss);
-     status = ssl_InitGather(&ss->gs);
-     ssl_ReleaseRecvBufLock(ss);
- 
-     ssl_GetSSL3HandshakeLock(ss);
-+    ss->ssl3.hs.canFalseStart = PR_FALSE;
-+    ss->ssl3.hs.restartTarget = NULL;
- 
-     /*
-     ** Blow away old security state and get a fresh setup.
-     */
-     ssl_GetXmitBufLock(ss); 
-     ssl_ResetSecurityInfo(&ss->sec, PR_TRUE);
-     status = ssl_CreateSecurityInfo(ss);
-     ssl_ReleaseXmitBufLock(ss); 
-@@ -326,16 +331,84 @@ SSL_HandshakeCallback(PRFileDesc *fd, SS
-     ss->handshakeCallbackData = client_data;
- 
-     ssl_ReleaseSSL3HandshakeLock(ss);
-     ssl_Release1stHandshakeLock(ss);
- 
-     return SECSuccess;
- }
- 
-+/* Register an application callback to be called when false start may happen.
-+** Acquires and releases HandshakeLock.
-+*/
-+SECStatus
-+SSL_SetCanFalseStartCallback(PRFileDesc *fd, SSLCanFalseStartCallback cb,
-+			     void *client_data)
-+{
-+    sslSocket *ss;
-+
-+    ss = ssl_FindSocket(fd);
-+    if (!ss) {
-+	SSL_DBG(("%d: SSL[%d]: bad socket in SSL_SetCanFalseStartCallback",
-+		 SSL_GETPID(), fd));
-+	return SECFailure;
-+    }
-+
-+    if (!ss->opt.useSecurity) {
-+	PORT_SetError(SEC_ERROR_INVALID_ARGS);
-+	return SECFailure;
-+    }
-+
-+    ssl_Get1stHandshakeLock(ss);
-+    ssl_GetSSL3HandshakeLock(ss);
-+
-+    ss->canFalseStartCallback     = cb;
-+    ss->canFalseStartCallbackData = client_data;
-+
-+    ssl_ReleaseSSL3HandshakeLock(ss);
-+    ssl_Release1stHandshakeLock(ss);
-+
-+    return SECSuccess;
-+}
-+
-+/* A utility function that can be called from a custom CanFalseStartCallback
-+** function to determine what NSS would have done for this connection if the
-+** custom callback was not implemented.
-+*/
-+SECStatus
-+SSL_DefaultCanFalseStart(PRFileDesc *fd, PRBool *canFalseStart)
-+{
-+    sslSocket *ss;
-+    *canFalseStart = PR_FALSE;
-+    ss = ssl_FindSocket(fd);
-+    if (!ss) {
-+	SSL_DBG(("%d: SSL[%d]: bad socket in SSL_DefaultCanFalseStart",
-+		 SSL_GETPID(), fd));
-+	return SECFailure;
-+    }
-+
-+    if (!ss->ssl3.initialized) {
-+	PORT_SetError(SEC_ERROR_NOT_INITIALIZED);
-+	return SECFailure;
-+    }
-+
-+    if (ss->version <= SSL_LIBRARY_VERSION_3_0) {
-+	PORT_SetError(SSL_ERROR_FEATURE_NOT_SUPPORTED_FOR_VERSION);
-+	return SECFailure;
-+    }
-+
-+    /* Require a forward-secret key exchange. */
-+    *canFalseStart = ss->ssl3.hs.kea_def->kea == kea_dhe_dss ||
-+		     ss->ssl3.hs.kea_def->kea == kea_dhe_rsa ||
-+		     ss->ssl3.hs.kea_def->kea == kea_ecdhe_ecdsa ||
-+		     ss->ssl3.hs.kea_def->kea == kea_ecdhe_rsa;
-+
-+    return SECSuccess;
-+}
-+
- /* Try to make progress on an SSL handshake by attempting to read the 
- ** next handshake from the peer, and sending any responses.
- ** For non-blocking sockets, returns PR_ERROR_WOULD_BLOCK  if it cannot 
- ** read the next handshake from the underlying socket.
- ** For SSLv2, returns when handshake is complete or fatal error occurs.
- ** For SSLv3, returns when handshake is complete, or application data has
- ** arrived that must be taken by application before handshake can continue, 
- ** or a fatal error occurs.
-@@ -1190,22 +1263,17 @@ ssl_SecureSend(sslSocket *ss, const unsi
-     if (len > 0) 
-     	ss->writerThread = PR_GetCurrentThread();
-     /* If any of these is non-zero, the initial handshake is not done. */
-     if (!ss->firstHsDone) {
- 	PRBool canFalseStart = PR_FALSE;
- 	ssl_Get1stHandshakeLock(ss);
- 	if (ss->version >= SSL_LIBRARY_VERSION_3_0) {
- 	    ssl_GetSSL3HandshakeLock(ss);
--	    if ((ss->ssl3.hs.ws == wait_change_cipher ||
--		ss->ssl3.hs.ws == wait_finished ||
--		ss->ssl3.hs.ws == wait_new_session_ticket) &&
--		ssl3_CanFalseStart(ss)) {
--		canFalseStart = PR_TRUE;
--	    }
-+	    canFalseStart = ss->ssl3.hs.canFalseStart;
- 	    ssl_ReleaseSSL3HandshakeLock(ss);
- 	}
- 	if (!canFalseStart &&
- 	    (ss->handshake || ss->nextHandshake || ss->securityHandshake)) {
- 	    rv = ssl_Do1stHandshake(ss);
- 	}
- 	ssl_Release1stHandshakeLock(ss);
-     }
-diff --git a/security/nss/lib/ssl/sslsock.c b/security/nss/lib/ssl/sslsock.c
---- a/security/nss/lib/ssl/sslsock.c
-+++ b/security/nss/lib/ssl/sslsock.c
-@@ -2336,19 +2336,23 @@ ssl_Poll(PRFileDesc *fd, PRInt16 how_fla
- 		    ** The code should select on write, not read.
- 		    */
- 		    new_flags ^=  PR_POLL_READ;	   /* don't select on read. */
- 		    new_flags |=  PR_POLL_WRITE;   /* do    select on write. */
- 		}
- 	    } else if (new_flags & PR_POLL_WRITE) {
- 		    /* The caller is trying to write, but the handshake is 
- 		    ** blocked waiting for data to read, and the first 
--		    ** handshake has been sent.  so do NOT to poll on write.
-+		    ** handshake has been sent.  So do NOT to poll on write
-+		    ** unless we did false start.
- 		    */
--		    new_flags ^=  PR_POLL_WRITE;   /* don't select on write. */
-+		    if (!(ss->version >= SSL_LIBRARY_VERSION_3_0 &&
-+			ss->ssl3.hs.canFalseStart)) {
-+			new_flags ^=  PR_POLL_WRITE;   /* don't select on write. */
-+		    }
- 		    new_flags |=  PR_POLL_READ;	   /* do    select on read. */
- 	    }
- 	}
-     } else if ((new_flags & PR_POLL_READ) && (SSL_DataPending(fd) > 0)) {
- 	*p_out_flags = PR_POLL_READ;	/* it's ready already. */
- 	return new_flags;
-     } else if ((ss->lastWriteBlocked) && (how_flags & PR_POLL_READ) &&
- 	       (ss->pendingBuf.len != 0)) { /* write data waiting to be sent */
diff --git a/security/patches/bug-935831.patch b/security/patches/bug-935831.patch
new file mode 100644
index 000000000000..14c77e9cf115
--- /dev/null
+++ b/security/patches/bug-935831.patch
@@ -0,0 +1,50 @@
+# HG changeset patch
+# Parent cb500491e8a524edb44213d1a787adb98c385ecd
+# User Richard Newman <rnewman@mozilla.com>
+
+Back out Bug 927230 for Android 2.3 startup crash. r=briansmith
+
+diff --git a/security/nss/lib/freebl/unix_rand.c b/security/nss/lib/freebl/unix_rand.c
+--- a/security/nss/lib/freebl/unix_rand.c
++++ b/security/nss/lib/freebl/unix_rand.c
+@@ -969,20 +969,16 @@ size_t RNG_FileUpdate(const char *fileNa
+     memset(&stat_buf, 0, sizeof(stat_buf));
+ 
+     if (stat((char *)fileName, &stat_buf) < 0)
+ 	return fileBytes;
+     RNG_RandomUpdate(&stat_buf, sizeof(stat_buf));
+     
+     file = fopen(fileName, "r");
+     if (file != NULL) {
+-	/* Set buffering mode to unbuffered I/O to avoid reading more bytes
+-	 * than we need from /dev/urandom. Moreover, we read into a buffer
+-	 * of size BUFSIZ, so buffered I/O has no performance advantage. */
+-	setvbuf(file, NULL, _IONBF, 0);
+ 	while (limit > fileBytes) {
+ 	    bytes = PR_MIN(sizeof buffer, limit - fileBytes);
+ 	    bytes = fread(buffer, 1, bytes, file);
+ 	    if (bytes == 0) 
+ 		break;
+ 	    RNG_RandomUpdate(buffer, bytes);
+ 	    fileBytes      += bytes;
+ 	    totalFileBytes += bytes;
+@@ -1133,19 +1129,16 @@ size_t RNG_SystemRNG(void *dest, size_t 
+     size_t bytes;
+     size_t fileBytes = 0;
+     unsigned char *buffer = dest;
+ 
+     file = fopen("/dev/urandom", "r");
+     if (file == NULL) {
+ 	return rng_systemFromNoise(dest, maxLen);
+     }
+-    /* Set buffering mode to unbuffered I/O to avoid reading more bytes
+-     * than we need from /dev/urandom. */
+-    setvbuf(file, NULL, _IONBF, 0);
+     while (maxLen > fileBytes) {
+ 	bytes = maxLen - fileBytes;
+ 	bytes = fread(buffer, 1, bytes, file);
+ 	if (bytes == 0) 
+ 	    break;
+ 	fileBytes += bytes;
+ 	buffer += bytes;
+     }
diff --git a/security/sandbox/linux/seccomp_filter.h b/security/sandbox/linux/seccomp_filter.h
index fb934165bafb..a1904e457c45 100644
--- a/security/sandbox/linux/seccomp_filter.h
+++ b/security/sandbox/linux/seccomp_filter.h
@@ -91,6 +91,116 @@
 #define SECCOMP_WHITELIST_ARCH_TOREMOVE
 #endif
 
+/* Architecture-specific syscalls for desktop linux */
+#if defined(__arm__)
+#define SECCOMP_WHITELIST_ARCH_DESKTOP_LINUX
+#elif defined(__i386__)
+#define SECCOMP_WHITELIST_ARCH_DESKTOP_LINUX
+#elif defined(__x86_64__)
+#define SECCOMP_WHITELIST_ARCH_DESKTOP_LINUX
+#else
+#define SECCOMP_WHITELIST_ARCH_DESKTOP_LINUX
+#endif
+
+/* B2G specific syscalls */
+#if defined(MOZ_B2G)
+
+#define SECCOMP_WHITELIST_B2G_HIGH \
+  ALLOW_SYSCALL(gettimeofday),
+
+#define SECCOMP_WHITELIST_B2G_MED \
+  ALLOW_SYSCALL(clock_gettime), \
+  ALLOW_SYSCALL(getpid), \
+  ALLOW_SYSCALL(rt_sigreturn), \
+  ALLOW_SYSCALL(epoll_wait),
+
+#define SECCOMP_WHITELIST_B2G_LOW \
+  ALLOW_SYSCALL(getdents64), \
+  ALLOW_SYSCALL(sched_setscheduler),
+
+#else
+#define SECCOMP_WHITELIST_B2G_HIGH
+#define SECCOMP_WHITELIST_B2G_MED
+#define SECCOMP_WHITELIST_B2G_LOW
+#endif
+/* End of B2G specific syscalls */
+
+
+/* Desktop Linux specific syscalls */
+#if defined(MOZ_CONTENT_SANDBOX) && !defined(MOZ_B2G) && defined(XP_UNIX) && !defined(XP_MACOSX)
+
+/* We should remove all of the following in the future (possibly even more) */
+#define SECCOMP_WHITELIST_DESKTOP_LINUX_TO_REMOVE \
+  ALLOW_SYSCALL(socket), \
+  ALLOW_SYSCALL(chmod), \
+  ALLOW_SYSCALL(execve), \
+  ALLOW_SYSCALL(rename), \
+  ALLOW_SYSCALL(symlink), \
+  ALLOW_SYSCALL(connect), \
+  ALLOW_SYSCALL(quotactl), \
+  ALLOW_SYSCALL(kill), \
+  ALLOW_SYSCALL(sendto),
+
+#define SECCOMP_WHITELIST_DESKTOP_LINUX \
+  SECCOMP_WHITELIST_ARCH_DESKTOP_LINUX \
+  ALLOW_SYSCALL(stat), \
+  ALLOW_SYSCALL(getdents), \
+  ALLOW_SYSCALL(lstat), \
+  ALLOW_SYSCALL(mmap), \
+  ALLOW_SYSCALL(openat), \
+  ALLOW_SYSCALL(fcntl), \
+  ALLOW_SYSCALL(fstat), \
+  ALLOW_SYSCALL(readlink), \
+  ALLOW_SYSCALL(getsockname), \
+  ALLOW_SYSCALL(recvmsg), \
+  ALLOW_SYSCALL(uname), \
+  /* duplicate rt_sigaction in SECCOMP_WHITELIST_PROFILING */ \
+  ALLOW_SYSCALL(rt_sigaction), \
+  ALLOW_SYSCALL(getuid), \
+  ALLOW_SYSCALL(geteuid), \
+  ALLOW_SYSCALL(mkdir), \
+  ALLOW_SYSCALL(getcwd), \
+  ALLOW_SYSCALL(readahead), \
+  ALLOW_SYSCALL(pread64), \
+  ALLOW_SYSCALL(statfs), \
+  ALLOW_SYSCALL(pipe), \
+  ALLOW_SYSCALL(ftruncate), \
+  ALLOW_SYSCALL(getrlimit), \
+  ALLOW_SYSCALL(shutdown), \
+  ALLOW_SYSCALL(getpeername), \
+  ALLOW_SYSCALL(eventfd2), \
+  ALLOW_SYSCALL(clock_getres), \
+  ALLOW_SYSCALL(sysinfo), \
+  ALLOW_SYSCALL(getresuid), \
+  ALLOW_SYSCALL(umask), \
+  ALLOW_SYSCALL(getresgid), \
+  ALLOW_SYSCALL(poll), \
+  ALLOW_SYSCALL(getegid), \
+  ALLOW_SYSCALL(inotify_init1), \
+  ALLOW_SYSCALL(wait4), \
+  ALLOW_SYSCALL(shmctl), \
+  ALLOW_SYSCALL(set_robust_list), \
+  ALLOW_SYSCALL(rmdir), \
+  ALLOW_SYSCALL(recvfrom), \
+  ALLOW_SYSCALL(shmdt), \
+  ALLOW_SYSCALL(pipe2), \
+  ALLOW_SYSCALL(setsockopt), \
+  ALLOW_SYSCALL(shmat), \
+  ALLOW_SYSCALL(set_tid_address), \
+  ALLOW_SYSCALL(inotify_add_watch), \
+  ALLOW_SYSCALL(rt_sigprocmask), \
+  ALLOW_SYSCALL(shmget), \
+  ALLOW_SYSCALL(getgid), \
+  ALLOW_SYSCALL(utime), \
+  ALLOW_SYSCALL(arch_prctl), \
+  ALLOW_SYSCALL(sched_getaffinity), \
+  SECCOMP_WHITELIST_DESKTOP_LINUX_TO_REMOVE
+#else
+#define SECCOMP_WHITELIST_DESKTOP_LINUX
+#endif
+/* End of Desktop Linux specific syscalls */
+
+
 /* Most used system calls should be at the top of the whitelist
  * for performance reasons. The whitelist BPF filter exits after
  * processing any ALLOW_SYSCALL macro.
@@ -110,7 +220,7 @@
 #define SECCOMP_WHITELIST \
   /* These are calls we're ok to allow */ \
   SECCOMP_WHITELIST_ARCH_HIGH \
-  ALLOW_SYSCALL(gettimeofday), \
+  SECCOMP_WHITELIST_B2G_HIGH \
   ALLOW_SYSCALL(read), \
   ALLOW_SYSCALL(write), \
   ALLOW_SYSCALL(lseek), \
@@ -124,13 +234,10 @@
   ALLOW_SYSCALL(writev), \
   ALLOW_SYSCALL(clone), \
   ALLOW_SYSCALL(brk), \
-  ALLOW_SYSCALL(clock_gettime), \
-  ALLOW_SYSCALL(getpid), \
+  SECCOMP_WHITELIST_B2G_MED \
   ALLOW_SYSCALL(gettid), \
   ALLOW_SYSCALL(getrusage), \
   ALLOW_SYSCALL(madvise), \
-  ALLOW_SYSCALL(rt_sigreturn), \
-  ALLOW_SYSCALL(epoll_wait), \
   ALLOW_SYSCALL(futex), \
   ALLOW_SYSCALL(dup), \
   ALLOW_SYSCALL(nanosleep), \
@@ -142,7 +249,6 @@
   ALLOW_SYSCALL(open), \
   ALLOW_SYSCALL(prctl), \
   ALLOW_SYSCALL(access), \
-  ALLOW_SYSCALL(getdents64), \
   ALLOW_SYSCALL(unlink), \
   ALLOW_SYSCALL(fsync), \
   ALLOW_SYSCALL(socketpair), \
@@ -150,12 +256,15 @@
   /* Should remove all of the following in the future, if possible */ \
   ALLOW_SYSCALL(getpriority), \
   ALLOW_SYSCALL(setpriority), \
-  ALLOW_SYSCALL(sched_setscheduler), \
   SECCOMP_WHITELIST_PROFILING \
+  SECCOMP_WHITELIST_B2G_LOW \
   /* Always last and always OK calls */ \
   SECCOMP_WHITELIST_ARCH_LAST \
   /* restart_syscall is called internally, generally when debugging */ \
   ALLOW_SYSCALL(restart_syscall), \
+  /* linux desktop is not as performance critical as B2G */ \
+  /* we can place desktop syscalls at the end */ \
+  SECCOMP_WHITELIST_DESKTOP_LINUX \
   ALLOW_SYSCALL(exit_group), \
   ALLOW_SYSCALL(exit)
 
diff --git a/services/datareporting/DataReportingService.js b/services/datareporting/DataReportingService.js
index 27a1679aeff0..f7e3db0a2e26 100644
--- a/services/datareporting/DataReportingService.js
+++ b/services/datareporting/DataReportingService.js
@@ -212,6 +212,8 @@ DataReportingService.prototype = Object.freeze({
       this._loadHealthReporter();
     } catch (ex) {
       this._healthReporter = null;
+      Cu.reportError("Exception when obtaining health reporter: " +
+                     CommonUtils.exceptionStr(ex));
     }
 
     return this._healthReporter;
diff --git a/storage/src/Makefile.in b/storage/src/Makefile.in
index 941864015325..c7391edbc342 100644
--- a/storage/src/Makefile.in
+++ b/storage/src/Makefile.in
@@ -6,14 +6,21 @@
 # Don't use the jemalloc allocator on Android, because we can't guarantee
 # that Gecko will configure sqlite before it is first used (bug 730495).
 #
+# Don't use the jemalloc allocator when using system sqlite. Linked in libraries
+# (such as NSS) might trigger an initialization of sqlite and allocation
+# of memory using the default allocator, prior to the storage service
+# registering its allocator, causing memory management failures (bug 938730).
+#
 # Note: On Windows our sqlite build assumes we use jemalloc.  If you disable
 # MOZ_STORAGE_MEMORY on Windows, you will also need to change the "ifdef
 # MOZ_MEMORY" options in db/sqlite3/src/Makefile.in.
 ifdef MOZ_MEMORY
+ifndef MOZ_NATIVE_SQLITE
 ifneq ($(OS_TARGET), Android)
 DEFINES += -DMOZ_STORAGE_MEMORY
 endif
 endif
+endif
 
 # For nsDependentJSString
 LOCAL_INCLUDES = \
diff --git a/testing/marionette/client/marionette/runtests.py b/testing/marionette/client/marionette/runtests.py
index 1bd6a3570469..9b4cd6258760 100644
--- a/testing/marionette/client/marionette/runtests.py
+++ b/testing/marionette/client/marionette/runtests.py
@@ -708,8 +708,7 @@ class MarionetteTestRunner(object):
                                                for results in results_list])))
         testsuite.setAttribute('errors', str(sum([len(results.errors)
                                              for results in results_list])))
-        if hasattr(results, 'skipped'):
-            testsuite.setAttribute('skips', str(sum([len(results.skipped) +
+        testsuite.setAttribute('skips', str(sum([len(results.skipped) +
                                                      len(results.expectedFailures)
                                                      for results in results_list])))
 
diff --git a/testing/mochitest/browser-test.js b/testing/mochitest/browser-test.js
index a88d60d492fc..e6aec0f88783 100644
--- a/testing/mochitest/browser-test.js
+++ b/testing/mochitest/browser-test.js
@@ -74,8 +74,10 @@ function Tester(aTests, aDumper, aCallback) {
   this._scriptLoader.loadSubScript("chrome://mochikit/content/tests/SimpleTest/SpecialPowersObserverAPI.js", simpleTestScope);
   this._scriptLoader.loadSubScript("chrome://mochikit/content/tests/SimpleTest/ChromePowers.js", simpleTestScope);
   this._scriptLoader.loadSubScript("chrome://mochikit/content/tests/SimpleTest/SimpleTest.js", simpleTestScope);
+  this._scriptLoader.loadSubScript("chrome://mochikit/content/tests/SimpleTest/MemoryStats.js", simpleTestScope);
   this._scriptLoader.loadSubScript("chrome://mochikit/content/chrome-harness.js", simpleTestScope);
   this.SimpleTest = simpleTestScope.SimpleTest;
+  this.MemoryStats = simpleTestScope.MemoryStats;
   this.Task = Components.utils.import("resource://gre/modules/Task.jsm", null).Task;
   this.Promise = Components.utils.import("resource://gre/modules/commonjs/sdk/core/promise.js", null).Promise;
   this.Assert = Components.utils.import("resource://testing-common/Assert.jsm", null).Assert;
@@ -357,6 +359,14 @@ Tester.prototype = {
         }
       }
 
+      // Dump memory stats for main thread.
+      if (Cc["@mozilla.org/xre/runtime;1"]
+          .getService(Ci.nsIXULRuntime)
+          .processType == Ci.nsIXULRuntime.PROCESS_TYPE_DEFAULT)
+      {
+        this.MemoryStats.dump((l) => { this.dumper.dump(l + "\n"); });
+      }
+
       // Note the test run time
       let time = Date.now() - this.lastStartTime;
       this.dumper.dump("INFO TEST-END | " + this.currentTest.path + " | finished in " + time + "ms\n");
diff --git a/testing/mochitest/harness.xul b/testing/mochitest/harness.xul
index 90bd73ab9628..aee10cd95369 100644
--- a/testing/mochitest/harness.xul
+++ b/testing/mochitest/harness.xul
@@ -15,6 +15,8 @@
           src="chrome://mochikit/content/tests/SimpleTest/SpecialPowersObserverAPI.js"/>
   <script type="text/javascript"
           src="chrome://mochikit/content/tests/SimpleTest/ChromePowers.js"/>
+  <script type="text/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/MemoryStats.js"/>
   <script type="text/javascript"
           src="chrome://mochikit/content/tests/SimpleTest/TestRunner.js"/>
   <script type="text/javascript"
diff --git a/testing/mochitest/jar.mn b/testing/mochitest/jar.mn
index d17f83d6eda2..11da6f74581c 100644
--- a/testing/mochitest/jar.mn
+++ b/testing/mochitest/jar.mn
@@ -16,6 +16,7 @@ mochikit.jar:
   content/tests/SimpleTest/EventUtils.js (tests/SimpleTest/EventUtils.js)
   content/tests/SimpleTest/ChromeUtils.js (tests/SimpleTest/ChromeUtils.js)
   content/tests/SimpleTest/LogController.js (tests/SimpleTest/LogController.js)
+  content/tests/SimpleTest/MemoryStats.js (tests/SimpleTest/MemoryStats.js)
   content/tests/SimpleTest/MozillaLogger.js (../specialpowers/content/MozillaLogger.js)
   content/tests/SimpleTest/SpecialPowersObserverAPI.js (../specialpowers/content/SpecialPowersObserverAPI.js)
   content/tests/SimpleTest/specialpowersAPI.js (../specialpowers/content/specialpowersAPI.js)
diff --git a/testing/mochitest/runtestsb2g.py b/testing/mochitest/runtestsb2g.py
index e5260e088d16..af1dbbdc40ee 100644
--- a/testing/mochitest/runtestsb2g.py
+++ b/testing/mochitest/runtestsb2g.py
@@ -9,6 +9,7 @@ import shutil
 import sys
 import tempfile
 import threading
+import time
 import traceback
 
 here = os.path.abspath(os.path.dirname(__file__))
@@ -143,11 +144,16 @@ class B2GMochitest(MochitestUtilsMixin):
             log.info("runtests.py | Received keyboard interrupt.\n");
             status = -1
         except:
+            # XXX Bug 937684
+            time.sleep(5)
             traceback.print_exc()
             log.error("Automation Error: Received unexpected exception while running application\n")
             self.runner.check_for_crashes()
             status = 1
 
+        # XXX Bug 937684
+        time.sleep(5)
+
         self.stopWebServer(options)
         self.stopWebSocketServer(options)
 
diff --git a/testing/mochitest/server.js b/testing/mochitest/server.js
index c26c56990c0d..4292a5ce8c8e 100644
--- a/testing/mochitest/server.js
+++ b/testing/mochitest/server.js
@@ -604,6 +604,8 @@ function testListing(metadata, response)
         ),
         SCRIPT({type: "text/javascript",
                  src: "/tests/SimpleTest/LogController.js"}),
+        SCRIPT({type: "text/javascript",
+                 src: "/tests/SimpleTest/MemoryStats.js"}),
         SCRIPT({type: "text/javascript",
                  src: "/tests/SimpleTest/TestRunner.js"}),
         SCRIPT({type: "text/javascript",
diff --git a/testing/mochitest/tests/SimpleTest/Makefile.in b/testing/mochitest/tests/SimpleTest/Makefile.in
index 129b0545e90c..30fbb85eb727 100644
--- a/testing/mochitest/tests/SimpleTest/Makefile.in
+++ b/testing/mochitest/tests/SimpleTest/Makefile.in
@@ -7,6 +7,7 @@ _SIMPLETEST_FILES =	LogController.js \
 			SimpleTest.js \
 			test.css \
 			TestRunner.js \
+			MemoryStats.js \
 			setup.js \
 			EventUtils.js \
 			ChromeUtils.js \
diff --git a/testing/mochitest/tests/SimpleTest/MemoryStats.js b/testing/mochitest/tests/SimpleTest/MemoryStats.js
new file mode 100644
index 000000000000..5570f04c55f4
--- /dev/null
+++ b/testing/mochitest/tests/SimpleTest/MemoryStats.js
@@ -0,0 +1,49 @@
+var MemoryStats = {};
+
+/**
+ * Statistics that we want to retrieve and display after every test is
+ * done.  The keys of this table are intended to be identical to the
+ * relevant attributes of nsIMemoryReporterManager.  However, since
+ * nsIMemoryReporterManager doesn't necessarily support all these
+ * statistics in all build configurations, we also use this table to
+ * tell us whether statistics are supported or not.
+ */
+var MEM_STAT_UNKNOWN = 0;
+var MEM_STAT_UNSUPPORTED = 1;
+var MEM_STAT_SUPPORTED = 2;
+
+MemoryStats._hasMemoryStatistics = {}
+MemoryStats._hasMemoryStatistics.vsize = MEM_STAT_UNKNOWN;
+MemoryStats._hasMemoryStatistics.vsizeMaxContiguous = MEM_STAT_UNKNOWN;
+MemoryStats._hasMemoryStatistics.residentFast = MEM_STAT_UNKNOWN;
+MemoryStats._hasMemoryStatistics.heapAllocated = MEM_STAT_UNKNOWN;
+
+MemoryStats.dump = function (dumpFn) {
+    var mrm;
+    try {
+	mrm = Cc["@mozilla.org/memory-reporter-manager;1"]
+	    .getService(Ci.nsIMemoryReporterManager);
+    } catch (e) {
+	mrm = SpecialPowers.Cc["@mozilla.org/memory-reporter-manager;1"]
+	                   .getService(SpecialPowers.Ci.nsIMemoryReporterManager);
+    }
+    for (var stat in MemoryStats._hasMemoryStatistics) {
+        var supported = MemoryStats._hasMemoryStatistics[stat];
+        var firstAccess = false;
+        if (supported == MEM_STAT_UNKNOWN) {
+            firstAccess = true;
+            try {
+                var value = mrm[stat];
+                supported = MEM_STAT_SUPPORTED;
+            } catch (e) {
+                supported = MEM_STAT_UNSUPPORTED;
+            }
+            MemoryStats._hasMemoryStatistics[stat] = supported;
+        }
+        if (supported == MEM_STAT_SUPPORTED) {
+            dumpFn("TEST-INFO | MEMORY STAT " + stat + " after test: " + mrm[stat]);
+        } else if (firstAccess) {
+            dumpFn("TEST-INFO | MEMORY STAT " + stat + " not supported in this build configuration.");
+        }
+    }
+};
diff --git a/testing/mochitest/tests/SimpleTest/TestRunner.js b/testing/mochitest/tests/SimpleTest/TestRunner.js
index 28254f437752..34429d7d2456 100644
--- a/testing/mochitest/tests/SimpleTest/TestRunner.js
+++ b/testing/mochitest/tests/SimpleTest/TestRunner.js
@@ -392,22 +392,6 @@ TestRunner.expectChildProcessCrash = function() {
     TestRunner._expectingProcessCrash = true;
 };
 
-/**
- * Statistics that we want to retrieve and display after every test is
- * done.  The keys of this table are intended to be identical to the
- * relevant attributes of nsIMemoryReporterManager.  However, since
- * nsIMemoryReporterManager doesn't necessarily support all these
- * statistics in all build configurations, we also use this table to
- * tell us whether statistics are supported or not.
- */
-var MEM_STAT_UNKNOWN = 0;
-var MEM_STAT_UNSUPPORTED = 1;
-var MEM_STAT_SUPPORTED = 2;
-TestRunner._hasMemoryStatistics = {}
-TestRunner._hasMemoryStatistics.vsize = MEM_STAT_UNKNOWN;
-TestRunner._hasMemoryStatistics.heapAllocated = MEM_STAT_UNKNOWN;
-TestRunner._hasMemoryStatistics.largestContiguousVMBlock = MEM_STAT_UNKNOWN;
-
 /**
  * This stub is called by SimpleTest when a test is finished.
 **/
@@ -425,33 +409,7 @@ TestRunner.testFinished = function(tests) {
     TestRunner._lastTestFinished = TestRunner._currentTest;
     TestRunner._loopIsRestarting = false;
 
-    var mrm;
-    try {
-	mrm = Cc["@mozilla.org/memory-reporter-manager;1"]
-	    .getService(Ci.nsIMemoryReporterManager);
-    } catch (e) {
-	mrm = SpecialPowers.Cc["@mozilla.org/memory-reporter-manager;1"]
-	                   .getService(SpecialPowers.Ci.nsIMemoryReporterManager);
-    }
-    for (stat in TestRunner._hasMemoryStatistics) {
-        var supported = TestRunner._hasMemoryStatistics[stat];
-        var firstAccess = false;
-        if (supported == MEM_STAT_UNKNOWN) {
-            firstAccess = true;
-            try {
-                var value = mrm[stat];
-                supported = MEM_STAT_SUPPORTED;
-            } catch (e) {
-                supported = MEM_STAT_UNSUPPORTED;
-            }
-            TestRunner._hasMemoryStatistics[stat] = supported;
-        }
-        if (supported == MEM_STAT_SUPPORTED) {
-            TestRunner.log("TEST-INFO | MEMORY STAT " + stat + " after test: " + mrm[stat]);
-        } else if (firstAccess) {
-            TestRunner.log("TEST-INFO | MEMORY STAT " + stat + " not supported in this build configuration.");
-        }
-    }
+    MemoryStats.dump(TestRunner.log);
 
     function cleanUpCrashDumpFiles() {
         if (!SpecialPowers.removeExpectedCrashDumpFiles(TestRunner._expectingProcessCrash)) {
diff --git a/testing/mochitest/tests/index.html b/testing/mochitest/tests/index.html
index c15dc5f676ee..9c715310633b 100644
--- a/testing/mochitest/tests/index.html
+++ b/testing/mochitest/tests/index.html
@@ -2,6 +2,7 @@
 <head>
     <!-- This harness does not work locally in Safari -->
     <script type="text/javascript" src="../MochiKit/MochiKit.js"></script>
+    <script type="text/javascript" src="SimpleTest/MemoryStats.js"></script>
     <script type="text/javascript" src="SimpleTest/TestRunner.js"></script>
     <script type="text/javascript" src="SimpleTest/MozillaLogger.js"></script>
     <!--<link rel="stylesheet" type="text/css" href="/static/main.css" />-->
diff --git a/testing/talos/talos.json b/testing/talos/talos.json
index 77f292d4b9c6..28a2d5275a0c 100644
--- a/testing/talos/talos.json
+++ b/testing/talos/talos.json
@@ -1,11 +1,11 @@
 {
     "talos.zip": {
-        "url": "http://talos-bundles.pvt.build.mozilla.org/zips/talos.0987e4cbd219.zip",
+        "url": "http://talos-bundles.pvt.build.mozilla.org/zips/talos.635c822fd27e.zip",
         "path": ""
     },
     "global": {
         "talos_repo": "http://hg.mozilla.org/build/talos",
-        "talos_revision": "0987e4cbd219"
+        "talos_revision": "635c822fd27e"
     },
     "suites": {
         "chromez": {
diff --git a/toolkit/components/aboutmemory/tests/test_aboutmemory5.xul b/toolkit/components/aboutmemory/tests/test_aboutmemory5.xul
index 50a464310cce..9aa61e290a66 100644
--- a/toolkit/components/aboutmemory/tests/test_aboutmemory5.xul
+++ b/toolkit/components/aboutmemory/tests/test_aboutmemory5.xul
@@ -104,7 +104,8 @@
         // If we have more than 1000 chars, we've probably successfully
         // copy+pasted.
         if (actual.length > 1000) {
-          let vsizes = actual.match(/vsize/g);
+          // Note: Match "vsize" but not "vsize-max-contiguous".
+          let vsizes = actual.match(/vsize[^-]/g);
           let endOfBrowsers  = actual.match(/End of Browser/g);
 
           if (vsizes.length == 4 && endOfBrowsers.length == 3) {
diff --git a/toolkit/components/aboutmemory/tests/test_memoryReporters.xul b/toolkit/components/aboutmemory/tests/test_memoryReporters.xul
index 0f6deb4bf516..ed22ebb22578 100644
--- a/toolkit/components/aboutmemory/tests/test_memoryReporters.xul
+++ b/toolkit/components/aboutmemory/tests/test_memoryReporters.xul
@@ -127,6 +127,7 @@
   }
   let amounts = [
     "vsize",
+    "vsizeMaxContiguous",
     "resident",
     "residentFast",
     "heapAllocated",
diff --git a/toolkit/components/captivedetect/captivedetect.js b/toolkit/components/captivedetect/captivedetect.js
index a42f8ce632f7..af1bd2326654 100644
--- a/toolkit/components/captivedetect/captivedetect.js
+++ b/toolkit/components/captivedetect/captivedetect.js
@@ -298,12 +298,13 @@ CaptivePortalDetector.prototype = {
 
     let urlFetcher = new URLFetcher(this._canonicalSiteURL, this._maxWaitingTime);
 
-    let requestDone = this.executeCallback.bind(this, true);
-    urlFetcher.ontimeout = requestDone;
-    urlFetcher.onerror = requestDone;
+    let mayRetry = this._mayRetry.bind(this);
+
+    urlFetcher.ontimeout = mayRetry;
+    urlFetcher.onerror = mayRetry;
     urlFetcher.onsuccess = function (content) {
       if (self.validateContent(content)) {
-        requestDone();
+        self.executeCallback(true);
       } else {
         // Content of the canonical website has been overwrite
         self._startLogin();
@@ -313,11 +314,8 @@ CaptivePortalDetector.prototype = {
       if (status >= 300 && status <= 399) {
         // The canonical website has been redirected to an unknown location
         self._startLogin();
-      } else if (self._runningRequest.retryCount++ < self._maxRetryCount) {
-        debug('startDetection-retry: ' + self._runningRequest.retryCount);
-        self._startDetection();
       } else {
-        requestDone();
+        mayRetry();
       }
     };
 
@@ -336,6 +334,15 @@ CaptivePortalDetector.prototype = {
     this._sendEvent(kOpenCaptivePortalLoginEvent, details);
   },
 
+  _mayRetry: function _mayRetry() {
+    if (this._runningRequest.retryCount++ < this._maxRetryCount) {
+      debug('retry-Detection: ' + this._runningRequest.retryCount + '/' + this._maxRetryCount);
+      this._startDetection();
+    } else {
+      this.executeCallback(true);
+    }
+  },
+
   executeCallback: function executeCallback(success) {
     if (this._runningRequest) {
       debug('callback executed');
diff --git a/toolkit/components/osfile/modules/osfile_async_front.jsm b/toolkit/components/osfile/modules/osfile_async_front.jsm
index d4b9c55c68ab..062e1a621409 100644
--- a/toolkit/components/osfile/modules/osfile_async_front.jsm
+++ b/toolkit/components/osfile/modules/osfile_async_front.jsm
@@ -880,7 +880,7 @@ let DirectoryIterator = function DirectoryIterator(path, options) {
    * @rejects {StopIteration} If all entries have already been visited
    * or the iterator has been closed.
    */
-  this._itmsg = Scheduler.post(
+  this.__itmsg = Scheduler.post(
     "new_DirectoryIterator", [Type.path.toMsg(path), options],
     path
   );
@@ -890,6 +890,17 @@ DirectoryIterator.prototype = {
   iterator: function () this,
   __iterator__: function () this,
 
+  // Once close() is called, _itmsg should reject with a
+  // StopIteration. However, we don't want to create the promise until
+  // it's needed because it might never be used. In that case, we
+  // would get a warning on the console.
+  get _itmsg() {
+    if (!this.__itmsg) {
+      this.__itmsg = Promise.reject(StopIteration);
+    }
+    return this.__itmsg;
+  },
+
   /**
    * Determine whether the directory exists.
    *
@@ -1029,7 +1040,9 @@ DirectoryIterator.prototype = {
     let self = this;
     return this._itmsg.then(
       function withIterator(iterator) {
-        self._itmsg = Promise.reject(StopIteration);
+        // Set __itmsg to null so that the _itmsg getter returns a
+        // rejected StopIteration promise if it's ever used.
+        self.__itmsg = null;
         return Scheduler.post("DirectoryIterator_prototype_close", [iterator]);
       }
     );
diff --git a/toolkit/components/places/tests/unit/test_null_interfaces.js b/toolkit/components/places/tests/unit/test_null_interfaces.js
index a847202146a6..2c7182cbf3b5 100644
--- a/toolkit/components/places/tests/unit/test_null_interfaces.js
+++ b/toolkit/components/places/tests/unit/test_null_interfaces.js
@@ -6,6 +6,8 @@
  * Test bug 489872 to make sure passing nulls to nsNavHistory doesn't crash.
  */
 
+let Cr = Components.results;
+
 /**
  * Print some debug message to the console. All arguments will be printed,
  * separated by spaces.
@@ -81,18 +83,18 @@ function run_test()
           _("Must have been an expected nothrow, so no need to try again");
           tryAgain = false;
         }
-        catch(ex if ex.name.match(/NS_ERROR_ILLEGAL_VALUE/)) {
+        catch(ex if ex.result == Cr.NS_ERROR_ILLEGAL_VALUE) {
           _("Caught an expected exception:", ex.name);
 
           _("Moving on to the next test..");
           tryAgain = false;
         }
-        catch(ex if ex.name.match(/NS_ERROR_XPC_NEED_OUT_OBJECT/)) {
+        catch(ex if ex.result == Cr.NS_ERROR_XPC_NEED_OUT_OBJECT) {
           let pos = Number(ex.message.match(/object arg (\d+)/)[1]);
           _("Function call expects an out object at", pos);
           args[pos] = {};
         }
-        catch(ex if ex.name.match(/NS_ERROR_NOT_IMPLEMENTED/)) {
+        catch(ex if ex.result == Cr.NS_ERROR_NOT_IMPLEMENTED) {
           _("Method not implemented exception:", ex.name);
 
           _("Moving on to the next test..");
diff --git a/toolkit/components/satchel/nsFormFillController.cpp b/toolkit/components/satchel/nsFormFillController.cpp
index 4499fd14f7b9..2317ffef342f 100644
--- a/toolkit/components/satchel/nsFormFillController.cpp
+++ b/toolkit/components/satchel/nsFormFillController.cpp
@@ -584,9 +584,8 @@ nsFormFillController::GetInPrivateContext(bool *aInPrivateContext)
   nsCOMPtr<nsIDOMElement> element = do_QueryInterface(mFocusedInput);
   element->GetOwnerDocument(getter_AddRefs(inputDoc));
   nsCOMPtr<nsIDocument> doc = do_QueryInterface(inputDoc);
-  nsCOMPtr<nsISupports> container = doc->GetContainer();
-  nsCOMPtr<nsIDocShell> docShell = do_QueryInterface(container);
-  nsCOMPtr<nsILoadContext> loadContext = do_QueryInterface(docShell);
+  nsCOMPtr<nsIDocShell> docShell = doc->GetDocShell();
+  nsCOMPtr<nsILoadContext> loadContext = doc->GetLoadContext();
   *aInPrivateContext = loadContext && loadContext->UsePrivateBrowsing();
   return NS_OK;
 }
diff --git a/toolkit/components/telemetry/Histograms.json b/toolkit/components/telemetry/Histograms.json
index 8560aa4fd042..50d4c4d4dcd5 100644
--- a/toolkit/components/telemetry/Histograms.json
+++ b/toolkit/components/telemetry/Histograms.json
@@ -255,6 +255,14 @@
     "extended_statistics_ok": true,
     "description": "Virtual memory size (KB)"
   },
+  "MEMORY_VSIZE_MAX_CONTIGUOUS": {
+    "kind": "exponential",
+    "low": "32 * 1024",
+    "high": "16 * 1024 * 1024",
+    "n_buckets": 100,
+    "extended_statistics_ok": true,
+    "description": "Maximum-sized block of contiguous virtual memory (KB)"
+  },
   "MEMORY_JS_COMPARTMENTS_SYSTEM": {
     "kind": "exponential",
     "high": "1000",
diff --git a/toolkit/components/telemetry/TelemetryPing.js b/toolkit/components/telemetry/TelemetryPing.js
index f206ef760a13..a67c6425ce66 100644
--- a/toolkit/components/telemetry/TelemetryPing.js
+++ b/toolkit/components/telemetry/TelemetryPing.js
@@ -374,10 +374,13 @@ TelemetryPing.prototype = {
     if (gfxInfo) {
       for each (let field in gfxfields) {
         try {
-          let value = "";
-          value = gfxInfo[field];
-          if (value != "")
+          let value = gfxInfo[field];
+          // bug 940806: We need to do a strict equality comparison here,
+          // otherwise a type conversion will occur and boolean false values
+          // will get filtered out
+          if (value !== "") {
             ret[field] = value;
+          }
         } catch (e) {
           continue
         }
@@ -452,6 +455,7 @@ TelemetryPing.prototype = {
     let p = (id, n) => h(id, Ci.nsIMemoryReporter.UNITS_PERCENTAGE, n);
 
     b("MEMORY_VSIZE", "vsize");
+    b("MEMORY_VSIZE_MAX_CONTIGUOUS", "vsizeMaxContiguous");
     b("MEMORY_RESIDENT", "residentFast");
     b("MEMORY_HEAP_ALLOCATED", "heapAllocated");
     p("MEMORY_HEAP_COMMITTED_UNUSED_RATIO", "heapOverheadRatio");
diff --git a/toolkit/content/aboutNetworking.js b/toolkit/content/aboutNetworking.js
index 1bfac7f246eb..73d5b96a9296 100644
--- a/toolkit/content/aboutNetworking.js
+++ b/toolkit/content/aboutNetworking.js
@@ -40,14 +40,14 @@ function displayHttp(data) {
   let new_cont = document.createElement('tbody');
   new_cont.setAttribute('id', 'http_content');
 
-  for (let i = 0; i < data.host.length; i++) {
+  for (let i = 0; i < data.connections.length; i++) {
     let row = document.createElement('tr');
-    row.appendChild(col(data.host[i]));
-    row.appendChild(col(data.port[i]));
-    row.appendChild(col(data.spdy[i]));
-    row.appendChild(col(data.ssl[i]));
-    row.appendChild(col(data.active[i].rtt.length));
-    row.appendChild(col(data.idle[i].rtt.length));
+    row.appendChild(col(data.connections[i].host));
+    row.appendChild(col(data.connections[i].port));
+    row.appendChild(col(data.connections[i].spdy));
+    row.appendChild(col(data.connections[i].ssl));
+    row.appendChild(col(data.connections[i].active.length));
+    row.appendChild(col(data.connections[i].idle.length));
     new_cont.appendChild(row);
   }
 
@@ -60,14 +60,14 @@ function displaySockets(data) {
   let new_cont = document.createElement('tbody');
   new_cont.setAttribute('id', 'sockets_content');
 
-  for (let i = 0; i < data.host.length; i++) {
+  for (let i = 0; i < data.sockets.length; i++) {
     let row = document.createElement('tr');
-    row.appendChild(col(data.host[i]));
-    row.appendChild(col(data.port[i]));
-    row.appendChild(col(data.tcp[i]));
-    row.appendChild(col(data.active[i]));
-    row.appendChild(col(data.socksent[i]));
-    row.appendChild(col(data.sockreceived[i]));
+    row.appendChild(col(data.sockets[i].host));
+    row.appendChild(col(data.sockets[i].port));
+    row.appendChild(col(data.sockets[i].tcp));
+    row.appendChild(col(data.sockets[i].active));
+    row.appendChild(col(data.sockets[i].sent));
+    row.appendChild(col(data.sockets[i].received));
     new_cont.appendChild(row);
   }
 
@@ -80,19 +80,19 @@ function displayDns(data) {
   let new_cont = document.createElement('tbody');
   new_cont.setAttribute('id', 'dns_content');
 
-  for (let i = 0; i < data.hostname.length; i++) {
+  for (let i = 0; i < data.entries.length; i++) {
     let row = document.createElement('tr');
-    row.appendChild(col(data.hostname[i]));
-    row.appendChild(col(data.family[i]));
+    row.appendChild(col(data.entries[i].hostname));
+    row.appendChild(col(data.entries[i].family));
     let column = document.createElement('td');
 
-    for (let j = 0; j< data.hostaddr[i].length; j++) {
-      column.appendChild(document.createTextNode(data.hostaddr[i][j]));
+    for (let j = 0; j < data.entries[i].hostaddr.length; j++) {
+      column.appendChild(document.createTextNode(data.entries[i].hostaddr[j]));
       column.appendChild(document.createElement('br'));
     }
 
     row.appendChild(column);
-    row.appendChild(col(data.expiration[i]));
+    row.appendChild(col(data.entries[i].expiration));
     new_cont.appendChild(row);
   }
 
@@ -105,14 +105,14 @@ function displayWebsockets(data) {
   let new_cont = document.createElement('tbody');
   new_cont.setAttribute('id', 'websockets_content');
 
-  for (let i = 0; i < data.hostport.length; i++) {
+  for (let i = 0; i < data.websockets.length; i++) {
     let row = document.createElement('tr');
-    row.appendChild(col(data.hostport[i]));
-    row.appendChild(col(data.encrypted[i]));
-    row.appendChild(col(data.msgsent[i]));
-    row.appendChild(col(data.msgreceived[i]));
-    row.appendChild(col(data.sentsize[i]));
-    row.appendChild(col(data.receivedsize[i]));
+    row.appendChild(col(data.websockets[i].hostport));
+    row.appendChild(col(data.websockets[i].encrypted));
+    row.appendChild(col(data.websockets[i].msgsent));
+    row.appendChild(col(data.websockets[i].msgreceived));
+    row.appendChild(col(data.websockets[i].sentsize));
+    row.appendChild(col(data.websockets[i].receivedsize));
     new_cont.appendChild(row);
   }
 
diff --git a/toolkit/content/tests/chrome/test_about_networking.html b/toolkit/content/tests/chrome/test_about_networking.html
index 76471b342c7f..6ffaf2ba79e3 100644
--- a/toolkit/content/tests/chrome/test_about_networking.html
+++ b/toolkit/content/tests/chrome/test_about_networking.html
@@ -25,8 +25,14 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=912103
 
     websocket.addEventListener("open", function() {
       dashboard.requestWebsocketConnections(function(data) {
-        isnot(data.hostport.indexOf("mochi.test:8888"), -1,
-              "tested websocket entry not found");
+        var found = false;
+        for (var i = 0; i < data.websockets.length; i++) {
+          if (data.websockets[i].hostport == "mochi.test:8888") {
+            found = true;
+            break;
+          }
+        }
+        isnot(found, false, "tested websocket entry not found");
         websocket.close();
         SimpleTest.finish();
       });
diff --git a/toolkit/mozapps/extensions/test/mochitest/file_empty.html b/toolkit/mozapps/extensions/test/mochitest/file_empty.html
new file mode 100644
index 000000000000..b6c8a53b417a
--- /dev/null
+++ b/toolkit/mozapps/extensions/test/mochitest/file_empty.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<html><head></head><body><span id="text">Nothing to see here</span></body></html>
diff --git a/toolkit/mozapps/extensions/test/mochitest/mochitest.ini b/toolkit/mozapps/extensions/test/mochitest/mochitest.ini
index cce7faf473c9..7ac2a2dd525c 100644
--- a/toolkit/mozapps/extensions/test/mochitest/mochitest.ini
+++ b/toolkit/mozapps/extensions/test/mochitest/mochitest.ini
@@ -1,3 +1,6 @@
 [DEFAULT]
+support-files =
+  file_empty.html
 
 [test_bug609794.html]
+[test_bug887098.html]
diff --git a/toolkit/mozapps/extensions/test/mochitest/test_bug887098.html b/toolkit/mozapps/extensions/test/mochitest/test_bug887098.html
new file mode 100644
index 000000000000..980ca08c3ee1
--- /dev/null
+++ b/toolkit/mozapps/extensions/test/mochitest/test_bug887098.html
@@ -0,0 +1,48 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=887098
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 887098</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+  <script type="application/javascript">
+
+  /** Test for Bug 887098 **/
+  SimpleTest.waitForExplicitFinish();
+
+  function loaded() {
+    var iwin = $('ifr').contentWindow;
+    var href = SpecialPowers.wrap(iwin).location.href;
+    if (/file_empty/.test(href)) {
+      window.evalRef = iwin.eval;
+      window.installTriggerRef = iwin.InstallTrigger; // Force lazy instantiation.
+      // about: is privileged, so we need to be privileged to load it.
+      SpecialPowers.wrap(iwin).location.href = 'about:';
+    } else {
+      is(href, 'about:', "Successfully navigated to about:");
+      try {
+        evalRef('InstallTrigger.install({URL: "chrome://global/skin/global.css"});');
+        ok(false, "Should have thrown when trying to install restricted URI from InstallTrigger");
+      } catch (e) {
+        ok(/permission/.test(e), "We should throw a security exception. Got: " + e);
+      }
+      SimpleTest.finish();
+    }
+  }
+
+  </script>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=887098">Mozilla Bug 887098</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+
+</div>
+<iframe onload="loaded();" id="ifr" src="file_empty.html"></iframe>
+<pre id="test">
+</pre>
+</body>
+</html>
diff --git a/uriloader/prefetch/nsOfflineCacheUpdateService.cpp b/uriloader/prefetch/nsOfflineCacheUpdateService.cpp
index d3acc291c96c..1ab166ac42ef 100644
--- a/uriloader/prefetch/nsOfflineCacheUpdateService.cpp
+++ b/uriloader/prefetch/nsOfflineCacheUpdateService.cpp
@@ -23,6 +23,7 @@
 #include "nsICacheSession.h"
 #include "nsICachingChannel.h"
 #include "nsIContent.h"
+#include "nsIDocShell.h"
 #include "nsIDocumentLoader.h"
 #include "nsIDOMElement.h"
 #include "nsIDOMWindow.h"
@@ -378,8 +379,7 @@ nsOfflineCacheUpdateService::ScheduleOnDocumentStop(nsIURI *aManifestURI,
          this, aManifestURI, aDocumentURI, aDocument));
 
     nsCOMPtr<nsIDocument> doc = do_QueryInterface(aDocument);
-    nsCOMPtr<nsISupports> container = doc->GetContainer();
-    nsCOMPtr<nsIWebProgress> progress = do_QueryInterface(container);
+    nsCOMPtr<nsIWebProgress> progress = do_QueryInterface(doc->GetContainer());
     NS_ENSURE_TRUE(progress, NS_ERROR_INVALID_ARG);
 
     // Proceed with cache update
diff --git a/widget/BasicEvents.h b/widget/BasicEvents.h
index 6a56a3f8546a..2dc93b035bd0 100644
--- a/widget/BasicEvents.h
+++ b/widget/BasicEvents.h
@@ -41,6 +41,7 @@ enum nsEventStructType
   NS_DRAG_EVENT,                     // WidgetDragEvent
   NS_MOUSE_SCROLL_EVENT,             // WidgetMouseScrollEvent
   NS_WHEEL_EVENT,                    // WidgetWheelEvent
+  NS_POINTER_EVENT,                  // PointerEvent
 
   // TouchEvents.h
   NS_GESTURENOTIFY_EVENT,            // WidgetGestureNotifyEvent
@@ -135,6 +136,19 @@ enum nsEventStructType
 #define NS_MOUSEENTER                   (NS_MOUSE_MESSAGE_START + 34)
 #define NS_MOUSELEAVE                   (NS_MOUSE_MESSAGE_START + 35)
 
+// Pointer spec events
+#define NS_POINTER_EVENT_START          4400
+#define NS_POINTER_MOVE                 (NS_POINTER_EVENT_START)
+#define NS_POINTER_UP                   (NS_POINTER_EVENT_START + 1)
+#define NS_POINTER_DOWN                 (NS_POINTER_EVENT_START + 2)
+#define NS_POINTER_OVER                 (NS_POINTER_EVENT_START + 22)
+#define NS_POINTER_OUT                  (NS_POINTER_EVENT_START + 23)
+#define NS_POINTER_ENTER                (NS_POINTER_EVENT_START + 24)
+#define NS_POINTER_LEAVE                (NS_POINTER_EVENT_START + 25)
+#define NS_POINTER_CANCEL               (NS_POINTER_EVENT_START + 26)
+#define NS_POINTER_GOT_CAPTURE          (NS_POINTER_EVENT_START + 27)
+#define NS_POINTER_LOST_CAPTURE         (NS_POINTER_EVENT_START + 28)
+
 #define NS_CONTEXTMENU_MESSAGE_START    500
 #define NS_CONTEXTMENU                  (NS_CONTEXTMENU_MESSAGE_START)
 
diff --git a/widget/EventClassList.h b/widget/EventClassList.h
index c32ff1e157a8..820df5d1d64a 100644
--- a/widget/EventClassList.h
+++ b/widget/EventClassList.h
@@ -33,6 +33,7 @@ NS_EVENT_CLASS(Widget, MouseEvent)
 NS_EVENT_CLASS(Widget, DragEvent)
 NS_EVENT_CLASS(Widget, MouseScrollEvent)
 NS_EVENT_CLASS(Widget, WheelEvent)
+NS_EVENT_CLASS(Widget, PointerEvent)
 
 // TouchEvents.h
 NS_EVENT_CLASS(Widget, GestureNotifyEvent)
diff --git a/widget/MouseEvents.h b/widget/MouseEvents.h
index 59301a0c4ee4..e4dd6bebd941 100644
--- a/widget/MouseEvents.h
+++ b/widget/MouseEvents.h
@@ -456,6 +456,67 @@ public:
   }
 };
 
+/******************************************************************************
+ * mozilla::WidgetPointerEvent
+ ******************************************************************************/
+
+class WidgetPointerEvent : public WidgetMouseEvent
+{
+  friend class mozilla::dom::PBrowserParent;
+  friend class mozilla::dom::PBrowserChild;
+
+  WidgetPointerEvent()
+  {
+  }
+
+public:
+  virtual WidgetPointerEvent* AsPointerEvent() MOZ_OVERRIDE { return this; }
+
+  WidgetPointerEvent(bool aIsTrusted, uint32_t aMsg, nsIWidget* w)
+    : WidgetMouseEvent(aIsTrusted, aMsg, w, NS_POINTER_EVENT, eReal)
+    , pointerId(0)
+    , width(0)
+    , height(0)
+    , tiltX(0)
+    , tiltY(0)
+    , isPrimary(true)
+  {
+  }
+
+  WidgetPointerEvent(const WidgetMouseEvent& aEvent)
+    : WidgetMouseEvent(aEvent)
+    , pointerId(0)
+    , width(0)
+    , height(0)
+    , tiltX(0)
+    , tiltY(0)
+    , isPrimary(true)
+  {
+    eventStructType = NS_POINTER_EVENT;
+  }
+
+  WidgetPointerEvent(bool aIsTrusted, uint32_t aMsg, nsIWidget* w,
+                     uint32_t aPointerId,
+                     uint32_t aWidth, uint32_t aHeight,
+                     uint32_t aTiltX, uint32_t aTiltY, bool aIsPrimary)
+    : WidgetMouseEvent(aIsTrusted, aMsg, w, NS_POINTER_EVENT, eReal)
+    , pointerId(aPointerId)
+    , width(aWidth)
+    , height(aHeight)
+    , tiltX(aTiltX)
+    , tiltY(aTiltY)
+    , isPrimary(aIsPrimary)
+  {
+  }
+
+  uint32_t pointerId;
+  uint32_t width;
+  uint32_t height;
+  uint32_t tiltX;
+  uint32_t tiltY;
+  bool isPrimary;
+};
+
 } // namespace mozilla
 
 #endif // mozilla_MouseEvents_h__
diff --git a/widget/cocoa/nsChildView.mm b/widget/cocoa/nsChildView.mm
index f81bfbb17437..6f8bfa6df932 100644
--- a/widget/cocoa/nsChildView.mm
+++ b/widget/cocoa/nsChildView.mm
@@ -2198,7 +2198,8 @@ nsChildView::UpdateTitlebarImageBuffer()
   if (dirtyTitlebarRegion.IsEmpty())
     return;
 
-  ClearRegion(mTitlebarImageBuffer, dirtyTitlebarRegion);
+  gfxUtils::ClipToRegion(mTitlebarImageBuffer, dirtyTitlebarRegion);
+  mTitlebarImageBuffer->ClearRect(gfx::Rect(0, 0, titlebarBufferSize.width, titlebarBufferSize.height));
 
   gfx::BorrowedCGContext borrow(mTitlebarImageBuffer);
   CGContextRef ctx = borrow.cg;
@@ -2222,9 +2223,7 @@ nsChildView::UpdateTitlebarImageBuffer()
   for (id view in [window titlebarControls]) {
     NSRect viewFrame = [view frame];
     nsIntRect viewRect = CocoaPointsToDevPixels([mView convertRect:viewFrame fromView:frameView]);
-    nsIntRegion intersection;
-    intersection.And(dirtyTitlebarRegion, viewRect);
-    if (intersection.IsEmpty()) {
+    if (!dirtyTitlebarRegion.Intersects(viewRect)) {
       continue;
     }
     // All of the titlebar controls we're interested in are subclasses of
@@ -2249,8 +2248,7 @@ nsChildView::UpdateTitlebarImageBuffer()
 
     [NSGraphicsContext setCurrentContext:[NSGraphicsContext graphicsContextWithGraphicsPort:ctx flipped:[view isFlipped]]];
 
-    NSRect intersectRect = DevPixelsToCocoaPoints(intersection.GetBounds());
-    [cell drawWithFrame:[view convertRect:intersectRect fromView:mView] inView:button];
+    [cell drawWithFrame:[button bounds] inView:button];
 
     [NSGraphicsContext setCurrentContext:context];
     CGContextRestoreGState(ctx);
@@ -2264,6 +2262,8 @@ nsChildView::UpdateTitlebarImageBuffer()
   [NSGraphicsContext setCurrentContext:oldContext];
   borrow.Finish();
 
+  mTitlebarImageBuffer->PopClip();
+
   mUpdatedTitlebarRegion.Or(mUpdatedTitlebarRegion, dirtyTitlebarRegion);
 }
 
diff --git a/widget/cocoa/nsNativeThemeCocoa.mm b/widget/cocoa/nsNativeThemeCocoa.mm
index d250bbd4382c..5ece8b31c180 100644
--- a/widget/cocoa/nsNativeThemeCocoa.mm
+++ b/widget/cocoa/nsNativeThemeCocoa.mm
@@ -3255,6 +3255,10 @@ nsNativeThemeCocoa::GetWidgetTransparency(nsIFrame* aFrame, uint8_t aWidgetType)
     // performance, because we create layers for them.
     return eOpaque;
 
+  case NS_THEME_TOOLBAR:
+  case NS_THEME_MOZ_MAC_UNIFIED_TOOLBAR:
+    return eOpaque;
+
   default:
     return eUnknownTransparency;
   }
diff --git a/widget/nsGUIEventIPC.h b/widget/nsGUIEventIPC.h
index b3b0442b2776..e219d618705a 100644
--- a/widget/nsGUIEventIPC.h
+++ b/widget/nsGUIEventIPC.h
@@ -206,6 +206,36 @@ struct ParamTraits<mozilla::WidgetMouseEvent>
   }
 };
 
+template<>
+struct ParamTraits<mozilla::WidgetPointerEvent>
+{
+  typedef mozilla::WidgetPointerEvent paramType;
+
+  static void Write(Message* aMsg, const paramType& aParam)
+  {
+    WriteParam(aMsg, static_cast<mozilla::WidgetMouseEvent>(aParam));
+    WriteParam(aMsg, aParam.pointerId);
+    WriteParam(aMsg, aParam.width);
+    WriteParam(aMsg, aParam.height);
+    WriteParam(aMsg, aParam.tiltX);
+    WriteParam(aMsg, aParam.tiltY);
+    WriteParam(aMsg, aParam.isPrimary);
+  }
+
+  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
+  {
+    bool rv =
+      ReadParam(aMsg, aIter, static_cast<mozilla::WidgetMouseEvent*>(aResult)) &&
+      ReadParam(aMsg, aIter, &aResult->pointerId) &&
+      ReadParam(aMsg, aIter, &aResult->width) &&
+      ReadParam(aMsg, aIter, &aResult->height) &&
+      ReadParam(aMsg, aIter, &aResult->tiltX) &&
+      ReadParam(aMsg, aIter, &aResult->tiltY) &&
+      ReadParam(aMsg, aIter, &aResult->isPrimary);
+    return rv;
+  }
+};
+
 template<>
 struct ParamTraits<mozilla::WidgetTouchEvent>
 {
diff --git a/widget/shared/WidgetEventImpl.cpp b/widget/shared/WidgetEventImpl.cpp
index b80d3b2d120b..91efa2880ec9 100644
--- a/widget/shared/WidgetEventImpl.cpp
+++ b/widget/shared/WidgetEventImpl.cpp
@@ -216,6 +216,7 @@ WidgetEvent::IsAllowedToDispatchDOMEvent() const
 {
   switch (eventStructType) {
     case NS_MOUSE_EVENT:
+    case NS_POINTER_EVENT:
       // We want synthesized mouse moves to cause mouseover and mouseout
       // DOM events (nsEventStateManager::PreHandleEvent), but not mousemove
       // DOM events.
diff --git a/widget/xpwidgets/APZCCallbackHelper.cpp b/widget/xpwidgets/APZCCallbackHelper.cpp
index a5a592f640c3..3e8490783fc7 100644
--- a/widget/xpwidgets/APZCCallbackHelper.cpp
+++ b/widget/xpwidgets/APZCCallbackHelper.cpp
@@ -138,7 +138,7 @@ APZCCallbackHelper::GetScrollIdentifiers(const nsIContent* aContent,
                                          uint32_t* aPresShellIdOut,
                                          FrameMetrics::ViewID* aViewIdOut)
 {
-    if (!nsLayoutUtils::FindIDFor(aContent, aViewIdOut)) {
+    if (!aContent || !nsLayoutUtils::FindIDFor(aContent, aViewIdOut)) {
         return false;
     }
     nsCOMPtr<nsIDOMWindowUtils> utils = GetDOMWindowUtils(aContent);
diff --git a/widget/xpwidgets/PuppetWidget.h b/widget/xpwidgets/PuppetWidget.h
index bd3d05892279..3040f69bb2db 100644
--- a/widget/xpwidgets/PuppetWidget.h
+++ b/widget/xpwidgets/PuppetWidget.h
@@ -133,14 +133,12 @@ public:
   // nsBaseWidget methods we override
   //
 
-  // Documents loaded in child processes are always subdocuments of
-  // other docs in an ancestor process.  To ensure that the
-  // backgrounds of those documents are painted like those of
-  // same-process subdocuments, we force the widget here to be
-  // transparent, which in turn will cause layout to use a transparent
-  // backstop background color.
+  // Force documents to be opaque so that we don't have to retain
+  // the content behind a remote frame. This is a large memory saving
+  // for HiDPI b2g devices. When we need apps to be transparent we
+  // will need to provide a way for them to opt into it.
   virtual nsTransparencyMode GetTransparencyMode() MOZ_OVERRIDE
-  { return eTransparencyTransparent; }
+  { return eTransparencyOpaque; }
 
   virtual LayerManager*
   GetLayerManager(PLayerTransactionChild* aShadowManager = nullptr,
diff --git a/xpcom/base/CycleCollectedJSRuntime.h b/xpcom/base/CycleCollectedJSRuntime.h
index e266f9b24657..35309eef2b94 100644
--- a/xpcom/base/CycleCollectedJSRuntime.h
+++ b/xpcom/base/CycleCollectedJSRuntime.h
@@ -73,6 +73,27 @@ public:
 
 class IncrementalFinalizeRunnable;
 
+// Contains various stats about the cycle collection.
+struct CycleCollectorResults
+{
+  void Init()
+  {
+    mForcedGC = false;
+    mMergedZones = false;
+    mVisitedRefCounted = 0;
+    mVisitedGCed = 0;
+    mFreedRefCounted = 0;
+    mFreedGCed = 0;
+  }
+
+  bool mForcedGC;
+  bool mMergedZones;
+  uint32_t mVisitedRefCounted;
+  uint32_t mVisitedGCed;
+  uint32_t mFreedRefCounted;
+  uint32_t mFreedGCed;
+};
+
 class CycleCollectedJSRuntime
 {
   friend class JSGCThingParticipant;
@@ -183,16 +204,16 @@ public:
   bool NeedCollect() const;
   void Collect(uint32_t reason) const;
 
-  virtual void PrepareForForgetSkippable() {}
-  virtual void PrepareForCollection() {}
-
   void DeferredFinalize(DeferredFinalizeAppendFunction aAppendFunc,
                         DeferredFinalizeFunction aFunc,
                         void* aThing);
   void DeferredFinalize(nsISupports* aSupports);
 
   void DumpJSHeap(FILE* aFile);
-  
+
+  virtual void PrepareForForgetSkippable() = 0;
+  virtual void BeginCycleCollectionCallback() = 0;
+  virtual void EndCycleCollectionCallback(CycleCollectorResults &aResults) = 0;
   virtual void DispatchDeferredDeletion(bool aContinuation) = 0;
 
   JSRuntime* Runtime() const
diff --git a/xpcom/base/ErrorList.h b/xpcom/base/ErrorList.h
index 1552bb0e11d6..94cd4893e969 100644
--- a/xpcom/base/ErrorList.h
+++ b/xpcom/base/ErrorList.h
@@ -16,8 +16,6 @@
   /* Returned when a given interface is not supported. */
   ERROR(NS_NOINTERFACE,                         0x80004002),
   ERROR(NS_ERROR_NO_INTERFACE,                  NS_NOINTERFACE),
-  ERROR(NS_ERROR_INVALID_POINTER,               0x80004003),
-  ERROR(NS_ERROR_NULL_POINTER,                  NS_ERROR_INVALID_POINTER),
   /* Returned when a function aborts */
   ERROR(NS_ERROR_ABORT,                         0x80004004),
   /* Returned when a function fails */
@@ -29,6 +27,8 @@
   /* Returned when an illegal value is passed */
   ERROR(NS_ERROR_ILLEGAL_VALUE,                 0x80070057),
   ERROR(NS_ERROR_INVALID_ARG,                   NS_ERROR_ILLEGAL_VALUE),
+  ERROR(NS_ERROR_INVALID_POINTER,               NS_ERROR_INVALID_ARG),
+  ERROR(NS_ERROR_NULL_POINTER,                  NS_ERROR_INVALID_ARG),
   /* Returned when a class doesn't allow aggregation */
   ERROR(NS_ERROR_NO_AGGREGATION,                0x80040110),
   /* Returned when an operation can't complete due to an unavailable resource */
diff --git a/xpcom/base/nsAgg.h b/xpcom/base/nsAgg.h
index 5b9ff7227978..bd1a36d52cc9 100644
--- a/xpcom/base/nsAgg.h
+++ b/xpcom/base/nsAgg.h
@@ -285,9 +285,9 @@ static nsresult                                                             \
 _InstanceClass##Constructor(nsISupports *aOuter, REFNSIID aIID,             \
                             void **aResult)                                 \
 {                                                                           \
-    *aResult = nullptr;                                                      \
-                                                                            \
-    NS_ENSURE_PROPER_AGGREGATION(aOuter, aIID);                             \
+    *aResult = nullptr;                                                     \
+    if (NS_WARN_IF(aOuter && !aIID.Equals(NS_GET_IID(nsISupports))))        \
+        return NS_ERROR_INVALID_ARG;                                        \
                                                                             \
     _InstanceClass* inst = new _InstanceClass(aOuter);                      \
     if (!inst) {                                                            \
@@ -308,9 +308,9 @@ static nsresult                                                             \
 _InstanceClass##Constructor(nsISupports *aOuter, REFNSIID aIID,             \
                             void **aResult)                                 \
 {                                                                           \
-    *aResult = nullptr;                                                      \
-                                                                            \
-    NS_ENSURE_PROPER_AGGREGATION(aOuter, aIID);                             \
+    *aResult = nullptr;                                                     \
+    if (NS_WARN_IF(aOuter && !aIID.Equals(NS_GET_IID(nsISupports))))        \
+        return NS_ERROR_INVALID_ARG;                                        \
                                                                             \
     _InstanceClass* inst = new _InstanceClass(aOuter);                      \
     if (!inst) {                                                            \
diff --git a/xpcom/base/nsCycleCollector.cpp b/xpcom/base/nsCycleCollector.cpp
index 4079ca38ca56..7b09c296fad3 100644
--- a/xpcom/base/nsCycleCollector.cpp
+++ b/xpcom/base/nsCycleCollector.cpp
@@ -98,12 +98,13 @@
 
 #include "base/process_util.h"
 
+#include "mozilla/AutoRestore.h"
+#include "mozilla/CycleCollectedJSRuntime.h"
 /* This must occur *after* base/process_util.h to avoid typedefs conflicts. */
 #include "mozilla/MemoryReporting.h"
 #include "mozilla/Util.h"
 #include "mozilla/LinkedList.h"
 
-#include "mozilla/CycleCollectedJSRuntime.h"
 #include "nsCycleCollectionParticipant.h"
 #include "nsCycleCollectionNoteRootCallback.h"
 #include "nsDeque.h"
@@ -576,6 +577,35 @@ private:
 };
 
 
+// Declarations for mPtrToNodeMap.
+
+struct PtrToNodeEntry : public PLDHashEntryHdr
+{
+    // The key is mNode->mPointer
+    PtrInfo *mNode;
+};
+
+static bool
+PtrToNodeMatchEntry(PLDHashTable *table,
+                    const PLDHashEntryHdr *entry,
+                    const void *key)
+{
+    const PtrToNodeEntry *n = static_cast<const PtrToNodeEntry*>(entry);
+    return n->mNode->mPointer == key;
+}
+
+static PLDHashTableOps PtrNodeOps = {
+    PL_DHashAllocTable,
+    PL_DHashFreeTable,
+    PL_DHashVoidPtrKeyStub,
+    PtrToNodeMatchEntry,
+    PL_DHashMoveEntryStub,
+    PL_DHashClearEntryStub,
+    PL_DHashFinalizeStub,
+    nullptr
+};
+
+
 struct WeakMapping
 {
     // map and key will be null if the corresponding objects are GC marked
@@ -594,9 +624,29 @@ struct GCGraph
     nsTArray<WeakMapping> mWeakMaps;
     uint32_t mRootCount;
 
-    GCGraph() : mRootCount(0) {
+private:
+    PLDHashTable mPtrToNodeMap;
+
+public:
+    GCGraph() : mRootCount(0)
+    {
+        mPtrToNodeMap.ops = nullptr;
     }
-    ~GCGraph() {
+
+    ~GCGraph()
+    {
+        if (mPtrToNodeMap.ops) {
+            PL_DHashTableFinish(&mPtrToNodeMap);
+        }
+    }
+
+    void Init()
+    {
+        MOZ_ASSERT(!mPtrToNodeMap.ops, "Failed to clear mPtrToNodeMap");
+        if (!PL_DHashTableInit(&mPtrToNodeMap, &PtrNodeOps, nullptr,
+                               sizeof(PtrToNodeEntry), 32768)) {
+            MOZ_CRASH();
+        }
     }
 
     void Clear()
@@ -605,6 +655,16 @@ struct GCGraph
         mEdges.Clear();
         mWeakMaps.Clear();
         mRootCount = 0;
+        PL_DHashTableFinish(&mPtrToNodeMap);
+        mPtrToNodeMap.ops = nullptr;
+    }
+
+    PtrInfo* FindNode(void *aPtr);
+    PtrToNodeEntry* AddNodeToMap(void *aPtr);
+
+    uint32_t MapCount() const
+    {
+        return mPtrToNodeMap.entryCount;
     }
 
     void SizeOfExcludingThis(MallocSizeOf aMallocSizeOf,
@@ -619,6 +679,28 @@ struct GCGraph
     }
 };
 
+PtrInfo*
+GCGraph::FindNode(void *aPtr)
+{
+    PtrToNodeEntry *e = static_cast<PtrToNodeEntry*>(PL_DHashTableOperate(&mPtrToNodeMap, aPtr, PL_DHASH_LOOKUP));
+    if (!PL_DHASH_ENTRY_IS_BUSY(e)) {
+        return nullptr;
+    }
+    return e->mNode;
+}
+
+PtrToNodeEntry*
+GCGraph::AddNodeToMap(void *aPtr)
+{
+    PtrToNodeEntry *e = static_cast<PtrToNodeEntry*>(PL_DHashTableOperate(&mPtrToNodeMap, aPtr, PL_DHASH_ADD));
+    if (!e) {
+        // Caller should track OOMs
+        return nullptr;
+    }
+    return e;
+}
+
+
 static nsISupports *
 CanonicalizeXPCOMParticipant(nsISupports *in)
 {
@@ -904,29 +986,24 @@ enum ccType {
 
 class nsCycleCollector
 {
-    friend class GCGraphBuilder;
-
     bool mCollectionInProgress;
     // mScanInProgress should be false when we're collecting white objects.
     bool mScanInProgress;
-    nsCycleCollectorResults *mResults;
+    CycleCollectorResults mResults;
     TimeStamp mCollectionStart;
 
     CycleCollectedJSRuntime *mJSRuntime;
 
     GCGraph mGraph;
+    nsAutoPtr<GCGraphBuilder> mBuilder;
+    nsCOMPtr<nsICycleCollectorListener> mListener;
 
     nsIThread* mThread;
 
     nsCycleCollectorParams mParams;
 
-    nsTArray<PtrInfo*> *mWhiteNodes;
     uint32_t mWhiteNodeCount;
 
-    // mVisitedRefCounted and mVisitedGCed are only used for telemetry
-    uint32_t mVisitedRefCounted;
-    uint32_t mVisitedGCed;
-
     CC_BeforeUnlinkCallback mBeforeUnlinkCB;
     CC_ForgetSkippableCallback mForgetSkippableCB;
 
@@ -963,8 +1040,6 @@ public:
     bool FreeSnowWhite(bool aUntilNoSWInPurpleBuffer);
 
     bool Collect(ccType aCCType,
-                 nsTArray<PtrInfo*> *aWhiteNodes,
-                 nsCycleCollectorResults *aResults,
                  nsICycleCollectorListener *aManualListener);
     void Shutdown();
 
@@ -973,21 +1048,18 @@ public:
                              size_t *aGraphNodesSize,
                              size_t *aGraphEdgesSize,
                              size_t *aWeakMapsSize,
-                             size_t *aWhiteNodeSize,
                              size_t *aPurpleBufferSize) const;
 
 private:
     void CheckThreadSafety();
     void ShutdownCollect();
 
-    void PrepareForCollection(nsCycleCollectorResults *aResults,
-                              nsTArray<PtrInfo*> *aWhiteNodes);
     void FixGrayBits(bool aForceGC);
     bool ShouldMergeZones(ccType aCCType);
 
     void BeginCollection(ccType aCCType, nsICycleCollectorListener *aManualListener);
-    void MarkRoots(GCGraphBuilder &aBuilder);
-    void ScanRoots(nsICycleCollectorListener *aListener);
+    void MarkRoots();
+    void ScanRoots();
     void ScanWeakMaps();
 
     // returns whether anything was collected
@@ -1221,12 +1293,14 @@ public:
         // want scripts which poll the filesystem looking for gc/cc dumps to
         // grab a file before we're finished writing to it.)
         nsCOMPtr<nsIFile> gcLogFile = CreateTempFile("incomplete-gc-edges");
-        NS_ENSURE_STATE(gcLogFile);
+        if (NS_WARN_IF(!gcLogFile))
+            return NS_ERROR_UNEXPECTED;
 
         // Dump the JS heap.
         FILE* gcLogANSIFile = nullptr;
         gcLogFile->OpenANSIFileDesc("w", &gcLogANSIFile);
-        NS_ENSURE_STATE(gcLogANSIFile);
+        if (NS_WARN_IF(!gcLogANSIFile))
+            return NS_ERROR_UNEXPECTED;
         MozillaRegisterDebugFILE(gcLogANSIFile);
         CollectorData *data = sCollectorData.get();
         if (data && data->mRuntime)
@@ -1237,11 +1311,13 @@ public:
         // Strip off "incomplete-".
         nsCOMPtr<nsIFile> gcLogFileFinalDestination =
             CreateTempFile("gc-edges");
-        NS_ENSURE_STATE(gcLogFileFinalDestination);
+        if (NS_WARN_IF(!gcLogFileFinalDestination))
+            return NS_ERROR_UNEXPECTED;
 
         nsAutoString gcLogFileFinalDestinationName;
         gcLogFileFinalDestination->GetLeafName(gcLogFileFinalDestinationName);
-        NS_ENSURE_STATE(!gcLogFileFinalDestinationName.IsEmpty());
+        if (NS_WARN_IF(gcLogFileFinalDestinationName.IsEmpty()))
+            return NS_ERROR_UNEXPECTED;
 
         gcLogFile->MoveTo(/* directory */ nullptr, gcLogFileFinalDestinationName);
 
@@ -1260,10 +1336,12 @@ public:
         // Open a file for dumping the CC graph.  We again prefix with
         // "incomplete-".
         mOutFile = CreateTempFile("incomplete-cc-edges");
-        NS_ENSURE_STATE(mOutFile);
+        if (NS_WARN_IF(!mOutFile))
+            return NS_ERROR_UNEXPECTED;
         MOZ_ASSERT(!mStream);
         mOutFile->OpenANSIFileDesc("w", &mStream);
-        NS_ENSURE_STATE(mStream);
+        if (NS_WARN_IF(!mStream))
+            return NS_ERROR_UNEXPECTED;
         MozillaRegisterDebugFILE(mStream);
 
         fprintf(mStream, "# WantAllTraces=%s\n", mWantAllTraces ? "true" : "false");
@@ -1388,11 +1466,13 @@ public:
             // Strip off "incomplete-" from the log file's name.
             nsCOMPtr<nsIFile> logFileFinalDestination =
                 CreateTempFile("cc-edges");
-            NS_ENSURE_STATE(logFileFinalDestination);
+            if (NS_WARN_IF(!logFileFinalDestination))
+                return NS_ERROR_UNEXPECTED;
 
             nsAutoString logFileFinalDestinationName;
             logFileFinalDestination->GetLeafName(logFileFinalDestinationName);
-            NS_ENSURE_STATE(!logFileFinalDestinationName.IsEmpty());
+            if (NS_WARN_IF(logFileFinalDestinationName.IsEmpty()))
+                return NS_ERROR_UNEXPECTED;
 
             mOutFile->MoveTo(/* directory = */ nullptr,
                              logFileFinalDestinationName);
@@ -1415,7 +1495,8 @@ public:
     NS_IMETHOD ProcessNext(nsICycleCollectorHandler* aHandler,
                            bool* aCanContinue)
     {
-        NS_ENSURE_STATE(aHandler && mWantAfterProcessing);
+        if (NS_WARN_IF(!aHandler) || NS_WARN_IF(!mWantAfterProcessing))
+            return NS_ERROR_UNEXPECTED;
         CCGraphDescriber* d = mDescribers.popFirst();
         if (d) {
             switch (d->mType) {
@@ -1515,7 +1596,8 @@ nsCycleCollectorLoggerConstructor(nsISupports* aOuter,
                                   const nsIID& aIID,
                                   void* *aInstancePtr)
 {
-    NS_ENSURE_TRUE(!aOuter, NS_ERROR_NO_AGGREGATION);
+    if (NS_WARN_IF(aOuter))
+        return NS_ERROR_NO_AGGREGATION;
 
     nsISupports *logger = new nsCycleCollectorLogger();
 
@@ -1526,41 +1608,14 @@ nsCycleCollectorLoggerConstructor(nsISupports* aOuter,
 // Bacon & Rajan's |MarkRoots| routine.
 ////////////////////////////////////////////////////////////////////////
 
-struct PtrToNodeEntry : public PLDHashEntryHdr
-{
-    // The key is mNode->mPointer
-    PtrInfo *mNode;
-};
-
-static bool
-PtrToNodeMatchEntry(PLDHashTable *table,
-                    const PLDHashEntryHdr *entry,
-                    const void *key)
-{
-    const PtrToNodeEntry *n = static_cast<const PtrToNodeEntry*>(entry);
-    return n->mNode->mPointer == key;
-}
-
-static PLDHashTableOps PtrNodeOps = {
-    PL_DHashAllocTable,
-    PL_DHashFreeTable,
-    PL_DHashVoidPtrKeyStub,
-    PtrToNodeMatchEntry,
-    PL_DHashMoveEntryStub,
-    PL_DHashClearEntryStub,
-    PL_DHashFinalizeStub,
-    nullptr
-};
-
 class GCGraphBuilder : public nsCycleCollectionTraversalCallback,
                        public nsCycleCollectionNoteRootCallback
 {
 private:
-    nsCycleCollector *mCollector;
+    GCGraph &mGraph;
+    CycleCollectorResults &mResults;
     NodePool::Builder mNodeBuilder;
     EdgePool::Builder mEdgeBuilder;
-    nsTArray<WeakMapping> &mWeakMaps;
-    PLDHashTable mPtrToNodeMap;
     PtrInfo *mCurrPi;
     nsCycleCollectionParticipant *mJSParticipant;
     nsCycleCollectionParticipant *mJSZoneParticipant;
@@ -1570,20 +1625,18 @@ private:
     bool mRanOutOfMemory;
 
 public:
-    GCGraphBuilder(nsCycleCollector *aCollector,
-                   GCGraph &aGraph,
+    GCGraphBuilder(GCGraph &aGraph,
+                   CycleCollectorResults &aResults,
                    CycleCollectedJSRuntime *aJSRuntime,
                    nsICycleCollectorListener *aListener,
                    bool aMergeZones);
-    ~GCGraphBuilder();
+    virtual ~GCGraphBuilder();
 
     bool WantAllTraces() const
     {
         return nsCycleCollectionNoteRootCallback::WantAllTraces();
     }
 
-    uint32_t Count() const { return mPtrToNodeMap.entryCount; }
-
     PtrInfo* AddNode(void *aPtr, nsCycleCollectionParticipant *aParticipant);
     PtrInfo* AddWeakMapNode(void* node);
     void Traverse(PtrInfo* aPtrInfo);
@@ -1653,26 +1706,21 @@ private:
     }
 };
 
-GCGraphBuilder::GCGraphBuilder(nsCycleCollector *aCollector,
-                               GCGraph &aGraph,
+GCGraphBuilder::GCGraphBuilder(GCGraph &aGraph,
+                               CycleCollectorResults &aResults,
                                CycleCollectedJSRuntime *aJSRuntime,
                                nsICycleCollectorListener *aListener,
                                bool aMergeZones)
-    : mCollector(aCollector),
+    : mGraph(aGraph),
+      mResults(aResults),
       mNodeBuilder(aGraph.mNodes),
       mEdgeBuilder(aGraph.mEdges),
-      mWeakMaps(aGraph.mWeakMaps),
       mJSParticipant(nullptr),
       mJSZoneParticipant(nullptr),
       mListener(aListener),
       mMergeZones(aMergeZones),
       mRanOutOfMemory(false)
 {
-    if (!PL_DHashTableInit(&mPtrToNodeMap, &PtrNodeOps, nullptr,
-                           sizeof(PtrToNodeEntry), 32768)) {
-        MOZ_CRASH();
-    }
-
     if (aJSRuntime) {
         mJSParticipant = aJSRuntime->GCThingParticipant();
         mJSZoneParticipant = aJSRuntime->ZoneParticipant();
@@ -1699,14 +1747,12 @@ GCGraphBuilder::GCGraphBuilder(nsCycleCollector *aCollector,
 
 GCGraphBuilder::~GCGraphBuilder()
 {
-    if (mPtrToNodeMap.ops)
-        PL_DHashTableFinish(&mPtrToNodeMap);
 }
 
 PtrInfo*
 GCGraphBuilder::AddNode(void *aPtr, nsCycleCollectionParticipant *aParticipant)
 {
-    PtrToNodeEntry *e = static_cast<PtrToNodeEntry*>(PL_DHashTableOperate(&mPtrToNodeMap, aPtr, PL_DHASH_ADD));
+    PtrToNodeEntry *e = mGraph.AddNodeToMap(aPtr);
     if (!e) {
         mRanOutOfMemory = true;
         return nullptr;
@@ -1781,7 +1827,7 @@ GCGraphBuilder::DescribeRefCountedNode(nsrefcnt refCount, const char *objName)
         Fault("zero refcount", mCurrPi);
     if (refCount == UINT32_MAX)
         Fault("overflowing refcount", mCurrPi);
-    mCollector->mVisitedRefCounted++;
+    mResults.mVisitedRefCounted++;
 
     if (mListener) {
         mListener->NoteRefCountedObject((uint64_t)mCurrPi->mPointer, refCount,
@@ -1796,7 +1842,7 @@ GCGraphBuilder::DescribeGCedNode(bool isMarked, const char *objName,
                                  uint64_t aCompartmentAddress)
 {
     uint32_t refCount = isMarked ? UINT32_MAX : 0;
-    mCollector->mVisitedGCed++;
+    mResults.mVisitedGCed++;
 
     if (mListener) {
         mListener->NoteGCedObject((uint64_t)mCurrPi->mPointer, isMarked,
@@ -1890,7 +1936,7 @@ GCGraphBuilder::NoteWeakMapping(void *map, void *key, void *kdelegate, void *val
 {
     // Don't try to optimize away the entry here, as we've already attempted to
     // do that in TraceWeakMapping in nsXPConnect.
-    WeakMapping *mapping = mWeakMaps.AppendElement();
+    WeakMapping *mapping = mGraph.mWeakMaps.AppendElement();
     mapping->mMap = map ? AddWeakMapNode(map) : nullptr;
     mapping->mKey = key ? AddWeakMapNode(key) : nullptr;
     mapping->mKeyDelegate = kdelegate ? AddWeakMapNode(kdelegate) : mapping->mKey;
@@ -2136,28 +2182,34 @@ nsCycleCollector::ForgetSkippable(bool aRemoveChildlessNodes,
 }
 
 MOZ_NEVER_INLINE void
-nsCycleCollector::MarkRoots(GCGraphBuilder &aBuilder)
+nsCycleCollector::MarkRoots()
 {
-    mGraph.mRootCount = aBuilder.Count();
+    TimeLog timeLog;
+    AutoRestore<bool> ar(mScanInProgress);
+    MOZ_ASSERT(!mScanInProgress);
+    mScanInProgress = true;
 
     // read the PtrInfo out of the graph that we are building
     NodePool::Enumerator queue(mGraph.mNodes);
     while (!queue.IsDone()) {
         PtrInfo *pi = queue.GetNext();
         CC_AbortIfNull(pi);
-        aBuilder.Traverse(pi);
+        mBuilder->Traverse(pi);
         if (queue.AtBlockEnd()) {
-            aBuilder.SetLastChild();
+            mBuilder->SetLastChild();
         }
     }
     if (mGraph.mRootCount > 0) {
-        aBuilder.SetLastChild();
+        mBuilder->SetLastChild();
     }
 
-    if (aBuilder.RanOutOfMemory()) {
+    if (mBuilder->RanOutOfMemory()) {
         MOZ_ASSERT(false, "Ran out of memory while building cycle collector graph");
         CC_TELEMETRY(_OOM, true);
     }
+
+    mBuilder = nullptr;
+    timeLog.Checkpoint("MarkRoots()");
 }
 
 
@@ -2278,8 +2330,12 @@ nsCycleCollector::ScanWeakMaps()
 }
 
 void
-nsCycleCollector::ScanRoots(nsICycleCollectorListener *aListener)
+nsCycleCollector::ScanRoots()
 {
+    TimeLog timeLog;
+    AutoRestore<bool> ar(mScanInProgress);
+    MOZ_ASSERT(!mScanInProgress);
+    mScanInProgress = true;
     mWhiteNodeCount = 0;
 
     // On the assumption that most nodes will be black, it's
@@ -2295,8 +2351,8 @@ nsCycleCollector::ScanRoots(nsICycleCollectorListener *aListener)
 
     ScanWeakMaps();
 
-    if (aListener) {
-        aListener->BeginResults();
+    if (mListener) {
+        mListener->BeginResults();
 
         NodePool::Enumerator etor(mGraph.mNodes);
         while (!etor.IsDone()) {
@@ -2305,12 +2361,12 @@ nsCycleCollector::ScanRoots(nsICycleCollectorListener *aListener)
             case black:
                 if (pi->mRefCount > 0 && pi->mRefCount < UINT32_MAX &&
                     pi->mInternalRefs != pi->mRefCount) {
-                    aListener->DescribeRoot((uint64_t)pi->mPointer,
+                    mListener->DescribeRoot((uint64_t)pi->mPointer,
                                             pi->mInternalRefs);
                 }
                 break;
             case white:
-                aListener->DescribeGarbage((uint64_t)pi->mPointer);
+                mListener->DescribeGarbage((uint64_t)pi->mPointer);
                 break;
             case grey:
                 // With incremental CC, we can end up with a grey object after
@@ -2319,8 +2375,10 @@ nsCycleCollector::ScanRoots(nsICycleCollectorListener *aListener)
             }
         }
 
-        aListener->End();
+        mListener->End();
+        mListener = nullptr;
     }
+    timeLog.Checkpoint("ScanRoots()");
 }
 
 
@@ -2346,11 +2404,9 @@ nsCycleCollector::CollectWhite()
     //   - Unroot(whites), which returns the whites to normal GC.
 
     TimeLog timeLog;
+    nsAutoTArray<PtrInfo*, 4000> whiteNodes;
 
-    MOZ_ASSERT(mWhiteNodes->IsEmpty(),
-               "CleanupAfterCollection wasn't called?");
-
-    mWhiteNodes->SetCapacity(mWhiteNodeCount);
+    whiteNodes.SetCapacity(mWhiteNodeCount);
     uint32_t numWhiteGCed = 0;
 
     NodePool::Enumerator etor(mGraph.mNodes);
@@ -2358,7 +2414,7 @@ nsCycleCollector::CollectWhite()
     {
         PtrInfo *pinfo = etor.GetNext();
         if (pinfo->mColor == white) {
-            mWhiteNodes->AppendElement(pinfo);
+            whiteNodes.AppendElement(pinfo);
             pinfo->mParticipant->Root(pinfo->mPointer);
             if (pinfo->mRefCount == 0) {
                 // only JS objects have a refcount of 0
@@ -2367,13 +2423,11 @@ nsCycleCollector::CollectWhite()
         }
     }
 
-    uint32_t count = mWhiteNodes->Length();
+    uint32_t count = whiteNodes.Length();
     MOZ_ASSERT(numWhiteGCed <= count,
                "More freed GCed nodes than total freed nodes.");
-    if (mResults) {
-        mResults->mFreedRefCounted += count - numWhiteGCed;
-        mResults->mFreedGCed += numWhiteGCed;
-    }
+    mResults.mFreedRefCounted += count - numWhiteGCed;
+    mResults.mFreedGCed += numWhiteGCed;
 
     timeLog.Checkpoint("CollectWhite::Root");
 
@@ -2383,7 +2437,7 @@ nsCycleCollector::CollectWhite()
     }
 
     for (uint32_t i = 0; i < count; ++i) {
-        PtrInfo *pinfo = mWhiteNodes->ElementAt(i);
+        PtrInfo *pinfo = whiteNodes.ElementAt(i);
         pinfo->mParticipant->Unlink(pinfo->mPointer);
 #ifdef DEBUG
         if (mJSRuntime) {
@@ -2394,7 +2448,7 @@ nsCycleCollector::CollectWhite()
     timeLog.Checkpoint("CollectWhite::Unlink");
 
     for (uint32_t i = 0; i < count; ++i) {
-        PtrInfo *pinfo = mWhiteNodes->ElementAt(i);
+        PtrInfo *pinfo = whiteNodes.ElementAt(i);
         pinfo->mParticipant->Unroot(pinfo->mPointer);
     }
     timeLog.Checkpoint("CollectWhite::Unroot");
@@ -2421,12 +2475,11 @@ class CycleCollectorReporter MOZ_FINAL : public MemoryMultiReporter
                               nsISupports* aClosure)
     {
         size_t objectSize, graphNodesSize, graphEdgesSize, weakMapsSize,
-            whiteNodesSize, purpleBufferSize;
+            purpleBufferSize;
         mCollector->SizeOfIncludingThis(MallocSizeOf,
                                         &objectSize,
                                         &graphNodesSize, &graphEdgesSize,
                                         &weakMapsSize,
-                                        &whiteNodesSize,
                                         &purpleBufferSize);
 
     #define REPORT(_path, _amount, _desc)                                     \
@@ -2438,7 +2491,8 @@ class CycleCollectorReporter MOZ_FINAL : public MemoryMultiReporter
                                    nsIMemoryReporter::KIND_HEAP,              \
                                    nsIMemoryReporter::UNITS_BYTES, _amount,   \
                                    NS_LITERAL_CSTRING(_desc), aClosure);      \
-                NS_ENSURE_SUCCESS(rv, rv);                                    \
+                if (NS_WARN_IF(NS_FAILED(rv)))                                \
+                    return rv;                                                \
             }                                                                 \
         } while (0)
 
@@ -2458,10 +2512,6 @@ class CycleCollectorReporter MOZ_FINAL : public MemoryMultiReporter
                "cycle collector's graph. "
                "This should be zero when the collector is idle.");
 
-        REPORT("explicit/cycle-collector/white-nodes", whiteNodesSize,
-               "Memory used for the cycle collector's white nodes array. "
-               "This should be zero when the collector is idle.");
-
         REPORT("explicit/cycle-collector/purple-buffer", purpleBufferSize,
                "Memory used for the cycle collector's purple buffer.");
 
@@ -2484,13 +2534,9 @@ class CycleCollectorReporter MOZ_FINAL : public MemoryMultiReporter
 nsCycleCollector::nsCycleCollector() :
     mCollectionInProgress(false),
     mScanInProgress(false),
-    mResults(nullptr),
     mJSRuntime(nullptr),
     mThread(NS_GetCurrentThread()),
-    mWhiteNodes(nullptr),
     mWhiteNodeCount(0),
-    mVisitedRefCounted(0),
-    mVisitedGCed(0),
     mBeforeUnlinkCB(nullptr),
     mForgetSkippableCB(nullptr),
     mReporter(nullptr),
@@ -2600,8 +2646,7 @@ nsCycleCollector::FixGrayBits(bool aForceGC)
         CC_TELEMETRY(_NEED_GC, needGC);
         if (!needGC)
             return;
-        if (mResults)
-            mResults->mForcedGC = true;
+        mResults.mForcedGC = true;
     }
 
     TimeLog timeLog;
@@ -2609,33 +2654,9 @@ nsCycleCollector::FixGrayBits(bool aForceGC)
     timeLog.Checkpoint("GC()");
 }
 
-void
-nsCycleCollector::PrepareForCollection(nsCycleCollectorResults *aResults,
-                                       nsTArray<PtrInfo*> *aWhiteNodes)
-{
-    TimeLog timeLog;
-
-    mCollectionStart = TimeStamp::Now();
-    mVisitedRefCounted = 0;
-    mVisitedGCed = 0;
-
-    mCollectionInProgress = true;
-
-    if (mJSRuntime) {
-        mJSRuntime->PrepareForCollection();
-    }
-
-    mResults = aResults;
-    mWhiteNodes = aWhiteNodes;
-
-    timeLog.Checkpoint("PrepareForCollection()");
-}
-
 void
 nsCycleCollector::CleanupAfterCollection()
 {
-    mWhiteNodes->Clear();
-    mWhiteNodes = nullptr;
     mGraph.Clear();
     mCollectionInProgress = false;
 
@@ -2649,35 +2670,27 @@ nsCycleCollector::CleanupAfterCollection()
     uint32_t interval = (uint32_t) ((TimeStamp::Now() - mCollectionStart).ToMilliseconds());
 #ifdef COLLECT_TIME_DEBUG
     printf("cc: total cycle collector time was %ums\n", interval);
-    if (mResults) {
-        printf("cc: visited %u ref counted and %u GCed objects, freed %d ref counted and %d GCed objects.\n",
-               mVisitedRefCounted, mVisitedGCed,
-               mResults->mFreedRefCounted, mResults->mFreedGCed);
-    } else {
-        printf("cc: visited %u ref counted and %u GCed objects, freed %d.\n",
-               mVisitedRefCounted, mVisitedGCed, mWhiteNodeCount);
-    }
+    printf("cc: visited %u ref counted and %u GCed objects, freed %d ref counted and %d GCed objects.\n",
+           mResults.mVisitedRefCounted, mResults.mVisitedGCed,
+           mResults.mFreedRefCounted, mResults.mFreedGCed);
     printf("cc: \n");
 #endif
-    if (mResults) {
-        mResults->mVisitedRefCounted = mVisitedRefCounted;
-        mResults->mVisitedGCed = mVisitedGCed;
-        mResults = nullptr;
-    }
     CC_TELEMETRY( , interval);
-    CC_TELEMETRY(_VISITED_REF_COUNTED, mVisitedRefCounted);
-    CC_TELEMETRY(_VISITED_GCED, mVisitedGCed);
+    CC_TELEMETRY(_VISITED_REF_COUNTED, mResults.mVisitedRefCounted);
+    CC_TELEMETRY(_VISITED_GCED, mResults.mVisitedGCed);
     CC_TELEMETRY(_COLLECTED, mWhiteNodeCount);
+
+    if (mJSRuntime) {
+        mJSRuntime->EndCycleCollectionCallback(mResults);
+    }
 }
 
 void
 nsCycleCollector::ShutdownCollect()
 {
-    nsAutoTArray<PtrInfo*, 4000> whiteNodes;
-
     for (uint32_t i = 0; i < DEFAULT_SHUTDOWN_COLLECTIONS; ++i) {
         NS_ASSERTION(i < NORMAL_SHUTDOWN_COLLECTIONS, "Extra shutdown CC");
-        if (!Collect(ShutdownCC, &whiteNodes, nullptr, nullptr)) {
+        if (!Collect(ShutdownCC, nullptr)) {
             break;
         }
     }
@@ -2685,8 +2698,6 @@ nsCycleCollector::ShutdownCollect()
 
 bool
 nsCycleCollector::Collect(ccType aCCType,
-                          nsTArray<PtrInfo*> *aWhiteNodes,
-                          nsCycleCollectorResults *aResults,
                           nsICycleCollectorListener *aManualListener)
 {
     CheckThreadSafety();
@@ -2696,8 +2707,9 @@ nsCycleCollector::Collect(ccType aCCType,
         return false;
     }
 
-    PrepareForCollection(aResults, aWhiteNodes);
     BeginCollection(aCCType, aManualListener);
+    MarkRoots();
+    ScanRoots();
     bool collectedAny = CollectWhite();
     CleanupAfterCollection();
     return collectedAny;
@@ -2743,62 +2755,69 @@ nsCycleCollector::BeginCollection(ccType aCCType,
                                   nsICycleCollectorListener *aManualListener)
 {
     TimeLog timeLog;
+
+    mCollectionStart = TimeStamp::Now();
+
+    mCollectionInProgress = true;
+
+    if (mJSRuntime) {
+        mJSRuntime->BeginCycleCollectionCallback();
+        timeLog.Checkpoint("BeginCycleCollectionCallback()");
+    }
+
     bool isShutdown = (aCCType == ShutdownCC);
 
     // Set up the listener for this CC.
     MOZ_ASSERT_IF(isShutdown, !aManualListener);
-    nsCOMPtr<nsICycleCollectorListener> listener(aManualListener);
+    MOZ_ASSERT(!mListener, "Forgot to clear a previous listener?");
+    mListener = aManualListener;
     aManualListener = nullptr;
-    if (!listener) {
+    if (!mListener) {
         if (mParams.mLogAll || (isShutdown && mParams.mLogShutdown)) {
             nsRefPtr<nsCycleCollectorLogger> logger = new nsCycleCollectorLogger();
             if (isShutdown && mParams.mAllTracesAtShutdown) {
                 logger->SetAllTraces();
             }
-            listener = logger.forget();
+            mListener = logger.forget();
         }
     }
 
     bool forceGC = isShutdown;
-    if (!forceGC && listener) {
+    if (!forceGC && mListener) {
         // On a WantAllTraces CC, force a synchronous global GC to prevent
         // hijinks from ForgetSkippable and compartmental GCs.
-        listener->GetWantAllTraces(&forceGC);
+        mListener->GetWantAllTraces(&forceGC);
     }
     FixGrayBits(forceGC);
 
     FreeSnowWhite(true);
 
-    if (listener && NS_FAILED(listener->Begin())) {
-        listener = nullptr;
+    if (mListener && NS_FAILED(mListener->Begin())) {
+        mListener = nullptr;
     }
 
     // Set up the data structures for building the graph.
+    mGraph.Init();
+    mResults.Init();
     bool mergeZones = ShouldMergeZones(aCCType);
-    if (mResults) {
-        mResults->mMergedZones = mergeZones;
-    }
+    mResults.mMergedZones = mergeZones;
 
-    GCGraphBuilder builder(this, mGraph, mJSRuntime, listener,
-                           mergeZones);
+    MOZ_ASSERT(!mBuilder, "Forgot to clear mBuilder");
+    mBuilder = new GCGraphBuilder(mGraph, mResults, mJSRuntime, mListener, mergeZones);
 
     if (mJSRuntime) {
-        mJSRuntime->BeginCycleCollection(builder);
+        mJSRuntime->BeginCycleCollection(*mBuilder);
         timeLog.Checkpoint("mJSRuntime->BeginCycleCollection()");
     }
 
+    AutoRestore<bool> ar(mScanInProgress);
+    MOZ_ASSERT(!mScanInProgress);
     mScanInProgress = true;
-    mPurpleBuf.SelectPointers(builder);
+    mPurpleBuf.SelectPointers(*mBuilder);
     timeLog.Checkpoint("SelectPointers()");
 
-    // The main Bacon & Rajan collection algorithm.
-    MarkRoots(builder);
-    timeLog.Checkpoint("MarkRoots()");
-
-    ScanRoots(listener);
-    timeLog.Checkpoint("ScanRoots()");
-
-    mScanInProgress = false;
+    // We've finished adding roots, and everything in the graph is a root.
+    mGraph.mRootCount = mGraph.MapCount();
 }
 
 uint32_t
@@ -2816,11 +2835,6 @@ nsCycleCollector::Shutdown()
     // Always delete snow white objects.
     FreeSnowWhite(true);
 
-#ifdef MOZ_VALGRIND
-    char *e = PR_GetEnv("XPCOM_CC_RUN_DURING_SHUTDOWN");
-    fprintf(stderr, "XPCOM_CC_RUN_DURING_SHUTDOWN = %s\n", e);
-#endif
-
 #ifndef DEBUG
     if (PR_GetEnv("XPCOM_CC_RUN_DURING_SHUTDOWN"))
 #endif
@@ -2835,7 +2849,6 @@ nsCycleCollector::SizeOfIncludingThis(MallocSizeOf aMallocSizeOf,
                                       size_t *aGraphNodesSize,
                                       size_t *aGraphEdgesSize,
                                       size_t *aWeakMapsSize,
-                                      size_t *aWhiteNodeSize,
                                       size_t *aPurpleBufferSize) const
 {
     *aObjectSize = aMallocSizeOf(this);
@@ -2843,16 +2856,9 @@ nsCycleCollector::SizeOfIncludingThis(MallocSizeOf aMallocSizeOf,
     mGraph.SizeOfExcludingThis(aMallocSizeOf, aGraphNodesSize, aGraphEdgesSize,
                                aWeakMapsSize);
 
-    // No need to measure what the entries point to; the pointers are
-    // non-owning.
-    *aWhiteNodeSize = mWhiteNodes
-                    ? mWhiteNodes->SizeOfIncludingThis(aMallocSizeOf)
-                    : 0;
-
     *aPurpleBufferSize = mPurpleBuf.SizeOfExcludingThis(aMallocSizeOf);
 
     // These fields are deliberately not measured:
-    // - mResults: because it's tiny and only contains scalars.
     // - mJSRuntime: because it's non-owning and measured by JS reporters.
     // - mParams: because it only contains scalars.
 }
@@ -3159,9 +3165,7 @@ nsCycleCollector_doDeferredDeletion()
 }
 
 void
-nsCycleCollector_collect(bool aManuallyTriggered,
-                         nsCycleCollectorResults *aResults,
-                         nsICycleCollectorListener *aManualListener)
+nsCycleCollector_collect(nsICycleCollectorListener *aManualListener)
 {
     CollectorData *data = sCollectorData.get();
 
@@ -3170,11 +3174,20 @@ nsCycleCollector_collect(bool aManuallyTriggered,
     MOZ_ASSERT(data->mCollector);
 
     PROFILER_LABEL("CC", "nsCycleCollector_collect");
+    data->mCollector->Collect(ManualCC, aManualListener);
+}
 
-    MOZ_ASSERT_IF(aManualListener, aManuallyTriggered);
-    nsAutoTArray<PtrInfo*, 4000> whiteNodes;
-    data->mCollector->Collect(aManuallyTriggered ? ManualCC : ScheduledCC,
-                              &whiteNodes, aResults, aManualListener);
+void
+nsCycleCollector_scheduledCollect()
+{
+    CollectorData *data = sCollectorData.get();
+
+    // We should have started the cycle collector by now.
+    MOZ_ASSERT(data);
+    MOZ_ASSERT(data->mCollector);
+
+    PROFILER_LABEL("CC", "nsCycleCollector_scheduledCollect");
+    data->mCollector->Collect(ScheduledCC, nullptr);
 }
 
 void
diff --git a/xpcom/base/nsCycleCollector.h b/xpcom/base/nsCycleCollector.h
index da023a16663b..e6309df54736 100644
--- a/xpcom/base/nsCycleCollector.h
+++ b/xpcom/base/nsCycleCollector.h
@@ -22,22 +22,6 @@ typedef bool (*DeferredFinalizeFunction)(uint32_t slice, void* data);
 
 }
 
-// Contains various stats about the cycle collection.
-class nsCycleCollectorResults
-{
-public:
-    nsCycleCollectorResults() :
-        mForcedGC(false), mMergedZones(false),
-        mVisitedRefCounted(0), mVisitedGCed(0),
-        mFreedRefCounted(0), mFreedGCed(0) {}
-    bool mForcedGC;
-    bool mMergedZones;
-    uint32_t mVisitedRefCounted;
-    uint32_t mVisitedGCed;
-    uint32_t mFreedRefCounted;
-    uint32_t mFreedGCed;
-};
-
 bool nsCycleCollector_init();
 
 void nsCycleCollector_startup();
@@ -54,9 +38,9 @@ void nsCycleCollector_forgetSkippable(bool aRemoveChildlessNodes = false,
 void nsCycleCollector_dispatchDeferredDeletion(bool aContinuation = false);
 bool nsCycleCollector_doDeferredDeletion();
 
-void nsCycleCollector_collect(bool aManuallyTriggered,
-                              nsCycleCollectorResults *aResults,
-                              nsICycleCollectorListener *aManualListener);
+void nsCycleCollector_collect(nsICycleCollectorListener *aManualListener);
+void nsCycleCollector_scheduledCollect();
+
 uint32_t nsCycleCollector_suspectedCount();
 void nsCycleCollector_shutdown();
 
diff --git a/xpcom/base/nsDebugImpl.cpp b/xpcom/base/nsDebugImpl.cpp
index cd9e12a1d0ca..3cb01f4432a2 100644
--- a/xpcom/base/nsDebugImpl.cpp
+++ b/xpcom/base/nsDebugImpl.cpp
@@ -565,7 +565,8 @@ static const nsDebugImpl kImpl;
 nsresult
 nsDebugImpl::Create(nsISupports* outer, const nsIID& aIID, void* *aInstancePtr)
 {
-  NS_ENSURE_NO_AGGREGATION(outer);
+  if (NS_WARN_IF(outer))
+    return NS_ERROR_NO_AGGREGATION;
 
   return const_cast<nsDebugImpl*>(&kImpl)->
     QueryInterface(aIID, aInstancePtr);
diff --git a/xpcom/base/nsErrorService.cpp b/xpcom/base/nsErrorService.cpp
index dd5464d7e5c7..58ef07b817fc 100644
--- a/xpcom/base/nsErrorService.cpp
+++ b/xpcom/base/nsErrorService.cpp
@@ -65,7 +65,8 @@ NS_IMPL_ISUPPORTS1(nsErrorService, nsIErrorService)
 nsresult
 nsErrorService::Create(nsISupports* outer, const nsIID& aIID, void* *aInstancePtr)
 {
-    NS_ENSURE_NO_AGGREGATION(outer);
+    if (NS_WARN_IF(outer))
+        return NS_ERROR_NO_AGGREGATION;
     nsRefPtr<nsErrorService> serv = new nsErrorService();
     return serv->QueryInterface(aIID, aInstancePtr);
 }
diff --git a/xpcom/base/nsGZFileWriter.cpp b/xpcom/base/nsGZFileWriter.cpp
index c1e96cacf476..166e199d54cf 100644
--- a/xpcom/base/nsGZFileWriter.cpp
+++ b/xpcom/base/nsGZFileWriter.cpp
@@ -33,21 +33,25 @@ nsGZFileWriter::~nsGZFileWriter()
 NS_IMETHODIMP
 nsGZFileWriter::Init(nsIFile* aFile)
 {
-  NS_ENSURE_FALSE(mInitialized, NS_ERROR_FAILURE);
-  NS_ENSURE_FALSE(mFinished, NS_ERROR_FAILURE);
+  if (NS_WARN_IF(mInitialized) ||
+      NS_WARN_IF(mFinished))
+    return NS_ERROR_FAILURE;
 
   // Get a FILE out of our nsIFile.  Convert that into a file descriptor which
   // gzip can own.  Then close our FILE, leaving only gzip's fd open.
 
   FILE* file;
   nsresult rv = aFile->OpenANSIFileDesc("wb", &file);
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
 
   mGZFile = gzdopen(dup(fileno(file)), "wb");
   fclose(file);
 
   // gzdopen returns nullptr on error.
-  NS_ENSURE_TRUE(mGZFile, NS_ERROR_FAILURE);
+  if (NS_WARN_IF(!mGZFile))
+    return NS_ERROR_FAILURE;
+
   mInitialized = true;
 
   return NS_OK;
@@ -56,8 +60,9 @@ nsGZFileWriter::Init(nsIFile* aFile)
 NS_IMETHODIMP
 nsGZFileWriter::Write(const nsACString& aStr)
 {
-  NS_ENSURE_TRUE(mInitialized, NS_ERROR_NOT_INITIALIZED);
-  NS_ENSURE_FALSE(mFinished, NS_ERROR_FAILURE);
+  if (NS_WARN_IF(!mInitialized) ||
+      NS_WARN_IF(mFinished))
+    return NS_ERROR_FAILURE;
 
   // gzwrite uses a return value of 0 to indicate failure.  Otherwise, it
   // returns the number of uncompressed bytes written.  To ensure we can
@@ -71,7 +76,8 @@ nsGZFileWriter::Write(const nsACString& aStr)
   // always be either 0 or aStr.Length(), and we shouldn't have to call it
   // multiple times in order to get it to read the whole buffer.
   int rv = gzwrite(mGZFile, aStr.BeginReading(), aStr.Length());
-  NS_ENSURE_TRUE(rv == static_cast<int>(aStr.Length()), NS_ERROR_FAILURE);
+  if (NS_WARN_IF(rv != static_cast<int>(aStr.Length())))
+    return NS_ERROR_FAILURE;
 
   return NS_OK;
 }
@@ -79,8 +85,9 @@ nsGZFileWriter::Write(const nsACString& aStr)
 NS_IMETHODIMP
 nsGZFileWriter::Finish()
 {
-  NS_ENSURE_TRUE(mInitialized, NS_ERROR_NOT_INITIALIZED);
-  NS_ENSURE_FALSE(mFinished, NS_ERROR_FAILURE);
+  if (NS_WARN_IF(!mInitialized) ||
+      NS_WARN_IF(mFinished))
+    return NS_ERROR_FAILURE;
 
   mFinished = true;
   gzclose(mGZFile);
diff --git a/xpcom/base/nsIMemoryReporter.idl b/xpcom/base/nsIMemoryReporter.idl
index 66e7ade7ac8f..df2154451e14 100644
--- a/xpcom/base/nsIMemoryReporter.idl
+++ b/xpcom/base/nsIMemoryReporter.idl
@@ -185,7 +185,7 @@ interface nsIFinishReportingCallback : nsISupports
   void callback(in nsISupports data);
 };
 
-[scriptable, builtinclass, uuid(2596fa26-495a-4827-a5f5-e34e7f4dd7b5)]
+[scriptable, builtinclass, uuid(41c667f4-16b3-424f-95d9-a6f903f72eb2)]
 interface nsIMemoryReporterManager : nsISupports
 {
   /*
@@ -263,6 +263,9 @@ interface nsIMemoryReporterManager : nsISupports
    * |vsize| (UNITS_BYTES)  The virtual size, i.e. the amount of address space
    * taken up.
    *
+   * |vsizeMaxContiguous| (UNITS_BYTES)  The size of the largest contiguous
+   * block of virtual memory.
+   *
    * |resident| (UNITS_BYTES)  The resident size (a.k.a. RSS or physical memory
    * used).
    *
@@ -300,13 +303,10 @@ interface nsIMemoryReporterManager : nsISupports
    *
    * |pageFaultsHard| (UNITS_COUNT_CUMULATIVE)  The number of hard (a.k.a.
    * major) page faults that have occurred since the process started.
-   *
-   * |largestContiguousVMBlock| (UNITS_BYTES)  The size of the largest
-   * contiguous block of virtual memory.  Only available on Windows; on all
-   * other platforms, reading this value returns 0.
    */
   readonly attribute int64_t explicit;
   readonly attribute int64_t vsize;
+  readonly attribute int64_t vsizeMaxContiguous;
   readonly attribute int64_t resident;
   readonly attribute int64_t residentFast;
 
@@ -329,8 +329,6 @@ interface nsIMemoryReporterManager : nsISupports
 
   readonly attribute int64_t pageFaultsHard;
 
-  readonly attribute int64_t largestContiguousVMBlock;
-
   /*
    * This attribute indicates if moz_malloc_usable_size() works.
    */
@@ -537,7 +535,8 @@ public:
   {
     int64_t amount;
     nsresult rv = GetAmount(&amount);
-    NS_ENSURE_SUCCESS(rv, rv);
+    if (NS_WARN_IF(NS_FAILED(rv)))
+      return rv;
 
     return aCallback->Callback(EmptyCString(), mNameAndPath, mKind, mUnits,
                                amount, mDescription, aData);
diff --git a/xpcom/base/nsMacUtilsImpl.cpp b/xpcom/base/nsMacUtilsImpl.cpp
index 84a030051dc9..bf9828ad8499 100644
--- a/xpcom/base/nsMacUtilsImpl.cpp
+++ b/xpcom/base/nsMacUtilsImpl.cpp
@@ -89,7 +89,8 @@ nsresult nsMacUtilsImpl::GetArchString(nsAString& archString)
 
 NS_IMETHODIMP nsMacUtilsImpl::GetIsUniversalBinary(bool *aIsUniversalBinary)
 {
-  NS_ENSURE_ARG_POINTER(aIsUniversalBinary);
+  if (NS_WARN_IF(!aIsUniversalBinary))
+    return NS_ERROR_INVALID_ARG;
   *aIsUniversalBinary = false;
 
   nsAutoString archString;
diff --git a/xpcom/base/nsMemoryImpl.cpp b/xpcom/base/nsMemoryImpl.cpp
index f8b9bfc5a236..2b25086e13f4 100644
--- a/xpcom/base/nsMemoryImpl.cpp
+++ b/xpcom/base/nsMemoryImpl.cpp
@@ -93,7 +93,8 @@ nsMemoryImpl::IsLowMemoryPlatform(bool *result)
 /*static*/ nsresult
 nsMemoryImpl::Create(nsISupports* outer, const nsIID& aIID, void **aResult)
 {
-    NS_ENSURE_NO_AGGREGATION(outer);
+    if (NS_WARN_IF(outer))
+        return NS_ERROR_NO_AGGREGATION;
     return sGlobalMemory.QueryInterface(aIID, aResult);
 }
 
diff --git a/xpcom/base/nsMemoryInfoDumper.cpp b/xpcom/base/nsMemoryInfoDumper.cpp
index c5ae19f08404..23a4d5fcc5e0 100644
--- a/xpcom/base/nsMemoryInfoDumper.cpp
+++ b/xpcom/base/nsMemoryInfoDumper.cpp
@@ -416,15 +416,18 @@ public:
       }
     } else {
       rv = NS_GetSpecialDirectory(NS_OS_TEMP_DIR, getter_AddRefs(file));
-      NS_ENSURE_SUCCESS(rv, -1);
+      if (NS_WARN_IF(NS_FAILED(rv)))
+        return -1;
     }
 
     rv = file->AppendNative(NS_LITERAL_CSTRING("debug_info_trigger"));
-    NS_ENSURE_SUCCESS(rv, -1);
+    if (NS_WARN_IF(NS_FAILED(rv)))
+      return -1;
 
     nsAutoCString path;
     rv = file->GetNativePath(path);
-    NS_ENSURE_SUCCESS(rv, -1);
+    if (NS_WARN_IF(NS_FAILED(rv)))
+      return -1;
 
     // unlink might fail because the file doesn't exist, or for other reasons.
     // But we don't care it fails; any problems will be detected later, when we
@@ -606,7 +609,8 @@ namespace mozilla {
 #define DUMP(o, s) \
   do { \
     nsresult rv = (o)->Write(s); \
-    NS_ENSURE_SUCCESS(rv, rv); \
+    if (NS_WARN_IF(NS_FAILED(rv))) \
+      return rv; \
   } while (0)
 
 static nsresult
@@ -680,7 +684,8 @@ public:
       nsISupports *aData)
   {
     nsCOMPtr<nsIGZFileWriter> writer = do_QueryInterface(aData);
-    NS_ENSURE_TRUE(writer, NS_ERROR_FAILURE);
+    if (NS_WARN_IF(!writer))
+      return NS_ERROR_FAILURE;
 
     nsresult rv = DumpReport(writer, mIsFirst, aProcess, aPath, aKind, aUnits,
                              aAmount, aDescription);
@@ -722,7 +727,8 @@ nsMemoryInfoDumper::OpenTempFile(const nsACString &aFilename, nsIFile* *aFile)
   nsresult rv;
   if (!*aFile) {
     rv = NS_GetSpecialDirectory(NS_OS_TEMP_DIR, aFile);
-    NS_ENSURE_SUCCESS(rv, rv);
+    if (NS_WARN_IF(NS_FAILED(rv)))
+      return rv;
   }
 
 #ifdef ANDROID
@@ -731,7 +737,8 @@ nsMemoryInfoDumper::OpenTempFile(const nsACString &aFilename, nsIFile* *aFile)
   // users to be able to remove these files, so we write them into a
   // subdirectory of the temp directory and chmod 777 that directory.
   rv = (*aFile)->AppendNative(NS_LITERAL_CSTRING("memory-reports"));
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
 
   // It's OK if this fails; that probably just means that the directory already
   // exists.
@@ -739,7 +746,8 @@ nsMemoryInfoDumper::OpenTempFile(const nsACString &aFilename, nsIFile* *aFile)
 
   nsAutoCString dirPath;
   rv = (*aFile)->GetNativePath(dirPath);
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
 
   while (chmod(dirPath.get(), 0777) == -1 && errno == EINTR) {}
 #endif
@@ -747,10 +755,12 @@ nsMemoryInfoDumper::OpenTempFile(const nsACString &aFilename, nsIFile* *aFile)
   nsCOMPtr<nsIFile> file(*aFile);
 
   rv = file->AppendNative(aFilename);
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
 
   rv = file->CreateUnique(nsIFile::NORMAL_FILE_TYPE, 0666);
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
 
 #ifdef ANDROID
     // Make this file world-read/writable; the permissions passed to the
@@ -758,7 +768,8 @@ nsMemoryInfoDumper::OpenTempFile(const nsACString &aFilename, nsIFile* *aFile)
     // umask.
     nsAutoCString path;
     rv = file->GetNativePath(path);
-    NS_ENSURE_SUCCESS(rv, rv);
+    if (NS_WARN_IF(NS_FAILED(rv)))
+      return rv;
 
     while (chmod(path.get(), 0666) == -1 && errno == EINTR) {}
 #endif
@@ -801,7 +812,8 @@ DumpHeader(nsIGZFileWriter* aWriter)
 
   nsCOMPtr<nsIMemoryReporterManager> mgr =
     do_GetService("@mozilla.org/memory-reporter-manager;1");
-  NS_ENSURE_STATE(mgr);
+  if (NS_WARN_IF(!mgr))
+    return NS_ERROR_UNEXPECTED;
 
   DUMP(aWriter, mgr->GetHasMozMallocUsableSize() ? "true" : "false");
   DUMP(aWriter, ",\n");
@@ -872,11 +884,12 @@ DumpProcessMemoryInfoToTempDir(const nsAString& aIdentifier)
   rv = nsMemoryInfoDumper::OpenTempFile(NS_LITERAL_CSTRING("incomplete-") +
                                         mrFilename,
                                         getter_AddRefs(mrTmpFile));
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
    return rv;
 
   nsRefPtr<nsGZFileWriter> mrWriter = new nsGZFileWriter();
   rv = mrWriter->Init(mrTmpFile);
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
 
   // Dump the memory reports to the file.
   DumpProcessMemoryReportsToGZFileWriter(mrWriter);
@@ -894,11 +907,13 @@ DumpProcessMemoryInfoToTempDir(const nsAString& aIdentifier)
 
   nsCOMPtr<nsIFile> dmdFile;
   rv = nsMemoryInfoDumper::OpenTempFile(dmdFilename, getter_AddRefs(dmdFile));
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
 
   nsRefPtr<nsGZFileWriter> dmdWriter = new nsGZFileWriter();
   rv = dmdWriter->Init(dmdFile);
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
 
   // Dump DMD output to the file.
 
@@ -907,7 +922,8 @@ DumpProcessMemoryInfoToTempDir(const nsAString& aIdentifier)
   dmd::Dump(w);
 
   rv = dmdWriter->Finish();
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
 #endif  // MOZ_DMD
 
   // The call to Finish() deallocates the memory allocated by mrWriter's first
@@ -916,42 +932,51 @@ DumpProcessMemoryInfoToTempDir(const nsAString& aIdentifier)
   // them -- by "heap-allocated" if nothing else -- we want DMD to see it as
   // well.  So we deliberately don't call Finish() until after DMD finishes.
   rv = mrWriter->Finish();
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
 
   // Rename the memory reports file, now that we're done writing all the files.
   // Its final name is "memory-report<-identifier>-<pid>.json.gz".
 
   nsCOMPtr<nsIFile> mrFinalFile;
   rv = NS_GetSpecialDirectory(NS_OS_TEMP_DIR, getter_AddRefs(mrFinalFile));
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
 
 #ifdef ANDROID
   rv = mrFinalFile->AppendNative(NS_LITERAL_CSTRING("memory-reports"));
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
 #endif
 
   rv = mrFinalFile->AppendNative(mrFilename);
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
 
   rv = mrFinalFile->CreateUnique(nsIFile::NORMAL_FILE_TYPE, 0600);
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
 
   nsAutoString mrActualFinalFilename;
   rv = mrFinalFile->GetLeafName(mrActualFinalFilename);
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
 
   rv = mrTmpFile->MoveTo(/* directory */ nullptr, mrActualFinalFilename);
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
 
   // Write a message to the console.
 
   nsCOMPtr<nsIConsoleService> cs =
     do_GetService(NS_CONSOLESERVICE_CONTRACTID, &rv);
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
 
   nsString path;
   mrTmpFile->GetPath(path);
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
 
   nsString msg = NS_LITERAL_STRING(
     "nsIMemoryInfoDumper dumped reports to ");
@@ -988,7 +1013,8 @@ nsMemoryInfoDumper::DumpMemoryInfoToTempDir(const nsAString& aIdentifier,
                                           /* dumpChildProcesses = */ false);
     nsCOMPtr<nsIMemoryReporterManager> mgr =
       do_GetService("@mozilla.org/memory-reporter-manager;1");
-    NS_ENSURE_TRUE(mgr, NS_ERROR_FAILURE);
+    if (NS_WARN_IF(!mgr))
+      return NS_ERROR_FAILURE;
     nsCOMPtr<nsICancelableRunnable> runnable;
     mgr->MinimizeMemoryUsage(callback, getter_AddRefs(runnable));
     return NS_OK;
@@ -1043,28 +1069,34 @@ nsMemoryInfoDumper::DumpMemoryReportsToNamedFile(
 
   nsCOMPtr<nsIFile> mrFile;
   nsresult rv = NS_NewLocalFile(aFilename, false, getter_AddRefs(mrFile));
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
 
   mrFile->InitWithPath(aFilename);
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
 
   bool exists;
   rv = mrFile->Exists(&exists);
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
 
   if (!exists) {
     rv = mrFile->Create(nsIFile::NORMAL_FILE_TYPE, 0644);
-    NS_ENSURE_SUCCESS(rv, rv);
+    if (NS_WARN_IF(NS_FAILED(rv)))
+      return rv;
   }
 
   // Write the memory reports to the file.
 
   nsRefPtr<nsGZFileWriter> mrWriter = new nsGZFileWriter();
   rv = mrWriter->Init(mrFile);
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
 
   rv = DumpHeader(mrWriter);
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
 
   // Process reports and finish up.
   nsRefPtr<DumpReportCallback> dumpReport = new DumpReportCallback();
diff --git a/xpcom/base/nsMemoryReporterManager.cpp b/xpcom/base/nsMemoryReporterManager.cpp
index dfa41367055c..aa6cc938b46e 100644
--- a/xpcom/base/nsMemoryReporterManager.cpp
+++ b/xpcom/base/nsMemoryReporterManager.cpp
@@ -59,19 +59,22 @@ static nsresult GetProcSelfStatmField(int aField, int64_t* aN)
 }
 
 #define HAVE_VSIZE_AND_RESIDENT_REPORTERS 1
-static nsresult GetVsize(int64_t* aN)
+static nsresult
+VsizeDistinguishedAmount(int64_t* aN)
 {
     return GetProcSelfStatmField(0, aN);
 }
 
-static nsresult GetResident(int64_t* aN)
+static nsresult
+ResidentDistinguishedAmount(int64_t* aN)
 {
     return GetProcSelfStatmField(1, aN);
 }
 
-static nsresult GetResidentFast(int64_t* aN)
+static nsresult
+ResidentFastDistinguishedAmount(int64_t* aN)
 {
-    return GetResident(aN);
+    return ResidentDistinguishedAmount(aN);
 }
 
 #define HAVE_RESIDENT_UNIQUE_REPORTER
@@ -99,7 +102,8 @@ private:
     *aAmount = 0;
 
     FILE *f = fopen("/proc/self/smaps", "r");
-    NS_ENSURE_STATE(f);
+    if (NS_WARN_IF(!f))
+        return NS_ERROR_UNEXPECTED;
 
     int64_t total = 0;
     char line[256];
@@ -172,7 +176,8 @@ static nsresult GetKinfoProcSelf(KINFO_PROC* aProc)
 }
 
 #define HAVE_VSIZE_AND_RESIDENT_REPORTERS 1
-static nsresult GetVsize(int64_t* aN)
+static nsresult
+VsizeDistinguishedAmount(int64_t* aN)
 {
     KINFO_PROC proc;
     nsresult rv = GetKinfoProcSelf(&proc);
@@ -182,7 +187,8 @@ static nsresult GetVsize(int64_t* aN)
     return rv;
 }
 
-static nsresult GetResident(int64_t* aN)
+static nsresult
+ResidentDistinguishedAmount(int64_t* aN)
 {
     KINFO_PROC proc;
     nsresult rv = GetKinfoProcSelf(&proc);
@@ -192,9 +198,10 @@ static nsresult GetResident(int64_t* aN)
     return rv;
 }
 
-static nsresult GetResidentFast(int64_t* aN)
+static nsresult
+ResidentFastDistinguishedAmount(int64_t* aN)
 {
-    return GetResident(aN);
+    return ResidentDistinguishedAmount(aN);
 }
 
 #elif defined(SOLARIS)
@@ -245,7 +252,8 @@ static void XMappingIter(int64_t& vsize, int64_t& resident)
 }
 
 #define HAVE_VSIZE_AND_RESIDENT_REPORTERS 1
-static nsresult GetVsize(int64_t* aN)
+static nsresult
+VsizeDistinguishedAmount(int64_t* aN)
 {
     int64_t vsize, resident;
     XMappingIter(vsize, resident);
@@ -256,7 +264,8 @@ static nsresult GetVsize(int64_t* aN)
     return NS_OK;
 }
 
-static nsresult GetResident(int64_t* aN)
+static nsresult
+ResidentDistinguishedAmount(int64_t* aN)
 {
     int64_t vsize, resident;
     XMappingIter(vsize, resident);
@@ -267,9 +276,10 @@ static nsresult GetResident(int64_t* aN)
     return NS_OK;
 }
 
-static nsresult GetResidentFast(int64_t* aN)
+static nsresult
+ResidentFastDistinguishedAmount(int64_t* aN)
 {
-    return GetResident(aN);
+    return ResidentDistinguishedAmount(aN);
 }
 
 #elif defined(XP_MACOSX)
@@ -289,7 +299,8 @@ static bool GetTaskBasicInfo(struct task_basic_info* aTi)
 // absurdly high, eg. 2GB+ even at start-up.  But both 'top' and 'ps' report
 // it, so we might as well too.
 #define HAVE_VSIZE_AND_RESIDENT_REPORTERS 1
-static nsresult GetVsize(int64_t* aN)
+static nsresult
+VsizeDistinguishedAmount(int64_t* aN)
 {
     task_basic_info ti;
     if (!GetTaskBasicInfo(&ti))
@@ -306,7 +317,7 @@ static nsresult GetVsize(int64_t* aN)
 //
 // Purging these pages can take a long time for some users (see bug 789975),
 // so we provide the option to get the RSS without purging first.
-static nsresult GetResident(int64_t* aN, bool aDoPurge)
+static nsresult ResidentDistinguishedAmountHelper(int64_t* aN, bool aDoPurge)
 {
 #ifdef HAVE_JEMALLOC_STATS
     if (aDoPurge) {
@@ -323,14 +334,16 @@ static nsresult GetResident(int64_t* aN, bool aDoPurge)
     return NS_OK;
 }
 
-static nsresult GetResidentFast(int64_t* aN)
+static nsresult
+ResidentFastDistinguishedAmount(int64_t* aN)
 {
-    return GetResident(aN, /* doPurge = */ false);
+    return ResidentDistinguishedAmountHelper(aN, /* doPurge = */ false);
 }
 
-static nsresult GetResident(int64_t* aN)
+static nsresult
+ResidentDistinguishedAmount(int64_t* aN)
 {
-    return GetResident(aN, /* doPurge = */ true);
+    return ResidentDistinguishedAmountHelper(aN, /* doPurge = */ true);
 }
 
 #elif defined(XP_WIN)
@@ -340,7 +353,8 @@ static nsresult GetResident(int64_t* aN)
 #include <algorithm>
 
 #define HAVE_VSIZE_AND_RESIDENT_REPORTERS 1
-static nsresult GetVsize(int64_t* aN)
+static nsresult
+VsizeDistinguishedAmount(int64_t* aN)
 {
     MEMORYSTATUSEX s;
     s.dwLength = sizeof(s);
@@ -353,7 +367,8 @@ static nsresult GetVsize(int64_t* aN)
     return NS_OK;
 }
 
-static nsresult GetResident(int64_t* aN)
+static nsresult
+ResidentDistinguishedAmount(int64_t* aN)
 {
     PROCESS_MEMORY_COUNTERS pmc;
     pmc.cb = sizeof(PROCESS_MEMORY_COUNTERS);
@@ -366,13 +381,15 @@ static nsresult GetResident(int64_t* aN)
     return NS_OK;
 }
 
-static nsresult GetResidentFast(int64_t* aN)
+static nsresult
+ResidentFastDistinguishedAmount(int64_t* aN)
 {
-    return GetResident(aN);
+    return ResidentDistinguishedAmount(aN);
 }
 
-#define HAVE_LARGEST_CONTIGUOUS_BLOCK_REPORTERS 1
-static nsresult LargestContiguousVMBlock(int64_t* aN)
+#define HAVE_VSIZE_MAX_CONTIGUOUS_REPORTER 1
+static nsresult
+VsizeMaxContiguousDistinguishedAmount(int64_t* aN)
 {
     SIZE_T biggestRegion = 0;
     MEMORY_BASIC_INFORMATION vmemInfo = {0};
@@ -399,6 +416,20 @@ static nsresult LargestContiguousVMBlock(int64_t* aN)
     return NS_OK;
 }
 
+class VsizeMaxContiguousReporter MOZ_FINAL : public MemoryUniReporter
+{
+public:
+    VsizeMaxContiguousReporter()
+      : MemoryUniReporter("vsize-max-contiguous", KIND_OTHER, UNITS_BYTES,
+"Size of the maximum contiguous block of available virtual memory.")
+    {}
+
+    NS_IMETHOD GetAmount(int64_t* aAmount)
+    {
+        return VsizeMaxContiguousDistinguishedAmount(aAmount);
+    }
+};
+
 #define HAVE_PRIVATE_REPORTER
 class PrivateReporter MOZ_FINAL : public MemoryUniReporter
 {
@@ -443,7 +474,10 @@ public:
 "resources used by the process.")
     {}
 
-    NS_IMETHOD GetAmount(int64_t* aAmount) { return GetVsize(aAmount); }
+    NS_IMETHOD GetAmount(int64_t* aAmount)
+    {
+        return VsizeDistinguishedAmount(aAmount);
+    }
 };
 
 class ResidentReporter MOZ_FINAL : public MemoryUniReporter
@@ -459,7 +493,10 @@ public:
 "time.")
     {}
 
-    NS_IMETHOD GetAmount(int64_t* aAmount) { return GetResident(aAmount); }
+    NS_IMETHOD GetAmount(int64_t* aAmount)
+    {
+        return ResidentDistinguishedAmount(aAmount);
+    }
 };
 #endif  // HAVE_VSIZE_AND_RESIDENT_REPORTERS
 
@@ -716,7 +753,8 @@ public:
                                    nsIMemoryReporter::KIND_HEAP,              \
                                    nsIMemoryReporter::UNITS_BYTES, _amount,   \
                                    NS_LITERAL_CSTRING(_desc), aData);         \
-      NS_ENSURE_SUCCESS(rv, rv);                                              \
+      if (NS_WARN_IF(NS_FAILED(rv)))                                          \
+          return rv;                                                          \
     } while (0)
 
     REPORT("explicit/dmd/stack-traces/used",
@@ -776,6 +814,10 @@ nsMemoryReporterManager::Init()
     RegisterReporter(new ResidentReporter);
 #endif
 
+#ifdef HAVE_VSIZE_MAX_CONTIGUOUS_REPORTER
+    RegisterReporter(new VsizeMaxContiguousReporter);
+#endif
+
 #ifdef HAVE_RESIDENT_UNIQUE_REPORTER
     RegisterReporter(new ResidentUniqueReporter);
 #endif
@@ -1244,7 +1286,8 @@ NS_IMPL_ISUPPORTS1(ExplicitCallback, nsIHandleReportCallback)
 NS_IMETHODIMP
 nsMemoryReporterManager::GetExplicit(int64_t* aAmount)
 {
-    NS_ENSURE_ARG_POINTER(aAmount);
+    if (NS_WARN_IF(!aAmount))
+        return NS_ERROR_INVALID_ARG;
     *aAmount = 0;
 #ifndef HAVE_JEMALLOC_STATS
     return NS_ERROR_NOT_AVAILABLE;
@@ -1278,18 +1321,29 @@ NS_IMETHODIMP
 nsMemoryReporterManager::GetVsize(int64_t* aVsize)
 {
 #ifdef HAVE_VSIZE_AND_RESIDENT_REPORTERS
-    return ::GetVsize(aVsize);
+    return VsizeDistinguishedAmount(aVsize);
 #else
     *aResident = 0;
     return NS_ERROR_NOT_AVAILABLE;
 #endif
 }
 
+NS_IMETHODIMP
+nsMemoryReporterManager::GetVsizeMaxContiguous(int64_t* aAmount)
+{
+#ifdef HAVE_VSIZE_MAX_CONTIGUOUS_REPORTER
+    return VsizeMaxContiguousDistinguishedAmount(aAmount);
+#else
+    *aAmount = 0;
+    return NS_ERROR_NOT_AVAILABLE;
+#endif
+}
+
 NS_IMETHODIMP
 nsMemoryReporterManager::GetResident(int64_t* aAmount)
 {
 #ifdef HAVE_VSIZE_AND_RESIDENT_REPORTERS
-    return ::GetResident(aAmount);
+    return ResidentDistinguishedAmount(aAmount);
 #else
     *aAmount = 0;
     return NS_ERROR_NOT_AVAILABLE;
@@ -1300,7 +1354,7 @@ NS_IMETHODIMP
 nsMemoryReporterManager::GetResidentFast(int64_t* aAmount)
 {
 #ifdef HAVE_VSIZE_AND_RESIDENT_REPORTERS
-    return ::GetResidentFast(aAmount);
+    return ResidentFastDistinguishedAmount(aAmount);
 #else
     *aAmount = 0;
     return NS_ERROR_NOT_AVAILABLE;
@@ -1411,17 +1465,6 @@ nsMemoryReporterManager::GetPageFaultsHard(int64_t* aAmount)
 #endif
 }
 
-NS_IMETHODIMP
-nsMemoryReporterManager::GetLargestContiguousVMBlock(int64_t* aAmount)
-{
-#ifdef HAVE_LARGEST_CONTIGUOUS_BLOCK_REPORTERS
-    return LargestContiguousVMBlock(aAmount);
-#else
-    *aAmount = 0;
-    return NS_ERROR_NOT_AVAILABLE;
-#endif
-}
-
 NS_IMETHODIMP
 nsMemoryReporterManager::GetHasMozMallocUsableSize(bool* aHas)
 {
@@ -1510,7 +1553,8 @@ NS_IMETHODIMP
 nsMemoryReporterManager::MinimizeMemoryUsage(nsIRunnable* aCallback,
                                              nsICancelableRunnable** aResult)
 {
-  NS_ENSURE_ARG_POINTER(aResult);
+  if (NS_WARN_IF(!aResult))
+    return NS_ERROR_INVALID_ARG;
 
   nsRefPtr<nsICancelableRunnable> runnable =
     new MinimizeMemoryUsageRunnable(aCallback);
@@ -1533,7 +1577,8 @@ nsMemoryReporterManager::SizeOfTab(nsIDOMWindow* aTopWindow,
 {
     nsCOMPtr<nsIGlobalObject> global = do_QueryInterface(aTopWindow);
     nsCOMPtr<nsPIDOMWindow> piWindow = do_QueryInterface(aTopWindow);
-    NS_ENSURE_TRUE(!!global && !!piWindow, NS_ERROR_FAILURE);
+    if (NS_WARN_IF(!global) || NS_WARN_IF(!piWindow))
+      return NS_ERROR_FAILURE;
 
     TimeStamp t1 = TimeStamp::Now();
 
@@ -1543,7 +1588,8 @@ nsMemoryReporterManager::SizeOfTab(nsIDOMWindow* aTopWindow,
     nsresult rv = mSizeOfTabFns.mJS(global->GetGlobalJSObject(),
                                     &jsObjectsSize, &jsStringsSize,
                                     &jsPrivateSize, &jsOtherSize);
-    NS_ENSURE_SUCCESS(rv, rv);
+    if (NS_WARN_IF(NS_FAILED(rv)))
+      return rv;
 
     TimeStamp t2 = TimeStamp::Now();
 
diff --git a/xpcom/base/nsMessageLoop.cpp b/xpcom/base/nsMessageLoop.cpp
index 0f1bd536e4e2..8ef4c17a39a2 100644
--- a/xpcom/base/nsMessageLoop.cpp
+++ b/xpcom/base/nsMessageLoop.cpp
@@ -87,7 +87,8 @@ nsresult
 MessageLoopIdleTask::Init(uint32_t aEnsureRunsAfterMS)
 {
   mTimer = do_CreateInstance("@mozilla.org/timer;1");
-  NS_ENSURE_STATE(mTimer);
+  if (NS_WARN_IF(!mTimer))
+    return NS_ERROR_UNEXPECTED;
 
   nsRefPtr<MessageLoopTimerCallback> callback =
     new MessageLoopTimerCallback(this);
@@ -153,7 +154,8 @@ nsMessageLoopConstructor(nsISupports* aOuter,
                          const nsIID& aIID,
                          void** aInstancePtr)
 {
-  NS_ENSURE_FALSE(aOuter, NS_ERROR_NO_AGGREGATION);
+  if (NS_WARN_IF(aOuter))
+    return NS_ERROR_NO_AGGREGATION;
   nsISupports* messageLoop = new nsMessageLoop();
   return messageLoop->QueryInterface(aIID, aInstancePtr);
 }
diff --git a/xpcom/base/nsSystemInfo.cpp b/xpcom/base/nsSystemInfo.cpp
index 9439092ee94f..0c32ac7901a5 100644
--- a/xpcom/base/nsSystemInfo.cpp
+++ b/xpcom/base/nsSystemInfo.cpp
@@ -165,7 +165,8 @@ nsSystemInfo::Init()
       if (PR_GetSystemInfo(items[i].cmd, buf, sizeof(buf)) == PR_SUCCESS) {
         rv = SetPropertyAsACString(NS_ConvertASCIItoUTF16(items[i].name),
                                    nsDependentCString(buf));
-        NS_ENSURE_SUCCESS(rv, rv);
+        if (NS_WARN_IF(NS_FAILED(rv)))
+          return rv;
       }
       else {
         NS_WARNING("PR_GetSystemInfo failed");
@@ -182,7 +183,8 @@ nsSystemInfo::Init()
     for (uint32_t i = 0; i < ArrayLength(cpuPropItems); i++) {
         rv = SetPropertyAsBool(NS_ConvertASCIItoUTF16(cpuPropItems[i].name),
                                cpuPropItems[i].propfun());
-        NS_ENSURE_SUCCESS(rv, rv);
+        if (NS_WARN_IF(NS_FAILED(rv)))
+          return rv;
     }
 
 #ifdef XP_WIN
@@ -191,7 +193,8 @@ nsSystemInfo::Init()
     NS_WARN_IF_FALSE(gotWow64Value, "IsWow64Process failed");
     if (gotWow64Value) {
       rv = SetPropertyAsBool(NS_LITERAL_STRING("isWow64"), !!isWow64);
-      NS_ENSURE_SUCCESS(rv, rv);
+      if (NS_WARN_IF(NS_FAILED(rv)))
+        return rv;
     }
     nsAutoCString hddModel, hddRevision;
     if (NS_SUCCEEDED(GetProfileHDDInfo(hddModel, hddRevision))) {
@@ -210,7 +213,8 @@ nsSystemInfo::Init()
       rv = SetPropertyAsACString(NS_LITERAL_STRING("secondaryLibrary"),
                                  nsDependentCString(gtkver));
       PR_smprintf_free(gtkver);
-      NS_ENSURE_SUCCESS(rv, rv);
+      if (NS_WARN_IF(NS_FAILED(rv)))
+        return rv;
     }
 #endif
 
diff --git a/xpcom/build/Omnijar.cpp b/xpcom/build/Omnijar.cpp
index 4d75c7ef7b55..3bc74178821a 100644
--- a/xpcom/build/Omnijar.cpp
+++ b/xpcom/build/Omnijar.cpp
@@ -145,7 +145,8 @@ Omnijar::GetURIString(Type aType, nsACString &result)
     nsAutoCString omniJarSpec;
     if (sPath[aType]) {
         nsresult rv = NS_GetURLSpecFromActualFile(sPath[aType], omniJarSpec);
-        NS_ENSURE_SUCCESS(rv, rv);
+        if (NS_WARN_IF(NS_FAILED(rv)))
+            return rv;
 
         result = "jar:";
         if (sIsNested[aType])
@@ -158,7 +159,8 @@ Omnijar::GetURIString(Type aType, nsACString &result)
         nsCOMPtr<nsIFile> dir;
         nsDirectoryService::gService->Get(SPROP(aType), NS_GET_IID(nsIFile), getter_AddRefs(dir));
         nsresult rv = NS_GetURLSpecFromActualFile(dir, result);
-        NS_ENSURE_SUCCESS(rv, rv);
+        if (NS_WARN_IF(NS_FAILED(rv)))
+            return rv;
     }
     result += "/";
     return NS_OK;
diff --git a/xpcom/build/nsXPCOMStrings.cpp b/xpcom/build/nsXPCOMStrings.cpp
index d5df93ac3215..02796a835b1e 100644
--- a/xpcom/build/nsXPCOMStrings.cpp
+++ b/xpcom/build/nsXPCOMStrings.cpp
@@ -40,7 +40,8 @@ NS_StringContainerInit2(nsStringContainer &aContainer,
   {
     if (aDataLength == UINT32_MAX)
     {
-      NS_ENSURE_ARG(!(aFlags & NS_STRING_CONTAINER_INIT_SUBSTRING));
+      if (NS_WARN_IF(aFlags & NS_STRING_CONTAINER_INIT_SUBSTRING))
+	return NS_ERROR_INVALID_ARG;
       aDataLength = nsCharTraits<PRUnichar>::length(aData);
     }
 
@@ -200,7 +201,8 @@ NS_CStringContainerInit2(nsCStringContainer &aContainer,
   {
     if (aDataLength == UINT32_MAX)
     {
-      NS_ENSURE_ARG(!(aFlags & NS_CSTRING_CONTAINER_INIT_SUBSTRING));
+      if (NS_WARN_IF(aFlags & NS_CSTRING_CONTAINER_INIT_SUBSTRING))
+	return NS_ERROR_INVALID_ARG;
       aDataLength = nsCharTraits<char>::length(aData);
     }
 
diff --git a/xpcom/build/nsXPComInit.cpp b/xpcom/build/nsXPComInit.cpp
index de58a8acd9e7..c3784f3f9724 100644
--- a/xpcom/build/nsXPComInit.cpp
+++ b/xpcom/build/nsXPComInit.cpp
@@ -219,7 +219,8 @@ nsThreadManagerGetSingleton(nsISupports* outer,
                             void* *aInstancePtr)
 {
     NS_ASSERTION(aInstancePtr, "null outptr");
-    NS_ENSURE_TRUE(!outer, NS_ERROR_NO_AGGREGATION);
+    if (NS_WARN_IF(outer))
+        return NS_ERROR_NO_AGGREGATION;
 
     return nsThreadManager::get()->QueryInterface(aIID, aInstancePtr);
 }
@@ -232,7 +233,8 @@ nsXPTIInterfaceInfoManagerGetSingleton(nsISupports* outer,
                                        void* *aInstancePtr)
 {
     NS_ASSERTION(aInstancePtr, "null outptr");
-    NS_ENSURE_TRUE(!outer, NS_ERROR_NO_AGGREGATION);
+    if (NS_WARN_IF(outer))
+        return NS_ERROR_NO_AGGREGATION;
 
     nsCOMPtr<nsIInterfaceInfoManager> iim
         (XPTInterfaceInfoManager::GetSingleton());
@@ -313,16 +315,16 @@ static nsIDebug* gDebug = nullptr;
 EXPORT_XPCOM_API(nsresult)
 NS_GetDebug(nsIDebug** result)
 {
-    return nsDebugImpl::Create(nullptr, 
-                               NS_GET_IID(nsIDebug), 
+    return nsDebugImpl::Create(nullptr,
+                               NS_GET_IID(nsIDebug),
                                (void**) result);
 }
 
 EXPORT_XPCOM_API(nsresult)
 NS_GetTraceRefcnt(nsITraceRefcnt** result)
 {
-    return nsTraceRefcntImpl::Create(nullptr, 
-                                     NS_GET_IID(nsITraceRefcnt), 
+    return nsTraceRefcntImpl::Create(nullptr,
+                                     NS_GET_IID(nsITraceRefcnt),
                                      (void**) result);
 }
 
@@ -411,38 +413,38 @@ NS_InitXPCOM2(nsIServiceManager* *result,
 
     if (!AtExitManager::AlreadyRegistered()) {
         sExitManager = new AtExitManager();
-        NS_ENSURE_STATE(sExitManager);
     }
 
     if (!MessageLoop::current()) {
         sMessageLoop = new MessageLoopForUI(MessageLoop::TYPE_MOZILLA_UI);
-        NS_ENSURE_STATE(sMessageLoop);
     }
 
     if (XRE_GetProcessType() == GeckoProcessType_Default &&
         !BrowserProcessSubThread::GetMessageLoop(BrowserProcessSubThread::IO)) {
         scoped_ptr<BrowserProcessSubThread> ioThread(
             new BrowserProcessSubThread(BrowserProcessSubThread::IO));
-        NS_ENSURE_TRUE(ioThread.get(), NS_ERROR_OUT_OF_MEMORY);
 
         base::Thread::Options options;
         options.message_loop_type = MessageLoop::TYPE_IO;
-        NS_ENSURE_TRUE(ioThread->StartWithOptions(options), NS_ERROR_FAILURE);
+        if (NS_WARN_IF(!ioThread->StartWithOptions(options)))
+            return NS_ERROR_FAILURE;
 
         sIOThread = ioThread.release();
     }
 
     // Establish the main thread here.
     rv = nsThreadManager::get()->Init();
-    if (NS_FAILED(rv)) return rv;
+    if (NS_WARN_IF(NS_FAILED(rv)))
+        return rv;
 
     // Set up the timer globals/timer thread
     rv = nsTimerImpl::Startup();
-    NS_ENSURE_SUCCESS(rv, rv);
+    if (NS_WARN_IF(NS_FAILED(rv)))
+        return rv;
 
 #ifndef ANDROID
     // If the locale hasn't already been setup by our embedder,
-    // get us out of the "C" locale and into the system 
+    // get us out of the "C" locale and into the system
     if (strcmp(setlocale(LC_ALL, nullptr), "C") == 0)
         setlocale(LC_ALL, "");
 #endif
@@ -493,18 +495,21 @@ NS_InitXPCOM2(nsIServiceManager* *result,
         CommandLine::Init(0, nullptr);
 #else
         nsCOMPtr<nsIFile> binaryFile;
-        nsDirectoryService::gService->Get(NS_XPCOM_CURRENT_PROCESS_DIR, 
-                                          NS_GET_IID(nsIFile), 
+        nsDirectoryService::gService->Get(NS_XPCOM_CURRENT_PROCESS_DIR,
+                                          NS_GET_IID(nsIFile),
                                           getter_AddRefs(binaryFile));
-        NS_ENSURE_STATE(binaryFile);
-        
+        if (NS_WARN_IF(!binaryFile))
+            return NS_ERROR_FAILURE;
+
         rv = binaryFile->AppendNative(NS_LITERAL_CSTRING("nonexistent-executable"));
-        NS_ENSURE_SUCCESS(rv, rv);
-        
+        if (NS_WARN_IF(NS_FAILED(rv)))
+            return rv;
+
         nsCString binaryPath;
         rv = binaryFile->GetNativePath(binaryPath);
-        NS_ENSURE_SUCCESS(rv, rv);
-        
+        if (NS_WARN_IF(NS_FAILED(rv)))
+            return rv;
+
         static char const *const argv = { strdup(binaryPath.get()) };
         CommandLine::Init(1, &argv);
 #endif
@@ -568,7 +573,7 @@ NS_InitXPCOM2(nsIServiceManager* *result,
     mozilla::AvailableMemoryTracker::Activate();
 
     // Notify observers of xpcom autoregistration start
-    NS_CreateServicesFromCategory(NS_XPCOM_STARTUP_CATEGORY, 
+    NS_CreateServicesFromCategory(NS_XPCOM_STARTUP_CATEGORY,
                                   nullptr,
                                   NS_XPCOM_STARTUP_OBSERVER_ID);
 #ifdef XP_WIN
@@ -626,7 +631,9 @@ ShutdownXPCOM(nsIServiceManager* servMgr)
     // Make sure the hang monitor is enabled for shutdown.
     HangMonitor::NotifyActivity();
 
-    NS_ENSURE_STATE(NS_IsMainThread());
+    if (!NS_IsMainThread()) {
+        NS_RUNTIMEABORT("Shutdown on wrong thread");
+    }
 
     nsresult rv;
     nsCOMPtr<nsISimpleEnumerator> moduleLoaders;
@@ -637,7 +644,8 @@ ShutdownXPCOM(nsIServiceManager* servMgr)
         // servicemanager shutdown
 
         nsCOMPtr<nsIThread> thread = do_GetCurrentThread();
-        NS_ENSURE_STATE(thread);
+        if (NS_WARN_IF(!thread))
+            return NS_ERROR_UNEXPECTED;
 
         nsRefPtr<nsObserverService> observerService;
         CallGetService("@mozilla.org/observer-service;1",
diff --git a/xpcom/build/perfprobe.cpp b/xpcom/build/perfprobe.cpp
index f74eb978e829..6c584b50c5a0 100644
--- a/xpcom/build/perfprobe.cpp
+++ b/xpcom/build/perfprobe.cpp
@@ -213,7 +213,8 @@ nsresult ProbeManager::StartSession(nsTArray<nsRefPtr<Probe>> &aProbes)
                       used only for unregistration*/
                      );
   delete[] probes;
-  NS_ENSURE_TRUE(result == ERROR_SUCCESS, NS_ERROR_UNEXPECTED);
+  if (NS_WARN_IF(result != ERROR_SUCCESS))
+    return NS_ERROR_UNEXPECTED;
   return NS_OK;
 }
 
diff --git a/xpcom/components/nsCategoryManager.cpp b/xpcom/components/nsCategoryManager.cpp
index b35dc180665a..6e2b43a635a7 100644
--- a/xpcom/components/nsCategoryManager.cpp
+++ b/xpcom/components/nsCategoryManager.cpp
@@ -299,7 +299,8 @@ CategoryNode::DeleteLeaf(const char* aEntryName)
 NS_METHOD 
 CategoryNode::Enumerate(nsISimpleEnumerator **_retval)
 {
-  NS_ENSURE_ARG_POINTER(_retval);
+  if (NS_WARN_IF(!_retval))
+    return NS_ERROR_INVALID_ARG;
 
   MutexAutoLock lock(mLock);
   EntryEnumerator* enumObj = EntryEnumerator::Create(mTable);
@@ -593,9 +594,10 @@ nsCategoryManager::GetCategoryEntry( const char *aCategoryName,
                                      const char *aEntryName,
                                      char **_retval )
 {
-  NS_ENSURE_ARG_POINTER(aCategoryName);
-  NS_ENSURE_ARG_POINTER(aEntryName);
-  NS_ENSURE_ARG_POINTER(_retval);
+  if (NS_WARN_IF(!aCategoryName) ||
+      NS_WARN_IF(!aEntryName) ||
+      NS_WARN_IF(!_retval))
+    return NS_ERROR_INVALID_ARG;;
 
   nsresult status = NS_ERROR_NOT_AVAILABLE;
 
@@ -687,8 +689,9 @@ nsCategoryManager::DeleteCategoryEntry( const char *aCategoryName,
                                         const char *aEntryName,
                                         bool aDontPersist)
 {
-  NS_ENSURE_ARG_POINTER(aCategoryName);
-  NS_ENSURE_ARG_POINTER(aEntryName);
+  if (NS_WARN_IF(!aCategoryName) ||
+      NS_WARN_IF(!aEntryName))
+    return NS_ERROR_INVALID_ARG;
 
   /*
     Note: no errors are reported since failure to delete
@@ -715,7 +718,8 @@ nsCategoryManager::DeleteCategoryEntry( const char *aCategoryName,
 NS_IMETHODIMP
 nsCategoryManager::DeleteCategory( const char *aCategoryName )
 {
-  NS_ENSURE_ARG_POINTER(aCategoryName);
+  if (NS_WARN_IF(!aCategoryName))
+    return NS_ERROR_INVALID_ARG;
 
   // the categories are arena-allocated, so we don't
   // actually delete them. We just remove all of the
@@ -740,8 +744,9 @@ NS_IMETHODIMP
 nsCategoryManager::EnumerateCategory( const char *aCategoryName,
                                       nsISimpleEnumerator **_retval )
 {
-  NS_ENSURE_ARG_POINTER(aCategoryName);
-  NS_ENSURE_ARG_POINTER(_retval);
+  if (NS_WARN_IF(!aCategoryName) ||
+      NS_WARN_IF(!_retval))
+    return NS_ERROR_INVALID_ARG;
 
   CategoryNode* category;
   {
@@ -759,7 +764,8 @@ nsCategoryManager::EnumerateCategory( const char *aCategoryName,
 NS_IMETHODIMP 
 nsCategoryManager::EnumerateCategories(nsISimpleEnumerator **_retval)
 {
-  NS_ENSURE_ARG_POINTER(_retval);
+  if (NS_WARN_IF(!_retval))
+    return NS_ERROR_INVALID_ARG;
 
   MutexAutoLock lock(mLock);
   CategoryEnumerator* enumObj = CategoryEnumerator::Create(mTable);
diff --git a/xpcom/components/nsComponentManager.cpp b/xpcom/components/nsComponentManager.cpp
index 0d27e9f17f82..af51024ac798 100644
--- a/xpcom/components/nsComponentManager.cpp
+++ b/xpcom/components/nsComponentManager.cpp
@@ -932,8 +932,9 @@ nsComponentManagerImpl::GetClassObjectByContractID(const char *contractID,
                                                    const nsIID &aIID,
                                                    void **aResult)
 {
-    NS_ENSURE_ARG_POINTER(aResult);
-    NS_ENSURE_ARG_POINTER(contractID);
+    if (NS_WARN_IF(!aResult) ||
+        NS_WARN_IF(!contractID))
+        return NS_ERROR_INVALID_ARG;
 
     nsresult rv;
 
@@ -1052,7 +1053,8 @@ nsComponentManagerImpl::CreateInstanceByContractID(const char *aContractID,
                                                    const nsIID &aIID,
                                                    void **aResult)
 {
-    NS_ENSURE_ARG_POINTER(aContractID);
+    if (NS_WARN_IF(!aContractID))
+        return NS_ERROR_INVALID_ARG;
 
     // test this first, since there's no point in creating a component during
     // shutdown -- whether it's available or not would depend on the order it
@@ -1607,7 +1609,9 @@ NS_IMETHODIMP
 nsComponentManagerImpl::IsContractIDRegistered(const char *aClass,
                                                bool *_retval)
 {
-    NS_ENSURE_ARG_POINTER(aClass);
+    if (NS_WARN_IF(!aClass))
+        return NS_ERROR_INVALID_ARG;
+
     nsFactoryEntry *entry = GetFactoryEntry(aClass, strlen(aClass));
 
     if (entry)
diff --git a/xpcom/ds/nsHashPropertyBag.cpp b/xpcom/ds/nsHashPropertyBag.cpp
index 29ea0c8c3eb1..9f60de99aedc 100644
--- a/xpcom/ds/nsHashPropertyBag.cpp
+++ b/xpcom/ds/nsHashPropertyBag.cpp
@@ -64,7 +64,8 @@ nsHashPropertyBag::GetProperty(const nsAString& name, nsIVariant* *_retval)
 NS_IMETHODIMP
 nsHashPropertyBag::SetProperty(const nsAString& name, nsIVariant *value)
 {
-    NS_ENSURE_ARG_POINTER(value);
+    if (NS_WARN_IF(!value))
+        return NS_ERROR_INVALID_ARG;
 
     mPropertyHash.Put(name, value);
 
diff --git a/xpcom/ds/nsINIParserImpl.cpp b/xpcom/ds/nsINIParserImpl.cpp
index 1e4421436378..86d6241356c1 100644
--- a/xpcom/ds/nsINIParserImpl.cpp
+++ b/xpcom/ds/nsINIParserImpl.cpp
@@ -51,7 +51,8 @@ nsINIParserFactory::CreateInstance(nsISupports* aOuter,
                                    REFNSIID aIID,
                                    void **aResult)
 {
-  NS_ENSURE_NO_AGGREGATION(aOuter);
+  if (NS_WARN_IF(aOuter))
+    return NS_ERROR_NO_AGGREGATION;
 
   // We are our own singleton.
   return QueryInterface(aIID, aResult);
diff --git a/xpcom/ds/nsObserverService.cpp b/xpcom/ds/nsObserverService.cpp
index b62b5d188531..f79fc75505b9 100644
--- a/xpcom/ds/nsObserverService.cpp
+++ b/xpcom/ds/nsObserverService.cpp
@@ -150,7 +150,8 @@ ObserverServiceReporter::CollectReports(nsIMemoryReporterCallback* cb,
                                "respect to the number of windows."),
             aClosure);
 
-        NS_ENSURE_SUCCESS(rv, rv);
+      if (NS_WARN_IF(NS_FAILED(rv)))
+          return rv;
     }
 
     rv = cb->Callback(/* process */ EmptyCString(),
@@ -162,7 +163,8 @@ ObserverServiceReporter::CollectReports(nsIMemoryReporterCallback* cb,
                            "observer service."),
         aClosure);
 
-    NS_ENSURE_SUCCESS(rv, rv);
+    if (NS_WARN_IF(NS_FAILED(rv)))
+        return rv;
 
     rv = cb->Callback(/* process */ EmptyCString(),
         NS_LITERAL_CSTRING("observer-service/referent/weak/alive"),
@@ -173,7 +175,8 @@ ObserverServiceReporter::CollectReports(nsIMemoryReporterCallback* cb,
                            "observer service that are still alive."),
         aClosure);
 
-    NS_ENSURE_SUCCESS(rv, rv);
+    if (NS_WARN_IF(NS_FAILED(rv)))
+        return rv;
 
     rv = cb->Callback(/* process */ EmptyCString(),
         NS_LITERAL_CSTRING("observer-service/referent/weak/dead"),
@@ -184,7 +187,8 @@ ObserverServiceReporter::CollectReports(nsIMemoryReporterCallback* cb,
                            "observer service that are dead."),
         aClosure);
 
-    NS_ENSURE_SUCCESS(rv, rv);
+    if (NS_WARN_IF(NS_FAILED(rv)))
+        return rv;
 
     return NS_OK;
 }
@@ -266,7 +270,8 @@ nsObserverService::AddObserver(nsIObserver* anObserver, const char* aTopic,
          (void*) anObserver, aTopic));
 
     NS_ENSURE_VALIDCALL
-    NS_ENSURE_ARG(anObserver && aTopic);
+    if (NS_WARN_IF(!anObserver) || NS_WARN_IF(!aTopic))
+        return NS_ERROR_INVALID_ARG;
 
     if (mozilla::net::IsNeckoChild() && !strncmp(aTopic, "http-on-", 8)) {
       return NS_ERROR_NOT_IMPLEMENTED;
@@ -285,7 +290,8 @@ nsObserverService::RemoveObserver(nsIObserver* anObserver, const char* aTopic)
     LOG(("nsObserverService::RemoveObserver(%p: %s)",
          (void*) anObserver, aTopic));
     NS_ENSURE_VALIDCALL
-    NS_ENSURE_ARG(anObserver && aTopic);
+    if (NS_WARN_IF(!anObserver) || NS_WARN_IF(!aTopic))
+        return NS_ERROR_INVALID_ARG;
 
     nsObserverList *observerList = mObserverTopicTable.GetEntry(aTopic);
     if (!observerList)
@@ -302,7 +308,8 @@ nsObserverService::EnumerateObservers(const char* aTopic,
                                       nsISimpleEnumerator** anEnumerator)
 {
     NS_ENSURE_VALIDCALL
-    NS_ENSURE_ARG(aTopic && anEnumerator);
+    if (NS_WARN_IF(!anEnumerator) || NS_WARN_IF(!aTopic))
+        return NS_ERROR_INVALID_ARG;
 
     nsObserverList *observerList = mObserverTopicTable.GetEntry(aTopic);
     if (!observerList)
@@ -319,7 +326,8 @@ NS_IMETHODIMP nsObserverService::NotifyObservers(nsISupports *aSubject,
     LOG(("nsObserverService::NotifyObservers(%s)", aTopic));
 
     NS_ENSURE_VALIDCALL
-    NS_ENSURE_ARG(aTopic);
+    if (NS_WARN_IF(!aTopic))
+        return NS_ERROR_INVALID_ARG;
 
     nsObserverList *observerList = mObserverTopicTable.GetEntry(aTopic);
     if (observerList)
diff --git a/xpcom/ds/nsProperties.cpp b/xpcom/ds/nsProperties.cpp
index 27d1f28779e4..8df2e9445c82 100644
--- a/xpcom/ds/nsProperties.cpp
+++ b/xpcom/ds/nsProperties.cpp
@@ -15,7 +15,8 @@ NS_INTERFACE_MAP_END
 NS_IMETHODIMP
 nsProperties::Get(const char* prop, const nsIID & uuid, void* *result)
 {
-    NS_ENSURE_ARG(prop);
+    if (NS_WARN_IF(!prop))
+        return NS_ERROR_INVALID_ARG;
 
     nsCOMPtr<nsISupports> value;
     if (!nsProperties_HashBase::Get(prop, getter_AddRefs(value))) {
@@ -27,7 +28,8 @@ nsProperties::Get(const char* prop, const nsIID & uuid, void* *result)
 NS_IMETHODIMP
 nsProperties::Set(const char* prop, nsISupports* value)
 {
-    NS_ENSURE_ARG(prop);
+    if (NS_WARN_IF(!prop))
+        return NS_ERROR_INVALID_ARG;
     Put(prop, value);
     return NS_OK;
 }
@@ -35,7 +37,8 @@ nsProperties::Set(const char* prop, nsISupports* value)
 NS_IMETHODIMP
 nsProperties::Undefine(const char* prop)
 {
-    NS_ENSURE_ARG(prop);
+    if (NS_WARN_IF(!prop))
+        return NS_ERROR_INVALID_ARG;
 
     nsCOMPtr<nsISupports> value;
     if (!nsProperties_HashBase::Get(prop, getter_AddRefs(value)))
@@ -48,7 +51,8 @@ nsProperties::Undefine(const char* prop)
 NS_IMETHODIMP
 nsProperties::Has(const char* prop, bool *result)
 {
-    NS_ENSURE_ARG(prop);
+    if (NS_WARN_IF(!prop))
+        return NS_ERROR_INVALID_ARG;
 
     nsCOMPtr<nsISupports> value;
     *result = nsProperties_HashBase::Get(prop,
@@ -82,12 +86,11 @@ GetKeysEnumerate(const char *key, nsISupports* data,
 NS_IMETHODIMP 
 nsProperties::GetKeys(uint32_t *count, char ***keys)
 {
-    NS_ENSURE_ARG(count);
-    NS_ENSURE_ARG(keys);
+    if (NS_WARN_IF(!count) || NS_WARN_IF(!keys))
+        return NS_ERROR_INVALID_ARG;
 
     uint32_t n = Count();
     char ** k = (char **) nsMemory::Alloc(n * sizeof(char *));
-    NS_ENSURE_TRUE(k, NS_ERROR_OUT_OF_MEMORY);
 
     GetKeysEnumData gked;
     gked.keys = k;
diff --git a/xpcom/ds/nsStringEnumerator.cpp b/xpcom/ds/nsStringEnumerator.cpp
index c71bd5cebbed..8af283354602 100644
--- a/xpcom/ds/nsStringEnumerator.cpp
+++ b/xpcom/ds/nsStringEnumerator.cpp
@@ -84,7 +84,6 @@ NS_IMPL_ISUPPORTS3(nsStringEnumerator,
 NS_IMETHODIMP
 nsStringEnumerator::HasMore(bool* aResult)
 {
-    NS_ENSURE_ARG_POINTER(aResult);
     *aResult = mIndex < Count();
     return NS_OK;
 }
@@ -119,7 +118,8 @@ nsStringEnumerator::GetNext(nsISupports** aResult)
 NS_IMETHODIMP
 nsStringEnumerator::GetNext(nsAString& aResult)
 {
-    NS_ENSURE_TRUE(mIndex < Count(), NS_ERROR_UNEXPECTED);
+    if (NS_WARN_IF(mIndex >= Count()))
+        return NS_ERROR_UNEXPECTED;
 
     if (mIsUnicode)
         aResult = mArray->ElementAt(mIndex++);
@@ -132,7 +132,8 @@ nsStringEnumerator::GetNext(nsAString& aResult)
 NS_IMETHODIMP
 nsStringEnumerator::GetNext(nsACString& aResult)
 {
-    NS_ENSURE_TRUE(mIndex < Count(), NS_ERROR_UNEXPECTED);
+    if (NS_WARN_IF(mIndex >= Count()))
+        return NS_ERROR_UNEXPECTED;
     
     if (mIsUnicode)
         CopyUTF16toUTF8(mArray->ElementAt(mIndex++), aResult);
@@ -160,8 +161,8 @@ nsresult
 NS_NewStringEnumerator(nsIStringEnumerator** aResult,
                        const nsTArray<nsString>* aArray, nsISupports* aOwner)
 {
-    NS_ENSURE_ARG_POINTER(aResult);
-    NS_ENSURE_ARG_POINTER(aArray);
+    if (NS_WARN_IF(!aResult) || NS_WARN_IF(!aArray))
+        return NS_ERROR_INVALID_ARG;
     
     *aResult = new nsStringEnumerator(aArray, aOwner);
     return StringEnumeratorTail(aResult);
@@ -172,8 +173,8 @@ nsresult
 NS_NewUTF8StringEnumerator(nsIUTF8StringEnumerator** aResult,
                            const nsTArray<nsCString>* aArray, nsISupports* aOwner)
 {
-    NS_ENSURE_ARG_POINTER(aResult);
-    NS_ENSURE_ARG_POINTER(aArray);
+    if (NS_WARN_IF(!aResult) || NS_WARN_IF(!aArray))
+        return NS_ERROR_INVALID_ARG;
     
     *aResult = new nsStringEnumerator(aArray, aOwner);
     return StringEnumeratorTail(aResult);
@@ -183,8 +184,8 @@ nsresult
 NS_NewAdoptingStringEnumerator(nsIStringEnumerator** aResult,
                                nsTArray<nsString>* aArray)
 {
-    NS_ENSURE_ARG_POINTER(aResult);
-    NS_ENSURE_ARG_POINTER(aArray);
+    if (NS_WARN_IF(!aResult) || NS_WARN_IF(!aArray))
+        return NS_ERROR_INVALID_ARG;
     
     *aResult = new nsStringEnumerator(aArray, true);
     return StringEnumeratorTail(aResult);
@@ -194,8 +195,8 @@ nsresult
 NS_NewAdoptingUTF8StringEnumerator(nsIUTF8StringEnumerator** aResult,
                                    nsTArray<nsCString>* aArray)
 {
-    NS_ENSURE_ARG_POINTER(aResult);
-    NS_ENSURE_ARG_POINTER(aArray);
+    if (NS_WARN_IF(!aResult) || NS_WARN_IF(!aArray))
+        return NS_ERROR_INVALID_ARG;
     
     *aResult = new nsStringEnumerator(aArray, true);
     return StringEnumeratorTail(aResult);
@@ -206,8 +207,8 @@ nsresult
 NS_NewStringEnumerator(nsIStringEnumerator** aResult,
                        const nsTArray<nsString>* aArray)
 {
-    NS_ENSURE_ARG_POINTER(aResult);
-    NS_ENSURE_ARG_POINTER(aArray);
+    if (NS_WARN_IF(!aResult) || NS_WARN_IF(!aArray))
+        return NS_ERROR_INVALID_ARG;
     
     *aResult = new nsStringEnumerator(aArray, false);
     return StringEnumeratorTail(aResult);
@@ -217,8 +218,8 @@ nsresult
 NS_NewUTF8StringEnumerator(nsIUTF8StringEnumerator** aResult,
                            const nsTArray<nsCString>* aArray)
 {
-    NS_ENSURE_ARG_POINTER(aResult);
-    NS_ENSURE_ARG_POINTER(aArray);
+    if (NS_WARN_IF(!aResult) || NS_WARN_IF(!aArray))
+        return NS_ERROR_INVALID_ARG;
     
     *aResult = new nsStringEnumerator(aArray, false);
     return StringEnumeratorTail(aResult);
diff --git a/xpcom/ds/nsSupportsArray.cpp b/xpcom/ds/nsSupportsArray.cpp
index 176c73cf28d5..1c742f0eff6e 100644
--- a/xpcom/ds/nsSupportsArray.cpp
+++ b/xpcom/ds/nsSupportsArray.cpp
@@ -585,7 +585,8 @@ nsSupportsArray::Clone(nsISupportsArray** aResult)
 {
   nsCOMPtr<nsISupportsArray> newArray;
   nsresult rv = NS_NewISupportsArray(getter_AddRefs(newArray));
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
 
   uint32_t count = 0;
   Count(&count);
diff --git a/xpcom/ds/nsSupportsPrimitives.cpp b/xpcom/ds/nsSupportsPrimitives.cpp
index a5c4f1d6146d..fb6d61427fa8 100644
--- a/xpcom/ds/nsSupportsPrimitives.cpp
+++ b/xpcom/ds/nsSupportsPrimitives.cpp
@@ -810,7 +810,8 @@ nsSupportsDependentCString::nsSupportsDependentCString(const char* aStr)
 NS_IMETHODIMP
 nsSupportsDependentCString::GetType(uint16_t *aType)
 {
-    NS_ENSURE_ARG_POINTER(aType);
+    if (NS_WARN_IF(!aType))
+        return NS_ERROR_INVALID_ARG;
 
     *aType = TYPE_CSTRING;
     return NS_OK;
@@ -826,7 +827,8 @@ nsSupportsDependentCString::GetData(nsACString& aData)
 NS_IMETHODIMP
 nsSupportsDependentCString::ToString(char **_retval)
 {
-    NS_ENSURE_ARG_POINTER(_retval);
+    if (NS_WARN_IF(!_retval))
+        return NS_ERROR_INVALID_ARG;
 
     *_retval = ToNewCString(mData);
     if (!*_retval)
diff --git a/xpcom/ds/nsWindowsRegKey.cpp b/xpcom/ds/nsWindowsRegKey.cpp
index 524e382061b9..25b51b4e79b9 100644
--- a/xpcom/ds/nsWindowsRegKey.cpp
+++ b/xpcom/ds/nsWindowsRegKey.cpp
@@ -103,7 +103,8 @@ NS_IMETHODIMP
 nsWindowsRegKey::OpenChild(const nsAString &path, uint32_t mode,
                            nsIWindowsRegKey **result)
 {
-  NS_ENSURE_TRUE(mKey, NS_ERROR_NOT_INITIALIZED);
+  if (NS_WARN_IF(!mKey))
+    return NS_ERROR_NOT_INITIALIZED;
 
   nsCOMPtr<nsIWindowsRegKey> child = new nsWindowsRegKey();
   
@@ -119,7 +120,8 @@ NS_IMETHODIMP
 nsWindowsRegKey::CreateChild(const nsAString &path, uint32_t mode,
                              nsIWindowsRegKey **result)
 {
-  NS_ENSURE_TRUE(mKey, NS_ERROR_NOT_INITIALIZED);
+  if (NS_WARN_IF(!mKey))
+    return NS_ERROR_NOT_INITIALIZED;
 
   nsCOMPtr<nsIWindowsRegKey> child = new nsWindowsRegKey();
   
@@ -134,13 +136,15 @@ nsWindowsRegKey::CreateChild(const nsAString &path, uint32_t mode,
 NS_IMETHODIMP
 nsWindowsRegKey::GetChildCount(uint32_t *result)
 {
-  NS_ENSURE_TRUE(mKey, NS_ERROR_NOT_INITIALIZED);
+  if (NS_WARN_IF(!mKey))
+    return NS_ERROR_NOT_INITIALIZED;
 
   DWORD numSubKeys;
   LONG rv = RegQueryInfoKeyW(mKey, nullptr, nullptr, nullptr, &numSubKeys,
                              nullptr, nullptr, nullptr, nullptr, nullptr,
                              nullptr, nullptr);
-  NS_ENSURE_STATE(rv == ERROR_SUCCESS);
+  if (rv != ERROR_SUCCESS)
+    return NS_ERROR_FAILURE;
 
   *result = numSubKeys;
   return NS_OK;
@@ -149,7 +153,8 @@ nsWindowsRegKey::GetChildCount(uint32_t *result)
 NS_IMETHODIMP
 nsWindowsRegKey::GetChildName(uint32_t index, nsAString &result)
 {
-  NS_ENSURE_TRUE(mKey, NS_ERROR_NOT_INITIALIZED);
+  if (NS_WARN_IF(!mKey))
+    return NS_ERROR_NOT_INITIALIZED;
 
   FILETIME lastWritten;
 
@@ -169,7 +174,8 @@ nsWindowsRegKey::GetChildName(uint32_t index, nsAString &result)
 NS_IMETHODIMP
 nsWindowsRegKey::HasChild(const nsAString &name, bool *result)
 {
-  NS_ENSURE_TRUE(mKey, NS_ERROR_NOT_INITIALIZED);
+  if (NS_WARN_IF(!mKey))
+    return NS_ERROR_NOT_INITIALIZED;
 
   // Check for the existence of a child key by opening the key with minimal
   // rights.  Perhaps there is a more efficient way to do this?
@@ -187,13 +193,15 @@ nsWindowsRegKey::HasChild(const nsAString &name, bool *result)
 NS_IMETHODIMP
 nsWindowsRegKey::GetValueCount(uint32_t *result)
 {
-  NS_ENSURE_TRUE(mKey, NS_ERROR_NOT_INITIALIZED);
+  if (NS_WARN_IF(!mKey))
+    return NS_ERROR_NOT_INITIALIZED;
 
   DWORD numValues;
   LONG rv = RegQueryInfoKeyW(mKey, nullptr, nullptr, nullptr, nullptr,
                              nullptr, nullptr, &numValues, nullptr, nullptr,
                              nullptr, nullptr);
-  NS_ENSURE_STATE(rv == ERROR_SUCCESS);
+  if (rv != ERROR_SUCCESS)
+    return NS_ERROR_FAILURE;
 
   *result = numValues;
   return NS_OK;
@@ -202,7 +210,8 @@ nsWindowsRegKey::GetValueCount(uint32_t *result)
 NS_IMETHODIMP
 nsWindowsRegKey::GetValueName(uint32_t index, nsAString &result)
 {
-  NS_ENSURE_TRUE(mKey, NS_ERROR_NOT_INITIALIZED);
+  if (NS_WARN_IF(!mKey))
+    return NS_ERROR_NOT_INITIALIZED;
 
   PRUnichar nameBuf[MAX_VALUE_NAME_LEN];
   DWORD nameLen = sizeof(nameBuf) / sizeof(nameBuf[0]);
@@ -220,7 +229,8 @@ nsWindowsRegKey::GetValueName(uint32_t index, nsAString &result)
 NS_IMETHODIMP
 nsWindowsRegKey::HasValue(const nsAString &name, bool *result)
 {
-  NS_ENSURE_TRUE(mKey, NS_ERROR_NOT_INITIALIZED);
+  if (NS_WARN_IF(!mKey))
+    return NS_ERROR_NOT_INITIALIZED;
 
   LONG rv = RegQueryValueExW(mKey, PromiseFlatString(name).get(), 0, nullptr,
                              nullptr, nullptr);
@@ -232,7 +242,8 @@ nsWindowsRegKey::HasValue(const nsAString &name, bool *result)
 NS_IMETHODIMP
 nsWindowsRegKey::RemoveChild(const nsAString &name)
 {
-  NS_ENSURE_TRUE(mKey, NS_ERROR_NOT_INITIALIZED);
+  if (NS_WARN_IF(!mKey))
+    return NS_ERROR_NOT_INITIALIZED;
 
   LONG rv = RegDeleteKeyW(mKey, PromiseFlatString(name).get());
 
@@ -242,7 +253,8 @@ nsWindowsRegKey::RemoveChild(const nsAString &name)
 NS_IMETHODIMP
 nsWindowsRegKey::RemoveValue(const nsAString &name)
 {
-  NS_ENSURE_TRUE(mKey, NS_ERROR_NOT_INITIALIZED);
+  if (NS_WARN_IF(!mKey))
+    return NS_ERROR_NOT_INITIALIZED;
 
   LONG rv = RegDeleteValueW(mKey, PromiseFlatString(name).get());
 
@@ -252,7 +264,8 @@ nsWindowsRegKey::RemoveValue(const nsAString &name)
 NS_IMETHODIMP
 nsWindowsRegKey::GetValueType(const nsAString &name, uint32_t *result)
 {
-  NS_ENSURE_TRUE(mKey, NS_ERROR_NOT_INITIALIZED);
+  if (NS_WARN_IF(!mKey))
+    return NS_ERROR_NOT_INITIALIZED;
 
   LONG rv = RegQueryValueExW(mKey, PromiseFlatString(name).get(), 0,
                              (LPDWORD) result, nullptr, nullptr);
@@ -263,7 +276,8 @@ nsWindowsRegKey::GetValueType(const nsAString &name, uint32_t *result)
 NS_IMETHODIMP
 nsWindowsRegKey::ReadStringValue(const nsAString &name, nsAString &result)
 {
-  NS_ENSURE_TRUE(mKey, NS_ERROR_NOT_INITIALIZED);
+  if (NS_WARN_IF(!mKey))
+    return NS_ERROR_NOT_INITIALIZED;
 
   DWORD type, size;
 
@@ -275,12 +289,12 @@ nsWindowsRegKey::ReadStringValue(const nsAString &name, nsAString &result)
 
   // This must be a string type in order to fetch the value as a string.
   // We're being a bit forgiving here by allowing types other than REG_SZ.
-  NS_ENSURE_STATE(type == REG_SZ ||
-                  type == REG_EXPAND_SZ ||
-                  type == REG_MULTI_SZ);
+  if (type != REG_SZ && type == REG_EXPAND_SZ && type == REG_MULTI_SZ)
+    return NS_ERROR_FAILURE;
 
   // The buffer size must be a multiple of 2.
-  NS_ENSURE_STATE(size % 2 == 0);
+  if (size % 2 != 0)
+    return NS_ERROR_UNEXPECTED;
 
   if (size == 0) {
     result.Truncate();
@@ -337,7 +351,8 @@ nsWindowsRegKey::ReadStringValue(const nsAString &name, nsAString &result)
 NS_IMETHODIMP
 nsWindowsRegKey::ReadIntValue(const nsAString &name, uint32_t *result)
 {
-  NS_ENSURE_TRUE(mKey, NS_ERROR_NOT_INITIALIZED);
+  if (NS_WARN_IF(!mKey))
+    return NS_ERROR_NOT_INITIALIZED;
 
   DWORD size = sizeof(*result);
   LONG rv = RegQueryValueExW(mKey, PromiseFlatString(name).get(), 0, nullptr,
@@ -349,7 +364,8 @@ nsWindowsRegKey::ReadIntValue(const nsAString &name, uint32_t *result)
 NS_IMETHODIMP
 nsWindowsRegKey::ReadInt64Value(const nsAString &name, uint64_t *result)
 {
-  NS_ENSURE_TRUE(mKey, NS_ERROR_NOT_INITIALIZED);
+  if (NS_WARN_IF(!mKey))
+    return NS_ERROR_NOT_INITIALIZED;
 
   DWORD size = sizeof(*result);
   LONG rv = RegQueryValueExW(mKey, PromiseFlatString(name).get(), 0, nullptr,
@@ -361,7 +377,8 @@ nsWindowsRegKey::ReadInt64Value(const nsAString &name, uint64_t *result)
 NS_IMETHODIMP
 nsWindowsRegKey::ReadBinaryValue(const nsAString &name, nsACString &result)
 {
-  NS_ENSURE_TRUE(mKey, NS_ERROR_NOT_INITIALIZED);
+  if (NS_WARN_IF(!mKey))
+    return NS_ERROR_NOT_INITIALIZED;
 
   DWORD size;
   LONG rv = RegQueryValueExW(mKey, PromiseFlatString(name).get(), 0,
@@ -385,7 +402,8 @@ nsWindowsRegKey::ReadBinaryValue(const nsAString &name, nsACString &result)
 NS_IMETHODIMP
 nsWindowsRegKey::WriteStringValue(const nsAString &name, const nsAString &value)
 {
-  NS_ENSURE_TRUE(mKey, NS_ERROR_NOT_INITIALIZED);
+  if (NS_WARN_IF(!mKey))
+    return NS_ERROR_NOT_INITIALIZED;
 
   // Need to indicate complete size of buffer including null terminator.
   const nsString &flatValue = PromiseFlatString(value);
@@ -400,7 +418,8 @@ nsWindowsRegKey::WriteStringValue(const nsAString &name, const nsAString &value)
 NS_IMETHODIMP
 nsWindowsRegKey::WriteIntValue(const nsAString &name, uint32_t value)
 {
-  NS_ENSURE_TRUE(mKey, NS_ERROR_NOT_INITIALIZED);
+  if (NS_WARN_IF(!mKey))
+    return NS_ERROR_NOT_INITIALIZED;
 
   LONG rv = RegSetValueExW(mKey, PromiseFlatString(name).get(), 0, REG_DWORD,
                            (const BYTE *) &value, sizeof(value));
@@ -411,7 +430,8 @@ nsWindowsRegKey::WriteIntValue(const nsAString &name, uint32_t value)
 NS_IMETHODIMP
 nsWindowsRegKey::WriteInt64Value(const nsAString &name, uint64_t value)
 {
-  NS_ENSURE_TRUE(mKey, NS_ERROR_NOT_INITIALIZED);
+  if (NS_WARN_IF(!mKey))
+    return NS_ERROR_NOT_INITIALIZED;
 
   LONG rv = RegSetValueExW(mKey, PromiseFlatString(name).get(), 0, REG_QWORD,
                            (const BYTE *) &value, sizeof(value));
@@ -422,7 +442,8 @@ nsWindowsRegKey::WriteInt64Value(const nsAString &name, uint64_t value)
 NS_IMETHODIMP
 nsWindowsRegKey::WriteBinaryValue(const nsAString &name, const nsACString &value)
 {
-  NS_ENSURE_TRUE(mKey, NS_ERROR_NOT_INITIALIZED);
+  if (NS_WARN_IF(!mKey))
+    return NS_ERROR_NOT_INITIALIZED;
 
   const nsCString &flatValue = PromiseFlatCString(value);
   LONG rv = RegSetValueExW(mKey, PromiseFlatString(name).get(), 0, REG_BINARY,
@@ -434,7 +455,8 @@ nsWindowsRegKey::WriteBinaryValue(const nsAString &name, const nsACString &value
 NS_IMETHODIMP
 nsWindowsRegKey::StartWatching(bool recurse)
 {
-  NS_ENSURE_TRUE(mKey, NS_ERROR_NOT_INITIALIZED);
+  if (NS_WARN_IF(!mKey))
+    return NS_ERROR_NOT_INITIALIZED;
 
   if (mWatchEvent)
     return NS_OK;
diff --git a/xpcom/glue/nsArrayEnumerator.cpp b/xpcom/glue/nsArrayEnumerator.cpp
index 572fc665a437..5c2588f59745 100644
--- a/xpcom/glue/nsArrayEnumerator.cpp
+++ b/xpcom/glue/nsArrayEnumerator.cpp
@@ -180,7 +180,6 @@ nsCOMArrayEnumerator::operator new (size_t size, const nsCOMArray_base& aArray)
     // do the actual allocation
     nsCOMArrayEnumerator * result =
         static_cast<nsCOMArrayEnumerator*>(::operator new(size));
-    NS_ENSURE_TRUE(result, nullptr);
 
     // now need to copy over the values, and addref each one
     // now this might seem like a lot of work, but we're actually just
diff --git a/xpcom/glue/nsCOMArray.cpp b/xpcom/glue/nsCOMArray.cpp
index 99b1b5e481a6..7b227a6c5a3a 100644
--- a/xpcom/glue/nsCOMArray.cpp
+++ b/xpcom/glue/nsCOMArray.cpp
@@ -57,7 +57,8 @@ int32_t
 nsCOMArray_base::IndexOfObject(nsISupports* aObject) const
 {
     nsCOMPtr<nsISupports> supports = do_QueryInterface(aObject);
-    NS_ENSURE_TRUE(supports, -1);
+    if (NS_WARN_IF(!supports))
+        return -1;
 
     uint32_t i, count;
     int32_t retval = -1;
diff --git a/xpcom/glue/nsComponentManagerUtils.cpp b/xpcom/glue/nsComponentManagerUtils.cpp
index f20d5e72e3b8..21decc4f4fab 100644
--- a/xpcom/glue/nsComponentManagerUtils.cpp
+++ b/xpcom/glue/nsComponentManagerUtils.cpp
@@ -46,7 +46,8 @@ nsresult
 CallGetService(const nsCID &aCID, const nsIID &aIID, void **aResult)
 {
     nsComponentManagerImpl *compMgr = nsComponentManagerImpl::gComponentManager;
-    NS_ENSURE_TRUE(compMgr, NS_ERROR_NOT_INITIALIZED);
+    if (NS_WARN_IF(!compMgr))
+        return NS_ERROR_NOT_INITIALIZED;
 
     return compMgr->nsComponentManagerImpl::GetService(aCID, aIID, aResult);
 }
@@ -55,7 +56,8 @@ nsresult
 CallGetService(const char *aContractID, const nsIID &aIID, void **aResult)
 {
     nsComponentManagerImpl *compMgr = nsComponentManagerImpl::gComponentManager;
-    NS_ENSURE_TRUE(compMgr, NS_ERROR_NOT_INITIALIZED);
+    if (NS_WARN_IF(!compMgr))
+        return NS_ERROR_NOT_INITIALIZED;
 
     return compMgr->
         nsComponentManagerImpl::GetServiceByContractID(aContractID,
@@ -119,7 +121,8 @@ CallCreateInstance(const nsCID &aCID, nsISupports *aDelegate,
                    const nsIID &aIID, void **aResult)
 {
     nsComponentManagerImpl *compMgr = nsComponentManagerImpl::gComponentManager;
-    NS_ENSURE_TRUE(compMgr, NS_ERROR_NOT_INITIALIZED);
+    if (NS_WARN_IF(!compMgr))
+        return NS_ERROR_NOT_INITIALIZED;
 
     return compMgr->
         nsComponentManagerImpl::CreateInstance(aCID, aDelegate, aIID, aResult);
@@ -130,7 +133,8 @@ CallCreateInstance(const char *aContractID, nsISupports *aDelegate,
                    const nsIID &aIID, void **aResult)
 {
     nsComponentManagerImpl *compMgr = nsComponentManagerImpl::gComponentManager;
-    NS_ENSURE_TRUE(compMgr, NS_ERROR_NOT_INITIALIZED);
+    if (NS_WARN_IF(!compMgr))
+        return NS_ERROR_NOT_INITIALIZED;
 
     return compMgr->
         nsComponentManagerImpl::CreateInstanceByContractID(aContractID,
@@ -142,7 +146,8 @@ nsresult
 CallGetClassObject(const nsCID &aCID, const nsIID &aIID, void **aResult)
 {
     nsComponentManagerImpl *compMgr = nsComponentManagerImpl::gComponentManager;
-    NS_ENSURE_TRUE(compMgr, NS_ERROR_NOT_INITIALIZED);
+    if (NS_WARN_IF(!compMgr))
+        return NS_ERROR_NOT_INITIALIZED;
 
     return compMgr->
         nsComponentManagerImpl::GetClassObject(aCID, aIID, aResult);
@@ -152,7 +157,8 @@ nsresult
 CallGetClassObject(const char *aContractID, const nsIID &aIID, void **aResult)
 {
     nsComponentManagerImpl *compMgr = nsComponentManagerImpl::gComponentManager;
-    NS_ENSURE_TRUE(compMgr, NS_ERROR_NOT_INITIALIZED);
+    if (NS_WARN_IF(!compMgr))
+        return NS_ERROR_NOT_INITIALIZED;
 
     return compMgr->
         nsComponentManagerImpl::GetClassObjectByContractID(aContractID, aIID,
diff --git a/xpcom/glue/nsDebug.h b/xpcom/glue/nsDebug.h
index 1e656c8127fc..8d3f543829c9 100644
--- a/xpcom/glue/nsDebug.h
+++ b/xpcom/glue/nsDebug.h
@@ -12,7 +12,7 @@
 
 #ifndef nsError_h__
 #include "nsError.h"
-#endif 
+#endif
 
 #include "nsXPCOM.h"
 #include "mozilla/Assertions.h"
@@ -22,7 +22,35 @@
 #include "prprf.h"
 #endif
 
+/**
+ * Warn if the given condition is true. The condition is evaluated in both
+ * release and debug builds, and the result is an expression which can be
+ * used in subsequent expressions, such as:
+ *
+ * if (NS_WARN_IF(NS_FAILED(rv))
+ *   return rv;
+ *
+ * This explicit warning and return is preferred to the NS_ENSURE_* macros
+ * which hide the warning and the return control flow.
+ *
+ * @note This is C++-only
+ */
+#ifdef __cplusplus
 #ifdef DEBUG
+inline bool NS_warn_if_impl(bool condition, const char* expr, const char* file,
+                            int32_t line)
+{
+  if (MOZ_UNLIKELY(condition)) {
+    NS_DebugBreak(NS_DEBUG_WARNING, nullptr, expr, file, line);
+  }
+  return condition;
+}
+#define NS_WARN_IF(condition) \
+  NS_warn_if_impl(condition, #condition, __FILE__, __LINE__)
+#else
+#define NS_WARN_IF(condition) (bool)(condition)
+#endif
+#endif
 
 /**
  * Abort the execution of the program if the expression evaluates to
@@ -40,12 +68,16 @@
  * Note also that the non-debug version of this macro does <b>not</b>
  * evaluate the message argument.
  */
+#ifdef DEBUG
 #define NS_ABORT_IF_FALSE(_expr, _msg)                        \
   do {                                                        \
     if (!(_expr)) {                                           \
       NS_DebugBreak(NS_DEBUG_ABORT, _msg, #_expr, __FILE__, __LINE__); \
     }                                                         \
   } while(0)
+#else
+#define NS_ABORT_IF_FALSE(_expr, _msg) do { /* nothing */ } while(0)
+#endif
 
 /**
  * Warn if a given condition is false.
@@ -55,103 +87,105 @@
  * Note also that the non-debug version of this macro does <b>not</b>
  * evaluate the message argument.
  */
+#ifdef DEBUG
 #define NS_WARN_IF_FALSE(_expr,_msg)                          \
   do {                                                        \
     if (!(_expr)) {                                           \
       NS_DebugBreak(NS_DEBUG_WARNING, _msg, #_expr, __FILE__, __LINE__); \
     }                                                         \
   } while(0)
+#else
+#define NS_WARN_IF_FALSE(_expr, _msg)  do { /* nothing */ } while(0)
+#endif
 
-/**
- * Test a precondition for truth. If the expression is not true then
- * trigger a program failure.
- */
-#define NS_PRECONDITION(expr, str)                            \
-  do {                                                        \
-    if (!(expr)) {                                            \
-      NS_DebugBreak(NS_DEBUG_ASSERTION, str, #expr, __FILE__, __LINE__); \
-    }                                                         \
-  } while(0)
 
 /**
  * Test an assertion for truth. If the expression is not true then
  * trigger a program failure.
+ *
+ * Note that the non-debug version of this macro does <b>not</b>
+ * evaluate the message argument.
  */
+#ifdef DEBUG
 #define NS_ASSERTION(expr, str)                               \
   do {                                                        \
     if (!(expr)) {                                            \
       NS_DebugBreak(NS_DEBUG_ASSERTION, str, #expr, __FILE__, __LINE__); \
     }                                                         \
   } while(0)
+#else
+#define NS_ASSERTION(expr, str)        do { /* nothing */ } while(0)
+#endif
 
 /**
- * Test a post-condition for truth. If the expression is not true then
- * trigger a program failure.
+ * NS_PRECONDITION/POSTCONDITION are synonyms for NS_ASSERTION.
  */
-#define NS_POSTCONDITION(expr, str)                           \
-  do {                                                        \
-    if (!(expr)) {                                            \
-      NS_DebugBreak(NS_DEBUG_ASSERTION, str, #expr, __FILE__, __LINE__); \
-    }                                                         \
-  } while(0)
+#define NS_PRECONDITION(expr, str) NS_ASSERTION(expr, str)
+#define NS_POSTCONDITION(expr, str) NS_ASSERTION(expr, str)
 
 /**
  * This macros triggers a program failure if executed. It indicates that
  * an attempt was made to execute some unimplemented functionality.
  */
+#ifdef DEBUG
 #define NS_NOTYETIMPLEMENTED(str)                             \
   NS_DebugBreak(NS_DEBUG_ASSERTION, str, "NotYetImplemented", __FILE__, __LINE__)
+#else
+#define NS_NOTYETIMPLEMENTED(str)      do { /* nothing */ } while(0)
+#endif
 
 /**
  * This macros triggers a program failure if executed. It indicates that
- * an attempt was made to execute some unimplemented functionality.
+ * an attempt was made to execute a codepath which should not be reachable.
  */
+#ifdef DEBUG
 #define NS_NOTREACHED(str)                                    \
   NS_DebugBreak(NS_DEBUG_ASSERTION, str, "Not Reached", __FILE__, __LINE__)
+#else
+#define NS_NOTREACHED(str)             do { /* nothing */ } while(0)
+#endif
 
 /**
  * Log an error message.
  */
+#ifdef DEBUG
 #define NS_ERROR(str)                                         \
   NS_DebugBreak(NS_DEBUG_ASSERTION, str, "Error", __FILE__, __LINE__)
+#else
+#define NS_ERROR(str)                  do { /* nothing */ } while(0)
+#endif
 
 /**
  * Log a warning message.
  */
+#ifdef DEBUG
 #define NS_WARNING(str)                                       \
   NS_DebugBreak(NS_DEBUG_WARNING, str, nullptr, __FILE__, __LINE__)
+#else
+#define NS_WARNING(str)                do { /* nothing */ } while(0)
+#endif
 
 /**
- * Trigger an abort
+ * Trigger an debug-only abort.
+ *
+ * @see NS_RUNTIMEABORT for release-mode asserts.
  */
+#ifdef DEBUG
 #define NS_ABORT()                                            \
   NS_DebugBreak(NS_DEBUG_ABORT, nullptr, nullptr, __FILE__, __LINE__)
+#else
+#define NS_ABORT()                     do { /* nothing */ } while(0)
+#endif
 
 /**
- * Cause a break
+ * Trigger a debugger breakpoint, only in debug builds.
  */
+#ifdef DEBUG
 #define NS_BREAK()                                            \
   NS_DebugBreak(NS_DEBUG_BREAK, nullptr, nullptr, __FILE__, __LINE__)
-
-#else /* DEBUG */
-
-/**
- * The non-debug version of these macros do not evaluate the
- * expression or the message arguments to the macro.
- */
-#define NS_ABORT_IF_FALSE(_expr, _msg) do { /* nothing */ } while(0)
-#define NS_WARN_IF_FALSE(_expr, _msg)  do { /* nothing */ } while(0)
-#define NS_PRECONDITION(expr, str)     do { /* nothing */ } while(0)
-#define NS_ASSERTION(expr, str)        do { /* nothing */ } while(0)
-#define NS_POSTCONDITION(expr, str)    do { /* nothing */ } while(0)
-#define NS_NOTYETIMPLEMENTED(str)      do { /* nothing */ } while(0)
-#define NS_NOTREACHED(str)             do { /* nothing */ } while(0)
-#define NS_ERROR(str)                  do { /* nothing */ } while(0)
-#define NS_WARNING(str)                do { /* nothing */ } while(0)
-#define NS_ABORT()                     do { /* nothing */ } while(0)
+#else
 #define NS_BREAK()                     do { /* nothing */ } while(0)
-
-#endif /* ! DEBUG */
+#endif
 
 /******************************************************************************
 ** Macros for static assertions.  These are used by the sixgill tool.
@@ -230,7 +264,7 @@
 
 /******************************************************************************
 ** Macros for terminating execution when an unrecoverable condition is
-** reached.  These need to be compiled regardless of the DEBUG flag. 
+** reached.  These need to be compiled regardless of the DEBUG flag.
 ******************************************************************************/
 
 /**
@@ -242,10 +276,11 @@
   NS_DebugBreak(NS_DEBUG_ABORT, msg, nullptr, __FILE__, __LINE__)
 
 
-/* Macros for checking the trueness of an expression passed in within an 
- * interface implementation.  These need to be compiled regardless of the */
-/* DEBUG flag
-******************************************************************************/
+/* Macros for checking the trueness of an expression passed in within an
+ * interface implementation.  These need to be compiled regardless of the
+ * DEBUG flag. New code should use NS_WARN_IF(condition) instead!
+ * @status deprecated
+ */
 
 #define NS_ENSURE_TRUE(x, ret)                                \
   do {                                                        \
@@ -340,9 +375,6 @@
 #define NS_ENSURE_NO_AGGREGATION(outer)                       \
   NS_ENSURE_FALSE(outer, NS_ERROR_NO_AGGREGATION)
 
-#define NS_ENSURE_PROPER_AGGREGATION(outer, iid)              \
-  NS_ENSURE_FALSE(outer && !iid.Equals(NS_GET_IID(nsISupports)), NS_ERROR_INVALID_ARG)
-
 /*****************************************************************************/
 
 #ifdef XPCOM_GLUE
diff --git a/xpcom/glue/nsINIParser.cpp b/xpcom/glue/nsINIParser.cpp
index 918c2f2427d8..9ce71aa9b0fd 100644
--- a/xpcom/glue/nsINIParser.cpp
+++ b/xpcom/glue/nsINIParser.cpp
@@ -65,7 +65,8 @@ nsINIParser::Init(nsIFile* aFile)
 #ifdef XP_WIN
     nsAutoString path;
     nsresult rv = aFile->GetPath(path);
-    NS_ENSURE_SUCCESS(rv, rv);
+    if (NS_WARN_IF(NS_FAILED(rv)))
+      return rv;
 
     fd = _wfopen(path.get(), READ_BINARYMODE);
 #else
diff --git a/xpcom/glue/nsMemory.cpp b/xpcom/glue/nsMemory.cpp
index 6b63420c9ec6..f77567a3f686 100644
--- a/xpcom/glue/nsMemory.cpp
+++ b/xpcom/glue/nsMemory.cpp
@@ -19,7 +19,8 @@ nsMemory::HeapMinimize(bool aImmediate)
 {
     nsCOMPtr<nsIMemory> mem;
     nsresult rv = NS_GetMemoryManager(getter_AddRefs(mem));
-    NS_ENSURE_SUCCESS(rv, rv);
+    if (NS_WARN_IF(NS_FAILED(rv)))
+        return rv;
 
     return mem->HeapMinimize(aImmediate);
 }
diff --git a/xpcom/glue/nsThreadUtils.cpp b/xpcom/glue/nsThreadUtils.cpp
index a99c2dea3ca7..c89faa4e7746 100644
--- a/xpcom/glue/nsThreadUtils.cpp
+++ b/xpcom/glue/nsThreadUtils.cpp
@@ -70,15 +70,18 @@ NS_NewThread(nsIThread **result, nsIRunnable *event, uint32_t stackSize)
   nsresult rv;
   nsCOMPtr<nsIThreadManager> mgr =
       do_GetService(NS_THREADMANAGER_CONTRACTID, &rv);
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
 
   rv = mgr->NewThread(0, stackSize, getter_AddRefs(thread));
 #endif
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
 
   if (event) {
     rv = thread->Dispatch(event, NS_DISPATCH_NORMAL);
-    NS_ENSURE_SUCCESS(rv, rv);
+    if (NS_WARN_IF(NS_FAILED(rv)))
+      return rv;
   }
 
   *result = nullptr;
@@ -95,7 +98,8 @@ NS_GetCurrentThread(nsIThread **result)
   nsresult rv;
   nsCOMPtr<nsIThreadManager> mgr =
       do_GetService(NS_THREADMANAGER_CONTRACTID, &rv);
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
   return mgr->GetCurrentThread(result);
 #endif
 }
@@ -109,7 +113,8 @@ NS_GetMainThread(nsIThread **result)
   nsresult rv;
   nsCOMPtr<nsIThreadManager> mgr =
       do_GetService(NS_THREADMANAGER_CONTRACTID, &rv);
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
   return mgr->GetMainThread(result);
 #endif
 }
@@ -161,7 +166,8 @@ NS_DispatchToCurrentThread(nsIRunnable *event)
 #else
   nsCOMPtr<nsIThread> thread;
   nsresult rv = NS_GetCurrentThread(getter_AddRefs(thread));
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
 #endif
   return thread->Dispatch(event, NS_DISPATCH_NORMAL);
 }
@@ -171,7 +177,8 @@ NS_DispatchToMainThread(nsIRunnable *event, uint32_t dispatchFlags)
 {
   nsCOMPtr<nsIThread> thread;
   nsresult rv = NS_GetMainThread(getter_AddRefs(thread));
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
   return thread->Dispatch(event, dispatchFlags);
 }
 
@@ -184,13 +191,15 @@ NS_ProcessPendingEvents(nsIThread *thread, PRIntervalTime timeout)
 #ifdef MOZILLA_INTERNAL_API
   if (!thread) {
     thread = NS_GetCurrentThread();
-    NS_ENSURE_STATE(thread);
+    if (NS_WARN_IF(!thread))
+      return NS_ERROR_UNEXPECTED;
   }
 #else
   nsCOMPtr<nsIThread> current;
   if (!thread) {
     rv = NS_GetCurrentThread(getter_AddRefs(current));
-    NS_ENSURE_SUCCESS(rv, rv);
+    if (NS_WARN_IF(NS_FAILED(rv)))
+      return rv;
     thread = current.get();
   }
 #endif
@@ -225,7 +234,8 @@ NS_HasPendingEvents(nsIThread *thread)
     return hasPendingEvents(current);
 #else
     thread = NS_GetCurrentThread();
-    NS_ENSURE_TRUE(thread, false);
+    if (NS_WARN_IF(!thread))
+      return false;
 #endif
   }
   return hasPendingEvents(thread);
@@ -237,13 +247,15 @@ NS_ProcessNextEvent(nsIThread *thread, bool mayWait)
 #ifdef MOZILLA_INTERNAL_API
   if (!thread) {
     thread = NS_GetCurrentThread();
-    NS_ENSURE_TRUE(thread, false);
+    if (NS_WARN_IF(!thread))
+      return false;
   }
 #else
   nsCOMPtr<nsIThread> current;
   if (!thread) {
     NS_GetCurrentThread(getter_AddRefs(current));
-    NS_ENSURE_TRUE(current, false);
+    if (NS_WARN_IF(!current))
+      return false;
     thread = current.get();
   }
 #endif
diff --git a/xpcom/glue/nsThreadUtils.h b/xpcom/glue/nsThreadUtils.h
index e53cc013153c..c567de3a4666 100644
--- a/xpcom/glue/nsThreadUtils.h
+++ b/xpcom/glue/nsThreadUtils.h
@@ -71,7 +71,8 @@ NS_NewNamedThread(const char (&name)[LEN],
                   uint32_t stackSize = nsIThreadManager::DEFAULT_STACK_SIZE)
 {
   nsresult rv = NS_NewThread(result, nullptr, stackSize);
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
   NS_SetThreadName<LEN>(*result, name);
   if (initialEvent) {
     rv = (*result)->Dispatch(initialEvent, NS_DISPATCH_NORMAL);
diff --git a/xpcom/io/Base64.cpp b/xpcom/io/Base64.cpp
index 94fec02775ae..4a6419eca57d 100644
--- a/xpcom/io/Base64.cpp
+++ b/xpcom/io/Base64.cpp
@@ -163,7 +163,8 @@ EncodeInputStream(nsIInputStream *aInputStream,
 
   if (!aCount) {
     rv = aInputStream->Available(&count64);
-    NS_ENSURE_SUCCESS(rv, rv);
+    if (NS_WARN_IF(NS_FAILED(rv)))
+      return rv;
     // if count64 is over 4GB, it will be failed at the below condition,
     // then will return NS_ERROR_OUT_OF_MEMORY
     aCount = (uint32_t)count64;
diff --git a/xpcom/io/CocoaFileUtils.mm b/xpcom/io/CocoaFileUtils.mm
index ca4e1b4fc3be..3f6872745536 100644
--- a/xpcom/io/CocoaFileUtils.mm
+++ b/xpcom/io/CocoaFileUtils.mm
@@ -16,7 +16,8 @@ nsresult RevealFileInFinder(CFURLRef url)
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NSRESULT;
 
-  NS_ENSURE_ARG_POINTER(url);
+  if (NS_WARN_IF(!url))
+    return NS_ERROR_INVALID_ARG;
 
   NSAutoreleasePool* ap = [[NSAutoreleasePool alloc] init];
   BOOL success = [[NSWorkspace sharedWorkspace] selectFile:[(NSURL*)url path] inFileViewerRootedAtPath:@""];
@@ -31,7 +32,8 @@ nsresult OpenURL(CFURLRef url)
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NSRESULT;
 
-  NS_ENSURE_ARG_POINTER(url);
+  if (NS_WARN_IF(!url))
+    return NS_ERROR_INVALID_ARG;
 
   NSAutoreleasePool* ap = [[NSAutoreleasePool alloc] init];
   BOOL success = [[NSWorkspace sharedWorkspace] openURL:(NSURL*)url];
@@ -46,8 +48,8 @@ nsresult GetFileCreatorCode(CFURLRef url, OSType *creatorCode)
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NSRESULT;
 
-  NS_ENSURE_ARG_POINTER(url);
-  NS_ENSURE_ARG_POINTER(creatorCode);
+  if (NS_WARN_IF(!url) || NS_WARN_IF(!creatorCode))
+    return NS_ERROR_INVALID_ARG;
 
   nsAutoreleasePool localPool;
 
@@ -76,7 +78,8 @@ nsresult SetFileCreatorCode(CFURLRef url, OSType creatorCode)
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NSRESULT;
 
-  NS_ENSURE_ARG_POINTER(url);
+  if (NS_WARN_IF(!url))
+    return NS_ERROR_INVALID_ARG;
 
   NSAutoreleasePool* ap = [[NSAutoreleasePool alloc] init];
   NSDictionary* dict = [NSDictionary dictionaryWithObject:[NSNumber numberWithUnsignedLong:creatorCode] forKey:NSFileHFSCreatorCode];
@@ -91,8 +94,8 @@ nsresult GetFileTypeCode(CFURLRef url, OSType *typeCode)
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NSRESULT;
 
-  NS_ENSURE_ARG_POINTER(url);
-  NS_ENSURE_ARG_POINTER(typeCode);
+  if (NS_WARN_IF(!url) || NS_WARN_IF(!typeCode))
+    return NS_ERROR_INVALID_ARG;
 
   nsAutoreleasePool localPool;
 
@@ -121,7 +124,8 @@ nsresult SetFileTypeCode(CFURLRef url, OSType typeCode)
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NSRESULT;
 
-  NS_ENSURE_ARG_POINTER(url);
+  if (NS_WARN_IF(!url))
+    return NS_ERROR_INVALID_ARG;
 
   NSAutoreleasePool* ap = [[NSAutoreleasePool alloc] init];
   NSDictionary* dict = [NSDictionary dictionaryWithObject:[NSNumber numberWithUnsignedLong:typeCode] forKey:NSFileHFSTypeCode];
diff --git a/xpcom/io/nsAnonymousTemporaryFile.cpp b/xpcom/io/nsAnonymousTemporaryFile.cpp
index aaac18958a22..de0cc43caf23 100644
--- a/xpcom/io/nsAnonymousTemporaryFile.cpp
+++ b/xpcom/io/nsAnonymousTemporaryFile.cpp
@@ -50,19 +50,23 @@ using namespace mozilla;
 static nsresult
 GetTempDir(nsIFile** aTempDir)
 {
-  NS_ENSURE_ARG(aTempDir);
+  if (NS_WARN_IF(!aTempDir))
+    return NS_ERROR_INVALID_ARG;
   nsCOMPtr<nsIFile> tmpFile;
   nsresult rv = NS_GetSpecialDirectory(NS_OS_TEMP_DIR, getter_AddRefs(tmpFile));
-  NS_ENSURE_SUCCESS(rv,rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
 
 #ifdef XP_WIN
   // On windows DELETE_ON_CLOSE is unreliable, so we store temporary files
   // in a subdir of the temp dir and delete that in an idle service observer
   // to ensure it's been cleared.
   rv = tmpFile->AppendNative(nsDependentCString("mozilla-temp-files"));
-  NS_ENSURE_SUCCESS(rv,rv);    
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
   rv = tmpFile->Create(nsIFile::DIRECTORY_TYPE, 0700);
-  NS_ENSURE_TRUE(rv == NS_ERROR_FILE_ALREADY_EXISTS || NS_SUCCEEDED(rv), rv);
+  if (rv != NS_ERROR_FILE_ALREADY_EXISTS && NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
 #endif
  
   tmpFile.forget(aTempDir);
@@ -73,12 +77,14 @@ GetTempDir(nsIFile** aTempDir)
 nsresult
 NS_OpenAnonymousTemporaryFile(PRFileDesc** aOutFileDesc)
 {
-  NS_ENSURE_ARG(aOutFileDesc);
+  if (NS_WARN_IF(!aOutFileDesc))
+    return NS_ERROR_INVALID_ARG;
   nsresult rv;
 
   nsCOMPtr<nsIFile> tmpFile;
   rv = GetTempDir(getter_AddRefs(tmpFile));
-  NS_ENSURE_SUCCESS(rv,rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
 
   // Give the temp file a name with a random element. CreateUnique will also
   // append a counter to the name if it encounters a name collision. Adding
@@ -90,10 +96,12 @@ NS_OpenAnonymousTemporaryFile(PRFileDesc** aOutFileDesc)
   name.AppendInt(rand());
 
   rv = tmpFile->AppendNative(name);
-  NS_ENSURE_SUCCESS(rv,rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
 
   rv = tmpFile->CreateUnique(nsIFile::NORMAL_FILE_TYPE, 0700);
-  NS_ENSURE_SUCCESS(rv,rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
 
   rv = tmpFile->OpenNSPRFileDesc(PR_RDWR | nsIFile::DELETE_ON_CLOSE,
                                  PR_IRWXU, aOutFileDesc);
@@ -146,16 +154,19 @@ public:
     // service is installed when running in xpcshell, and this interferes with
     // the fake idle service, causing xpcshell-test failures.
     mTimer = do_CreateInstance(NS_TIMER_CONTRACTID);
-    NS_ENSURE_TRUE(mTimer != nullptr, NS_ERROR_FAILURE);
+    if (NS_WARN_IF(!mTimer))
+      return NS_ERROR_FAILURE;
     nsresult rv = mTimer->Init(this,
                          SCHEDULE_TIMEOUT_MS,
                          nsITimer::TYPE_ONE_SHOT);
-    NS_ENSURE_SUCCESS(rv, rv);
+    if (NS_WARN_IF(NS_FAILED(rv)))
+      return rv;
 
     // Register shutdown observer so we can cancel the timer if we shutdown before
     // the timer runs.
     nsCOMPtr<nsIObserverService> obsSrv = services::GetObserverService();
-    NS_ENSURE_TRUE(obsSrv != nullptr, NS_ERROR_FAILURE);
+    if (NS_WARN_IF(!obsSrv))
+      return NS_ERROR_FAILURE;
     return obsSrv->AddObserver(this, XPCOM_SHUTDOWN_TOPIC, false);
   }
 
@@ -211,7 +222,8 @@ public:
   void RemoveAnonTempFileFiles() {
     nsCOMPtr<nsIFile> tmpDir;
     nsresult rv = GetTempDir(getter_AddRefs(tmpDir));
-    NS_ENSURE_SUCCESS_VOID(rv);
+    if (NS_WARN_IF(NS_FAILED(rv)))
+      return;
 
     // Remove the directory recursively.
     tmpDir->Remove(true);
diff --git a/xpcom/io/nsAppFileLocationProvider.cpp b/xpcom/io/nsAppFileLocationProvider.cpp
index b0243c514e7c..c0f77437c7ac 100644
--- a/xpcom/io/nsAppFileLocationProvider.cpp
+++ b/xpcom/io/nsAppFileLocationProvider.cpp
@@ -87,10 +87,12 @@ NS_IMPL_ISUPPORTS2(nsAppFileLocationProvider, nsIDirectoryServiceProvider, nsIDi
 NS_IMETHODIMP
 nsAppFileLocationProvider::GetFile(const char *prop, bool *persistent, nsIFile **_retval)
 {
+    if (NS_WARN_IF(!prop))
+        return NS_ERROR_INVALID_ARG;
+
     nsCOMPtr<nsIFile>  localFile;
     nsresult rv = NS_ERROR_FAILURE;
 
-    NS_ENSURE_ARG(prop);
     *_retval = nullptr;
     *persistent = true;
 
@@ -250,7 +252,8 @@ nsAppFileLocationProvider::GetFile(const char *prop, bool *persistent, nsIFile *
 
 NS_METHOD nsAppFileLocationProvider::CloneMozBinDirectory(nsIFile **aLocalFile)
 {
-    NS_ENSURE_ARG_POINTER(aLocalFile);
+    if (NS_WARN_IF(!aLocalFile))
+        return NS_ERROR_INVALID_ARG;
     nsresult rv;
 
     if (!mMozBinDirectory)
@@ -291,7 +294,8 @@ NS_METHOD nsAppFileLocationProvider::CloneMozBinDirectory(nsIFile **aLocalFile)
 //----------------------------------------------------------------------------------------
 NS_METHOD nsAppFileLocationProvider::GetProductDirectory(nsIFile **aLocalFile, bool aLocal)
 {
-    NS_ENSURE_ARG_POINTER(aLocalFile);
+    if (NS_WARN_IF(!aLocalFile))
+        return NS_ERROR_INVALID_ARG;
 
     nsresult rv;
     bool exists;
@@ -352,7 +356,8 @@ NS_METHOD nsAppFileLocationProvider::GetProductDirectory(nsIFile **aLocalFile, b
 //----------------------------------------------------------------------------------------
 NS_METHOD nsAppFileLocationProvider::GetDefaultUserProfileRoot(nsIFile **aLocalFile, bool aLocal)
 {
-    NS_ENSURE_ARG_POINTER(aLocalFile);
+    if (NS_WARN_IF(!aLocalFile))
+        return NS_ERROR_INVALID_ARG;
 
     nsresult rv;
     nsCOMPtr<nsIFile> localDir;
@@ -416,7 +421,8 @@ class nsAppDirectoryEnumerator : public nsISimpleEnumerator
 
     NS_IMETHOD GetNext(nsISupports **result) 
     {
-        NS_ENSURE_ARG_POINTER(result);
+        if (NS_WARN_IF(!result))
+            return NS_ERROR_INVALID_ARG;
         *result = nullptr;
 
         bool hasMore;
@@ -511,7 +517,8 @@ class nsPathsDirectoryEnumerator : public nsAppDirectoryEnumerator
 NS_IMETHODIMP
 nsAppFileLocationProvider::GetFiles(const char *prop, nsISimpleEnumerator **_retval)
 {
-    NS_ENSURE_ARG_POINTER(_retval);
+    if (NS_WARN_IF(!_retval))
+        return NS_ERROR_INVALID_ARG;
     *_retval = nullptr;
     nsresult rv = NS_ERROR_FAILURE;
     
diff --git a/xpcom/io/nsBinaryStream.cpp b/xpcom/io/nsBinaryStream.cpp
index e3917845870c..67784f9eea54 100644
--- a/xpcom/io/nsBinaryStream.cpp
+++ b/xpcom/io/nsBinaryStream.cpp
@@ -34,21 +34,24 @@ NS_IMPL_ISUPPORTS3(nsBinaryOutputStream, nsIObjectOutputStream, nsIBinaryOutputS
 NS_IMETHODIMP
 nsBinaryOutputStream::Flush() 
 { 
-    NS_ENSURE_STATE(mOutputStream);
+    if (NS_WARN_IF(!mOutputStream))
+        return NS_ERROR_UNEXPECTED;
     return mOutputStream->Flush(); 
 }
 
 NS_IMETHODIMP
 nsBinaryOutputStream::Close() 
 { 
-    NS_ENSURE_STATE(mOutputStream);
+    if (NS_WARN_IF(!mOutputStream))
+        return NS_ERROR_UNEXPECTED;
     return mOutputStream->Close(); 
 }
 
 NS_IMETHODIMP
 nsBinaryOutputStream::Write(const char *aBuf, uint32_t aCount, uint32_t *aActualBytes)
 {
-    NS_ENSURE_STATE(mOutputStream);
+    if (NS_WARN_IF(!mOutputStream))
+        return NS_ERROR_UNEXPECTED;
     return mOutputStream->Write(aBuf, aCount, aActualBytes);
 }
 
@@ -69,14 +72,16 @@ nsBinaryOutputStream::WriteSegments(nsReadSegmentFun reader, void * closure, uin
 NS_IMETHODIMP
 nsBinaryOutputStream::IsNonBlocking(bool *aNonBlocking)
 {
-    NS_ENSURE_STATE(mOutputStream);
+    if (NS_WARN_IF(!mOutputStream))
+        return NS_ERROR_UNEXPECTED;
     return mOutputStream->IsNonBlocking(aNonBlocking);
 }
 
 nsresult
 nsBinaryOutputStream::WriteFully(const char *aBuf, uint32_t aCount)
 {
-    NS_ENSURE_STATE(mOutputStream);
+    if (NS_WARN_IF(!mOutputStream))
+        return NS_ERROR_UNEXPECTED;
 
     nsresult rv;
     uint32_t bytesWritten;
@@ -91,7 +96,8 @@ nsBinaryOutputStream::WriteFully(const char *aBuf, uint32_t aCount)
 NS_IMETHODIMP
 nsBinaryOutputStream::SetOutputStream(nsIOutputStream *aOutputStream)
 {
-    NS_ENSURE_ARG_POINTER(aOutputStream);
+    if (NS_WARN_IF(!aOutputStream))
+        return NS_ERROR_INVALID_ARG;
     mOutputStream = aOutputStream;
     mBufferAccess = do_QueryInterface(aOutputStream);
     return NS_OK;
@@ -245,23 +251,25 @@ nsBinaryOutputStream::WriteCompoundObject(nsISupports* aObject,
                                           const nsIID& aIID,
                                           bool aIsStrongRef)
 {
-    // Can't deal with weak refs
-    NS_ENSURE_TRUE(aIsStrongRef, NS_ERROR_UNEXPECTED);
-    
     nsCOMPtr<nsIClassInfo> classInfo = do_QueryInterface(aObject);
-    NS_ENSURE_TRUE(classInfo, NS_ERROR_NOT_AVAILABLE);
-
     nsCOMPtr<nsISerializable> serializable = do_QueryInterface(aObject);
-    NS_ENSURE_TRUE(serializable, NS_ERROR_NOT_AVAILABLE);
+
+    // Can't deal with weak refs
+    if (NS_WARN_IF(!aIsStrongRef))
+        return NS_ERROR_UNEXPECTED;
+    if (NS_WARN_IF(!classInfo) || NS_WARN_IF(!serializable))
+        return NS_ERROR_NOT_AVAILABLE;
 
     nsCID cid;
     classInfo->GetClassIDNoAlloc(&cid);
 
     nsresult rv = WriteID(cid);
-    NS_ENSURE_SUCCESS(rv, rv);
-    
+    if (NS_WARN_IF(NS_FAILED(rv)))
+        return rv;
+
     rv = WriteID(aIID);
-    NS_ENSURE_SUCCESS(rv, rv);
+    if (NS_WARN_IF(NS_FAILED(rv)))
+        return rv;
 
     return serializable->Write(this);
 }
@@ -270,17 +278,21 @@ NS_IMETHODIMP
 nsBinaryOutputStream::WriteID(const nsIID& aIID)
 {
     nsresult rv = Write32(aIID.m0);
-    NS_ENSURE_SUCCESS(rv, rv);
+    if (NS_WARN_IF(NS_FAILED(rv)))
+        return rv;
 
     rv = Write16(aIID.m1);
-    NS_ENSURE_SUCCESS(rv, rv);
+    if (NS_WARN_IF(NS_FAILED(rv)))
+        return rv;
 
     rv = Write16(aIID.m2);
-    NS_ENSURE_SUCCESS(rv, rv);
+    if (NS_WARN_IF(NS_FAILED(rv)))
+        return rv;
 
     for (int i = 0; i < 8; ++i) {
         rv = Write8(aIID.m3[i]);
-        NS_ENSURE_SUCCESS(rv, rv);
+        if (NS_WARN_IF(NS_FAILED(rv)))
+            return rv;
     }
 
     return NS_OK;
@@ -306,14 +318,16 @@ NS_IMPL_ISUPPORTS3(nsBinaryInputStream, nsIObjectInputStream, nsIBinaryInputStre
 NS_IMETHODIMP
 nsBinaryInputStream::Available(uint64_t* aResult)
 {
-    NS_ENSURE_STATE(mInputStream);
+    if (NS_WARN_IF(!mInputStream))
+        return NS_ERROR_UNEXPECTED;
     return mInputStream->Available(aResult);
 }
 
 NS_IMETHODIMP
 nsBinaryInputStream::Read(char* aBuffer, uint32_t aCount, uint32_t *aNumRead)
 {
-    NS_ENSURE_STATE(mInputStream);
+    if (NS_WARN_IF(!mInputStream))
+        return NS_ERROR_UNEXPECTED;
 
     // mInputStream might give us short reads, so deal with that.
     uint32_t totalRead = 0;
@@ -383,7 +397,8 @@ ReadSegmentForwardingThunk(nsIInputStream* aStream,
 NS_IMETHODIMP
 nsBinaryInputStream::ReadSegments(nsWriteSegmentFun writer, void * closure, uint32_t count, uint32_t *_retval)
 {
-    NS_ENSURE_STATE(mInputStream);
+    if (NS_WARN_IF(!mInputStream))
+        return NS_ERROR_UNEXPECTED;
 
     ReadSegmentsClosure thunkClosure = { this, closure, writer, NS_OK, 0 };
     
@@ -416,21 +431,24 @@ nsBinaryInputStream::ReadSegments(nsWriteSegmentFun writer, void * closure, uint
 NS_IMETHODIMP
 nsBinaryInputStream::IsNonBlocking(bool *aNonBlocking)
 {
-    NS_ENSURE_STATE(mInputStream);
+    if (NS_WARN_IF(!mInputStream))
+        return NS_ERROR_UNEXPECTED;
     return mInputStream->IsNonBlocking(aNonBlocking);
 }
 
 NS_IMETHODIMP
-nsBinaryInputStream::Close() 
-{ 
-    NS_ENSURE_STATE(mInputStream);
-    return mInputStream->Close(); 
+nsBinaryInputStream::Close()
+{
+    if (NS_WARN_IF(!mInputStream))
+        return NS_ERROR_UNEXPECTED;
+    return mInputStream->Close();
 }
 
 NS_IMETHODIMP
 nsBinaryInputStream::SetInputStream(nsIInputStream *aInputStream)
 {
-    NS_ENSURE_ARG_POINTER(aInputStream);
+    if (NS_WARN_IF(!aInputStream))
+        return NS_ERROR_INVALID_ARG;
     mInputStream = aInputStream;
     mBufferAccess = do_QueryInterface(aInputStream);
     return NS_OK;
@@ -729,7 +747,8 @@ nsBinaryInputStream::ReadArrayBuffer(uint32_t aLength, const JS::Value& aBuffer,
 
     uint32_t bytesRead;
     nsresult rv = Read(reinterpret_cast<char*>(data), aLength, &bytesRead);
-    NS_ENSURE_SUCCESS(rv, rv);
+    if (NS_WARN_IF(NS_FAILED(rv)))
+        return rv;
     if (bytesRead != aLength) {
         return NS_ERROR_FAILURE;
     }
@@ -742,10 +761,12 @@ nsBinaryInputStream::ReadObject(bool aIsStrongRef, nsISupports* *aObject)
     nsCID cid;
     nsIID iid;
     nsresult rv = ReadID(&cid);
-    NS_ENSURE_SUCCESS(rv, rv);
+    if (NS_WARN_IF(NS_FAILED(rv)))
+        return rv;
 
     rv = ReadID(&iid);
-    NS_ENSURE_SUCCESS(rv, rv);
+    if (NS_WARN_IF(NS_FAILED(rv)))
+        return rv;
 
     // HACK: Intercept old (pre-gecko6) nsIURI IID, and replace with
     // the updated IID, so that we're QI'ing to an actual interface.
@@ -774,13 +795,16 @@ nsBinaryInputStream::ReadObject(bool aIsStrongRef, nsISupports* *aObject)
     // END HACK
 
     nsCOMPtr<nsISupports> object = do_CreateInstance(cid, &rv);
-    NS_ENSURE_SUCCESS(rv, rv);
+    if (NS_WARN_IF(NS_FAILED(rv)))
+        return rv;
 
     nsCOMPtr<nsISerializable> serializable = do_QueryInterface(object);
-    NS_ENSURE_TRUE(serializable, NS_ERROR_UNEXPECTED);
+    if (NS_WARN_IF(!serializable))
+        return NS_ERROR_UNEXPECTED;
 
     rv = serializable->Read(this);
-    NS_ENSURE_SUCCESS(rv, rv);    
+    if (NS_WARN_IF(NS_FAILED(rv)))
+        return rv;
 
     return object->QueryInterface(iid, reinterpret_cast<void**>(aObject));
 }
@@ -789,17 +813,21 @@ NS_IMETHODIMP
 nsBinaryInputStream::ReadID(nsID *aResult)
 {
     nsresult rv = Read32(&aResult->m0);
-    NS_ENSURE_SUCCESS(rv, rv);
+    if (NS_WARN_IF(NS_FAILED(rv)))
+        return rv;
 
     rv = Read16(&aResult->m1);
-    NS_ENSURE_SUCCESS(rv, rv);
+    if (NS_WARN_IF(NS_FAILED(rv)))
+        return rv;
 
     rv = Read16(&aResult->m2);
-    NS_ENSURE_SUCCESS(rv, rv);
+    if (NS_WARN_IF(NS_FAILED(rv)))
+        return rv;
 
     for (int i = 0; i < 8; ++i) {
         rv = Read8(&aResult->m3[i]);
-        NS_ENSURE_SUCCESS(rv, rv);
+        if (NS_WARN_IF(NS_FAILED(rv)))
+            return rv;
     }
 
     return NS_OK;
diff --git a/xpcom/io/nsDirectoryService.cpp b/xpcom/io/nsDirectoryService.cpp
index 603c9c015ca0..a1078d4dfb9a 100644
--- a/xpcom/io/nsDirectoryService.cpp
+++ b/xpcom/io/nsDirectoryService.cpp
@@ -59,7 +59,8 @@ nsresult
 nsDirectoryService::GetCurrentProcessDirectory(nsIFile** aFile)
 //----------------------------------------------------------------------------------------
 {
-    NS_ENSURE_ARG_POINTER(aFile);
+    if (NS_WARN_IF(!aFile))
+        return NS_ERROR_INVALID_ARG;
     *aFile = nullptr;
     
    //  Set the component registry location:
@@ -225,8 +226,10 @@ nsDirectoryService::nsDirectoryService()
 nsresult
 nsDirectoryService::Create(nsISupports *outer, REFNSIID aIID, void **aResult)
 {
-    NS_ENSURE_ARG_POINTER(aResult);
-    NS_ENSURE_NO_AGGREGATION(outer);
+    if (NS_WARN_IF(!aResult))
+        return NS_ERROR_INVALID_ARG;
+    if (NS_WARN_IF(outer))
+        return NS_ERROR_NO_AGGREGATION;
 
     if (!gService)
     {
@@ -284,7 +287,8 @@ NS_IMPL_ISUPPORTS4(nsDirectoryService, nsIProperties, nsIDirectoryService, nsIDi
 NS_IMETHODIMP
 nsDirectoryService::Undefine(const char* prop)
 {
-    NS_ENSURE_ARG(prop);
+    if (NS_WARN_IF(!prop))
+        return NS_ERROR_INVALID_ARG;
 
     nsDependentCString key(prop);
     if (!mHashtable.Get(key, nullptr))
@@ -360,7 +364,8 @@ static bool FindProviderFile(nsIDirectoryServiceProvider* aElement,
 NS_IMETHODIMP
 nsDirectoryService::Get(const char* prop, const nsIID & uuid, void* *result)
 {
-    NS_ENSURE_ARG(prop);
+    if (NS_WARN_IF(!prop))
+        return NS_ERROR_INVALID_ARG;
 
     nsDependentCString key(prop);
 
@@ -409,7 +414,8 @@ nsDirectoryService::Get(const char* prop, const nsIID & uuid, void* *result)
 NS_IMETHODIMP
 nsDirectoryService::Set(const char* prop, nsISupports* value)
 {
-    NS_ENSURE_ARG(prop);
+    if (NS_WARN_IF(!prop))
+        return NS_ERROR_INVALID_ARG;
 
     nsDependentCString key(prop);
     if (mHashtable.Get(key, nullptr) || !value) {
@@ -431,7 +437,8 @@ nsDirectoryService::Set(const char* prop, nsISupports* value)
 NS_IMETHODIMP
 nsDirectoryService::Has(const char *prop, bool *_retval)
 {
-    NS_ENSURE_ARG(prop);
+    if (NS_WARN_IF(!prop))
+        return NS_ERROR_INVALID_ARG;
 
     *_retval = false;
     nsCOMPtr<nsIFile> value;
@@ -910,7 +917,8 @@ nsDirectoryService::GetFile(const char *prop, bool *persistent, nsIFile **_retva
 NS_IMETHODIMP
 nsDirectoryService::GetFiles(const char *prop, nsISimpleEnumerator **_retval)
 {
-    NS_ENSURE_ARG_POINTER(_retval);
+    if (NS_WARN_IF(!_retval))
+        return NS_ERROR_INVALID_ARG;
     *_retval = nullptr;
         
     return NS_ERROR_FAILURE;
diff --git a/xpcom/io/nsIOUtil.cpp b/xpcom/io/nsIOUtil.cpp
index 4363355de1a9..e4062793b0ba 100644
--- a/xpcom/io/nsIOUtil.cpp
+++ b/xpcom/io/nsIOUtil.cpp
@@ -1,4 +1,4 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
@@ -13,7 +13,8 @@ NS_IMPL_ISUPPORTS1(nsIOUtil, nsIIOUtil)
 NS_IMETHODIMP
 nsIOUtil::InputStreamIsBuffered(nsIInputStream* aStream, bool* _retval)
 {
-  NS_ENSURE_ARG_POINTER(aStream);
+  if (NS_WARN_IF(!aStream))
+    return NS_ERROR_INVALID_ARG;
   *_retval = NS_InputStreamIsBuffered(aStream);
   return NS_OK;
 }
@@ -21,7 +22,8 @@ nsIOUtil::InputStreamIsBuffered(nsIInputStream* aStream, bool* _retval)
 NS_IMETHODIMP
 nsIOUtil::OutputStreamIsBuffered(nsIOutputStream* aStream, bool* _retval)
 {
-  NS_ENSURE_ARG_POINTER(aStream);
+  if (NS_WARN_IF(!aStream))
+    return NS_ERROR_INVALID_ARG;
   *_retval = NS_OutputStreamIsBuffered(aStream);
   return NS_OK;
 }
diff --git a/xpcom/io/nsInputStreamTee.cpp b/xpcom/io/nsInputStreamTee.cpp
index 4ac153dfe217..b1c4094120a9 100644
--- a/xpcom/io/nsInputStreamTee.cpp
+++ b/xpcom/io/nsInputStreamTee.cpp
@@ -164,7 +164,6 @@ nsInputStreamTee::TeeSegment(const char *buf, uint32_t count)
         }
         nsRefPtr<nsIRunnable> event =
             new nsInputStreamTeeWriteEvent(buf, count, mSink, this);
-        NS_ENSURE_TRUE(event, NS_ERROR_OUT_OF_MEMORY);
         LOG(("nsInputStreamTee::TeeSegment [%p] dispatching write %u bytes\n",
               this, count));
         return mEventTarget->Dispatch(event, NS_DISPATCH_NORMAL);
@@ -214,7 +213,8 @@ NS_IMPL_ISUPPORTS2(nsInputStreamTee,
 NS_IMETHODIMP
 nsInputStreamTee::Close()
 {
-    NS_ENSURE_TRUE(mSource, NS_ERROR_NOT_INITIALIZED);
+    if (NS_WARN_IF(!mSource))
+        return NS_ERROR_NOT_INITIALIZED;
     nsresult rv = mSource->Close();
     mSource = 0;
     mSink = 0;
@@ -224,14 +224,16 @@ nsInputStreamTee::Close()
 NS_IMETHODIMP
 nsInputStreamTee::Available(uint64_t *avail)
 {
-    NS_ENSURE_TRUE(mSource, NS_ERROR_NOT_INITIALIZED);
+    if (NS_WARN_IF(!mSource))
+        return NS_ERROR_NOT_INITIALIZED;
     return mSource->Available(avail);
 }
 
 NS_IMETHODIMP
 nsInputStreamTee::Read(char *buf, uint32_t count, uint32_t *bytesRead)
 {
-    NS_ENSURE_TRUE(mSource, NS_ERROR_NOT_INITIALIZED);
+    if (NS_WARN_IF(!mSource))
+        return NS_ERROR_NOT_INITIALIZED;
 
     nsresult rv = mSource->Read(buf, count, bytesRead);
     if (NS_FAILED(rv) || (*bytesRead == 0))
@@ -246,7 +248,8 @@ nsInputStreamTee::ReadSegments(nsWriteSegmentFun writer,
                                uint32_t count,
                                uint32_t *bytesRead)
 {
-    NS_ENSURE_TRUE(mSource, NS_ERROR_NOT_INITIALIZED);
+    if (NS_WARN_IF(!mSource))
+        return NS_ERROR_NOT_INITIALIZED;
 
     mWriter = writer;
     mClosure = closure;
@@ -257,7 +260,8 @@ nsInputStreamTee::ReadSegments(nsWriteSegmentFun writer,
 NS_IMETHODIMP
 nsInputStreamTee::IsNonBlocking(bool *result)
 {
-    NS_ENSURE_TRUE(mSource, NS_ERROR_NOT_INITIALIZED);
+    if (NS_WARN_IF(!mSource))
+        return NS_ERROR_NOT_INITIALIZED;
     return mSource->IsNonBlocking(result);
 }
 
@@ -348,3 +352,5 @@ NS_NewInputStreamTee(nsIInputStream **result,
 {
     return NS_NewInputStreamTeeAsync(result, source, sink, nullptr);
 }
+
+#undef LOG
diff --git a/xpcom/io/nsLocalFileCommon.cpp b/xpcom/io/nsLocalFileCommon.cpp
index 5ec4bae22b3a..75c53483877f 100644
--- a/xpcom/io/nsLocalFileCommon.cpp
+++ b/xpcom/io/nsLocalFileCommon.cpp
@@ -33,7 +33,8 @@ void NS_ShutdownLocalFile()
 NS_IMETHODIMP
 nsLocalFile::InitWithFile(nsIFile *aFile)
 {
-    NS_ENSURE_ARG(aFile);
+    if (NS_WARN_IF(!aFile))
+        return NS_ERROR_INVALID_ARG;
     
     nsAutoCString path;
     aFile->GetNativePath(path);
@@ -189,7 +190,8 @@ static int32_t SplitPath(PRUnichar *path, PRUnichar **nodeArray, int32_t arrayLe
 NS_IMETHODIMP
 nsLocalFile::GetRelativeDescriptor(nsIFile *fromFile, nsACString& _retval)
 {
-    NS_ENSURE_ARG_POINTER(fromFile);
+    if (NS_WARN_IF(!fromFile))
+        return NS_ERROR_INVALID_ARG;
     const int32_t kMaxNodesInPath = 32;
 
     //
diff --git a/xpcom/io/nsLocalFileUnix.cpp b/xpcom/io/nsLocalFileUnix.cpp
index 099bcea90280..c0127e80949b 100644
--- a/xpcom/io/nsLocalFileUnix.cpp
+++ b/xpcom/io/nsLocalFileUnix.cpp
@@ -243,8 +243,10 @@ nsLocalFile::nsLocalFileConstructor(nsISupports *outer,
                                     const nsIID &aIID,
                                     void **aInstancePtr)
 {
-    NS_ENSURE_ARG_POINTER(aInstancePtr);
-    NS_ENSURE_NO_AGGREGATION(outer);
+    if (NS_WARN_IF(!aInstancePtr))
+        return NS_ERROR_INVALID_ARG;
+    if (NS_WARN_IF(outer))
+        return NS_ERROR_NO_AGGREGATION;
 
     *aInstancePtr = nullptr;
 
@@ -1005,7 +1007,8 @@ NS_IMETHODIMP
 nsLocalFile::GetLastModifiedTime(PRTime *aLastModTime)
 {
     CHECK_mPath();
-    NS_ENSURE_ARG(aLastModTime);
+    if (NS_WARN_IF(!aLastModTime))
+        return NS_ERROR_INVALID_ARG;
 
     PRFileInfo64 info;
     if (PR_GetFileInfo64(mPath.get(), &info) != PR_SUCCESS)
@@ -1043,7 +1046,8 @@ NS_IMETHODIMP
 nsLocalFile::GetLastModifiedTimeOfLink(PRTime *aLastModTimeOfLink)
 {
     CHECK_mPath();
-    NS_ENSURE_ARG(aLastModTimeOfLink);
+    if (NS_WARN_IF(!aLastModTimeOfLink))
+        return NS_ERROR_INVALID_ARG;
 
     struct STAT sbuf;
     if (LSTAT(mPath.get(), &sbuf) == -1)
@@ -1072,7 +1076,8 @@ nsLocalFile::SetLastModifiedTimeOfLink(PRTime aLastModTimeOfLink)
 NS_IMETHODIMP
 nsLocalFile::GetPermissions(uint32_t *aPermissions)
 {
-    NS_ENSURE_ARG(aPermissions);
+    if (NS_WARN_IF(!aPermissions))
+        return NS_ERROR_INVALID_ARG;
     ENSURE_STAT_CACHE();
     *aPermissions = NORMALIZE_PERMS(mCachedStat.st_mode);
     return NS_OK;
@@ -1082,7 +1087,8 @@ NS_IMETHODIMP
 nsLocalFile::GetPermissionsOfLink(uint32_t *aPermissionsOfLink)
 {
     CHECK_mPath();
-    NS_ENSURE_ARG(aPermissionsOfLink);
+    if (NS_WARN_IF(!aPermissionsOfLink))
+        return NS_ERROR_INVALID_ARG;
 
     struct STAT sbuf;
     if (LSTAT(mPath.get(), &sbuf) == -1)
@@ -1127,7 +1133,8 @@ nsLocalFile::SetPermissionsOfLink(uint32_t aPermissions)
 NS_IMETHODIMP
 nsLocalFile::GetFileSize(int64_t *aFileSize)
 {
-    NS_ENSURE_ARG_POINTER(aFileSize);
+    if (NS_WARN_IF(!aFileSize))
+        return NS_ERROR_INVALID_ARG;
     *aFileSize = 0;
     ENSURE_STAT_CACHE();
 
@@ -1176,7 +1183,8 @@ NS_IMETHODIMP
 nsLocalFile::GetFileSizeOfLink(int64_t *aFileSize)
 {
     CHECK_mPath();
-    NS_ENSURE_ARG(aFileSize);
+    if (NS_WARN_IF(!aFileSize))
+        return NS_ERROR_INVALID_ARG;
 
     struct STAT sbuf;
     if (LSTAT(mPath.get(), &sbuf) == -1)
@@ -1241,7 +1249,8 @@ GetDeviceName(int deviceMajor, int deviceMinor, nsACString &deviceName)
 NS_IMETHODIMP
 nsLocalFile::GetDiskSpaceAvailable(int64_t *aDiskSpaceAvailable)
 {
-    NS_ENSURE_ARG_POINTER(aDiskSpaceAvailable);
+    if (NS_WARN_IF(!aDiskSpaceAvailable))
+        return NS_ERROR_INVALID_ARG;
 
     // These systems have the operations necessary to check disk space.
 
@@ -1326,7 +1335,8 @@ NS_IMETHODIMP
 nsLocalFile::GetParent(nsIFile **aParent)
 {
     CHECK_mPath();
-    NS_ENSURE_ARG_POINTER(aParent);
+    if (NS_WARN_IF(!aParent))
+        return NS_ERROR_INVALID_ARG;
     *aParent = nullptr;
 
     // if '/' we are at the top of the volume, return null
@@ -1372,7 +1382,8 @@ NS_IMETHODIMP
 nsLocalFile::Exists(bool *_retval)
 {
     CHECK_mPath();
-    NS_ENSURE_ARG_POINTER(_retval);
+    if (NS_WARN_IF(!_retval))
+        return NS_ERROR_INVALID_ARG;
 
     *_retval = (access(mPath.get(), F_OK) == 0);
     return NS_OK;
@@ -1383,7 +1394,8 @@ NS_IMETHODIMP
 nsLocalFile::IsWritable(bool *_retval)
 {
     CHECK_mPath();
-    NS_ENSURE_ARG_POINTER(_retval);
+    if (NS_WARN_IF(!_retval))
+        return NS_ERROR_INVALID_ARG;
 
     *_retval = (access(mPath.get(), W_OK) == 0);
     if (*_retval || errno == EACCES)
@@ -1395,7 +1407,8 @@ NS_IMETHODIMP
 nsLocalFile::IsReadable(bool *_retval)
 {
     CHECK_mPath();
-    NS_ENSURE_ARG_POINTER(_retval);
+    if (NS_WARN_IF(!_retval))
+        return NS_ERROR_INVALID_ARG;
 
     *_retval = (access(mPath.get(), R_OK) == 0);
     if (*_retval || errno == EACCES)
@@ -1407,7 +1420,8 @@ NS_IMETHODIMP
 nsLocalFile::IsExecutable(bool *_retval)
 {
     CHECK_mPath();
-    NS_ENSURE_ARG_POINTER(_retval);
+    if (NS_WARN_IF(!_retval))
+        return NS_ERROR_INVALID_ARG;
 
     // Check extension (bug 663899). On certain platforms, the file
     // extension may cause the OS to treat it as executable regardless of
@@ -1496,7 +1510,8 @@ nsLocalFile::IsExecutable(bool *_retval)
 NS_IMETHODIMP
 nsLocalFile::IsDirectory(bool *_retval)
 {
-    NS_ENSURE_ARG_POINTER(_retval);
+    if (NS_WARN_IF(!_retval))
+        return NS_ERROR_INVALID_ARG;
     *_retval = false;
     ENSURE_STAT_CACHE();
     *_retval = S_ISDIR(mCachedStat.st_mode);
@@ -1506,7 +1521,8 @@ nsLocalFile::IsDirectory(bool *_retval)
 NS_IMETHODIMP
 nsLocalFile::IsFile(bool *_retval)
 {
-    NS_ENSURE_ARG_POINTER(_retval);
+    if (NS_WARN_IF(!_retval))
+        return NS_ERROR_INVALID_ARG;
     *_retval = false;
     ENSURE_STAT_CACHE();
     *_retval = S_ISREG(mCachedStat.st_mode);
@@ -1516,7 +1532,8 @@ nsLocalFile::IsFile(bool *_retval)
 NS_IMETHODIMP
 nsLocalFile::IsHidden(bool *_retval)
 {
-    NS_ENSURE_ARG_POINTER(_retval);
+    if (NS_WARN_IF(!_retval))
+        return NS_ERROR_INVALID_ARG;
     nsACString::const_iterator begin, end;
     LocateNativeLeafName(begin, end);
     *_retval = (*begin == '.');
@@ -1526,7 +1543,8 @@ nsLocalFile::IsHidden(bool *_retval)
 NS_IMETHODIMP
 nsLocalFile::IsSymlink(bool *_retval)
 {
-    NS_ENSURE_ARG_POINTER(_retval);
+    if (NS_WARN_IF(!_retval))
+        return NS_ERROR_INVALID_ARG;
     CHECK_mPath();
 
     struct STAT symStat;
@@ -1539,7 +1557,8 @@ nsLocalFile::IsSymlink(bool *_retval)
 NS_IMETHODIMP
 nsLocalFile::IsSpecial(bool *_retval)
 {
-    NS_ENSURE_ARG_POINTER(_retval);
+    if (NS_WARN_IF(!_retval))
+        return NS_ERROR_INVALID_ARG;
     ENSURE_STAT_CACHE();
     *_retval = S_ISCHR(mCachedStat.st_mode)      ||
                  S_ISBLK(mCachedStat.st_mode)    ||
@@ -1554,8 +1573,10 @@ nsLocalFile::IsSpecial(bool *_retval)
 NS_IMETHODIMP
 nsLocalFile::Equals(nsIFile *inFile, bool *_retval)
 {
-    NS_ENSURE_ARG(inFile);
-    NS_ENSURE_ARG_POINTER(_retval);
+    if (NS_WARN_IF(!inFile))
+        return NS_ERROR_INVALID_ARG;
+    if (NS_WARN_IF(!_retval))
+        return NS_ERROR_INVALID_ARG;
     *_retval = false;
 
     nsAutoCString inPath;
@@ -1573,8 +1594,10 @@ NS_IMETHODIMP
 nsLocalFile::Contains(nsIFile *inFile, bool recur, bool *_retval)
 {
     CHECK_mPath();
-    NS_ENSURE_ARG(inFile);
-    NS_ENSURE_ARG_POINTER(_retval);
+    if (NS_WARN_IF(!inFile))
+        return NS_ERROR_INVALID_ARG;
+    if (NS_WARN_IF(!_retval))
+        return NS_ERROR_INVALID_ARG;
 
     nsAutoCString inPath;
     nsresult rv;
@@ -1710,7 +1733,8 @@ NS_IMETHODIMP
 nsLocalFile::Load(PRLibrary **_retval)
 {
     CHECK_mPath();
-    NS_ENSURE_ARG_POINTER(_retval);
+    if (NS_WARN_IF(!_retval))
+        return NS_ERROR_INVALID_ARG;
 
 #ifdef NS_BUILD_REFCNT_LOGGING
     nsTraceRefcntImpl::SetActivityIsLegal(false);
@@ -2121,7 +2145,8 @@ nsLocalFile::InitWithCFURL(CFURLRef aCFURL)
 NS_IMETHODIMP
 nsLocalFile::InitWithFSRef(const FSRef *aFSRef)
 {
-  NS_ENSURE_ARG(aFSRef);
+  if (NS_WARN_IF(!aFSRef))
+      return NS_ERROR_INVALID_ARG;
 
   CFURLRef newURLRef = ::CFURLCreateFromFSRef(kCFAllocatorDefault, aFSRef);
   if (newURLRef) {
@@ -2151,7 +2176,8 @@ nsLocalFile::GetCFURL(CFURLRef *_retval)
 NS_IMETHODIMP
 nsLocalFile::GetFSRef(FSRef *_retval)
 {
-  NS_ENSURE_ARG_POINTER(_retval);
+  if (NS_WARN_IF(!_retval))
+      return NS_ERROR_INVALID_ARG;
 
   nsresult rv = NS_ERROR_FAILURE;
 
@@ -2169,7 +2195,8 @@ nsLocalFile::GetFSRef(FSRef *_retval)
 NS_IMETHODIMP
 nsLocalFile::GetFSSpec(FSSpec *_retval)
 {
-  NS_ENSURE_ARG_POINTER(_retval);
+  if (NS_WARN_IF(!_retval))
+      return NS_ERROR_INVALID_ARG;
 
   FSRef fsRef;
   nsresult rv = GetFSRef(&fsRef);
@@ -2184,7 +2211,8 @@ nsLocalFile::GetFSSpec(FSSpec *_retval)
 NS_IMETHODIMP
 nsLocalFile::GetFileSizeWithResFork(int64_t *aFileSizeWithResFork)
 {
-  NS_ENSURE_ARG_POINTER(aFileSizeWithResFork);
+  if (NS_WARN_IF(!aFileSizeWithResFork))
+      return NS_ERROR_INVALID_ARG;
 
   FSRef fsRef;
   nsresult rv = GetFSRef(&fsRef);
@@ -2343,7 +2371,8 @@ nsLocalFile::OpenDocWithApp(nsIFile *aAppToOpenWith, bool aLaunchInBackground)
 NS_IMETHODIMP
 nsLocalFile::IsPackage(bool *_retval)
 {
-  NS_ENSURE_ARG(_retval);
+  if (NS_WARN_IF(!_retval))
+      return NS_ERROR_INVALID_ARG;
   *_retval = false;
 
   CFURLRef url;
@@ -2414,7 +2443,8 @@ NS_IMETHODIMP
 nsLocalFile::GetBundleContentsLastModifiedTime(int64_t *aLastModTime)
 {
   CHECK_mPath();
-  NS_ENSURE_ARG_POINTER(aLastModTime);
+  if (NS_WARN_IF(!aLastModTime))
+      return NS_ERROR_INVALID_ARG;
 
   bool isPackage = false;
   nsresult rv = IsPackage(&isPackage);
@@ -2440,7 +2470,8 @@ nsLocalFile::GetBundleContentsLastModifiedTime(int64_t *aLastModTime)
 
 NS_IMETHODIMP nsLocalFile::InitWithFile(nsIFile *aFile)
 {
-  NS_ENSURE_ARG(aFile);
+  if (NS_WARN_IF(!aFile))
+      return NS_ERROR_INVALID_ARG;
 
   nsAutoCString nativePath;
   nsresult rv = aFile->GetNativePath(nativePath);
diff --git a/xpcom/io/nsLocalFileWin.cpp b/xpcom/io/nsLocalFileWin.cpp
index c8cd7911f159..3d1e3e01ab0f 100644
--- a/xpcom/io/nsLocalFileWin.cpp
+++ b/xpcom/io/nsLocalFileWin.cpp
@@ -725,7 +725,8 @@ struct nsDir
 static nsresult
 OpenDir(const nsAFlatString &name, nsDir * *dir)
 {
-    NS_ENSURE_ARG_POINTER(dir);
+    if (NS_WARN_IF(!dir))
+        return NS_ERROR_INVALID_ARG;
 
     *dir = nullptr;
     if (name.Length() + 3 >= MAX_PATH)
@@ -765,7 +766,8 @@ static nsresult
 ReadDir(nsDir *dir, PRDirFlags flags, nsString& name)
 {
     name.Truncate();
-    NS_ENSURE_ARG(dir);
+    if (NS_WARN_IF(!dir))
+        return NS_ERROR_INVALID_ARG;
 
     while (1) {
         BOOL rv;
@@ -809,7 +811,8 @@ ReadDir(nsDir *dir, PRDirFlags flags, nsString& name)
 static nsresult
 CloseDir(nsDir *&d)
 {
-    NS_ENSURE_ARG(d);
+    if (NS_WARN_IF(!d))
+        return NS_ERROR_INVALID_ARG;
 
     BOOL isOk = FindClose(d->handle);
     // PR_DELETE also nulls out the passed in pointer.
@@ -962,8 +965,10 @@ nsLocalFile::nsLocalFile()
 nsresult
 nsLocalFile::nsLocalFileConstructor(nsISupports* outer, const nsIID& aIID, void* *aInstancePtr)
 {
-    NS_ENSURE_ARG_POINTER(aInstancePtr);
-    NS_ENSURE_NO_AGGREGATION(outer);
+    if (NS_WARN_IF(!aInstancePtr))
+        return NS_ERROR_INVALID_ARG;
+    if (NS_WARN_IF(outer))
+        return NS_ERROR_NO_AGGREGATION;
 
     nsLocalFile* inst = new nsLocalFile();
     if (inst == nullptr)
@@ -1149,7 +1154,8 @@ nsLocalFile::Clone(nsIFile **file)
 NS_IMETHODIMP
 nsLocalFile::InitWithFile(nsIFile *aFile)
 {
-    NS_ENSURE_ARG(aFile);
+    if (NS_WARN_IF(!aFile))
+        return NS_ERROR_INVALID_ARG;
     
     nsAutoString path;
     aFile->GetPath(path);
@@ -2072,7 +2078,8 @@ nsLocalFile::CopyMove(nsIFile *aParentDir, const nsAString &newName, bool follow
                         return NS_ERROR_FAILURE;
 
                     rv = file->MoveTo(target, EmptyString());
-                    NS_ENSURE_SUCCESS(rv,rv);
+                    if (NS_FAILED(rv))
+                        return rv;
                 }
                 else
                 {
@@ -2080,7 +2087,8 @@ nsLocalFile::CopyMove(nsIFile *aParentDir, const nsAString &newName, bool follow
                         rv = file->CopyToFollowingLinks(target, EmptyString());
                     else
                         rv = file->CopyTo(target, EmptyString());
-                    NS_ENSURE_SUCCESS(rv,rv);
+                    if (NS_FAILED(rv))
+                        return rv;
                 }
             }
         }
@@ -2093,7 +2101,8 @@ nsLocalFile::CopyMove(nsIFile *aParentDir, const nsAString &newName, bool follow
         if (move)
         {
           rv = Remove(false /* recursive */);
-          NS_ENSURE_SUCCESS(rv,rv);
+          if (NS_FAILED(rv))
+              return rv;
         }
     }
 
@@ -2258,7 +2267,8 @@ nsLocalFile::GetLastModifiedTime(PRTime *aLastModifiedTime)
     // Check we are correctly initialized.
     CHECK_mWorkingPath();
 
-    NS_ENSURE_ARG(aLastModifiedTime);
+    if (NS_WARN_IF(!aLastModifiedTime))
+        return NS_ERROR_INVALID_ARG;
  
     // get the modified time of the target as determined by mFollowSymlinks
     // If true, then this will be for the target of the shortcut file, 
@@ -2281,7 +2291,8 @@ nsLocalFile::GetLastModifiedTimeOfLink(PRTime *aLastModifiedTime)
     // Check we are correctly initialized.
     CHECK_mWorkingPath();
 
-    NS_ENSURE_ARG(aLastModifiedTime);
+    if (NS_WARN_IF(!aLastModifiedTime))
+        return NS_ERROR_INVALID_ARG;
  
     // The caller is assumed to have already called IsSymlink 
     // and to have found that this file is a link. 
@@ -2381,7 +2392,8 @@ nsLocalFile::SetModDate(PRTime aLastModifiedTime, const PRUnichar *filePath)
 NS_IMETHODIMP
 nsLocalFile::GetPermissions(uint32_t *aPermissions)
 {
-    NS_ENSURE_ARG(aPermissions);
+    if (NS_WARN_IF(!aPermissions))
+        return NS_ERROR_INVALID_ARG;
 
     // get the permissions of the target as determined by mFollowSymlinks
     // If true, then this will be for the target of the shortcut file, 
@@ -2410,7 +2422,8 @@ nsLocalFile::GetPermissionsOfLink(uint32_t *aPermissions)
     // Check we are correctly initialized.
     CHECK_mWorkingPath();
 
-    NS_ENSURE_ARG(aPermissions);
+    if (NS_WARN_IF(!aPermissions))
+        return NS_ERROR_INVALID_ARG;
 
     // The caller is assumed to have already called IsSymlink 
     // and to have found that this file is a link. It is not 
@@ -2479,7 +2492,8 @@ nsLocalFile::SetPermissionsOfLink(uint32_t aPermissions)
 NS_IMETHODIMP
 nsLocalFile::GetFileSize(int64_t *aFileSize)
 {
-    NS_ENSURE_ARG(aFileSize);
+    if (NS_WARN_IF(!aFileSize))
+        return NS_ERROR_INVALID_ARG;
 
     nsresult rv = ResolveAndStat();
     if (NS_FAILED(rv))
@@ -2496,7 +2510,8 @@ nsLocalFile::GetFileSizeOfLink(int64_t *aFileSize)
     // Check we are correctly initialized.
     CHECK_mWorkingPath();
 
-    NS_ENSURE_ARG(aFileSize);
+    if (NS_WARN_IF(!aFileSize))
+        return NS_ERROR_INVALID_ARG;
 
     // The caller is assumed to have already called IsSymlink 
     // and to have found that this file is a link. 
@@ -2551,7 +2566,8 @@ nsLocalFile::GetDiskSpaceAvailable(int64_t *aDiskSpaceAvailable)
     // Check we are correctly initialized.
     CHECK_mWorkingPath();
 
-    NS_ENSURE_ARG(aDiskSpaceAvailable);
+    if (NS_WARN_IF(!aDiskSpaceAvailable))
+        return NS_ERROR_INVALID_ARG;
 
     ResolveAndStat();
 
@@ -2580,7 +2596,8 @@ nsLocalFile::GetParent(nsIFile * *aParent)
     // Check we are correctly initialized.
     CHECK_mWorkingPath();
 
-    NS_ENSURE_ARG_POINTER(aParent);
+    if (NS_WARN_IF(!aParent))
+        return NS_ERROR_INVALID_ARG;
 
     // A two-character path must be a drive such as C:, so it has no parent
     if (mWorkingPath.Length() == 2) {
@@ -2624,7 +2641,8 @@ nsLocalFile::Exists(bool *_retval)
     // Check we are correctly initialized.
     CHECK_mWorkingPath();
 
-    NS_ENSURE_ARG(_retval);
+    if (NS_WARN_IF(!_retval))
+        return NS_ERROR_INVALID_ARG;
     *_retval = false;
 
     MakeDirty();
@@ -2694,7 +2712,8 @@ nsLocalFile::IsReadable(bool *_retval)
     // Check we are correctly initialized.
     CHECK_mWorkingPath();
 
-    NS_ENSURE_ARG(_retval);
+    if (NS_WARN_IF(!_retval))
+        return NS_ERROR_INVALID_ARG;
     *_retval = false;
 
     nsresult rv = ResolveAndStat();
@@ -2712,7 +2731,8 @@ nsLocalFile::IsExecutable(bool *_retval)
     // Check we are correctly initialized.
     CHECK_mWorkingPath();
 
-    NS_ENSURE_ARG(_retval);
+    if (NS_WARN_IF(!_retval))
+        return NS_ERROR_INVALID_ARG;
     *_retval = false;
     
     nsresult rv;
@@ -2867,7 +2887,8 @@ nsLocalFile::IsHidden(bool *_retval)
 nsresult
 nsLocalFile::HasFileAttribute(DWORD fileAttrib, bool *_retval)
 {
-    NS_ENSURE_ARG(_retval);
+    if (NS_WARN_IF(!_retval))
+        return NS_ERROR_INVALID_ARG;
 
     nsresult rv = Resolve();
     if (NS_FAILED(rv)) {
@@ -2889,7 +2910,8 @@ nsLocalFile::IsSymlink(bool *_retval)
     // Check we are correctly initialized.
     CHECK_mWorkingPath();
 
-    NS_ENSURE_ARG(_retval);
+    if (NS_WARN_IF(!_retval))
+        return NS_ERROR_INVALID_ARG;
 
     // unless it is a valid shortcut path it's not a symlink
     if (!IsShortcutPath(mWorkingPath)) {
@@ -2920,8 +2942,10 @@ nsLocalFile::IsSpecial(bool *_retval)
 NS_IMETHODIMP
 nsLocalFile::Equals(nsIFile *inFile, bool *_retval)
 {
-    NS_ENSURE_ARG(inFile);
-    NS_ENSURE_ARG(_retval);
+    if (NS_WARN_IF(!inFile))
+        return NS_ERROR_INVALID_ARG;
+    if (NS_WARN_IF(!_retval))
+        return NS_ERROR_INVALID_ARG;
 
     EnsureShortPath();
 
diff --git a/xpcom/io/nsMultiplexInputStream.cpp b/xpcom/io/nsMultiplexInputStream.cpp
index 2373cfaa737b..4d36fb90721f 100644
--- a/xpcom/io/nsMultiplexInputStream.cpp
+++ b/xpcom/io/nsMultiplexInputStream.cpp
@@ -118,7 +118,6 @@ nsMultiplexInputStream::InsertStream(nsIInputStream *aStream, uint32_t aIndex)
 {
     NS_ASSERTION(SeekableStreamAtBeginning(aStream), "Inserted stream not at beginning.");
     bool result = mStreams.InsertElementAt(aIndex, aStream);
-    NS_ENSURE_TRUE(result, NS_ERROR_OUT_OF_MEMORY);
     if (mCurrentStream > aIndex ||
         (mCurrentStream == aIndex && mStartedReadingCurrent))
         ++mCurrentStream;
@@ -143,7 +142,8 @@ NS_IMETHODIMP
 nsMultiplexInputStream::GetStream(uint32_t aIndex, nsIInputStream **_retval)
 {
     *_retval = mStreams.SafeElementAt(aIndex, nullptr);
-    NS_ENSURE_TRUE(*_retval, NS_ERROR_NOT_AVAILABLE);
+    if (NS_WARN_IF(!*_retval))
+        return NS_ERROR_NOT_AVAILABLE;
 
     NS_ADDREF(*_retval);
     return NS_OK;
@@ -181,7 +181,8 @@ nsMultiplexInputStream::Available(uint64_t *_retval)
     for (uint32_t i = mCurrentStream; i < len; i++) {
         uint64_t streamAvail;
         rv = mStreams[i]->Available(&streamAvail);
-        NS_ENSURE_SUCCESS(rv, rv);
+        if (NS_WARN_IF(NS_FAILED(rv)))
+            return rv;
         avail += streamAvail;
     }
     *_retval = avail;
@@ -328,7 +329,8 @@ nsMultiplexInputStream::IsNonBlocking(bool *aNonBlocking)
     }
     for (uint32_t i = 0; i < len; ++i) {
         nsresult rv = mStreams[i]->IsNonBlocking(aNonBlocking);
-        NS_ENSURE_SUCCESS(rv, rv);
+        if (NS_WARN_IF(NS_FAILED(rv)))
+            return rv;
         // If one is non-blocking the entire stream becomes non-blocking
         // (except that we don't implement nsIAsyncInputStream, so there's
         //  not much for the caller to do if Read returns "would block")
@@ -367,7 +369,8 @@ nsMultiplexInputStream::Seek(int32_t aWhence, int64_t aOffset)
                 if (i < oldCurrentStream ||
                     (i == oldCurrentStream && oldStartedReadingCurrent)) {
                     rv = stream->Seek(NS_SEEK_SET, 0);
-                    NS_ENSURE_SUCCESS(rv, rv);
+                    if (NS_WARN_IF(NS_FAILED(rv)))
+                        return rv;
                     continue;
                 }
                 else {
@@ -383,13 +386,15 @@ nsMultiplexInputStream::Seek(int32_t aWhence, int64_t aOffset)
             }
             else {
                 rv = stream->Tell(&streamPos);
-                NS_ENSURE_SUCCESS(rv, rv);
+                if (NS_WARN_IF(NS_FAILED(rv)))
+                    return rv;
             }
 
             // See if we need to seek current stream forward or backward
             if (remaining < streamPos) {
                 rv = stream->Seek(NS_SEEK_SET, remaining);
-                NS_ENSURE_SUCCESS(rv, rv);
+                if (NS_WARN_IF(NS_FAILED(rv)))
+                    return rv;
 
                 mCurrentStream = i;
                 mStartedReadingCurrent = remaining != 0;
@@ -405,12 +410,14 @@ nsMultiplexInputStream::Seek(int32_t aWhence, int64_t aOffset)
                 else {
                     uint64_t avail;
                     rv = mStreams[i]->Available(&avail);
-                    NS_ENSURE_SUCCESS(rv, rv);
+                    if (NS_WARN_IF(NS_FAILED(rv)))
+                        return rv;
 
                     int64_t newPos = XPCOM_MIN(remaining, streamPos + (int64_t)avail);
 
                     rv = stream->Seek(NS_SEEK_SET, newPos);
-                    NS_ENSURE_SUCCESS(rv, rv);
+                    if (NS_WARN_IF(NS_FAILED(rv)))
+                        return rv;
 
                     mCurrentStream = i;
                     mStartedReadingCurrent = true;
@@ -436,12 +443,14 @@ nsMultiplexInputStream::Seek(int32_t aWhence, int64_t aOffset)
 
             uint64_t avail;
             rv = mStreams[i]->Available(&avail);
-            NS_ENSURE_SUCCESS(rv, rv);
+            if (NS_WARN_IF(NS_FAILED(rv)))
+                return rv;
 
             int64_t seek = XPCOM_MIN((int64_t)avail, remaining);
 
             rv = stream->Seek(NS_SEEK_CUR, seek);
-            NS_ENSURE_SUCCESS(rv, rv);
+            if (NS_WARN_IF(NS_FAILED(rv)))
+                return rv;
 
             mCurrentStream = i;
             mStartedReadingCurrent = true;
@@ -460,12 +469,14 @@ nsMultiplexInputStream::Seek(int32_t aWhence, int64_t aOffset)
 
             int64_t pos;
             rv = stream->Tell(&pos);
-            NS_ENSURE_SUCCESS(rv, rv);
+            if (NS_WARN_IF(NS_FAILED(rv)))
+                return rv;
 
             int64_t seek = XPCOM_MIN(pos, remaining);
 
             rv = stream->Seek(NS_SEEK_CUR, -seek);
-            NS_ENSURE_SUCCESS(rv, rv);
+            if (NS_WARN_IF(NS_FAILED(rv)))
+                return rv;
 
             mCurrentStream = i;
             mStartedReadingCurrent = seek != -pos;
@@ -495,7 +506,8 @@ nsMultiplexInputStream::Seek(int32_t aWhence, int64_t aOffset)
             if (remaining == 0) {
                 if (i >= oldCurrentStream) {
                     rv = stream->Seek(NS_SEEK_END, 0);
-                    NS_ENSURE_SUCCESS(rv, rv);
+                    if (NS_WARN_IF(NS_FAILED(rv)))
+                        return rv;
                 }
                 else {
                     break;
@@ -509,7 +521,8 @@ nsMultiplexInputStream::Seek(int32_t aWhence, int64_t aOffset)
             } else {
                 uint64_t avail;
                 rv = mStreams[i]->Available(&avail);
-                NS_ENSURE_SUCCESS(rv, rv);
+                if (NS_WARN_IF(NS_FAILED(rv)))
+                    return rv;
 
                 streamPos = avail;
             }
@@ -517,7 +530,8 @@ nsMultiplexInputStream::Seek(int32_t aWhence, int64_t aOffset)
             // See if we have enough data in the current stream.
             if (DeprecatedAbs(remaining) < streamPos) {
                 rv = stream->Seek(NS_SEEK_END, remaining);
-                NS_ENSURE_SUCCESS(rv, rv);
+                if (NS_WARN_IF(NS_FAILED(rv)))
+                    return rv;
 
                 mCurrentStream = i;
                 mStartedReadingCurrent = true;
@@ -531,12 +545,14 @@ nsMultiplexInputStream::Seek(int32_t aWhence, int64_t aOffset)
                 } else {
                     int64_t avail;
                     rv = stream->Tell(&avail);
-                    NS_ENSURE_SUCCESS(rv, rv);
+                    if (NS_WARN_IF(NS_FAILED(rv)))
+                        return rv;
 
                     int64_t newPos = streamPos + XPCOM_MIN(avail, DeprecatedAbs(remaining));
 
                     rv = stream->Seek(NS_SEEK_END, -newPos);
-                    NS_ENSURE_SUCCESS(rv, rv);
+                    if (NS_WARN_IF(NS_FAILED(rv)))
+                        return rv;
 
                     mCurrentStream = i;
                     mStartedReadingCurrent = true;
@@ -570,11 +586,13 @@ nsMultiplexInputStream::Tell(int64_t *_retval)
     last = mStartedReadingCurrent ? mCurrentStream+1 : mCurrentStream;
     for (i = 0; i < last; ++i) {
         nsCOMPtr<nsISeekableStream> stream = do_QueryInterface(mStreams[i]);
-        NS_ENSURE_TRUE(stream, NS_ERROR_NO_INTERFACE);
+        if (NS_WARN_IF(!stream))
+            return NS_ERROR_NO_INTERFACE;
 
         int64_t pos;
         rv = stream->Tell(&pos);
-        NS_ENSURE_SUCCESS(rv, rv);
+        if (NS_WARN_IF(NS_FAILED(rv)))
+            return rv;
         ret64 += pos;
     }
     *_retval =  ret64;
diff --git a/xpcom/io/nsPipe3.cpp b/xpcom/io/nsPipe3.cpp
index eb63ef92432f..4c988cf083bf 100644
--- a/xpcom/io/nsPipe3.cpp
+++ b/xpcom/io/nsPipe3.cpp
@@ -356,7 +356,8 @@ nsPipe::GetInputStream(nsIAsyncInputStream **aInputStream)
 NS_IMETHODIMP
 nsPipe::GetOutputStream(nsIAsyncOutputStream **aOutputStream)
 {
-    NS_ENSURE_TRUE(mInited, NS_ERROR_NOT_INITIALIZED);
+    if (NS_WARN_IF(!mInited))
+	return NS_ERROR_NOT_INITIALIZED;
     NS_ADDREF(*aOutputStream = &mOutput);
     return NS_OK;
 }
diff --git a/xpcom/io/nsStorageStream.cpp b/xpcom/io/nsStorageStream.cpp
index 1bf82156757a..5c745819b5b3 100644
--- a/xpcom/io/nsStorageStream.cpp
+++ b/xpcom/io/nsStorageStream.cpp
@@ -88,8 +88,10 @@ NS_IMETHODIMP
 nsStorageStream::GetOutputStream(int32_t aStartingOffset, 
                                  nsIOutputStream * *aOutputStream)
 {
-    NS_ENSURE_ARG(aOutputStream);
-    NS_ENSURE_TRUE(mSegmentedBuffer, NS_ERROR_NOT_INITIALIZED);
+    if (NS_WARN_IF(!aOutputStream))
+        return NS_ERROR_INVALID_ARG;
+    if (NS_WARN_IF(!mSegmentedBuffer))
+        return NS_ERROR_NOT_INITIALIZED;
     
     if (mWriteInProgress)
         return NS_ERROR_NOT_AVAILABLE;
@@ -116,7 +118,8 @@ nsStorageStream::GetOutputStream(int32_t aStartingOffset,
 NS_IMETHODIMP
 nsStorageStream::Close()
 {
-    NS_ENSURE_TRUE(mSegmentedBuffer, NS_ERROR_NOT_INITIALIZED);
+    if (NS_WARN_IF(!mSegmentedBuffer))
+        return NS_ERROR_NOT_INITIALIZED;
     
     mWriteInProgress = false;
     
@@ -145,15 +148,15 @@ nsStorageStream::Flush()
 NS_IMETHODIMP
 nsStorageStream::Write(const char *aBuffer, uint32_t aCount, uint32_t *aNumWritten)
 {
-    NS_ENSURE_TRUE(mSegmentedBuffer, NS_ERROR_NOT_INITIALIZED);
+    if (NS_WARN_IF(!aNumWritten) || NS_WARN_IF(!aBuffer))
+        return NS_ERROR_INVALID_ARG;
+    if (NS_WARN_IF(!mSegmentedBuffer))
+        return NS_ERROR_NOT_INITIALIZED;
     
     const char* readCursor;
     uint32_t count, availableInSegment, remaining;
     nsresult rv = NS_OK;
 
-    NS_ENSURE_ARG_POINTER(aNumWritten);
-    NS_ENSURE_ARG(aBuffer);
-
     LOG(("nsStorageStream [%p] Write mWriteCursor=%x mSegmentEnd=%x aCount=%d\n",
         this, mWriteCursor, mSegmentEnd, aCount));
 
@@ -223,7 +226,6 @@ nsStorageStream::IsNonBlocking(bool *aNonBlocking)
 NS_IMETHODIMP
 nsStorageStream::GetLength(uint32_t *aLength)
 {
-    NS_ENSURE_ARG(aLength);
     *aLength = mLogicalLength;
     return NS_OK;
 }
@@ -232,7 +234,8 @@ nsStorageStream::GetLength(uint32_t *aLength)
 NS_IMETHODIMP
 nsStorageStream::SetLength(uint32_t aLength)
 {
-    NS_ENSURE_TRUE(mSegmentedBuffer, NS_ERROR_NOT_INITIALIZED);
+    if (NS_WARN_IF(!mSegmentedBuffer))
+        return NS_ERROR_NOT_INITIALIZED;
     
     if (mWriteInProgress)
         return NS_ERROR_NOT_AVAILABLE;
@@ -257,8 +260,6 @@ nsStorageStream::SetLength(uint32_t aLength)
 NS_IMETHODIMP
 nsStorageStream::GetWriteInProgress(bool *aWriteInProgress)
 {
-    NS_ENSURE_ARG(aWriteInProgress);
-
     *aWriteInProgress = mWriteInProgress;
     return NS_OK;
 }
@@ -266,7 +267,8 @@ nsStorageStream::GetWriteInProgress(bool *aWriteInProgress)
 NS_METHOD
 nsStorageStream::Seek(int32_t aPosition)
 {
-    NS_ENSURE_TRUE(mSegmentedBuffer, NS_ERROR_NOT_INITIALIZED);
+    if (NS_WARN_IF(!mSegmentedBuffer))
+        return NS_ERROR_NOT_INITIALIZED;
     
     // An argument of -1 means "seek to end of stream"
     if (aPosition == -1)
@@ -358,7 +360,8 @@ NS_IMPL_ISUPPORTS2(nsStorageInputStream,
 NS_IMETHODIMP
 nsStorageStream::NewInputStream(int32_t aStartingOffset, nsIInputStream* *aInputStream)
 {
-    NS_ENSURE_TRUE(mSegmentedBuffer, NS_ERROR_NOT_INITIALIZED);
+    if (NS_WARN_IF(!mSegmentedBuffer))
+        return NS_ERROR_NOT_INITIALIZED;
 
     nsStorageInputStream *inputStream = new nsStorageInputStream(this, mSegmentSize);
     if (!inputStream)
@@ -524,8 +527,6 @@ nsStorageInputStream::Seek(uint32_t aPosition)
 nsresult
 NS_NewStorageStream(uint32_t segmentSize, uint32_t maxSize, nsIStorageStream **result)
 {
-    NS_ENSURE_ARG(result);
-
     nsStorageStream* storageStream = new nsStorageStream();
     if (!storageStream) return NS_ERROR_OUT_OF_MEMORY;
     
diff --git a/xpcom/io/nsStringStream.cpp b/xpcom/io/nsStringStream.cpp
index f32817811921..f6bfd18d9f72 100644
--- a/xpcom/io/nsStringStream.cpp
+++ b/xpcom/io/nsStringStream.cpp
@@ -112,7 +112,8 @@ nsStringInputStream::GetData(nsACString &data)
     // The stream doesn't have any data when it is closed.  We could fake it
     // and return an empty string here, but it seems better to keep this return
     // value consistent with the behavior of the other 'getter' methods.
-    NS_ENSURE_TRUE(!Closed(), NS_BASE_STREAM_CLOSED);
+    if (NS_WARN_IF(Closed()))
+        return NS_BASE_STREAM_CLOSED;
 
     data.Assign(mData);
     return NS_OK;
@@ -140,7 +141,8 @@ nsStringInputStream::ToString(char **result)
 NS_IMETHODIMP
 nsStringInputStream::SetData(const char *data, int32_t dataLen)
 {
-    NS_ENSURE_ARG_POINTER(data);
+    if (NS_WARN_IF(!data))
+        return NS_ERROR_INVALID_ARG;
     mData.Assign(data, dataLen);
     mOffset = 0;
     return NS_OK;
@@ -149,7 +151,8 @@ nsStringInputStream::SetData(const char *data, int32_t dataLen)
 NS_IMETHODIMP
 nsStringInputStream::AdoptData(char *data, int32_t dataLen)
 {
-    NS_ENSURE_ARG_POINTER(data);
+    if (NS_WARN_IF(!data))
+        return NS_ERROR_INVALID_ARG;
     mData.Adopt(data, dataLen);
     mOffset = 0;
     return NS_OK;
@@ -158,7 +161,8 @@ nsStringInputStream::AdoptData(char *data, int32_t dataLen)
 NS_IMETHODIMP
 nsStringInputStream::ShareData(const char *data, int32_t dataLen)
 {
-    NS_ENSURE_ARG_POINTER(data);
+    if (NS_WARN_IF(!data))
+        return NS_ERROR_INVALID_ARG;
 
     if (dataLen < 0)
         dataLen = strlen(data);
@@ -262,8 +266,8 @@ nsStringInputStream::Seek(int32_t whence, int64_t offset)
         return NS_ERROR_INVALID_ARG;
     }
 
-    NS_ENSURE_ARG(newPos >= 0);
-    NS_ENSURE_ARG(newPos <= Length());
+    if (NS_WARN_IF(newPos < 0) || NS_WARN_IF(newPos > Length()))
+        return NS_ERROR_INVALID_ARG;
 
     mOffset = (uint32_t)newPos;
     return NS_OK;
@@ -386,7 +390,8 @@ nsStringInputStreamConstructor(nsISupports *outer, REFNSIID iid, void **result)
 {
     *result = nullptr;
 
-    NS_ENSURE_TRUE(!outer, NS_ERROR_NO_AGGREGATION);
+    if (NS_WARN_IF(outer))
+        return NS_ERROR_NO_AGGREGATION;
 
     nsStringInputStream *inst = new nsStringInputStream();
     if (!inst)
diff --git a/xpcom/reflect/xptcall/src/xptcall.cpp b/xpcom/reflect/xptcall/src/xptcall.cpp
index e46ddd559d3d..a33b1e70051d 100644
--- a/xpcom/reflect/xptcall/src/xptcall.cpp
+++ b/xpcom/reflect/xptcall/src/xptcall.cpp
@@ -40,11 +40,13 @@ EXPORT_XPCOM_API(nsresult)
 NS_GetXPTCallStub(REFNSIID aIID, nsIXPTCProxy* aOuter,
                   nsISomeInterface* *aResult)
 {
-    NS_ENSURE_ARG(aOuter && aResult);
+    if (NS_WARN_IF(!aOuter) || NS_WARN_IF(!aResult))
+        return NS_ERROR_INVALID_ARG;
 
     XPTInterfaceInfoManager *iim =
         XPTInterfaceInfoManager::GetSingleton();
-    NS_ENSURE_TRUE(iim, NS_ERROR_NOT_INITIALIZED);
+    if (NS_WARN_IF(!iim))
+        return NS_ERROR_NOT_INITIALIZED;
 
     xptiInterfaceEntry *iie = iim->GetInterfaceEntryForIID(&aIID);
     if (!iie || !iie->EnsureResolved() || iie->GetBuiltinClassFlag())
diff --git a/xpcom/threads/LazyIdleThread.cpp b/xpcom/threads/LazyIdleThread.cpp
index 0cf14ad0acd5..71bf2ea53718 100644
--- a/xpcom/threads/LazyIdleThread.cpp
+++ b/xpcom/threads/LazyIdleThread.cpp
@@ -147,21 +147,26 @@ LazyIdleThread::EnsureThread()
   if (mShutdownMethod == AutomaticShutdown && NS_IsMainThread()) {
     nsCOMPtr<nsIObserverService> obs =
       do_GetService(NS_OBSERVERSERVICE_CONTRACTID, &rv);
-    NS_ENSURE_SUCCESS(rv, rv);
+    if (NS_WARN_IF(NS_FAILED(rv)))
+      return rv;
 
     rv = obs->AddObserver(this, "xpcom-shutdown-threads", false);
-    NS_ENSURE_SUCCESS(rv, rv);
+    if (NS_WARN_IF(NS_FAILED(rv)))
+      return rv;
   }
 
   mIdleTimer = do_CreateInstance(NS_TIMER_CONTRACTID, &rv);
-  NS_ENSURE_TRUE(mIdleTimer, NS_ERROR_FAILURE);
+  if (NS_WARN_IF(!mIdleTimer))
+    return NS_ERROR_UNEXPECTED;
 
   nsCOMPtr<nsIRunnable> runnable =
     NS_NewRunnableMethod(this, &LazyIdleThread::InitThread);
-  NS_ENSURE_TRUE(runnable, NS_ERROR_FAILURE);
+  if (NS_WARN_IF(!runnable))
+    return NS_ERROR_UNEXPECTED;
 
   rv = NS_NewThread(getter_AddRefs(mThread), runnable);
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
 
   return NS_OK;
 }
@@ -268,12 +273,14 @@ LazyIdleThread::ShutdownThread()
 
     nsCOMPtr<nsIRunnable> runnable =
       NS_NewRunnableMethod(this, &LazyIdleThread::CleanupThread);
-    NS_ENSURE_TRUE(runnable, NS_ERROR_FAILURE);
+    if (NS_WARN_IF(!runnable))
+      return NS_ERROR_UNEXPECTED;
 
     PreDispatch();
 
     rv = mThread->Dispatch(runnable, NS_DISPATCH_NORMAL);
-    NS_ENSURE_SUCCESS(rv, rv);
+    if (NS_WARN_IF(NS_FAILED(rv)))
+      return rv;
 
     // Put the temporary queue in place before calling Shutdown().
     mQueuedRunnables = &queuedRunnables;
@@ -299,7 +306,8 @@ LazyIdleThread::ShutdownThread()
 
   if (mIdleTimer) {
     rv = mIdleTimer->Cancel();
-    NS_ENSURE_SUCCESS(rv, rv);
+    if (NS_WARN_IF(NS_FAILED(rv)))
+      return rv;
 
     mIdleTimer = nullptr;
   }
@@ -376,7 +384,8 @@ LazyIdleThread::Dispatch(nsIRunnable* aEvent,
   ASSERT_OWNING_THREAD();
 
   // LazyIdleThread can't always support synchronous dispatch currently.
-  NS_ENSURE_TRUE(aFlags == NS_DISPATCH_NORMAL, NS_ERROR_NOT_IMPLEMENTED);
+  if (NS_WARN_IF(aFlags != NS_DISPATCH_NORMAL))
+    return NS_ERROR_NOT_IMPLEMENTED;
 
   // If our thread is shutting down then we can't actually dispatch right now.
   // Queue this runnable for later.
@@ -386,7 +395,8 @@ LazyIdleThread::Dispatch(nsIRunnable* aEvent,
   }
 
   nsresult rv = EnsureThread();
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
 
   PreDispatch();
 
@@ -427,7 +437,8 @@ LazyIdleThread::Shutdown()
 
   mIdleObserver = nullptr;
 
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
 
   return NS_OK;
 }
@@ -467,7 +478,8 @@ LazyIdleThread::Notify(nsITimer* aTimer)
   }
 
   nsresult rv = ShutdownThread();
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
 
   return NS_OK;
 }
@@ -513,10 +525,12 @@ LazyIdleThread::AfterProcessNextEvent(nsIThreadInternal* /* aThread */,
   if (shouldNotifyIdle) {
     nsCOMPtr<nsIRunnable> runnable =
       NS_NewRunnableMethod(this, &LazyIdleThread::ScheduleTimer);
-    NS_ENSURE_TRUE(runnable, NS_ERROR_FAILURE);
+    if (NS_WARN_IF(!runnable))
+      return NS_ERROR_UNEXPECTED;
 
     nsresult rv = mOwningThread->Dispatch(runnable, NS_DISPATCH_NORMAL);
-    NS_ENSURE_SUCCESS(rv, rv);
+    if (NS_WARN_IF(NS_FAILED(rv)))
+      return rv;
   }
 
   return NS_OK;
diff --git a/xpcom/threads/nsEnvironment.cpp b/xpcom/threads/nsEnvironment.cpp
index f5c0656b4ed3..53b207556735 100644
--- a/xpcom/threads/nsEnvironment.cpp
+++ b/xpcom/threads/nsEnvironment.cpp
@@ -48,7 +48,8 @@ nsEnvironment::Exists(const nsAString& aName, bool *aOutValue)
 {
     nsAutoCString nativeName;
     nsresult rv = NS_CopyUnicodeToNative(aName, nativeName);
-    NS_ENSURE_SUCCESS(rv, rv);
+    if (NS_WARN_IF(NS_FAILED(rv)))
+        return rv;
 
     nsAutoCString nativeVal;
 #if defined(XP_UNIX)
@@ -78,7 +79,8 @@ nsEnvironment::Get(const nsAString& aName, nsAString& aOutValue)
 {
     nsAutoCString nativeName;
     nsresult rv = NS_CopyUnicodeToNative(aName, nativeName);
-    NS_ENSURE_SUCCESS(rv, rv);
+    if (NS_WARN_IF(NS_FAILED(rv)))
+        return rv;
 
     nsAutoCString nativeVal;
     const char *value = PR_GetEnv(nativeName.get());
@@ -122,10 +124,12 @@ nsEnvironment::Set(const nsAString& aName, const nsAString& aValue)
     nsAutoCString nativeVal;
 
     nsresult rv = NS_CopyUnicodeToNative(aName, nativeName);
-    NS_ENSURE_SUCCESS(rv, rv);
+    if (NS_WARN_IF(NS_FAILED(rv)))
+        return rv;
 
     rv = NS_CopyUnicodeToNative(aValue, nativeVal);
-    NS_ENSURE_SUCCESS(rv, rv);
+    if (NS_WARN_IF(NS_FAILED(rv)))
+        return rv;
 
     MutexAutoLock lock(mLock);
 
diff --git a/xpcom/threads/nsMemoryPressure.cpp b/xpcom/threads/nsMemoryPressure.cpp
index 0e1b556054ea..094d4c06ab04 100644
--- a/xpcom/threads/nsMemoryPressure.cpp
+++ b/xpcom/threads/nsMemoryPressure.cpp
@@ -49,6 +49,5 @@ NS_DispatchMemoryPressure(MemoryPressureState state)
 {
   NS_DispatchEventualMemoryPressure(state);
   nsCOMPtr<nsIRunnable> event = new nsRunnable;
-  NS_ENSURE_TRUE(event, NS_ERROR_OUT_OF_MEMORY);
   return NS_DispatchToMainThread(event);
 }
diff --git a/xpcom/threads/nsProcessCommon.cpp b/xpcom/threads/nsProcessCommon.cpp
index 8a6345d11d35..d2d660bafb66 100644
--- a/xpcom/threads/nsProcessCommon.cpp
+++ b/xpcom/threads/nsProcessCommon.cpp
@@ -88,7 +88,8 @@ nsProcess::Init(nsIFile* executable)
     if (mExecutable)
         return NS_ERROR_ALREADY_INITIALIZED;
 
-    NS_ENSURE_ARG_POINTER(executable);
+    if (NS_WARN_IF(!executable))
+        return NS_ERROR_INVALID_ARG;
     bool isFile;
 
     //First make sure the file exists
@@ -408,8 +409,10 @@ nsresult
 nsProcess::RunProcess(bool blocking, char **my_argv, nsIObserver* observer,
                       bool holdWeak, bool argsUTF8)
 {
-    NS_ENSURE_TRUE(mExecutable, NS_ERROR_NOT_INITIALIZED);
-    NS_ENSURE_FALSE(mThread, NS_ERROR_ALREADY_INITIALIZED);
+    if (NS_WARN_IF(!mExecutable))
+        return NS_ERROR_NOT_INITIALIZED;
+    if (NS_WARN_IF(mThread))
+        return NS_ERROR_ALREADY_INITIALIZED;
 
     if (observer) {
         if (holdWeak) {
diff --git a/xpcom/threads/nsThread.cpp b/xpcom/threads/nsThread.cpp
index 94e8a04da130..9cc4e2528e8f 100644
--- a/xpcom/threads/nsThread.cpp
+++ b/xpcom/threads/nsThread.cpp
@@ -152,9 +152,9 @@ NS_IMPL_CI_INTERFACE_GETTER4(nsThread, nsIThread, nsIThreadInternal,
 
 class nsThreadStartupEvent : public nsRunnable {
 public:
-  // Create a new thread startup object.
-  static nsThreadStartupEvent *Create() {
-    return new nsThreadStartupEvent();
+  nsThreadStartupEvent()
+    : mMon("nsThreadStartupEvent.mMon")
+    , mInitialized(false) {
   }
 
   // This method does not return until the thread startup object is in the
@@ -180,11 +180,6 @@ private:
     return NS_OK;
   }
 
-  nsThreadStartupEvent()
-    : mMon("nsThreadStartupEvent.mMon")
-    , mInitialized(false) {
-  }
-
   ReentrantMonitor mMon;
   bool       mInitialized;
 };
@@ -310,8 +305,7 @@ nsresult
 nsThread::Init()
 {
   // spawn thread and wait until it is fully setup
-  nsRefPtr<nsThreadStartupEvent> startup = nsThreadStartupEvent::Create();
-  NS_ENSURE_TRUE(startup, NS_ERROR_OUT_OF_MEMORY);
+  nsRefPtr<nsThreadStartupEvent> startup = new nsThreadStartupEvent();
  
   NS_ADDREF_THIS();
  
@@ -377,7 +371,8 @@ nsThread::Dispatch(nsIRunnable *event, uint32_t flags)
 {
   LOG(("THRD(%p) Dispatch [%p %x]\n", this, event, flags));
 
-  NS_ENSURE_ARG_POINTER(event);
+  if (NS_WARN_IF(!event))
+    return NS_ERROR_INVALID_ARG;
 
   if (gXPCOMThreadsShutDown && MAIN_THREAD != mIsMainThread) {
     return NS_ERROR_ILLEGAL_DURING_SHUTDOWN;
@@ -385,7 +380,8 @@ nsThread::Dispatch(nsIRunnable *event, uint32_t flags)
 
   if (flags & DISPATCH_SYNC) {
     nsThread *thread = nsThreadManager::get()->GetCurrentThread();
-    NS_ENSURE_STATE(thread);
+    if (NS_WARN_IF(!thread))
+      return NS_ERROR_NOT_AVAILABLE;
 
     // XXX we should be able to do something better here... we should
     //     be able to monitor the slot occupied by this event and use
@@ -437,7 +433,8 @@ nsThread::Shutdown()
   if (!mThread)
     return NS_OK;
 
-  NS_ENSURE_STATE(mThread != PR_GetCurrentThread());
+  if (NS_WARN_IF(mThread == PR_GetCurrentThread()))
+    return NS_ERROR_UNEXPECTED;
 
   // Prevent multiple calls to this method
   {
@@ -490,7 +487,8 @@ nsThread::Shutdown()
 NS_IMETHODIMP
 nsThread::HasPendingEvents(bool *result)
 {
-  NS_ENSURE_STATE(PR_GetCurrentThread() == mThread);
+  if (NS_WARN_IF(PR_GetCurrentThread() != mThread))
+    return NS_ERROR_NOT_SAME_THREAD;
 
   *result = mEvents.GetEvent(false, nullptr);
   return NS_OK;
@@ -548,7 +546,8 @@ nsThread::ProcessNextEvent(bool mayWait, bool *result)
 {
   LOG(("THRD(%p) ProcessNextEvent [%u %u]\n", this, mayWait, mRunningEvent));
 
-  NS_ENSURE_STATE(PR_GetCurrentThread() == mThread);
+  if (NS_WARN_IF(PR_GetCurrentThread() != mThread))
+    return NS_ERROR_NOT_SAME_THREAD;
 
   if (MAIN_THREAD == mIsMainThread && mayWait && !ShuttingDown())
     HangMonitor::Suspend();
@@ -644,7 +643,8 @@ nsThread::GetPriority(int32_t *priority)
 NS_IMETHODIMP
 nsThread::SetPriority(int32_t priority)
 {
-  NS_ENSURE_STATE(mThread);
+  if (NS_WARN_IF(!mThread))
+    return NS_ERROR_NOT_INITIALIZED;
 
   // NSPR defines the following four thread priorities:
   //   PR_PRIORITY_LOW
@@ -690,7 +690,8 @@ nsThread::GetObserver(nsIThreadObserver **obs)
 NS_IMETHODIMP
 nsThread::SetObserver(nsIThreadObserver *obs)
 {
-  NS_ENSURE_STATE(PR_GetCurrentThread() == mThread);
+  if (NS_WARN_IF(PR_GetCurrentThread() != mThread))
+    return NS_ERROR_NOT_SAME_THREAD;
 
   MutexAutoLock lock(mLock);
   mObserver = obs;
@@ -700,8 +701,8 @@ nsThread::SetObserver(nsIThreadObserver *obs)
 NS_IMETHODIMP
 nsThread::GetRecursionDepth(uint32_t *depth)
 {
-  NS_ENSURE_ARG_POINTER(depth);
-  NS_ENSURE_STATE(PR_GetCurrentThread() == mThread);
+  if (NS_WARN_IF(PR_GetCurrentThread() != mThread))
+    return NS_ERROR_NOT_SAME_THREAD;
 
   *depth = mRunningEvent;
   return NS_OK;
@@ -710,8 +711,10 @@ nsThread::GetRecursionDepth(uint32_t *depth)
 NS_IMETHODIMP
 nsThread::AddObserver(nsIThreadObserver *observer)
 {
-  NS_ENSURE_ARG_POINTER(observer);
-  NS_ENSURE_STATE(PR_GetCurrentThread() == mThread);
+  if (NS_WARN_IF(!observer))
+    return NS_ERROR_INVALID_ARG;
+  if (NS_WARN_IF(PR_GetCurrentThread() != mThread))
+    return NS_ERROR_NOT_SAME_THREAD;
 
   NS_WARN_IF_FALSE(!mEventObservers.Contains(observer),
                    "Adding an observer twice!");
@@ -727,7 +730,8 @@ nsThread::AddObserver(nsIThreadObserver *observer)
 NS_IMETHODIMP
 nsThread::RemoveObserver(nsIThreadObserver *observer)
 {
-  NS_ENSURE_STATE(PR_GetCurrentThread() == mThread);
+  if (NS_WARN_IF(PR_GetCurrentThread() != mThread))
+    return NS_ERROR_NOT_SAME_THREAD;
 
   if (observer && !mEventObservers.RemoveElement(observer)) {
     NS_WARNING("Removing an observer that was never added!");
diff --git a/xpcom/threads/nsThreadManager.cpp b/xpcom/threads/nsThreadManager.cpp
index 52d1364f6953..cf41dcdb49a9 100644
--- a/xpcom/threads/nsThreadManager.cpp
+++ b/xpcom/threads/nsThreadManager.cpp
@@ -217,7 +217,8 @@ nsThreadManager::NewThread(uint32_t creationFlags,
                            nsIThread **result)
 {
   // No new threads during Shutdown
-  NS_ENSURE_TRUE(mInitialized, NS_ERROR_NOT_INITIALIZED);
+  if (NS_WARN_IF(!mInitialized))
+    return NS_ERROR_NOT_INITIALIZED;
 
   nsThread *thr = new nsThread(nsThread::NOT_MAIN_THREAD, stackSize);
   if (!thr)
@@ -242,8 +243,10 @@ NS_IMETHODIMP
 nsThreadManager::GetThreadFromPRThread(PRThread *thread, nsIThread **result)
 {
   // Keep this functioning during Shutdown
-  NS_ENSURE_TRUE(mMainThread, NS_ERROR_NOT_INITIALIZED);
-  NS_ENSURE_ARG_POINTER(thread);
+  if (NS_WARN_IF(!mMainThread))
+    return NS_ERROR_NOT_INITIALIZED;
+  if (NS_WARN_IF(!thread))
+    return NS_ERROR_INVALID_ARG;
 
   nsRefPtr<nsThread> temp;
   {
@@ -259,7 +262,8 @@ NS_IMETHODIMP
 nsThreadManager::GetMainThread(nsIThread **result)
 {
   // Keep this functioning during Shutdown
-  NS_ENSURE_TRUE(mMainThread, NS_ERROR_NOT_INITIALIZED);
+  if (NS_WARN_IF(!mMainThread))
+    return NS_ERROR_NOT_INITIALIZED;
   NS_ADDREF(*result = mMainThread);
   return NS_OK;
 }
@@ -268,7 +272,8 @@ NS_IMETHODIMP
 nsThreadManager::GetCurrentThread(nsIThread **result)
 {
   // Keep this functioning during Shutdown
-  NS_ENSURE_TRUE(mMainThread, NS_ERROR_NOT_INITIALIZED);
+  if (NS_WARN_IF(!mMainThread))
+    return NS_ERROR_NOT_INITIALIZED;
   *result = GetCurrentThread();
   if (!*result)
     return NS_ERROR_OUT_OF_MEMORY;
diff --git a/xpcom/threads/nsThreadPool.cpp b/xpcom/threads/nsThreadPool.cpp
index 2ccc4b0142f2..6e3236db7a73 100644
--- a/xpcom/threads/nsThreadPool.cpp
+++ b/xpcom/threads/nsThreadPool.cpp
@@ -92,7 +92,8 @@ nsThreadPool::PutEvent(nsIRunnable *event)
   nsThreadManager::get()->NewThread(0,
                                     nsIThreadManager::DEFAULT_STACK_SIZE,
                                     getter_AddRefs(thread));
-  NS_ENSURE_STATE(thread);
+  if (NS_WARN_IF(!thread))
+    return NS_ERROR_UNEXPECTED;
 
   bool killThread = false;
   {
@@ -225,12 +226,14 @@ nsThreadPool::Dispatch(nsIRunnable *event, uint32_t flags)
 {
   LOG(("THRD-P(%p) dispatch [%p %x]\n", this, event, flags));
 
-  NS_ENSURE_STATE(!mShutdown);
+  if (NS_WARN_IF(mShutdown))
+    return NS_ERROR_NOT_AVAILABLE;
 
   if (flags & DISPATCH_SYNC) {
     nsCOMPtr<nsIThread> thread;
     nsThreadManager::get()->GetCurrentThread(getter_AddRefs(thread));
-    NS_ENSURE_STATE(thread);
+    if (NS_WARN_IF(!thread))
+      return NS_ERROR_NOT_AVAILABLE;
 
     nsRefPtr<nsThreadSyncDispatch> wrapper =
         new nsThreadSyncDispatch(thread, event);
diff --git a/xpcom/threads/nsTimerImpl.cpp b/xpcom/threads/nsTimerImpl.cpp
index bb59fc98bf10..3aa9e606e24c 100644
--- a/xpcom/threads/nsTimerImpl.cpp
+++ b/xpcom/threads/nsTimerImpl.cpp
@@ -317,14 +317,16 @@ nsresult nsTimerImpl::InitCommon(uint32_t aType, uint32_t aDelay)
 {
   nsresult rv;
 
-  NS_ENSURE_TRUE(gThread, NS_ERROR_NOT_INITIALIZED);
+  if (NS_WARN_IF(!gThread))
+    return NS_ERROR_NOT_INITIALIZED;
   if (!mEventTarget) {
     NS_ERROR("mEventTarget is NULL");
     return NS_ERROR_NOT_INITIALIZED;
   }
 
   rv = gThread->Init();
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_WARN_IF(NS_FAILED(rv)))
+    return rv;
 
   /**
    * In case of re-Init, both with and without a preceding Cancel, clear the
@@ -357,7 +359,8 @@ NS_IMETHODIMP nsTimerImpl::InitWithFuncCallback(nsTimerCallbackFunc aFunc,
                                                 uint32_t aDelay,
                                                 uint32_t aType)
 {
-  NS_ENSURE_ARG_POINTER(aFunc);
+  if (NS_WARN_IF(!aFunc))
+    return NS_ERROR_INVALID_ARG;
   
   ReleaseCallback();
   mCallbackType = CALLBACK_TYPE_FUNC;
@@ -371,7 +374,8 @@ NS_IMETHODIMP nsTimerImpl::InitWithCallback(nsITimerCallback *aCallback,
                                             uint32_t aDelay,
                                             uint32_t aType)
 {
-  NS_ENSURE_ARG_POINTER(aCallback);
+  if (NS_WARN_IF(!aCallback))
+    return NS_ERROR_INVALID_ARG;
 
   ReleaseCallback();
   mCallbackType = CALLBACK_TYPE_INTERFACE;
@@ -385,7 +389,8 @@ NS_IMETHODIMP nsTimerImpl::Init(nsIObserver *aObserver,
                                 uint32_t aDelay,
                                 uint32_t aType)
 {
-  NS_ENSURE_ARG_POINTER(aObserver);
+  if (NS_WARN_IF(!aObserver))
+    return NS_ERROR_INVALID_ARG;
 
   ReleaseCallback();
   mCallbackType = CALLBACK_TYPE_OBSERVER;
@@ -481,8 +486,8 @@ NS_IMETHODIMP nsTimerImpl::GetTarget(nsIEventTarget** aTarget)
 
 NS_IMETHODIMP nsTimerImpl::SetTarget(nsIEventTarget* aTarget)
 {
-  NS_ENSURE_TRUE(mCallbackType == CALLBACK_TYPE_UNKNOWN,
-                 NS_ERROR_ALREADY_INITIALIZED);
+  if (NS_WARN_IF(mCallbackType != CALLBACK_TYPE_UNKNOWN))
+    return NS_ERROR_ALREADY_INITIALIZED;
 
   if (aTarget)
     mEventTarget = aTarget;
diff --git a/xpfe/components/directory/nsDirectoryViewer.cpp b/xpfe/components/directory/nsDirectoryViewer.cpp
index e0d8f991abfc..98c84dba4c6e 100644
--- a/xpfe/components/directory/nsDirectoryViewer.cpp
+++ b/xpfe/components/directory/nsDirectoryViewer.cpp
@@ -17,6 +17,7 @@
 
 #include "nsDirectoryViewer.h"
 #include "nsIDirIndex.h"
+#include "nsIDocShell.h"
 #include "jsapi.h"
 #include "nsCOMPtr.h"
 #include "nsCRT.h"
@@ -1265,7 +1266,7 @@ nsDirectoryViewerFactory::CreateInstance(const char *aCommand,
                                          nsIChannel* aChannel,
                                          nsILoadGroup* aLoadGroup,
                                          const char* aContentType, 
-                                         nsISupports* aContainer,
+                                         nsIDocShell* aContainer,
                                          nsISupports* aExtraInfo,
                                          nsIStreamListener** aDocListenerResult,
                                          nsIContentViewer** aDocViewerResult)